Make display confirmation test deterministic

Verify settings search routing
Model rendered lock fallback in diagnostics
2026-08-18 15:32:59 -04:00 · 2026-08-18 15:09:50 -04:00 · 2026-08-18 15:05:12 -04:00 · 2026-08-18 15:02:41 -04:00 · 2026-08-18 15:01:49 -04:00 · 2026-08-18 15:00:54 -04:00
169 changed files with 17197 additions and 664 deletions
@@ -16,3 +16,9 @@ __pycache__/

 # Generated from the colour scheme; machine state, not configuration.
 /config/dot/kitty/current-theme.conf
+
+# Generated from the colour scheme; machine state, not configuration.
+/config/dot/gtk-3.0/settings.ini
+/config/dot/gtk-4.0/settings.ini
+/config/dot/tmux/current-theme.conf
+/config/dot/hypr/hyprlock.conf
@@ -0,0 +1,57 @@
+# Tokyo Night Day for btop, the light counterpart to tokyonight-moon.
+#
+# btop ships no Tokyo Night light variant at all, and the nearest stock light
+# theme (flat-remix-light) is a different palette that happens to have a similar
+# background. Same colours as kitty/themes/tokyonight-day.conf so the terminal
+# and what runs inside it cannot disagree.
+#
+# Gradients keep the same low -> middle -> high meaning as the dark theme, using
+# Day's darker, more saturated accents: the light versions of these hues are too
+# faint to read as a filled meter.
+
+theme[main_bg]="#e1e2e7"
+theme[main_fg]="#3760bf"
+theme[title]="#3760bf"
+theme[hi_fg]="#2e7de9"
+theme[selected_bg]="#c4c8da"
+theme[selected_fg]="#2e7de9"
+theme[inactive_fg]="#7079a8"
+theme[proc_misc]="#587539"
+
+theme[cpu_box]="#a8aecb"
+theme[mem_box]="#a8aecb"
+theme[net_box]="#a8aecb"
+theme[proc_box]="#a8aecb"
+theme[div_line]="#c4c8da"
+
+theme[temp_start]="#2e7de9"
+theme[temp_mid]="#8c6c3e"
+theme[temp_end]="#f52a65"
+
+theme[cpu_start]="#2e7de9"
+theme[cpu_mid]="#9854f1"
+theme[cpu_end]="#f52a65"
+
+theme[free_start]="#c4c8da"
+theme[free_mid]="#007197"
+theme[free_end]="#2e7de9"
+
+theme[cached_start]="#007197"
+theme[cached_mid]="#2e7de9"
+theme[cached_end]="#9854f1"
+
+theme[available_start]="#8c6c3e"
+theme[available_mid]="#b15c00"
+theme[available_end]="#f52a65"
+
+theme[used_start]="#587539"
+theme[used_mid]="#8c6c3e"
+theme[used_end]="#f52a65"
+
+theme[download_start]="#c4c8da"
+theme[download_mid]="#2e7de9"
+theme[download_end]="#007197"
+
+theme[upload_start]="#c4c8da"
+theme[upload_mid]="#9854f1"
+theme[upload_end]="#7847bd"
@@ -0,0 +1,56 @@
+# Tokyo Night Moon for btop, matched to Panama's palette.
+#
+# btop ships a "tokyo-night" theme, but it is the Night variant (#1a1b26). The
+# rest of this desktop is Moon (#222436), and two Tokyo Nights side by side read
+# as a mistake rather than as a choice.
+#
+# The *_start/_mid/_end triples are gradients btop draws meters with: low,
+# middle, and high. They run blue -> yellow -> red so a saturated resource is
+# obvious at a glance without reading the number.
+
+theme[main_bg]="#222436"
+theme[main_fg]="#c8d3f5"
+theme[title]="#c8d3f5"
+theme[hi_fg]="#82aaff"
+theme[selected_bg]="#3b4261"
+theme[selected_fg]="#82aaff"
+theme[inactive_fg]="#636da6"
+theme[proc_misc]="#a5e8b5"
+
+theme[cpu_box]="#4d5685"
+theme[mem_box]="#4d5685"
+theme[net_box]="#4d5685"
+theme[proc_box]="#4d5685"
+theme[div_line]="#3b4261"
+
+theme[temp_start]="#82aaff"
+theme[temp_mid]="#ffc777"
+theme[temp_end]="#ff757f"
+
+theme[cpu_start]="#82aaff"
+theme[cpu_mid]="#c099ff"
+theme[cpu_end]="#ff757f"
+
+theme[free_start]="#3b4261"
+theme[free_mid]="#589ed7"
+theme[free_end]="#86e1fc"
+
+theme[cached_start]="#86e1fc"
+theme[cached_mid]="#82aaff"
+theme[cached_end]="#c099ff"
+
+theme[available_start]="#ffc777"
+theme[available_mid]="#ff966c"
+theme[available_end]="#ff757f"
+
+theme[used_start]="#a5e8b5"
+theme[used_mid]="#ffc777"
+theme[used_end]="#ff757f"
+
+theme[download_start]="#3b4261"
+theme[download_mid]="#82aaff"
+theme[download_end]="#86e1fc"
+
+theme[upload_start]="#3b4261"
+theme[upload_mid]="#c099ff"
+theme[upload_end]="#fca7ea"
@@ -1,3 +1,12 @@
+# GENERATED FILE -- edit settings.ini.template instead.
+#
+# The theme name and dark preference below follow Panama's colour
+# scheme, so this file is regenerated on every switch and is not
+# committed. Under GNOME, gnome-settings-daemon publishes these over
+# XSETTINGS and this file is ignored; under Hyprland there is no
+# settings daemon, so for GTK3 it is authoritative -- which is why it
+# has to change with the scheme rather than being pinned to dark.
+#
 [Settings]
 # These values must match `gsettings get org.gnome.desktop.interface ...`.
 #
@@ -6,12 +15,12 @@
 # this file becomes authoritative for GTK3 — which is why it previously named
 # themes that aren't installed (Tahoe-Dark, WhiteSur-cursors) without anything
 # appearing broken.
-gtk-theme-name=adw-gtk3-dark
+gtk-theme-name=@GTK_THEME@
 gtk-icon-theme-name=Adwaita
 gtk-font-name=Adwaita Sans 11
 gtk-cursor-theme-name=oreo_blue_cursors
 gtk-cursor-theme-size=24
-gtk-application-prefer-dark-theme=1
+gtk-application-prefer-dark-theme=@PREFER_DARK@

 gtk-toolbar-style=GTK_TOOLBAR_ICONS
 gtk-toolbar-icon-size=GTK_ICON_SIZE_LARGE_TOOLBAR
@@ -1,11 +0,0 @@
-[Settings]
-# libadwaita apps normally take their dark preference from the
-# org.freedesktop.appearance portal (served by xdg-desktop-portal-gtk, which
-# reads gsettings). This file is the fallback for plain GTK4 apps and for the
-# window before the portal answers.
-gtk-application-prefer-dark-theme=1
-gtk-theme-name=adw-gtk3-dark
-gtk-icon-theme-name=Adwaita
-gtk-font-name=Adwaita Sans 11
-gtk-cursor-theme-name=oreo_blue_cursors
-gtk-cursor-theme-size=24
@@ -0,0 +1,20 @@
+# GENERATED FILE -- edit settings.ini.template instead.
+#
+# The theme name and dark preference below follow Panama's colour
+# scheme, so this file is regenerated on every switch and is not
+# committed. Under GNOME, gnome-settings-daemon publishes these over
+# XSETTINGS and this file is ignored; under Hyprland there is no
+# settings daemon, so for GTK3 it is authoritative -- which is why it
+# has to change with the scheme rather than being pinned to dark.
+#
+[Settings]
+# libadwaita apps normally take their dark preference from the
+# org.freedesktop.appearance portal (served by xdg-desktop-portal-gtk, which
+# reads gsettings). This file is the fallback for plain GTK4 apps and for the
+# window before the portal answers.
+gtk-application-prefer-dark-theme=@PREFER_DARK@
+gtk-theme-name=@GTK_THEME@
+gtk-icon-theme-name=Adwaita
+gtk-font-name=Adwaita Sans 11
+gtk-cursor-theme-name=oreo_blue_cursors
+gtk-cursor-theme-size=24
@@ -37,6 +37,31 @@ Last live audit: 2026-08-17, Fedora 44, Hyprland 0.56.2, Quickshell 0.3.0.
 | Autostart apps | Nextcloud, Bitwarden, and RustDesk system service/tray | Live |
 | Printer administration | CUPS with the `system-config-printer` graphical interface | Live |
 | System settings | The Settings app for display policy, appearance, desktop, sound, focus, shortcuts, and services; labelled GNOME hardware/account handoffs | Live |
+| System health and recovery | Settings → System Health, `Panama: Check System Health` in Vicinae, a degraded-only bar indicator, redacted reports, and bounded Panama-owned repairs | Live |
+
+## System health and recovery
+
+Panama stays silent while the desktop is healthy. A compact bar indicator
+appears only for actionable warnings or errors and opens the same **System
+Health** page available from Settings and the Vicinae command **Panama: Check
+System Health**. The terminal summary is available with:
+
+```bash
+~/.config/quickshell/scripts/panama-doctor --summary
+```
+
+The doctor reports authored, redacted observations about Panama-owned services,
+tools, links, and configured integrations. It does not read secrets, clipboard
+or notification contents, calendar events, SSIDs, or device addresses. Repairs
+are a small allow-list: Panama user services, Panama-owned links and launcher
+commands, duplicate Panama Caffeine inhibitors, and a confirmed shell restart.
+They never install packages, invoke `sudo`, delete user data, or rewrite
+arbitrary configuration.
+
+Generic Fedora configuration remains with the system tools that own it. The
+final System Health card hands network settings, users, sharing, colour
+profiles, and digital wellbeing to their exact GNOME Settings panels rather
+than presenting inert Hyprland controls.

 ## GNOME extension migration

@@ -9,6 +9,8 @@
 -- instead. They still work here; see the session notes in autostart.lua.
 -- ─────────────────────────────────────────────────────────────────────────────

+local prefs = require("prefs")
+
 -- ── GPU selection ───────────────────────────────────────────────────────────
 -- This box has a discrete RX 7800 XT (0000:03:00.0) and a Granite Ridge iGPU
 -- (0000:12:00.0). The monitor hangs off the dGPU, so the dGPU must render.
@@ -47,7 +49,7 @@ end
 -- (it has cursors/ + index.theme and no hyprcursors/ directory or manifest.hl),
 -- so setting it would point hyprcursor at nothing. Hyprland falls back to the
 -- XCursor path, which is what we want.
-hl.env("XCURSOR_THEME", "oreo_blue_cursors")
+hl.env("XCURSOR_THEME", prefs.get("cursorTheme", "oreo_blue_cursors"))
 hl.env("XCURSOR_SIZE", "24")

 -- ── Toolkits ────────────────────────────────────────────────────────────────
@@ -15,7 +15,7 @@

 general {
    # `pidof` guard prevents stacking lockers if this fires twice.
-    lock_cmd = pidof hyprlock || hyprlock
+    lock_cmd = pidof hyprlock || ~/.config/quickshell/scripts/panama-lock run
    before_sleep_cmd = loginctl lock-session
    after_sleep_cmd = hyprctl dispatch 'hl.dsp.dpms({ action = "on" })'

@@ -1,8 +1,17 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# hyprlock — lock screen
+# hyprlock — lock screen.
 #
-# Tokyo Night Moon, matching quickshell/config/Theme.qml:
-#   accent  #82aaff    fg  #c8d3f5    dim  #828bb8    bg  #222436    red #ff757f
+# GENERATED FILE. Edit hyprlock.conf.template and re-run
+# quickshell/scripts/panama-theme-apps; editing this copy is overwritten on the
+# next colour scheme change.
+#
+# The colours here follow the desktop's light/dark setting. They used to be
+# hardcoded Tokyo Night Moon, which meant the one screen you see most often
+# stayed dark when everything else went light.
+#
+# hyprlock takes rgba(r, g, b, a) in DECIMAL rather than hex, which is why the
+# template carries "R, G, B" triples where the rest of Panama uses hex. The two
+# Pango markup values are the exception and want ##rrggbb.
 #
 # hyprlang syntax, not Lua — hyprlock is a separate project from Hyprland.
 # ─────────────────────────────────────────────────────────────────────────────
@@ -45,7 +54,7 @@ background {
    vibrancy_darkness = 0.05

    # Shown if the screenshot is unavailable.
-    color = rgba(34, 36, 54, 1.0)
+    color = rgba(@BG@, 1.0)

    zindex = -1
 }
@@ -54,7 +63,7 @@ background {
 label {
    monitor =
    text = cmd[update:1000] date +"%-I:%M"
-    color = rgba(200, 211, 245, 1.0)
+    color = rgba(@FG@, 1.0)
    font_size = 120
    font_family = Adwaita Sans Light
    position = 0, 260
@@ -65,7 +74,7 @@ label {
 label {
    monitor =
    text = cmd[update:60000] date +"%A, %B %-d"
-    color = rgba(130, 139, 184, 1.0)
+    color = rgba(@MUTED@, 1.0)
    font_size = 24
    font_family = Adwaita Sans
    position = 0, 160
@@ -84,18 +93,18 @@ input-field {
    outline_thickness = 2
    rounding = 26

-    outer_color = rgba(130, 170, 255, 0.9)
-    inner_color = rgba(46, 47, 61, 0.85)
-    font_color = rgba(200, 211, 245, 1.0)
-    check_color = rgba(130, 170, 255, 1.0)
-    fail_color = rgba(255, 117, 127, 1.0)
+    outer_color = rgba(@ACCENT@, 0.9)
+    inner_color = rgba(@FIELD@, 0.85)
+    font_color = rgba(@FG@, 1.0)
+    check_color = rgba(@ACCENT@, 1.0)
+    fail_color = rgba(@ERROR@, 1.0)

    dots_size = 0.25
    dots_spacing = 0.3
    dots_center = true

-    placeholder_text = <span foreground="##828bb8"><i>Password</i></span>
-    fail_text = <span foreground="##ff757f"><i>$FAIL ($ATTEMPTS)</i></span>
+    placeholder_text = <span foreground="##@MUTED_HEX@"><i>Password</i></span>
+    fail_text = <span foreground="##@ERROR_HEX@"><i>$FAIL ($ATTEMPTS)</i></span>

    fade_on_empty = false
    hide_input = false
@@ -105,7 +114,7 @@ input-field {
 label {
    monitor =
    text = $USER
-    color = rgba(200, 211, 245, 0.9)
+    color = rgba(@FG@, 0.9)
    font_size = 16
    font_family = Adwaita Sans
    position = 0, -110
@@ -10,9 +10,9 @@ local prefs = require("prefs")
 hl.config({
    input = {
        kb_layout  = prefs.get("keyboardLayout", "us"),
-        kb_variant = "",
+        kb_variant = prefs.get("keyboardVariant", ""),
        kb_model   = "",
-        kb_options = "",
+        kb_options = prefs.get("keyboardOptions", "caps:escape_shifted_capslock"),
        kb_rules   = "",

        numlock_by_default = prefs.get("numlockByDefault", true),
@@ -21,10 +21,18 @@ hl.config({
        repeat_delay = prefs.get("keyRepeatDelay", 500),
        repeat_rate  = prefs.get("keyRepeatRate", 33),

-        -- 1 = click to focus. GNOME's behaviour; NOT sloppy focus.
+        -- 1 = FOLLOW. The window under the pointer takes focus. This comment
+        -- previously claimed 1 was "click to focus, GNOME's behaviour", which
+        -- is the opposite of what Hyprland does -- `hyprctl descriptions` gives
+        -- map: [{"separate":3},{"detached":2},{"follow":1},{"disabled":0}],
+        -- so click-to-focus is 0. Changing the shipped value is a behaviour
+        -- decision rather than a correction, so the value is left alone and
+        -- only the description is fixed; Settings exposes all four.
        follow_mouse = prefs.getInt("followMouse", 1),

-        -- Don't refocus on mouse move alone -- only on click.
+        -- Softens follow_mouse: with this off, focus changes only when the
+        -- pointer crosses a window boundary, not on every movement inside one.
+        -- Still focus-follows-pointer, just less twitchy.
        mouse_refocus = false,

        -- Flat pointer response, no acceleration. Matters for gaming.
@@ -195,9 +195,21 @@ bind(mod .. " + SHIFT + U", hl.dsp.window.resize({ x = 0, y = step, relative = t
 bind(mod .. " + SHIFT + P", hl.dsp.window.resize({ x = 0, y = -step, relative = true }), { repeating = true, description = "Shorter" })
 bind(mod .. " + SHIFT + N", hl.dsp.window.resize({ x = 0, y = -step, relative = true }), { repeating = true, description = "Shorter" })

-- Window cycling (GNOME: cycle-windows on SUPER+Tab).
-bind(mod .. " + Tab", hl.dsp.window.cycle_next({ next = true }), { description = "Next window" })
-bind(mod .. " + SHIFT + Tab", hl.dsp.window.cycle_next({ next = false }), { description = "Previous window" })
+-- Window cycling (GNOME: cycle-windows on SUPER+Tab), now with an overlay
+-- showing what you are choosing between.
+--
+-- The gesture needs three binds, not two. Tab steps the selection, and the
+-- switch is only COMMITTED when the modifier is released -- which is the sole
+-- way the compositor can tell the gesture is finished. That release bind is on
+-- the bare modifier, so it fires on EVERY Super release in the session; the
+-- handler returns immediately when no switch is open, which is why this is
+-- affordable.
+--
+-- The release bind carries no description on purpose: it is not a shortcut
+-- anyone would look up or rebind, and the Shortcuts page lists what it finds.
+bind(mod .. " + Tab", hl.dsp.exec_cmd(qs("switcher", "next")), { description = "Next window" })
+bind(mod .. " + SHIFT + Tab", hl.dsp.exec_cmd(qs("switcher", "previous")), { description = "Previous window" })
+bind(mod, hl.dsp.exec_cmd(qs("switcher", "commit")), { release = true, description = "Commit window switch" })
 -- Jump back to the previously focused window.
 bind(mod .. " + SHIFT + grave", hl.dsp.focus({ last = true }), { description = "Last window" })

@@ -22,21 +22,22 @@ hl.config({
        border_size = prefs.get("borderSize", 2),

        col = {
-            -- The prism: blue leads, orchid follows, on a diagonal so the pair
-            -- is visible on both a tall and a wide window. Same two colours as
-            -- the shell's hairline (quickshell/widgets/PrismEdge.qml) and the
-            -- tmux theme this palette came from.
+            -- The focused accent role: blue leads, orchid follows, on a
+            -- diagonal so the pair is visible on both a tall and a wide
+            -- window. ColorScheme never writes this role; a future accent
+            -- picker can own it without fighting light/dark mode.
            active_border   = { colors = { "rgba(82aaffee)", "rgba(b172b0ee)" }, angle = 115 },
-            -- Unfocused windows get no colour at all. The gradient only means
-            -- something if exactly one window on screen is wearing it.
-            -- Follows the colour scheme: a dark neutral is invisible against a
-            -- light desktop. services/ColorScheme.qml applies changes live;
-            -- this is the value a fresh session starts from.
+            -- The neutral inactive role follows the colour scheme because a
+            -- dark neutral disappears against a light desktop.
+            -- services/ColorScheme.qml applies the same values live; this is
+            -- the value a fresh session starts from.
            inactive_border = prefs.get("colorScheme", "dark") == "light"
                and "rgba(a8aecb99)" or "rgba(3b426199)",
        },

-        resize_on_border = true,
+        resize_on_border         = prefs.get("resizeOnBorder", true),
+        extend_border_grab_area  = prefs.getInt("borderGrabArea", 15),
+        hover_icon_on_border     = prefs.get("hoverIconOnBorder", true),

        -- Enables the per-window "immediate" rule used for games in rules.lua.
        -- Harmless on its own; tearing only happens where a rule opts in.
@@ -44,16 +45,22 @@ hl.config({

        layout = "dwindle",

-        snap = { enabled = true },
+        snap = {
+            enabled      = true,
+            window_gap   = prefs.getInt("snapWindowGap", 10),
+            monitor_gap  = prefs.getInt("snapMonitorGap", 10),
+            respect_gaps = prefs.get("snapRespectGaps", false),
+        },
    },

    decoration = {
        -- 18 to match the shell's popover radius, so a window and a panel sitting
        -- next to each other read as the same object family.
        rounding       = prefs.get("windowRounding", 18),
-        rounding_power = 2,
+        rounding_power = prefs.get("roundingPower", 2),

-        active_opacity   = 1.0,
+        active_opacity     = prefs.get("activeOpacity", 1.0),
+        fullscreen_opacity = prefs.get("fullscreenOpacity", 1.0),
        inactive_opacity = prefs.get("inactiveOpacity", 1.0),

        blur = {
@@ -83,9 +90,13 @@ hl.config({
        shadow = {
            enabled      = prefs.get("shadowEnabled", true),
            range        = prefs.get("shadowRange", 20),
-            render_power = 3,
-            sharp        = false,
+            render_power = prefs.getInt("shadowRenderPower", 3),
+            sharp        = prefs.get("shadowSharp", false),
            color        = "rgba(15161eee)",
+            -- Deliberately not a setting: a two-axis offset needs a control we
+            -- do not have, and a slider bound to half a value is worse than
+            -- leaving it alone. SystemSettings understands the vec2 shape
+            -- already, so adding it later is only a matter of the widget.
            offset       = { 0, 4 },
            scale        = 1.0,
        },
@@ -110,14 +121,32 @@ hl.config({
    dwindle = {
        -- Keep the split orientation a window was created with. Closest match
        -- to how the Forge extension behaved on GNOME.
-        preserve_split = true,
+        preserve_split = prefs.get("preserveSplit", true),
        smart_resizing = true,
    },

+    -- Only in effect when the tiling layout is "master". Panama ships dwindle,
+    -- but Settings offers master as a choice, and a layout you can select and
+    -- cannot configure is barely a choice at all.
+    master = {
+        mfact       = prefs.get("masterFactor", 0.55),
+        orientation = prefs.get("masterOrientation", "left"),
+        new_status  = prefs.get("masterNewStatus", "slave"),
+        new_on_top  = prefs.get("masterNewOnTop", false),
+    },
+
    misc = {
        force_default_wallpaper  = 0,
-        disable_hyprland_logo    = true,
-        disable_splash_rendering = true,
+        -- Stored as "show the logo / show the splash" and written as Hyprland's
+        -- `disable_*`, matching the `invert` flag on these entries in
+        -- PreferenceSchema so both sides agree about which way round they are.
+        disable_hyprland_logo    = not prefs.get("hyprlandLogo", false),
+        disable_splash_rendering = not prefs.get("hyprlandSplash", false),
+
+        -- Keep native Wayland selection paste and GTK's matching preference
+        -- in lockstep. DesktopStyle applies the GTK half only after this value
+        -- has been read back and stored by SystemSettings.
+        middle_click_paste = prefs.get("middleClickPaste", true),

        -- Same setting as Theme.fontFamily in the shell. If only the QML side
        -- followed the preference, the compositor and the shell would disagree
@@ -172,8 +201,8 @@ hl.config({
    },

    ecosystem = {
-        no_update_news   = true,
-        no_donation_nag  = true,
+        no_update_news   = not prefs.get("hyprlandUpdateNews", false),
+        no_donation_nag  = not prefs.get("hyprlandDonationNag", false),
    },

    xwayland = {
@@ -20,7 +20,10 @@
 local prefs = require("prefs")

 -- Per-output overrides written by Panama Settings, keyed by output name:
--   { ["DP-2"] = { mode = "3840x2160@60", scale = 2, transform = 0 } }
+--   { ["DP-2"] = {
+--       mode = "3840x2160@60", scale = 2, transform = 0,
+--       x = 0, y = 0, primary = true,
+--   } }
 --
 -- Only mode, scale, and transform are read. Colour management and bit depth
 -- stay here, because those are the settings with a documented reason attached
@@ -71,6 +74,26 @@ local function valid_transform(transform)
        and transform <= 3
 end

+local function valid_coordinate(value)
+    return type(value) == "number"
+        and value == value
+        and value == math.floor(value)
+        and value >= -100000
+        and value <= 100000
+end
+
+local function valid_position(entry)
+    return valid_coordinate(entry.x) and valid_coordinate(entry.y)
+end
+
+local function valid_primary(entry)
+    return type(entry.primary) == "boolean"
+end
+
+local function has_layout_fields(entry)
+    return entry.x ~= nil or entry.y ~= nil or entry.primary ~= nil
+end
+
 local function display_entry(output)
    if type(output) ~= "string" or output == ""
        or output:match("^[%w_.-]+$") == nil then
@@ -85,9 +108,23 @@ local function display_entry(output)
        or not valid_transform(entry.transform) then
        return nil
    end
+    -- Legacy records have none of the layout fields and keep automatic
+    -- placement. A partially written extended record is unsafe: accepting its
+    -- mode but guessing its position could overlap or strand another output.
+    if has_layout_fields(entry)
+        and (not valid_position(entry) or not valid_primary(entry)) then
+        return nil
+    end
    return entry
 end

+local function display_position(entry, fallback)
+    if entry ~= nil and has_layout_fields(entry) then
+        return string.format("%dx%d", entry.x, entry.y)
+    end
+    return fallback
+end
+
 local shipped_mode = "4500x3000@60"
 local shipped_scale = 1.5
 local shipped_transform = 0
@@ -96,7 +133,7 @@ local dp2 = display_entry("DP-2")
 hl.monitor({
    output   = "DP-2",
    mode     = dp2 and dp2.mode or shipped_mode,
-    position = "0x0",
+    position = display_position(dp2, "0x0"),
    scale    = dp2 and dp2.scale or shipped_scale,
    transform = dp2 and dp2.transform or shipped_transform,

@@ -119,7 +156,7 @@ for output, _ in pairs(displays) do
            hl.monitor({
                output = output,
                mode = entry.mode,
-                position = "auto",
+                position = display_position(entry, "auto"),
                scale = entry.scale,
                transform = entry.transform,
            })
@@ -0,0 +1,136 @@
+import Quickshell
+import Quickshell.Io
+import Quickshell.Services.Pipewire
+import QtQuick
+
+import "services/AudioStreams.js" as AudioStreams
+import qs.services
+
+ShellRoot {
+    readonly property int audioOutStreamFlag: 4
+
+    property var fixtureNodes: [
+        {
+            id: 10,
+            ready: true,
+            type: audioOutStreamFlag,
+            properties: {
+                "application.id": "org.chromium.Chromium",
+                "application.name": "Chromium",
+                "application.icon_name": "chromium"
+            },
+            description: "Chromium audio",
+            audio: { volume: 0.4, muted: false }
+        },
+        {
+            id: 11,
+            ready: true,
+            type: audioOutStreamFlag,
+            properties: {
+                "application.id": "org.chromium.Chromium",
+                "application.name": "Chromium",
+                "application.icon_name": "chromium"
+            },
+            description: "Chromium audio",
+            audio: { volume: 0.8, muted: true }
+        },
+        {
+            id: 20,
+            ready: true,
+            type: audioOutStreamFlag,
+            properties: {
+                "application.process.binary": "spotify",
+                "application.name": "Spotify"
+            },
+            description: "Spotify",
+            audio: { volume: 0.25, muted: false }
+        },
+        {
+            id: 30,
+            ready: true,
+            type: 2,
+            properties: { "application.name": "Microphone capture" },
+            description: "Input stream",
+            audio: { volume: 0.5, muted: false }
+        },
+        {
+            id: 40,
+            ready: false,
+            type: audioOutStreamFlag,
+            properties: { "application.name": "Not ready" },
+            description: "Unready stream",
+            audio: { volume: 0.5, muted: false }
+        },
+        {
+            id: 99,
+            ready: true,
+            type: audioOutStreamFlag,
+            properties: {},
+            description: "",
+            audio: { volume: 1, muted: false }
+        }
+    ]
+
+    function groups(): var {
+        return AudioStreams.group(fixtureNodes, audioOutStreamFlag);
+    }
+
+    IpcHandler {
+        target: "application-volume-test"
+
+        function summary(): string {
+            const applications = groups();
+            const chromium = applications.find(application =>
+                application.key === "org.chromium.Chromium");
+            return JSON.stringify({
+                groups: applications.map(application => ({
+                    key: application.key,
+                    label: application.label,
+                    icon: application.icon,
+                    count: application.nodes.length
+                })),
+                chromiumVolume: AudioStreams.volume(chromium),
+                chromiumMuted: AudioStreams.muted(chromium)
+            });
+        }
+
+        function mutateVolume(): string {
+            const chromium = groups().find(application =>
+                application.key === "org.chromium.Chromium");
+            const changed = AudioStreams.setVolume(chromium, 0.7);
+            return JSON.stringify({
+                changed,
+                volumes: chromium.nodes.map(node => node.audio.volume),
+                muted: chromium.nodes.map(node => node.audio.muted)
+            });
+        }
+
+        function mutateMute(): string {
+            const chromium = groups().find(application =>
+                application.key === "org.chromium.Chromium");
+            const changed = AudioStreams.setMuted(chromium, true);
+            return JSON.stringify({
+                changed,
+                muted: chromium.nodes.map(node => node.audio.muted)
+            });
+        }
+
+        function serviceSummary(): string {
+            const applications = AudioDevices.applications;
+            return JSON.stringify({
+                count: applications.length,
+                validTypes: applications.every(application =>
+                    application.nodes.every(node =>
+                        (node.type & PwNodeType.AudioOutStream)
+                            === PwNodeType.AudioOutStream))
+            });
+        }
+
+        function invalidMutations(): string {
+            return JSON.stringify({
+                nullVolume: AudioDevices.setApplicationVolume(null, 0.5),
+                emptyMute: AudioDevices.setApplicationMuted({ nodes: [] }, true)
+            });
+        }
+    }
+}
@@ -98,7 +98,26 @@ Singleton {
            // back to shipped defaults and let the next write replace it.
            parsed = {};
        }
-        root.values = (parsed && typeof parsed === "object") ? parsed : {};
+        const raw = (parsed && typeof parsed === "object") ? parsed : {};
+
+        // Upgrade before anything reads a value. A stored key the current
+        // schema no longer recognises is carried through untouched and silently
+        // stops taking effect, so the conversion has to happen here rather than
+        // being noticed later by whoever owns that setting.
+        const result = Migrations.apply(raw);
+        root.values = result.values;
+
+        if (result.migrated)
+            console.info("Settings migrated from version", result.from, "to", result.to + ":",
+                         result.applied.join("; "));
+
+        // Write whenever the version moved, which includes stamping a file
+        // written before versioning existed. Left unwritten, the stamp lives
+        // only in memory and is redone on every launch, and a migration that is
+        // not idempotent would compound.
+        if (result.changed)
+            persistTimer.restart();
+
        root.revision++;
        root.loaded = true;
    }
@@ -0,0 +1,121 @@
+pragma Singleton
+
+// Versioned upgrades for the settings file.
+//
+// The schema is the single source of truth for what a setting IS, but it cannot
+// describe what a setting USED to be. Renaming a key, changing its units, or
+// splitting one setting into two all leave a stored value that the new schema
+// does not recognise -- and an unrecognised key is silently carried through
+// untouched, so the user's choice simply stops taking effect with nothing to
+// say why. That is the failure this exists to prevent.
+//
+// HOW IT WORKS
+//
+// settings.json carries a schemaVersion. On load, every migration with a
+// version ABOVE the stored one runs in order, then the file is stamped with
+// `current`. A file with no schemaVersion at all is a file written before this
+// existed; it is stamped at `baseline` and NOT migrated, because those
+// migrations were never written for it.
+//
+// WRITING ONE
+//
+//   { version: 2, describe: "rename dockDelay to dockHideDelayMs",
+//     migrate: values => { ... return values; } }
+//
+// Rules that make this safe to run against a real user's file:
+//
+//   * migrate() receives the whole values object and returns it. Mutating and
+//     returning the same object is fine.
+//   * NEVER delete a key you are not replacing. Unknown keys are deliberately
+//     preserved so that rolling back to an older Panama does not discard a
+//     newer version's settings, and a migration is the one place that promise
+//     could quietly be broken.
+//   * A migration must tolerate its input being absent or the wrong type. It
+//     runs against files written by every previous version, including ones
+//     that were hand-edited.
+//   * Migrations never run twice: the stored version only moves forward.
+
+import QtQuick
+
+QtObject {
+    id: root
+
+    // What a file written today is stamped with. Bump this when adding a
+    // migration, to the version of the migration you added.
+    readonly property int current: 1
+
+    // Files predating versioning are stamped here without being migrated.
+    readonly property int baseline: 1
+
+    readonly property string versionKey: "schemaVersion"
+
+    // Ordered by version. Empty is the correct state until the first breaking
+    // schema change -- this exists so that change is a routine edit rather than
+    // an emergency.
+    readonly property var steps: []
+
+    function storedVersion(values: var): int {
+        const raw = values ? values[root.versionKey] : undefined;
+        return (typeof raw === "number" && isFinite(raw)) ? Math.floor(raw) : 0;
+    }
+
+    // Returns { values, migrated, changed, from, to, applied }.
+    //
+    // `applied` names each step that ran, so the caller can log something
+    // meaningful rather than "settings changed somehow". `changed` is the one
+    // the caller should write on: stamping a pre-versioning file changes it
+    // without running any step, and left unwritten the stamp would live only in
+    // memory and be redone on every launch.
+    function apply(values: var): var {
+        return root.applyWith(values, root.steps, root.current, root.baseline);
+    }
+
+    // The same logic with the step list injected, so the machinery can be
+    // tested against fixture migrations. The real list is empty until the first
+    // breaking schema change, and a mechanism that has never run against a
+    // failing step is not one to find out about during an upgrade.
+    function applyWith(values: var, steps: var, current: int, baseline: int): var {
+        const safe = (values && typeof values === "object") ? values : {};
+        const from = root.storedVersion(safe);
+
+        // No version: written before versioning existed. Stamp it and stop.
+        // Running the migration list against it would apply upgrades designed
+        // for schemas this file never had.
+        if (from === 0) {
+            safe[root.versionKey] = baseline;
+            return { values: safe, migrated: false, changed: true, from: 0, to: baseline, applied: [] };
+        }
+
+        // A file from a NEWER Panama. Left completely alone: downgrading its
+        // keys is not something this can do correctly, and unknown keys are
+        // already preserved, so the older build simply ignores what it does not
+        // understand.
+        if (from > current)
+            return { values: safe, migrated: false, changed: false, from: from, to: from, applied: [] };
+
+        const applied = [];
+        let working = safe;
+        for (const step of steps) {
+            if (step.version <= from || step.version > current)
+                continue;
+            try {
+                const result = step.migrate(working);
+                if (result && typeof result === "object")
+                    working = result;
+                applied.push(step.version + ": " + step.describe);
+            } catch (error) {
+                // One bad migration must not cost the user every setting. Stop
+                // at the last good version so the next launch retries from
+                // here rather than skipping the failed step forever.
+                console.warn("Migrations: step", step.version, "failed:", error);
+                working[root.versionKey] = step.version - 1;
+                return { values: working, migrated: applied.length > 0, changed: applied.length > 0,
+                         from: from, to: step.version - 1, applied: applied };
+            }
+        }
+
+        working[root.versionKey] = current;
+        return { values: working, migrated: applied.length > 0, changed: from !== current,
+                 from: from, to: current, applied: applied };
+    }
+}
@@ -128,10 +128,21 @@ Singleton {
        {
            key: "vrrPolicy", type: "enum", def: 3, group: "display",
            label: "Variable refresh rate",
-            detail: "Content-aware matches the display to what is on screen",
+            detail: "Matches the display's refresh rate to what is on screen",
+            // All four the compositor publishes, rather than the two that were
+            // here. Always-on VRR is a legitimate choice on a panel that
+            // handles it well, and it was simply unreachable -- as was
+            // fullscreen-only, which is what someone wanting VRR for video
+            // rather than games wants.
            options: [
-                { value: 0, label: "Off" },
-                { value: 3, label: "Content-aware" }
+                { value: 0, label: "Off",
+                  detail: "The display runs at a fixed refresh rate" },
+                { value: 1, label: "Always on",
+                  detail: "Best on panels that handle low refresh rates without flicker" },
+                { value: 2, label: "Fullscreen only",
+                  detail: "Any fullscreen window, including video" },
+                { value: 3, label: "Fullscreen games",
+                  detail: "Only fullscreen games, which is the safest default" }
            ],
            hypr: { path: ["misc", "vrr"], option: "misc:vrr", readAs: "int" }
        },
@@ -140,8 +151,12 @@ Singleton {
            label: "Direct scanout",
            detail: "Lets fullscreen content bypass compositing",
            options: [
-                { value: 0, label: "Off" },
-                { value: 2, label: "Automatic" }
+                { value: 0, label: "Off",
+                  detail: "Everything goes through the compositor" },
+                { value: 1, label: "Always on",
+                  detail: "Forced rather than decided per surface; can drop frames on some drivers" },
+                { value: 2, label: "Automatic",
+                  detail: "The compositor decides per surface, which is the safe default" }
            ],
            hypr: { path: ["render", "direct_scanout"], option: "render:direct_scanout", readAs: "int" }
        },
@@ -191,6 +206,147 @@ Singleton {
            hypr: { path: ["decoration", "inactive_opacity"], option: "decoration:inactive_opacity", readAs: "float" }
        },

+        {
+            key: "activeOpacity", type: "real", def: 1.0, min: 0.5, max: 1.0, step: 0.05,
+            group: "windows",
+            label: "Focused window opacity",
+            detail: "Fade even the focused window; 1.0 is fully opaque",
+            hypr: { path: ["decoration", "active_opacity"], option: "decoration:active_opacity", readAs: "float" }
+        },
+        {
+            key: "fullscreenOpacity", type: "real", def: 1.0, min: 0.5, max: 1.0, step: 0.05,
+            group: "windows",
+            label: "Fullscreen opacity",
+            detail: "Applied instead of the focused opacity when a window is fullscreen",
+            hypr: { path: ["decoration", "fullscreen_opacity"], option: "decoration:fullscreen_opacity", readAs: "float" }
+        },
+        {
+            key: "roundingPower", type: "real", def: 2.0, min: 2.0, max: 10.0, step: 0.5,
+            group: "windows",
+            label: "Corner shape",
+            detail: "2 is a circular corner; higher values approach a squircle",
+            hypr: { path: ["decoration", "rounding_power"], option: "decoration:rounding_power", readAs: "float" }
+        },
+
+        // ── Window edges ────────────────────────────────────────────────────
+        // How the pointer interacts with a window's border, and how windows
+        // behave near each other. All shipped by looks.lua with no way to
+        // change any of it.
+        {
+            key: "resizeOnBorder", type: "bool", def: true, group: "edges",
+            label: "Resize by dragging the border",
+            detail: "Drag a window's edge to resize it, instead of only with the keyboard",
+            hypr: { path: ["general", "resize_on_border"], option: "general:resize_on_border", readAs: "bool" }
+        },
+        {
+            key: "borderGrabArea", type: "int", def: 15, min: 0, max: 40, step: 1,
+            unit: "px",
+            group: "edges",
+            label: "Border grab area",
+            detail: "How far outside the border still counts as grabbing it. Larger is easier to hit",
+            hypr: { path: ["general", "extend_border_grab_area"], option: "general:extend_border_grab_area", readAs: "int" }
+        },
+        {
+            key: "hoverIconOnBorder", type: "bool", def: true, group: "edges",
+            label: "Show the resize cursor",
+            detail: "Change the pointer when it is over a resizable border",
+            hypr: { path: ["general", "hover_icon_on_border"], option: "general:hover_icon_on_border", readAs: "bool" }
+        },
+        {
+            key: "snapWindowGap", type: "int", def: 10, min: 0, max: 60, step: 1,
+            unit: "px",
+            group: "edges",
+            label: "Snap distance between windows",
+            detail: "How close two floating windows must be before they snap together",
+            hypr: { path: ["general", "snap", "window_gap"], option: "general:snap:window_gap", readAs: "int" }
+        },
+        {
+            key: "snapMonitorGap", type: "int", def: 10, min: 0, max: 60, step: 1,
+            unit: "px",
+            group: "edges",
+            label: "Snap distance to screen edges",
+            detail: "How close a floating window must be to an edge before it snaps to it",
+            hypr: { path: ["general", "snap", "monitor_gap"], option: "general:snap:monitor_gap", readAs: "int" }
+        },
+        {
+            key: "snapRespectGaps", type: "bool", def: false, group: "edges",
+            label: "Snapping respects gaps",
+            detail: "Snapped windows keep the configured gap instead of touching",
+            hypr: { path: ["general", "snap", "respect_gaps"], option: "general:snap:respect_gaps", readAs: "bool" }
+        },
+
+        // ── Master layout ───────────────────────────────────────────────────
+        // Only meaningful when the tiling layout is Master and stack. Offering
+        // that layout with none of its options was an omission: it is the one
+        // layout whose whole behaviour is in these settings.
+        {
+            key: "masterFactor", type: "real", def: 0.55, min: 0.1, max: 0.9, step: 0.05,
+            group: "master",
+            label: "Master area size",
+            detail: "How much of the screen the master window takes",
+            hypr: { path: ["master", "mfact"], option: "master:mfact", readAs: "float" }
+        },
+        {
+            key: "masterOrientation", type: "enum", def: "left", group: "master",
+            label: "Master area position",
+            detail: "Which side of the screen the master window occupies",
+            options: [
+                { value: "left", label: "Left" },
+                { value: "right", label: "Right" },
+                { value: "top", label: "Top" },
+                { value: "bottom", label: "Bottom" },
+                { value: "center", label: "Centre" }
+            ],
+            hypr: { path: ["master", "orientation"], option: "master:orientation", readAs: "str" }
+        },
+        {
+            key: "masterNewStatus", type: "enum", def: "slave", group: "master",
+            label: "New windows become",
+            detail: "Whether a new window takes the master area or joins the stack",
+            options: [
+                { value: "master", label: "The master window" },
+                { value: "slave", label: "Part of the stack" },
+                { value: "inherit", label: "Whatever the focused window is" }
+            ],
+            hypr: { path: ["master", "new_status"], option: "master:new_status", readAs: "str" }
+        },
+        {
+            key: "masterNewOnTop", type: "bool", def: false, group: "master",
+            label: "Add new windows at the top",
+            detail: "New stack windows go above the others rather than below",
+            hypr: { path: ["master", "new_on_top"], option: "master:new_on_top", readAs: "bool" }
+        },
+
+        // ── Hyprland's own notices ──────────────────────────────────────────
+        // Panama turns all four off on the user's behalf. That is a defensible
+        // default and was not a decision anyone could reverse without editing
+        // looks.lua, which is precisely the kind of thing this app exists to
+        // stop.
+        {
+            key: "hyprlandLogo", type: "bool", def: false, group: "notices",
+            label: "Hyprland wallpaper",
+            detail: "The stock background Hyprland draws when no wallpaper is set",
+            hypr: { path: ["misc", "disable_hyprland_logo"], option: "misc:disable_hyprland_logo", readAs: "bool", invert: true }
+        },
+        {
+            key: "hyprlandSplash", type: "bool", def: false, group: "notices",
+            label: "Splash text",
+            detail: "The line of text Hyprland renders over the stock background",
+            hypr: { path: ["misc", "disable_splash_rendering"], option: "misc:disable_splash_rendering", readAs: "bool", invert: true }
+        },
+        {
+            key: "hyprlandUpdateNews", type: "bool", def: false, group: "notices",
+            label: "Update announcements",
+            detail: "The window Hyprland opens after an update to describe what changed",
+            hypr: { path: ["ecosystem", "no_update_news"], option: "ecosystem:no_update_news", readAs: "bool", invert: true }
+        },
+        {
+            key: "hyprlandDonationNag", type: "bool", def: false, group: "notices",
+            label: "Donation reminders",
+            detail: "The prompt Hyprland shows twice a year asking for support",
+            hypr: { path: ["ecosystem", "no_donation_nag"], option: "ecosystem:no_donation_nag", readAs: "bool", invert: true }
+        },
+
        // ── Effects ─────────────────────────────────────────────────────────
        {
            key: "blurEnabled", type: "bool", def: true, group: "effects",
@@ -226,6 +382,19 @@ Singleton {
            detail: "How far the shadow spreads from the window edge",
            hypr: { path: ["decoration", "shadow", "range"], option: "decoration:shadow:range", readAs: "int" }
        },
+        {
+            key: "shadowSharp", type: "bool", def: false, group: "effects",
+            label: "Hard-edged shadow",
+            detail: "A crisp shadow instead of a soft falloff",
+            hypr: { path: ["decoration", "shadow", "sharp"], option: "decoration:shadow:sharp", readAs: "bool" }
+        },
+        {
+            key: "shadowRenderPower", type: "int", def: 3, min: 1, max: 4, step: 1,
+            group: "effects",
+            label: "Shadow falloff",
+            detail: "How sharply the shadow fades out. Higher is tighter to the window",
+            hypr: { path: ["decoration", "shadow", "render_power"], option: "decoration:shadow:render_power", readAs: "int" }
+        },
        {
            key: "glowEnabled", type: "bool", def: true, group: "effects",
            label: "Focus glow",
@@ -267,7 +436,7 @@ Singleton {
            hypr: { path: ["input", "kb_variant"], option: "input:kb_variant", readAs: "str" }
        },
        {
-            key: "keyboardOptions", type: "string", def: "", group: "input",
+            key: "keyboardOptions", type: "string", def: "caps:escape_shifted_capslock", group: "input",
            // XKB option names are colon-separated pairs in a comma-separated
            // list, e.g. "compose:ralt,caps:escape".
            pattern: "^$|^[a-z0-9_]+:[a-z0-9_]+(,[a-z0-9_]+:[a-z0-9_]+)*$",
@@ -298,19 +467,35 @@ Singleton {
            hypr: { path: ["input", "repeat_rate"], option: "input:repeat_rate", readAs: "int" }
        },
        {
-            key: "followMouse", type: "enum", def: 1, group: "input",
-            label: "Focus follows pointer",
-            detail: "Click to focus matches GNOME; sloppy focus follows the pointer",
+            key: "followMouse", type: "enum", def: 1, group: "pointer",
+            label: "Pointer focus",
+            detail: "What moving the pointer does to which window is focused",
+            // These labels were wrong, and wrong in the worst way: value 1 was
+            // shown as "Click to focus" while Hyprland's 1 means the opposite.
+            // The compositor publishes the authoritative mapping itself --
+            // `hyprctl descriptions` gives
+            //   map: [{"separate":3},{"detached":2},{"follow":1},{"disabled":0}]
+            // -- so a desktop labelled "Click to focus" was in fact following
+            // the pointer, and the way to actually get click-to-focus was to
+            // choose "Never". Value 3 was missing entirely.
+            //
+            // enum-hypr-map-contract now pins every mapped enum against that
+            // published map, so this cannot drift again.
            options: [
-                { value: 0, label: "Never" },
-                { value: 1, label: "Click to focus" },
-                { value: 2, label: "Sloppy focus" }
+                { value: 0, label: "Click to focus",
+                  detail: "Moving the pointer never changes focus" },
+                { value: 1, label: "Focus follows pointer",
+                  detail: "The window under the pointer takes focus as you move" },
+                { value: 2, label: "Pointer detached",
+                  detail: "The pointer highlights windows on its own; clicking moves keyboard focus" },
+                { value: 3, label: "Pointer fully separate",
+                  detail: "Clicking does not move keyboard focus at all" }
            ],
            hypr: { path: ["input", "follow_mouse"], option: "input:follow_mouse", readAs: "int" }
        },
        {
            key: "pointerSensitivity", type: "real", def: 0.0, min: -1.0, max: 1.0, step: 0.05,
-            group: "input",
+            group: "pointer",
            label: "Pointer speed",
            detail: "Zero is flat, unaccelerated response",
            hypr: { path: ["input", "sensitivity"], option: "input:sensitivity", readAs: "float" }
@@ -318,7 +503,7 @@ Singleton {
        {
            key: "cursorInactiveTimeout", type: "int", def: 4, min: 0, max: 60, step: 1,
            unit: "s",
-            group: "input",
+            group: "pointer",
            label: "Hide pointer after",
            detail: "Seconds of stillness before the pointer fades out; 0 never hides it",
            // Reported as a float even though it is only ever set to whole
@@ -363,6 +548,12 @@ Singleton {
            detail: "Swap the primary and secondary buttons",
            hypr: { path: ["input", "left_handed"], option: "input:left_handed", readAs: "bool" }
        },
+        {
+            key: "middleClickPaste", type: "bool", def: true, group: "pointer",
+            label: "Middle-click paste",
+            detail: "Paste the primary selection in GTK and native Wayland applications",
+            hypr: { path: ["misc", "middle_click_paste"], option: "misc:middle_click_paste", readAs: "bool" }
+        },

        // ── Touchpad ────────────────────────────────────────────────────────
        //
@@ -489,6 +680,42 @@ Singleton {
            hypr: { path: ["misc", "mouse_move_focuses_monitor"], option: "misc:mouse_move_focuses_monitor", readAs: "bool" }
        },

+        // ── Accessibility ───────────────────────────────────────────────────
+        //
+        // Only what Hyprland can actually deliver. GNOME's sticky keys, slow
+        // keys, bounce keys and mouse keys are AccessX, an X11 server feature:
+        // XKB under Wayland has no accessx option group at all (verified
+        // against evdev.lst), and Hyprland does not implement it. The
+        // compositor will happily STORE "accessx:enable" as a keyboard option
+        // and nothing will ever act on it, which is exactly the kind of switch
+        // this app refuses to ship.
+        {
+            key: "magnifierFactor", type: "real", def: 1.0, min: 1.0, max: 5.0, step: 0.1,
+            group: "accessibility",
+            label: "Magnifier",
+            detail: "Magnifies the screen around the pointer. 1.0 is off",
+            hypr: { path: ["cursor", "zoom_factor"], option: "cursor:zoom_factor", readAs: "float" }
+        },
+        {
+            key: "magnifierRigid", type: "bool", def: false, group: "accessibility",
+            label: "Magnifier follows in steps",
+            detail: "Moves the magnified view in increments rather than gliding with the pointer",
+            hypr: { path: ["cursor", "zoom_rigid"], option: "cursor:zoom_rigid", readAs: "bool" }
+        },
+        {
+            key: "dimInactive", type: "bool", def: false, group: "accessibility",
+            label: "Dim inactive windows",
+            detail: "Darkens every window except the focused one, so the active window is unmistakable",
+            hypr: { path: ["decoration", "dim_inactive"], option: "decoration:dim_inactive", readAs: "bool" }
+        },
+        {
+            key: "dimStrength", type: "real", def: 0.5, min: 0.05, max: 0.9, step: 0.05,
+            group: "accessibility",
+            label: "Dim amount",
+            detail: "How much darker unfocused windows are",
+            hypr: { path: ["decoration", "dim_strength"], option: "decoration:dim_strength", readAs: "float" }
+        },
+
        // ── Night light ─────────────────────────────────────────────────────
        {
            key: "nightLightEnabled", type: "bool", def: false, group: "nightLight",
@@ -520,6 +747,66 @@ Singleton {
            label: "Wallpaper",
            detail: "Shown on every output"
        },
+        {
+            key: "wallpaperMode", type: "enum", def: "single", group: "wallpaper",
+            label: "Wallpaper mode", detail: "Use one image, rotate a collection, or choose per display",
+            options: [
+                { value: "single", label: "Single" },
+                { value: "slideshow", label: "Slideshow" },
+                { value: "per-monitor", label: "Per display" }
+            ]
+        },
+        {
+            key: "wallpaperSlideshowPaths", type: "json", def: ([]), group: "wallpaper", internal: true,
+            label: "Slideshow collection", detail: "Backgrounds selected for rotation"
+        },
+        {
+            key: "wallpaperIntervalMinutes", type: "int", def: 30, min: 5, max: 1440, step: 5,
+            unit: "min", group: "wallpaper", label: "Change background every",
+            detail: "Time between slideshow images"
+        },
+        {
+            key: "wallpaperShuffle", type: "bool", def: true, group: "wallpaper",
+            label: "Shuffle", detail: "Show every selected image before repeating"
+        },
+        {
+            key: "wallpaperPerMonitor", type: "json", def: ({}), group: "wallpaper", internal: true,
+            label: "Per-display backgrounds", detail: "Background assigned to each connected display"
+        },
+
+        // ── Lock-screen appearance ─────────────────────────────────────────
+        // scripts/panama-lock validates these again before generating a state
+        // config. The tracked hyprlock.conf remains the safe fallback.
+        {
+            key: "lockBackgroundMode", type: "enum", def: "screenshot", group: "lockAppearance",
+            label: "Background", detail: "What appears behind the lock screen",
+            options: [
+                { value: "screenshot", label: "Blurred desktop" },
+                { value: "wallpaper", label: "Current wallpaper" },
+                { value: "solid", label: "Solid color" }
+            ]
+        },
+        {
+            key: "lockBlurLevel", type: "int", def: 3, min: 0, max: 5, step: 1,
+            group: "lockAppearance", label: "Background blur",
+            detail: "Softens what is behind the password field"
+        },
+        {
+            key: "lockShowClock", type: "bool", def: true, group: "lockAppearance",
+            label: "Show clock", detail: "Use the desktop's 12 or 24-hour format"
+        },
+        {
+            key: "lockShowDate", type: "bool", def: true, group: "lockAppearance",
+            label: "Show date", detail: "Show the weekday and full date"
+        },
+        {
+            key: "lockShowUser", type: "bool", def: true, group: "lockAppearance",
+            label: "Show user name", detail: "Identify the signed-in account"
+        },
+        {
+            key: "lockFadeOnEmpty", type: "bool", def: false, group: "lockAppearance",
+            label: "Hide password field until typing", detail: "Keep the empty field out of the way"
+        },

        // ── Idle, lock, and sleep ───────────────────────────────────────────
        // Written into a generated hypridle config; see scripts/panama-idle.
@@ -585,6 +872,24 @@ Singleton {
            ]
        },

+        // ── Application themes ─────────────────────────────────────────────
+        // ColorScheme owns GTK's light/dark theme. These are the two theme
+        // choices GNOME applications expose independently of that palette:
+        // their icons and pointer. DesktopStyle only accepts names found in
+        // the read-only XDG catalog before storing them.
+        {
+            key: "cursorTheme", type: "string", def: "oreo_blue_cursors", group: "themes",
+            pattern: "^[A-Za-z0-9 ._+@'-]{1,96}$",
+            label: "Pointer theme",
+            detail: "The pointer design used by applications and Hyprland"
+        },
+        {
+            key: "iconTheme", type: "string", def: "Adwaita", group: "themes",
+            pattern: "^[A-Za-z0-9 ._+@'-]{1,96}$",
+            label: "Application icons",
+            detail: "The icon set used by GTK applications"
+        },
+
        // ── Typography ──────────────────────────────────────────────────────
        // The single largest thing in this desktop that used to be changeable
        // only by editing Theme.qml.
@@ -614,6 +919,91 @@ Singleton {
            label: "Interface text size",
            detail: "The base size the rest of the shell's type scales from"
        },
+        {
+            key: "applicationFont", type: "string", def: "Adwaita Sans", group: "typography",
+            pattern: "^[A-Za-z0-9 ._+@'-]{1,96}$",
+            label: "Application font",
+            detail: "Used by menus, controls, and labels in applications"
+        },
+        {
+            key: "applicationFontSize", type: "int", def: 11, min: 6, max: 32, step: 1,
+            unit: "pt", group: "typography",
+            label: "Application text size",
+            detail: "The base text size used by applications"
+        },
+        {
+            key: "documentFont", type: "string", def: "Adwaita Sans", group: "typography",
+            pattern: "^[A-Za-z0-9 ._+@'-]{1,96}$",
+            label: "Document font",
+            detail: "Used for document content when an application follows the system choice"
+        },
+        {
+            key: "documentFontSize", type: "int", def: 12, min: 6, max: 32, step: 1,
+            unit: "pt", group: "typography",
+            label: "Document text size",
+            detail: "The default text size for document content"
+        },
+        {
+            key: "monospaceFont", type: "string", def: "VictorMono Nerd Font", group: "typography",
+            pattern: "^[A-Za-z0-9 ._+@'-]{1,96}$",
+            label: "Monospace font",
+            detail: "Used by terminals, editors, and code fields that follow the system choice"
+        },
+        {
+            key: "monospaceFontSize", type: "int", def: 10, min: 6, max: 32, step: 1,
+            unit: "pt", group: "typography",
+            label: "Monospace text size",
+            detail: "The default text size for terminals and code"
+        },
+        {
+            key: "fontHinting", type: "enum", def: "slight", group: "typography",
+            label: "Font hinting",
+            detail: "How strongly text aligns to the pixel grid",
+            options: [
+                { value: "none", label: "None" },
+                { value: "slight", label: "Slight" },
+                { value: "medium", label: "Medium" },
+                { value: "full", label: "Full" }
+            ]
+        },
+        {
+            key: "fontAntialiasing", type: "enum", def: "rgba", group: "typography",
+            label: "Text smoothing",
+            detail: "How application text softens its edges",
+            options: [
+                { value: "none", label: "None" },
+                { value: "grayscale", label: "Grayscale" },
+                { value: "rgba", label: "Subpixel" }
+            ]
+        },
+
+        // ── Application titlebars ──────────────────────────────────────────
+        // These affect applications that honour GNOME's window preferences.
+        // Hyprland itself has no server-side titlebar buttons, so minimize is
+        // deliberately absent rather than presented as a switch that lies.
+        {
+            key: "titlebarButtonSide", type: "enum", def: "right", group: "titlebar",
+            label: "Button side",
+            detail: "Place application titlebar buttons on the left or right",
+            options: [
+                { value: "left", label: "Left" },
+                { value: "right", label: "Right" }
+            ]
+        },
+        {
+            key: "titlebarMaximizeButton", type: "bool", def: false, group: "titlebar",
+            label: "Maximize button",
+            detail: "Show a maximize button in application titlebars that support it"
+        },
+        {
+            key: "titlebarDoubleClick", type: "enum", def: "toggle-maximize", group: "titlebar",
+            label: "Double-click titlebar",
+            detail: "Choose what a double-click on an application titlebar does",
+            options: [
+                { value: "toggle-maximize", label: "Toggle maximize" },
+                { value: "none", label: "Do nothing" }
+            ]
+        },

        // ── Accessibility ───────────────────────────────────────────────────
        // Backed by gsettings so GTK applications agree with the shell, and
@@ -801,7 +1191,7 @@ Singleton {
        },

        // ── Display configuration ───────────────────────────────────────────
-        // { "<output>": { mode, scale, transform } }, applied by
+        // { "<output>": { mode, scale, transform, x, y, primary } }, applied by
        // hypr/monitors.lua on top of the shipped values. Colour management and
        // bit depth are deliberately not here: those carry a documented
        // screencopy tradeoff that a settings page cannot explain at the moment
@@ -810,7 +1200,7 @@ Singleton {
            key: "displays", type: "json", def: ({}), group: "display",
            internal: true,
            label: "Display configuration",
-            detail: "Resolution, scale, and rotation per connected display"
+            detail: "Resolution, scale, rotation, position, and primary display"
        },

        // ── Per-application notification rules ──────────────────────────────
@@ -4,3 +4,4 @@ singleton PreferenceSchema 1.0 PreferenceSchema.qml
 singleton HomePreferences 1.0 HomePreferences.qml
 singleton Settings 1.0 Settings.qml
 singleton Theme 1.0 Theme.qml
+singleton Migrations 1.0 Migrations.qml
@@ -0,0 +1,81 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.modules.settings
+import qs.services
+
+ShellRoot {
+    DisplayIdentify {}
+
+    QtObject {
+        id: fixtureService
+
+        property var monitors: [
+            {
+                name: "DP-2", description: "Primary display", width: 4500, height: 3000,
+                refreshRate: 60, mode: "[email protected]", scale: 1.5,
+                transform: 0, x: 0, y: 0, primary: true
+            },
+            {
+                name: "HDMI-A-1", description: "Second display", width: 2560, height: 1440,
+                refreshRate: 60, mode: "[email protected]", scale: 1,
+                transform: 0, x: 3000, y: 0, primary: false
+            }
+        ]
+        property var applied: []
+
+        function currentLayout(): var {
+            return monitors.map(record => Object.assign({}, record));
+        }
+
+        function applyLayout(layout: var): bool {
+            applied = layout.map(record => Object.assign({}, record));
+            return true;
+        }
+    }
+
+    DisplayArrangement {
+        id: arrangement
+        width: 800
+        displayService: fixtureService
+        selectedOutput: "HDMI-A-1"
+    }
+
+    IpcHandler {
+        target: "display-arrangement-test"
+
+        function status(width: int): string {
+            arrangement.width = width;
+            arrangement.resetDraft();
+            return JSON.stringify(arrangement.canvasSnapshot());
+        }
+
+        function dragFixture(): string {
+            arrangement.resetDraft();
+            arrangement.setDraftPosition("HDMI-A-1", 3016, 0, true);
+            arrangement.applyDraft();
+            return JSON.stringify(fixtureService.applied);
+        }
+
+        function keyboardFixture(): string {
+            arrangement.resetDraft();
+            arrangement.nudge("HDMI-A-1", -10, 0);
+            const afterArrow = arrangement.draftLayout.find(record => record.name === "HDMI-A-1").x;
+            arrangement.nudge("HDMI-A-1", -100, 0);
+            const afterShiftArrow = arrangement.draftLayout.find(record => record.name === "HDMI-A-1").x;
+            return JSON.stringify({ afterArrow, afterShiftArrow });
+        }
+
+        function primaryFixture(): string {
+            arrangement.resetDraft();
+            arrangement.makePrimary("HDMI-A-1");
+            return JSON.stringify(fixtureService.applied.map(record => ({
+                name: record.name, x: record.x, y: record.y, primary: record.primary
+            })));
+        }
+
+        function identify(): void { Displays.identify(); }
+        function identifying(): bool { return Displays.identifying; }
+    }
+}
@@ -0,0 +1,50 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import "services/DisplayLayout.js" as DisplayLayout
+
+ShellRoot {
+    readonly property var fixture: [
+        { name: "DP-2", width: 4500, height: 3000, scale: 1.5, transform: 0, x: 140, y: 80, primary: true },
+        { name: "HDMI-A-1", width: 2560, height: 1440, scale: 1, transform: 1, x: 3140, y: 80, primary: false }
+    ]
+
+    IpcHandler {
+        target: "display-layout-test"
+
+        function status(): string {
+            const normalized = DisplayLayout.normalize(fixture);
+            const canvas = DisplayLayout.canvasRects(normalized, 800, 500, 20);
+            const near = normalized.map(record => Object.assign({}, record));
+            near[1].x = 3016;
+            const far = normalized.map(record => Object.assign({}, record));
+            far[1].x = 3017;
+            return JSON.stringify({
+                valid: DisplayLayout.validate(fixture),
+                sizes: fixture.map(DisplayLayout.logicalSize),
+                normalized: normalized.map(record => ({ name: record.name, x: record.x, y: record.y, primary: record.primary })),
+                bounds: canvas.bounds,
+                canvasScale: canvas.scale,
+                canvasRects: canvas.rects,
+                near: DisplayLayout.snap(near, "HDMI-A-1", 16).find(record => record.name === "HDMI-A-1").x,
+                far: DisplayLayout.snap(far, "HDMI-A-1", 16).find(record => record.name === "HDMI-A-1").x
+            });
+        }
+
+        function invalid(): string {
+            const base = fixture.map(record => Object.assign({}, record));
+            const cases = [];
+            const add = layout => cases.push(DisplayLayout.validate(layout));
+            add([base[0], Object.assign({}, base[1], { name: "DP-2" })]);
+            add(base.map(record => Object.assign({}, record, { primary: false })));
+            add(base.map(record => Object.assign({}, record, { primary: true })));
+            add([Object.assign({}, base[0], { x: 0.5 }), base[1]]);
+            add([Object.assign({}, base[0], { scale: 0 }), base[1]]);
+            add([Object.assign({}, base[0], { transform: 4 }), base[1]]);
+            add([Object.assign({}, base[0], { width: Infinity }), base[1]]);
+            add([Object.assign({}, base[0], { width: 0 }), base[1]]);
+            return JSON.stringify(cases);
+        }
+    }
+}
@@ -20,6 +20,9 @@ ShellRoot {
                mode: monitor ? monitor.mode : "",
                scale: monitor ? monitor.scale : 0,
                transform: monitor ? monitor.transform : -1,
+                x: monitor ? monitor.x : 0,
+                y: monitor ? monitor.y : 0,
+                primary: monitor ? monitor.primary : false,
                modes: monitor ? monitor.modes.length : 0,
                awaiting: Displays.awaitingConfirmation,
                canConfirm: Displays.canConfirm,
@@ -36,6 +39,49 @@ ShellRoot {
            return Displays.apply(monitor.name, mode, scale, monitor.transform);
        }

+        function transactionStatus(): string {
+            return JSON.stringify({
+                layout: Displays.currentLayout(),
+                pending: Displays.pendingRequestedLayout,
+                previous: Displays.pendingPreviousLayout,
+                reverting: Displays.revertExpectedLayout,
+                awaiting: Displays.awaitingConfirmation,
+                canConfirm: Displays.canConfirm,
+                busy: Displays.busy,
+                generation: Displays.operationGeneration,
+                revertGeneration: Displays.revertGeneration,
+                lastError: Displays.lastError
+            });
+        }
+
+        function applyLayoutFixture(secondX: int, secondY: int): bool {
+            const layout = Displays.currentLayout();
+            if (layout.length !== 2) return false;
+            layout[0].x = 0;
+            layout[0].y = 0;
+            layout[0].primary = true;
+            layout[1].x = secondX;
+            layout[1].y = secondY;
+            layout[1].primary = false;
+            return Displays.applyLayout(layout);
+        }
+
+        function makePrimaryFixture(output: string): bool {
+            return Displays.makePrimary(output);
+        }
+
+        function injectReadback(text: string, generation: int): void {
+            Displays.parse(text, generation);
+        }
+
+        function expireApplyVerification(): void {
+            Displays.verificationTimedOut();
+        }
+
+        function expireRevertVerification(): void {
+            Displays.revertVerificationTimedOut();
+        }
+
        function refreshIdentityFixture(): string {
            const modes = Displays.normaliseModes([
                "[email protected]",
@@ -49,6 +95,30 @@ ShellRoot {
            });
        }

+        function positionFixture(): string {
+            const previous = Displays.monitors;
+            Displays.parse(JSON.stringify([
+                {
+                    name: "DP-2", description: "Primary", width: 4500, height: 3000,
+                    refreshRate: 60, scale: 1.5, transform: 0, x: 140, y: 80,
+                    availableModes: ["[email protected]"]
+                },
+                {
+                    name: "HDMI-A-1", description: "Second", width: 2560, height: 1440,
+                    refreshRate: 60, scale: 1, transform: 0, x: 3140, y: 80,
+                    availableModes: ["[email protected]"]
+                }
+            ]), Displays.operationGeneration);
+            const result = JSON.stringify(Displays.monitors.map(monitor => ({
+                name: monitor.name,
+                x: monitor.x,
+                y: monitor.y,
+                primary: monitor.primary
+            })));
+            Displays.monitors = previous;
+            return result;
+        }
+
        function applyBad(kind: string): bool {
            const monitor = Displays.monitors[0];
            if (!monitor) return false;
@@ -0,0 +1,23 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.services
+
+ShellRoot {
+    // The production singleton still performs its delayed startup scan. The
+    // harness turns it off before its 2200 ms deadline so each fixture drives
+    // only the state transition it is asserting.
+    Component.onCompleted: Health.startupScanEnabled = false
+
+    IpcHandler {
+        target: "health-test"
+
+        function accept(text: string, generation: int): bool { return Health.consumeSnapshot(text, generation); }
+        function queue(): void { Health.refresh(); Health.refresh(); }
+        function status(): string { return JSON.stringify(Health.diagnostics()); }
+        function repair(id: string): bool { return Health.repair(id, false); }
+        function report(): string { return JSON.stringify(Health.snapshot, null, 2); }
+        function copy(): bool { return Health.copyReport(); }
+    }
+}
@@ -0,0 +1,32 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.config
+import qs.services
+
+ShellRoot {
+    IpcHandler {
+        target: "lock-screen-test"
+
+        function status(): string {
+            return JSON.stringify({
+                generated: LockScreen.generated,
+                path: LockScreen.path,
+                fallback: LockScreen.fallback,
+                lastError: LockScreen.lastError,
+                busy: LockScreen.busy
+            });
+        }
+
+        function burst(): void {
+            DesktopPreferences.set("lockBlurLevel", 1);
+            DesktopPreferences.set("lockBlurLevel", 2);
+            DesktopPreferences.set("lockBlurLevel", 4);
+        }
+
+        function refresh(): void {
+            LockScreen.refresh();
+        }
+    }
+}
@@ -0,0 +1,83 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.modules.settings
+
+ShellRoot {
+    id: root
+
+    readonly property string fixtureWallpaper: `${Quickshell.env("HOME")}/Pictures/Wallpapers/faroe_islands.jpg`
+
+    LockScreenPreview {
+        id: screenshotPreview
+        width: 620
+        backgroundMode: "screenshot"
+        blurLevel: 4
+        showClock: true
+        showDate: true
+        showUser: true
+        fadeOnEmpty: false
+        wallpaperPath: root.fixtureWallpaper
+    }
+
+    LockScreenPreview {
+        id: wallpaperPreview
+        width: 620
+        backgroundMode: "wallpaper"
+        blurLevel: 2
+        showClock: false
+        showDate: true
+        showUser: false
+        fadeOnEmpty: true
+        wallpaperPath: root.fixtureWallpaper
+    }
+
+    LockScreenPreview {
+        id: solidPreview
+        width: 620
+        backgroundMode: "solid"
+        blurLevel: 0
+        showClock: true
+        showDate: false
+        showUser: true
+        fadeOnEmpty: false
+        wallpaperPath: root.fixtureWallpaper
+    }
+
+    IpcHandler {
+        target: "lock-screen-settings-test"
+
+        function status(): string {
+            return JSON.stringify({
+                screenshot: {
+                    mode: screenshotPreview.previewMode,
+                    wallpaperVisible: screenshotPreview.wallpaperVisible,
+                    blurStrength: screenshotPreview.blurStrength,
+                    clockVisible: screenshotPreview.clockVisible,
+                    dateVisible: screenshotPreview.dateVisible,
+                    userVisible: screenshotPreview.userVisible,
+                    passwordVisible: screenshotPreview.passwordVisible
+                },
+                wallpaper: {
+                    mode: wallpaperPreview.previewMode,
+                    wallpaperVisible: wallpaperPreview.wallpaperVisible,
+                    blurStrength: wallpaperPreview.blurStrength,
+                    clockVisible: wallpaperPreview.clockVisible,
+                    dateVisible: wallpaperPreview.dateVisible,
+                    userVisible: wallpaperPreview.userVisible,
+                    passwordVisible: wallpaperPreview.passwordVisible
+                },
+                solid: {
+                    mode: solidPreview.previewMode,
+                    wallpaperVisible: solidPreview.wallpaperVisible,
+                    blurStrength: solidPreview.blurStrength,
+                    clockVisible: solidPreview.clockVisible,
+                    dateVisible: solidPreview.dateVisible,
+                    userVisible: solidPreview.userVisible,
+                    passwordVisible: solidPreview.passwordVisible
+                }
+            });
+        }
+    }
+}
@@ -0,0 +1,56 @@
+// Exercises Migrations.applyWith against fixture steps and prints a verdict per
+// case. Run by tests/quickshell/migrations-contract.sh.
+//
+// Fixture steps rather than the real list: the real one is empty until the
+// first breaking schema change, and a mechanism that has never been run against
+// a failing step is not one to discover the behaviour of during an upgrade.
+
+import Quickshell
+import QtQuick
+import qs.config
+
+ShellRoot {
+    Component.onCompleted: {
+        const steps = [
+            { version: 2, describe: "add b", migrate: v => { v.b = (v.a ?? 0) + 1; return v; } },
+            { version: 3, describe: "add c", migrate: v => { v.c = "three"; return v; } },
+            { version: 4, describe: "explode", migrate: v => { throw new Error("boom"); } }
+        ];
+        const results = {};
+
+        // No version at all: a file written before versioning. Stamped, never
+        // migrated.
+        let r = Migrations.applyWith({ a: 1 }, steps, 3, 1);
+        results.unversioned = { v: r.values.schemaVersion, migrated: r.migrated,
+                                changed: r.changed, untouched: r.values.b === undefined };
+
+        // Older file: every step above its version runs, in order.
+        r = Migrations.applyWith({ a: 1, schemaVersion: 1 }, steps, 3, 1);
+        results.upgrade = { v: r.values.schemaVersion, b: r.values.b, c: r.values.c,
+                            count: r.applied.length, migrated: r.migrated };
+
+        // Already current: nothing runs.
+        r = Migrations.applyWith({ schemaVersion: 3, keep: "me" }, steps, 3, 1);
+        results.current = { v: r.values.schemaVersion, migrated: r.migrated,
+                            kept: r.values.keep === "me", b: r.values.b === undefined };
+
+        // From the future: left completely alone, including its unknown keys.
+        r = Migrations.applyWith({ schemaVersion: 9, futureKey: "x" }, steps, 3, 1);
+        results.future = { v: r.values.schemaVersion, migrated: r.migrated,
+                           changed: r.changed, kept: r.values.futureKey === "x" };
+
+        // A failing step stops at the last good version rather than losing the
+        // file or skipping past the failure forever.
+        r = Migrations.applyWith({ schemaVersion: 1, a: 5 }, steps, 4, 1);
+        results.failure = { v: r.values.schemaVersion, b: r.values.b, c: r.values.c,
+                            kept: r.values.a === 5, count: r.applied.length };
+
+        // Unknown keys survive a migration: rolling back to an older Panama
+        // must not discard a newer version's settings.
+        r = Migrations.applyWith({ schemaVersion: 1, unknownFromFuture: true }, steps, 3, 1);
+        results.preserved = { kept: r.values.unknownFromFuture === true };
+
+        console.info("PANAMA-MIGRATIONS " + JSON.stringify(results));
+        Qt.callLater(() => Qt.quit());
+    }
+}
@@ -13,6 +13,9 @@ Pill {
    horizontalPadding: 8
    onActivated: ShellState.toggle("activity")

+    // Right-click opens the settings that govern this widget. Camera, microphone and screen-sharing state is a privacy readout.
+    onSecondaryActivated: ShellState.openSettings("privacy")
+
    Text {
        anchors.verticalCenter: parent.verticalCenter
        text: {
@@ -108,6 +108,10 @@ PanelWindow {
                anchors.verticalCenter: parent.verticalCenter
            }

+            HealthIndicator {
+                anchors.verticalCenter: parent.verticalCenter
+            }
+
            ActivityIndicator {
                anchors.verticalCenter: parent.verticalCenter
            }
@@ -15,6 +15,9 @@ Pill {
    horizontalPadding: 8
    onActivated: ShellState.openDateMenu("agenda")

+    // Right-click opens the settings that govern this widget. The same place the clock leads, since this is the calendar's own reminder.
+    onSecondaryActivated: ShellState.openSettings("datetime")
+
    ToolTip.visible: root.hovered && root.visible
    ToolTip.delay: 500
    ToolTip.text: CalendarAgenda.nextEvent?.summary ?? "Upcoming event"
@@ -26,6 +26,11 @@ Pill {

    onActivated: ShellState.toggleDateMenu("agenda")

+    // Right-click opens the settings that govern this widget. Timezone and clock format live on Date & Time. The
+    // format toggles are mirrored on Appearance, but someone right-clicking a
+    // clock is far more often after the time itself than its typography.
+    onSecondaryActivated: ShellState.openSettings("datetime")
+
    Text {
        anchors.verticalCenter: parent.verticalCenter
        text: Qt.formatDateTime(clock.date, root.format)
@@ -0,0 +1,89 @@
+// A deliberately absent-until-needed health affordance. Healthy and merely
+// unconfigured systems leave no ornament or layout residue in the bar.
+
+import QtQuick
+import QtQuick.Controls
+import qs.config
+import qs.services
+
+Rectangle {
+    id: root
+
+    signal activated
+
+    readonly property int issueCount: Health.summary.warnings + Health.summary.errors
+    readonly property color tone: Health.status === "error"
+        ? Theme.danger
+        : (Health.status === "warning" ? Theme.warn : "transparent")
+    readonly property string statusText: root.issueCount === 1
+        ? "1 system health issue"
+        : root.issueCount + " system health issues"
+    readonly property string accessibleLabel: Health.status === "error"
+        ? "System Health: " + root.issueCount + (root.issueCount === 1 ? " issue requires action" : " issues require action")
+        : "System Health: " + root.issueCount + (root.issueCount === 1 ? " issue needs attention" : " issues need attention")
+    readonly property string tooltipText: root.accessibleLabel
+
+    visible: Health.actionable
+    implicitWidth: visible ? content.implicitWidth + 16 : 0
+    implicitHeight: visible ? 24 : 0
+    width: implicitWidth
+    height: implicitHeight
+    radius: 9
+    color: visible ? Theme.alpha(root.tone, 0.09) : "transparent"
+    border.width: activeFocus ? 2 : 1
+    border.color: visible ? Theme.alpha(root.tone, activeFocus ? 0.72 : 0.20) : "transparent"
+
+    activeFocusOnTab: visible
+    Accessible.role: Accessible.Button
+    Accessible.name: root.accessibleLabel
+    Accessible.description: "Open System Health"
+    Accessible.onPressAction: root.activated()
+
+    onActivated: {
+        ShellState.openSettings("services");
+        Health.refresh();
+    }
+
+    Keys.onReturnPressed: root.activated()
+    Keys.onEnterPressed: root.activated()
+    Keys.onSpacePressed: root.activated()
+
+    Row {
+        id: content
+
+        anchors.centerIn: parent
+        spacing: 6
+
+        Text {
+            anchors.verticalCenter: parent.verticalCenter
+            text: "\u{F0ECD}" // md-shield-alert-outline
+            color: root.tone
+            font.family: Theme.fontMono
+            font.pixelSize: 14
+        }
+
+        Text {
+            anchors.verticalCenter: parent.verticalCenter
+            text: String(root.issueCount)
+            color: root.tone
+            font.family: Theme.fontFamily
+            font.features: Theme.tabularFigures
+            font.pixelSize: Theme.fontSizeSmall
+            font.weight: Font.DemiBold
+        }
+    }
+
+    MouseArea {
+        id: pointer
+
+        anchors.fill: parent
+        enabled: root.visible
+        hoverEnabled: true
+        cursorShape: Qt.PointingHandCursor
+        onClicked: root.activated()
+    }
+
+    ToolTip.visible: pointer.containsMouse && root.visible
+    ToolTip.delay: 500
+    ToolTip.text: root.tooltipText
+}
@@ -7,6 +7,7 @@
 import QtQuick
 import Quickshell.Services.Mpris
 import qs.config
+import qs.services
 import qs.widgets

 Pill {
@@ -34,6 +35,9 @@ Pill {
    onActivated: if (root.player?.canTogglePlaying)
        root.player.togglePlaying()

+    // Right-click opens the settings that govern this widget. Output device and per-application volume.
+    onSecondaryActivated: ShellState.openSettings("sound")
+
    // Scroll up = previous, down = next — the same direction as the workspace
    // switcher, so the whole bar scrolls consistently.
    onScrolled: delta => {
@@ -24,6 +24,9 @@ Pill {

    onActivated: root.requestQuickSettings()

+    // Right-click opens the settings that govern this widget. Network and Bluetooth, which is most of what these glyphs report.
+    onSecondaryActivated: ShellState.openSettings("connectivity")
+
    // ── Audio ───────────────────────────────────────────────────────────────
    // Without a tracker, volume and muted silently read as zero/false.
    PwObjectTracker {
@@ -13,6 +13,10 @@ import qs.widgets
 Pill {
    id: root

+    // Right-click opens the settings that govern this widget. Which readouts
+    // appear in the bar, and how often they update.
+    onSecondaryActivated: ShellState.openSettings("appearance")
+
    interactive: false

    Row {
@@ -10,6 +10,9 @@ import qs.widgets
 Pill {
    id: root

+    // Right-click opens the settings that govern this widget. Location, units and refresh interval are all on Home.
+    onSecondaryActivated: ShellState.openSettings("home")
+
    interactive: false
    visible: Weather.available

@@ -37,20 +37,49 @@ SettingsPage {
        ToggleRow { setting: "animationsEnabled"; divider: false }
    }

+    // Zoom, done by the compositor rather than handed to GNOME. Hyprland has a
+    // real magnifier (cursor:zoom_factor) that follows the pointer, so there is
+    // no reason to send someone to another application for it.
    SettingsCard {
-        title: "Contrast"
-        subtitle: "Unfocused windows can be faded to make the focused one obvious, or left at full strength if that is harder to read."
+        title: "Magnifier"
+        subtitle: "Magnifies the screen around the pointer. Set the magnification to 1× to turn it off."

-        SliderRow { setting: "inactiveOpacity"; divider: false }
+        SliderRow { setting: "magnifierFactor"; zeroLabel: "Off" }
+        ToggleRow { setting: "magnifierRigid"; divider: false }
    }

    SettingsCard {
-        title: "System accessibility"
-        subtitle: "Screen reader, zoom, and on-screen keyboard are provided by GNOME's accessibility stack."
+        title: "Contrast"
+        subtitle: "Unfocused windows can be faded or darkened to make the focused one obvious, or left alone if that is harder to read."
+
+        SliderRow { setting: "inactiveOpacity" }
+        ToggleRow { setting: "dimInactive" }
+        SliderRow { setting: "dimStrength"; divider: false }
+    }
+
+    // What this session genuinely cannot do, said plainly.
+    //
+    // Sticky keys, slow keys, bounce keys and mouse keys are AccessX, which is
+    // an X11 SERVER feature. XKB under Wayland has no accessx option group at
+    // all, and Hyprland does not implement one. The compositor will accept
+    // "accessx:enable" as a keyboard option and store it, and nothing will ever
+    // act on it -- so there is no switch here, and pointing at GNOME's panel
+    // would be no better, since the daemon that applies those keys is not
+    // running either.
+    SettingsCard {
+        title: "Keyboard accessibility"
+        subtitle: "Sticky, slow and bounce keys are an X11 feature with no Wayland equivalent, so they are unavailable in this session. Offering them here would store a preference that nothing acts on."
+
+        ActionRow {
+            label: "Screen reader"
+            detail: "Orca reads the screen aloud and works over the accessibility bus, which does run here"
+            action: "Start Orca"
+            onTriggered: SystemSettings.openApplication("orca")
+        }

        ActionRow {
            label: "GNOME accessibility settings"
-            detail: "Opens in GNOME Settings"
+            detail: "For the parts GNOME's own stack still owns"
            action: "Open"
            divider: false
            onTriggered: SystemSettings.openGnomePanel("universal-access")
@@ -17,8 +17,10 @@ import qs.services
 SettingsPage {
    id: root

+    property string expandedPicker: ""
+
    title: "Appearance"
-    lede: "Drag anything below. The preview above is your real geometry, to scale."
+    lede: "Tune the Prism shell and the applications that live inside it. The preview above is your real geometry, to scale."

    header: Component {
        Column {
@@ -48,9 +50,16 @@ SettingsPage {
            ? Wallpaper.lastError
            : "Applied to every display. Looked for in ~/Pictures/Wallpapers, ~/Pictures/Backgrounds, ~/.local/share/backgrounds, and /usr/share/backgrounds."

+        WallpaperControls {
+            id: wallpaperControls
+            width: parent.width
+        }
+
        WallpaperPicker {
            id: wallpapers
            width: parent.width
+            mode: wallpaperControls.mode
+            selectedOutput: wallpaperControls.selectedOutput
        }

        ActionRow {
@@ -73,6 +82,24 @@ SettingsPage {
        }
    }

+    SettingsCard {
+        title: "Lock screen"
+        subtitle: LockScreen.lastError !== ""
+            ? LockScreen.lastError
+            : "A representative preview of the screen shown before authentication."
+
+        LockScreenPreview {
+            width: parent.width
+        }
+
+        ChoiceRow { setting: "lockBackgroundMode" }
+        SliderRow { setting: "lockBlurLevel"; zeroLabel: "Off" }
+        ToggleRow { setting: "lockShowClock" }
+        ToggleRow { setting: "lockShowDate" }
+        ToggleRow { setting: "lockShowUser" }
+        ToggleRow { setting: "lockFadeOnEmpty"; divider: false }
+    }
+
    SettingsCard {
        title: "Colour scheme"
        subtitle: ColorScheme.lastError !== ""
@@ -83,7 +110,7 @@ SettingsPage {
    }

    SettingsCard {
-        title: "Typography"
+        title: "Shell typography"
        subtitle: Fonts.lastError !== ""
            ? Fonts.lastError
            : "Every piece of text in the shell. Samples are drawn in the font they name."
@@ -123,6 +150,137 @@ SettingsPage {
        }
    }

+    SettingsCard {
+        title: "Application typography"
+        subtitle: DesktopStyle.lastError !== ""
+            ? DesktopStyle.lastError
+            : "Fonts used by applications that follow the desktop defaults. Open one family at a time to keep the page calm."
+
+        ActionRow {
+            label: "Application font"
+            detail: DesktopStyle.applicationFont
+            action: root.expandedPicker === "application-font" ? "Close" : "Choose"
+            onTriggered: root.expandedPicker = root.expandedPicker === "application-font" ? "" : "application-font"
+        }
+
+        FontPicker {
+            visible: root.expandedPicker === "application-font"
+            width: parent.width
+            families: Fonts.interfaceFonts
+            current: DesktopStyle.applicationFont
+            emptyText: Fonts.scanning ? "Reading installed fonts…" : "No application fonts found"
+            onPicked: family => {
+                if (DesktopStyle.setApplicationFont(family))
+                    root.expandedPicker = "";
+            }
+        }
+
+        SliderRow { setting: "applicationFontSize" }
+
+        ActionRow {
+            label: "Document font"
+            detail: DesktopStyle.documentFont
+            action: root.expandedPicker === "document-font" ? "Close" : "Choose"
+            onTriggered: root.expandedPicker = root.expandedPicker === "document-font" ? "" : "document-font"
+        }
+
+        FontPicker {
+            visible: root.expandedPicker === "document-font"
+            width: parent.width
+            families: Fonts.interfaceFonts
+            current: DesktopStyle.documentFont
+            emptyText: Fonts.scanning ? "Reading installed fonts…" : "No document fonts found"
+            onPicked: family => {
+                if (DesktopStyle.setDocumentFont(family))
+                    root.expandedPicker = "";
+            }
+        }
+
+        SliderRow { setting: "documentFontSize" }
+
+        ActionRow {
+            label: "Monospace font"
+            detail: DesktopStyle.monospaceFont
+            action: root.expandedPicker === "monospace-font" ? "Close" : "Choose"
+            onTriggered: root.expandedPicker = root.expandedPicker === "monospace-font" ? "" : "monospace-font"
+        }
+
+        FontPicker {
+            visible: root.expandedPicker === "monospace-font"
+            width: parent.width
+            families: Fonts.monospaceFonts
+            current: DesktopStyle.monospaceFont
+            emptyText: Fonts.scanning ? "Reading installed fonts…" : "No monospace fonts found"
+            onPicked: family => {
+                if (DesktopStyle.setMonospaceFont(family))
+                    root.expandedPicker = "";
+            }
+        }
+
+        SliderRow { setting: "monospaceFontSize" }
+        ChoiceRow { setting: "fontHinting" }
+        ChoiceRow { setting: "fontAntialiasing"; divider: false }
+    }
+
+    SettingsCard {
+        title: "Icons & pointer"
+        subtitle: DesktopStyle.lastError !== ""
+            ? DesktopStyle.lastError
+            : "Installed themes only. The pointer updates in applications and Hyprland together."
+
+        ActionRow {
+            label: "Application icons"
+            detail: DesktopStyle.iconTheme
+            action: root.expandedPicker === "icon-theme" ? "Close" : "Choose"
+            enabled: DesktopStyle.catalogLoaded
+            onTriggered: root.expandedPicker = root.expandedPicker === "icon-theme" ? "" : "icon-theme"
+        }
+
+        SearchPicker {
+            visible: root.expandedPicker === "icon-theme"
+            width: parent.width
+            items: DesktopStyle.iconThemes
+            current: DesktopStyle.iconTheme
+            placeholder: "Search icon themes"
+            emptyText: DesktopStyle.scanning ? "Reading installed icon themes…" : "No icon themes found"
+            onPicked: value => {
+                if (DesktopStyle.setIconTheme(value))
+                    root.expandedPicker = "";
+            }
+        }
+
+        ActionRow {
+            label: "Pointer theme"
+            detail: DesktopStyle.cursorTheme
+            action: root.expandedPicker === "cursor-theme" ? "Close" : "Choose"
+            enabled: DesktopStyle.catalogLoaded
+            divider: false
+            onTriggered: root.expandedPicker = root.expandedPicker === "cursor-theme" ? "" : "cursor-theme"
+        }
+
+        SearchPicker {
+            visible: root.expandedPicker === "cursor-theme"
+            width: parent.width
+            items: DesktopStyle.cursorThemes
+            current: DesktopStyle.cursorTheme
+            placeholder: "Search pointer themes"
+            emptyText: DesktopStyle.scanning ? "Reading installed pointer themes…" : "No pointer themes found"
+            onPicked: value => {
+                if (DesktopStyle.setCursorTheme(value))
+                    root.expandedPicker = "";
+            }
+        }
+    }
+
+    SettingsCard {
+        title: "Titlebars"
+        subtitle: "For applications that draw GNOME-compatible titlebars. Hyprland itself does not add titlebar buttons to tiled windows."
+
+        ChoiceRow { setting: "titlebarButtonSide" }
+        ToggleRow { setting: "titlebarMaximizeButton" }
+        ChoiceRow { setting: "titlebarDoubleClick"; divider: false }
+    }
+
    SettingsCard {
        title: "Windows"
        subtitle: "Spacing and shape of tiled windows. Each change is applied to the compositor and confirmed before it is saved."
@@ -131,7 +289,10 @@ SettingsPage {
        SliderRow { setting: "gapsIn" }
        SliderRow { setting: "gapsOut" }
        SliderRow { setting: "borderSize"; zeroLabel: "None" }
-        SliderRow { setting: "inactiveOpacity"; divider: false }
+        SliderRow { setting: "roundingPower" }
+        SliderRow { setting: "inactiveOpacity" }
+        SliderRow { setting: "activeOpacity" }
+        SliderRow { setting: "fullscreenOpacity"; divider: false }
    }

    SettingsCard {
@@ -143,6 +304,8 @@ SettingsPage {
        SliderRow { setting: "blurPasses" }
        ToggleRow { setting: "shadowEnabled" }
        SliderRow { setting: "shadowRange"; zeroLabel: "None" }
+        SliderRow { setting: "shadowRenderPower" }
+        ToggleRow { setting: "shadowSharp" }
        ToggleRow { setting: "glowEnabled" }
        SliderRow { setting: "glowRange"; zeroLabel: "None" }
        ToggleRow { setting: "animationsEnabled"; divider: false }
@@ -162,7 +325,10 @@ SettingsPage {

        ToggleRow { setting: "showCpu" }
        ToggleRow { setting: "showMemory" }
-        ToggleRow { setting: "showGpu"; divider: GraphicsDevices.devices.length > 1 || GraphicsDevices.selectionMissing }
+        ToggleRow { setting: "showGpu"; divider: true }
+        // Refresh interval was on the Home page, which split one concept across
+        // two pages -- what the vitals show here, how often they update there.
+        SliderRow { setting: "vitalsIntervalMs"; divider: GraphicsDevices.devices.length > 1 || GraphicsDevices.selectionMissing }

        // Only worth asking when there is a choice to make.
        ChoiceGrid {
@@ -182,11 +348,4 @@ SettingsPage {
        }
    }

-    SettingsCard {
-        title: "Theme"
-        subtitle: "This desktop has one curated visual identity rather than a matrix of partially compatible themes. The controls above adjust its parameters — how much space, how soft, how much motion — without replacing it."
-
-        TextRow { label: "Color palette"; detail: "Tokyo Night Moon"; value: "Prism" }
-        TextRow { label: "Interface type"; detail: "Adwaita Sans"; value: "System"; divider: false }
-    }
 }
@@ -0,0 +1,48 @@
+import Quickshell.Services.Pipewire
+import QtQuick
+
+import qs.config
+import qs.services
+
+Column {
+    id: root
+
+    property var applications: AudioDevices.applications
+    property bool pipewireReady: Pipewire.ready
+
+    readonly property int rowCount: applicationRepeater.count
+    readonly property string statusText: {
+        if (!root.pipewireReady)
+            return "PipeWire is unavailable";
+        if (root.applications.length === 0)
+            return "Applications playing sound will appear here";
+        return "";
+    }
+
+    width: parent ? parent.width : 620
+    spacing: 8
+
+    Repeater {
+        id: applicationRepeater
+        model: root.applications
+
+        ApplicationVolumeRow {
+            required property var modelData
+
+            width: root.width
+            application: modelData
+        }
+    }
+
+    Text {
+        width: parent.width
+        visible: root.statusText !== ""
+        text: root.statusText
+        color: Theme.fgDim
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSize
+        horizontalAlignment: Text.AlignHCenter
+        topPadding: 18
+        bottomPadding: 18
+    }
+}
@@ -0,0 +1,106 @@
+import Quickshell.Services.Pipewire
+import QtQuick
+
+import qs.config
+import qs.modules.quicksettings
+import qs.services
+import qs.widgets
+
+Rectangle {
+    id: root
+
+    required property var application
+
+    readonly property real volume: AudioDevices.applicationVolume(root.application)
+    readonly property bool muted: AudioDevices.applicationMuted(root.application)
+
+    width: parent ? parent.width : 620
+    implicitHeight: 78
+    radius: Theme.cardRadius
+    color: Theme.alpha(Theme.fg, 0.025)
+    border.width: 1
+    border.color: Theme.alpha(Theme.fg, 0.07)
+
+    PwObjectTracker {
+        objects: root.application?.nodes ?? []
+    }
+
+    ThemedIcon {
+        id: applicationIcon
+        anchors.left: parent.left
+        anchors.leftMargin: 12
+        anchors.top: parent.top
+        anchors.topMargin: 11
+        size: 20
+        icon: root.application?.icon ?? "audio-x-generic-symbolic"
+        iconFallback: "audio-x-generic-symbolic"
+        tint: Theme.fg
+    }
+
+    Column {
+        anchors.left: applicationIcon.right
+        anchors.leftMargin: 10
+        anchors.right: parent.right
+        anchors.rightMargin: 12
+        anchors.verticalCenter: applicationIcon.verticalCenter
+        spacing: 1
+
+        Text {
+            width: parent.width
+            text: root.application?.label ?? "Unknown application"
+            color: Theme.fg
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSize
+            font.weight: Font.Medium
+            elide: Text.ElideRight
+        }
+
+        Text {
+            width: parent.width
+            visible: (root.application?.nodes?.length ?? 0) > 1
+            text: `${root.application?.nodes?.length ?? 0} audio streams`
+            color: Theme.fgDim
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+        }
+    }
+
+    IconButton {
+        id: muteButton
+        anchors.left: parent.left
+        anchors.leftMargin: 8
+        anchors.bottom: parent.bottom
+        anchors.bottomMargin: 6
+        size: 30
+        iconSize: 17
+        icon: root.muted || root.volume <= 0.001
+            ? "audio-volume-muted-symbolic"
+            : "audio-volume-high-symbolic"
+        iconFallback: "audio-volume-high-symbolic"
+        onClicked: AudioDevices.setApplicationMuted(root.application, !root.muted)
+    }
+
+    ValueSlider {
+        anchors.left: muteButton.right
+        anchors.leftMargin: 7
+        anchors.right: volumeText.left
+        anchors.rightMargin: 10
+        anchors.verticalCenter: muteButton.verticalCenter
+        value: root.muted ? 0 : root.volume
+        onMoved: value => AudioDevices.setApplicationVolume(root.application, value)
+    }
+
+    Text {
+        id: volumeText
+        anchors.right: parent.right
+        anchors.rightMargin: 12
+        anchors.verticalCenter: muteButton.verticalCenter
+        width: 38
+        text: Math.round(root.volume * 100) + "%"
+        color: Theme.fgDim
+        font.family: Theme.fontMono
+        font.features: Theme.tabularFigures
+        font.pixelSize: Theme.fontSizeSmall
+        horizontalAlignment: Text.AlignRight
+    }
+}
@@ -12,6 +12,7 @@ SettingsPage {
    lede: "Choose what opens your files and links, and what starts with your session."

    property string expandedRole: ""
+    property bool addingAutostart: false
    readonly property var applications: DesktopEntries.applications.values
    readonly property var roles: [
        { key: "browser", label: "Browser", detail: "Web links and HTML pages", categorySets: [["webbrowser"]], terms: ["web browser", "browser"] },
@@ -178,7 +179,28 @@ SettingsPage {

    SettingsCard {
        title: "User autostart"
-        subtitle: "These desktop entries live in your user configuration. Select a row to toggle it."
+        subtitle: "Choose what starts with your session. Entries live in your user configuration, not the compositor."
+
+        ActionRow {
+            label: "Add an application"
+            detail: root.addingAutostart
+                ? "Search the applications installed on this machine"
+                : "Start another installed application when you sign in"
+            action: root.addingAutostart ? "Close" : "Choose"
+            divider: !root.addingAutostart || DefaultApps.autostartEntries.length > 0
+            enabled: !DefaultApps.busy
+            onTriggered: root.addingAutostart = !root.addingAutostart
+        }
+
+        AutostartAppPicker {
+            visible: root.addingAutostart
+            width: parent.width
+            existing: DefaultApps.autostartEntries.map(entry => entry.id)
+            onPicked: id => {
+                DefaultApps.addAutostart(id);
+                root.addingAutostart = false;
+            }
+        }

        TextRow {
            visible: !DefaultApps.busy && DefaultApps.autostartEntries.length === 0
@@ -32,7 +32,7 @@ SettingRow {

    readonly property int leftIndex: root.channelIndex(PwAudioChannel.FrontLeft)
    readonly property int rightIndex: root.channelIndex(PwAudioChannel.FrontRight)
-    readonly property bool available: root.node?.audio
+    readonly property bool available: !!root.node?.audio
        && root.leftIndex >= 0 && root.rightIndex >= 0
        && root.node.audio.volumes.length > Math.max(root.leftIndex, root.rightIndex)

@@ -0,0 +1,77 @@
+// Adds an installed application to the user's freedesktop autostart directory.
+
+import QtQuick
+import Quickshell
+import qs.config
+import qs.modules.clipboard
+
+Column {
+    id: root
+
+    required property var existing
+    signal picked(string id)
+
+    spacing: 0
+
+    function desktopId(entry: var): string {
+        const id = String(entry?.id ?? "");
+        return id.endsWith(".desktop") ? id : id + ".desktop";
+    }
+
+    readonly property var matches: {
+        const needle = search.text.trim().toLowerCase();
+        if (needle === "")
+            return [];
+        const out = [];
+        for (const entry of DesktopEntries.applications.values) {
+            const desktopId = root.desktopId(entry);
+            if (entry.noDisplay || root.existing.indexOf(desktopId) >= 0)
+                continue;
+            const haystack = `${entry.name ?? ""} ${entry.genericName ?? ""} ${desktopId}`.toLowerCase();
+            if (haystack.indexOf(needle) >= 0)
+                out.push(entry);
+            if (out.length >= 8)
+                break;
+        }
+        return out;
+    }
+
+    SearchField {
+        id: search
+        width: parent.width
+        placeholder: "Search installed applications"
+    }
+
+    Repeater {
+        model: root.matches
+
+        SettingRow {
+            id: candidate
+
+            required property var modelData
+            required property int index
+
+            label: String(candidate.modelData.name || root.desktopId(candidate.modelData))
+            detail: String(candidate.modelData.genericName || root.desktopId(candidate.modelData))
+            divider: candidate.index < root.matches.length - 1
+            controlWidth: 86
+
+            SettingsButton {
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Add"
+                onClicked: {
+                    root.picked(root.desktopId(candidate.modelData));
+                    search.text = "";
+                }
+            }
+        }
+    }
+
+    SettingRow {
+        visible: search.text.trim() !== "" && root.matches.length === 0
+        label: "No matching applications"
+        detail: "Only installed desktop applications can start with the session"
+        divider: false
+    }
+}
@@ -19,13 +19,18 @@ import qs.services
 SettingsPage {
    id: root

+
    title: "Network & Devices"
    lede: Connectivity.activeNetwork
        ? "Connected to " + Connectivity.activeNetwork.name
        : "Wi-Fi, Bluetooth, and the things Fedora owns."

    // Drive the scanners only while this page is the one being shown.
-    Component.onCompleted: Connectivity.active = true
+    Component.onCompleted: {
+        Connectivity.active = true;
+        if (!WifiShare.scanned)
+            WifiShare.refresh();
+    }
    Component.onDestruction: Connectivity.active = false

    SettingsCard {
@@ -68,6 +73,69 @@ SettingsPage {
        }
    }

+    // Sharing a network by QR, the way GNOME's Wi-Fi panel does. The
+    // alternative is reading a passphrase out loud.
+    //
+    // The image holds the password in machine-readable form, so it is generated
+    // on demand rather than up front, and the helper writes it to tmpfs under
+    // XDG_RUNTIME_DIR instead of anywhere persistent.
+    SettingsCard {
+        visible: Connectivity.wifiDevice !== null && WifiShare.shareable.length > 0
+        title: "Share a network"
+        subtitle: WifiShare.sharing !== ""
+            ? "Point a phone's camera at the code to join " + WifiShare.sharing + "."
+            : "Shows a QR code a phone can scan to join, without reading the password out."
+
+        Repeater {
+            model: WifiShare.shareable
+
+            ActionRow {
+                id: shareRow
+                required property var modelData
+                required property int index
+
+                label: shareRow.modelData.ssid
+                detail: WifiShare.sharing === shareRow.modelData.name
+                    ? "Showing a code below — anyone who can see the screen can join"
+                    : "Saved network"
+                action: WifiShare.sharing === shareRow.modelData.name ? "Hide" : "Show code"
+                divider: shareRow.index < WifiShare.shareable.length - 1 || WifiShare.sharing !== ""
+                onTriggered: WifiShare.sharing === shareRow.modelData.name
+                    ? WifiShare.stopSharing()
+                    : WifiShare.share(shareRow.modelData.name)
+            }
+        }
+
+        // Drawn at its natural size on a white plate: a QR code inverted or
+        // tinted to match a dark theme is unreliable to scan, and this one has
+        // exactly one job.
+        Item {
+            width: parent.width
+            visible: WifiShare.sharing !== "" && WifiShare.imagePath !== ""
+            implicitHeight: visible ? plate.height + 20 : 0
+
+            Rectangle {
+                id: plate
+                anchors.horizontalCenter: parent.horizontalCenter
+                y: 10
+                width: 208
+                height: 208
+                radius: 10
+                color: "white"
+
+                Image {
+                    anchors.centerIn: parent
+                    width: 184
+                    height: 184
+                    smooth: false
+                    fillMode: Image.PreserveAspectFit
+                    cache: false
+                    source: WifiShare.imagePath !== "" ? "file://" + WifiShare.imagePath : ""
+                }
+            }
+        }
+    }
+
    SettingsCard {
        title: "Bluetooth"
        visible: Connectivity.adapter !== null
@@ -67,6 +67,45 @@ SettingsPage {
    }

    // GNOME's Multitasking panel, in Hyprland's terms.
+    // Only meaningful when the layout above is Master and stack. Hidden
+    // otherwise, because a card of settings that do nothing under the layout
+    // you are actually running is worse than not offering the layout at all.
+    SettingsCard {
+        visible: DesktopPreferences.get("windowLayout") === "master"
+        title: "Master and stack"
+        subtitle: "How the master area behaves. These apply only while the tiling layout above is Master and stack."
+
+        SliderRow { setting: "masterFactor" }
+        ChoiceRow { setting: "masterOrientation" }
+        ChoiceRow { setting: "masterNewStatus" }
+        ToggleRow { setting: "masterNewOnTop"; divider: false }
+    }
+
+    SettingsCard {
+        title: "Window edges"
+        subtitle: "How the pointer grabs a window's border, and how floating windows behave near each other and the screen edge."
+
+        ToggleRow { setting: "resizeOnBorder" }
+        SliderRow { setting: "borderGrabArea"; zeroLabel: "Border only" }
+        ToggleRow { setting: "hoverIconOnBorder" }
+        SliderRow { setting: "snapWindowGap"; zeroLabel: "Touching" }
+        SliderRow { setting: "snapMonitorGap"; zeroLabel: "Touching" }
+        ToggleRow { setting: "snapRespectGaps"; divider: false }
+    }
+
+    // Hyprland's own interruptions. Panama turns all four off, which is a
+    // defensible default and was not previously a decision anyone could
+    // reverse without editing looks.lua.
+    SettingsCard {
+        title: "Hyprland notices"
+        subtitle: "Panama hides all of these by default. They are the compositor's own, not Panama's."
+
+        ToggleRow { setting: "hyprlandLogo" }
+        ToggleRow { setting: "hyprlandSplash" }
+        ToggleRow { setting: "hyprlandUpdateNews" }
+        ToggleRow { setting: "hyprlandDonationNag"; divider: false }
+    }
+
    SettingsCard {
        title: "Workspaces & focus"
        subtitle: "Hyprland's workspaces are created and destroyed as you use them, so there is no fixed count to set."
@@ -74,8 +113,7 @@ SettingsPage {
        ToggleRow { setting: "workspaceBackAndForth" }
        ToggleRow { setting: "allowWorkspaceCycles" }
        ToggleRow { setting: "focusOnActivate" }
-        ToggleRow { setting: "mouseMoveFocusesMonitor" }
-        ChoiceRow { setting: "followMouse"; divider: false }
+        ToggleRow { setting: "mouseMoveFocusesMonitor"; divider: false }
    }

    SettingsCard {
@@ -0,0 +1,318 @@
+import QtQuick
+import qs.config
+import qs.widgets
+import "../../services/DisplayLayout.js" as DisplayLayout
+
+Item {
+    id: root
+
+    required property var displayService
+    property string selectedOutput: ""
+    property var draftLayout: []
+    property bool interactionEnabled: true
+
+    signal selectionRequested(string output)
+
+    implicitHeight: content.implicitHeight
+    readonly property var canvasData: DisplayLayout.canvasRects(
+        root.draftLayout, canvas.width, canvas.height, 18)
+
+    function copied(layout): var {
+        return (layout || []).map(record => Object.assign({}, record));
+    }
+
+    function resetDraft(): void {
+        root.draftLayout = root.copied(root.displayService.currentLayout());
+    }
+
+    function setDraftPosition(output: string, x: real, y: real, snapToEdges: bool): bool {
+        const next = root.copied(root.draftLayout);
+        const record = next.find(candidate => candidate.name === output);
+        if (!record)
+            return false;
+        record.x = Math.round(x);
+        record.y = Math.round(y);
+        root.draftLayout = snapToEdges ? DisplayLayout.snap(next, output, 16) : next;
+        return true;
+    }
+
+    function nudge(output: string, dx: int, dy: int): bool {
+        const record = root.draftLayout.find(candidate => candidate.name === output);
+        return !!record && root.setDraftPosition(output, record.x + dx, record.y + dy, false);
+    }
+
+    function applyDraft(): bool {
+        return root.displayService.applyLayout(root.copied(root.draftLayout));
+    }
+
+    function makePrimary(output: string): bool {
+        const next = root.copied(root.draftLayout);
+        if (!next.some(record => record.name === output))
+            return false;
+        for (const record of next)
+            record.primary = record.name === output;
+        root.draftLayout = DisplayLayout.normalize(next);
+        return root.applyDraft();
+    }
+
+    function canvasSnapshot(): var {
+        return {
+            bounds: root.canvasData.bounds,
+            scale: root.canvasData.scale,
+            rects: root.canvasData.rects.map(record => Object.assign({}, record))
+        };
+    }
+
+    Component.onCompleted: root.resetDraft()
+
+    Connections {
+        target: root.displayService
+        ignoreUnknownSignals: true
+        function onMonitorsChanged(): void {
+            if (!root.displayService.awaitingConfirmation)
+                root.resetDraft();
+        }
+    }
+
+    Column {
+        id: content
+        width: parent.width
+        spacing: 11
+
+        Rectangle {
+            id: canvas
+            width: parent.width
+            height: root.width >= 620 ? 232 : 190
+            radius: Theme.cardRadius
+            color: Theme.alpha(Theme.bgDark, 0.76)
+            border.width: 1
+            border.color: Theme.alpha(Theme.fg, 0.07)
+            clip: true
+
+            // A restrained coordinate field makes the topology feel like a
+            // precision instrument without turning it into a technical graph.
+            Repeater {
+                model: 4
+                Rectangle {
+                    required property int index
+                    y: (index + 1) * canvas.height / 5
+                    width: canvas.width
+                    height: 1
+                    color: Theme.alpha(Theme.fg, 0.025)
+                }
+            }
+
+            Repeater {
+                model: root.canvasData.rects
+
+                Rectangle {
+                    id: tile
+
+                    required property var modelData
+                    readonly property bool selected: root.selectedOutput === modelData.name
+                    readonly property var draft: root.draftLayout.find(
+                        record => record.name === modelData.name)
+
+                    x: modelData.x
+                    y: modelData.y
+                    width: Math.max(64, modelData.width)
+                    height: Math.max(48, modelData.height)
+                    radius: 11
+                    color: tile.selected
+                        ? Theme.alpha(Theme.bgHighlight, 0.92)
+                        : Theme.alpha(Theme.bgPanel, hover.hovered ? 0.94 : 0.78)
+                    border.width: tile.selected || activeFocus ? 2 : 1
+                    border.color: activeFocus
+                        ? Theme.accentSecondary
+                        : (tile.selected ? Theme.accent : Theme.alpha(Theme.fg, 0.14))
+                    opacity: root.interactionEnabled ? 1 : 0.5
+                    activeFocusOnTab: root.interactionEnabled
+
+                    Accessible.role: Accessible.Button
+                    Accessible.name: "Move " + tile.modelData.name
+                    Accessible.description: tile.draft && tile.draft.primary
+                        ? "Primary display. Drag or use the arrow keys to move it."
+                        : "Drag or use the arrow keys to move this display."
+
+                    Rectangle {
+                        anchors.fill: parent
+                        anchors.margins: 2
+                        radius: parent.radius - 2
+                        visible: tile.selected
+                        opacity: 0.24
+                        gradient: Gradient {
+                            orientation: Gradient.Horizontal
+                            GradientStop { position: 0; color: Theme.accent }
+                            GradientStop { position: 1; color: Theme.accentSecondary }
+                        }
+                    }
+
+                    Column {
+                        anchors.left: parent.left
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        anchors.margins: 11
+                        spacing: 2
+
+                        Text {
+                            width: parent.width
+                            text: tile.modelData.name
+                            color: Theme.fg
+                            font.family: Theme.fontFamily
+                            font.pixelSize: Theme.fontSize
+                            font.weight: Font.DemiBold
+                            elide: Text.ElideRight
+                        }
+                        Text {
+                            width: parent.width
+                            text: tile.draft
+                                ? `${Math.round(tile.draft.width / tile.draft.scale)} × ${Math.round(tile.draft.height / tile.draft.scale)}`
+                                : ""
+                            color: Theme.fgDim
+                            font.family: Theme.fontFamily
+                            font.features: Theme.tabularFigures
+                            font.pixelSize: Theme.fontSizeSmall
+                            elide: Text.ElideRight
+                        }
+                    }
+
+                    Rectangle {
+                        anchors.top: parent.top
+                        anchors.right: parent.right
+                        anchors.margins: 7
+                        width: primaryText.implicitWidth + 12
+                        height: 20
+                        radius: Theme.pillRadius
+                        visible: tile.draft && tile.draft.primary
+                        color: Theme.alpha(Theme.accent, 0.2)
+
+                        Text {
+                            id: primaryText
+                            anchors.centerIn: parent
+                            text: "Primary"
+                            color: Theme.accentAlt
+                            font.family: Theme.fontFamily
+                            font.pixelSize: Math.max(9, Theme.fontSizeSmall - 1)
+                            font.weight: Font.DemiBold
+                        }
+                    }
+
+                    HoverHandler {
+                        id: hover
+                        enabled: root.interactionEnabled
+                        cursorShape: Qt.OpenHandCursor
+                    }
+
+                    TapHandler {
+                        enabled: root.interactionEnabled
+                        onTapped: {
+                            root.selectionRequested(tile.modelData.name);
+                            tile.forceActiveFocus();
+                        }
+                    }
+
+                    DragHandler {
+                        id: drag
+                        target: null
+                        enabled: root.interactionEnabled
+                        property real initialX: 0
+                        property real initialY: 0
+                        property bool moved: false
+
+                        onActiveChanged: {
+                            if (active) {
+                                const record = root.draftLayout.find(
+                                    candidate => candidate.name === tile.modelData.name);
+                                initialX = record ? record.x : 0;
+                                initialY = record ? record.y : 0;
+                                moved = false;
+                                root.selectionRequested(tile.modelData.name);
+                                tile.forceActiveFocus();
+                            } else if (moved) {
+                                const record = root.draftLayout.find(
+                                    candidate => candidate.name === tile.modelData.name);
+                                if (record) {
+                                    root.setDraftPosition(tile.modelData.name, record.x, record.y, true);
+                                    root.applyDraft();
+                                }
+                            }
+                        }
+                        onTranslationChanged: {
+                            if (!active || root.canvasData.scale <= 0)
+                                return;
+                            moved = true;
+                            root.setDraftPosition(
+                                tile.modelData.name,
+                                initialX + translation.x / root.canvasData.scale,
+                                initialY + translation.y / root.canvasData.scale,
+                                false);
+                        }
+                    }
+
+                    Keys.onPressed: event => {
+                        if (!root.interactionEnabled)
+                            return;
+                        const step = event.modifiers & Qt.ShiftModifier ? 100 : 10;
+                        let handled = true;
+                        if (event.key === Qt.Key_Left)
+                            root.nudge(tile.modelData.name, -step, 0);
+                        else if (event.key === Qt.Key_Right)
+                            root.nudge(tile.modelData.name, step, 0);
+                        else if (event.key === Qt.Key_Up)
+                            root.nudge(tile.modelData.name, 0, -step);
+                        else if (event.key === Qt.Key_Down)
+                            root.nudge(tile.modelData.name, 0, step);
+                        else if (event.key === Qt.Key_Return || event.key === Qt.Key_Enter)
+                            root.applyDraft();
+                        else if (event.key === Qt.Key_Escape)
+                            root.resetDraft();
+                        else
+                            handled = false;
+                        event.accepted = handled;
+                    }
+                }
+            }
+        }
+
+        Row {
+            width: parent.width
+            spacing: 8
+
+            Text {
+                width: Math.max(0, parent.width - identifyButton.width
+                    - primaryButton.width - applyButton.width - 24)
+                anchors.verticalCenter: parent.verticalCenter
+                text: root.width >= 600
+                    ? "Drag to arrange · arrows move 10 px · Shift moves 100 px"
+                    : "Drag or use the arrow keys"
+                color: Theme.fgMuted
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                elide: Text.ElideRight
+            }
+
+            SettingsButton {
+                id: identifyButton
+                text: "Identify"
+                enabled: root.interactionEnabled
+                onClicked: root.displayService.identify()
+            }
+
+            SettingsButton {
+                id: primaryButton
+                text: "Make primary"
+                enabled: root.interactionEnabled && root.selectedOutput !== ""
+                    && !root.draftLayout.find(record =>
+                        record.name === root.selectedOutput)?.primary
+                onClicked: root.makePrimary(root.selectedOutput)
+            }
+
+            SettingsButton {
+                id: applyButton
+                text: "Apply"
+                enabled: root.interactionEnabled
+                onClicked: root.applyDraft()
+            }
+        }
+    }
+}
@@ -0,0 +1,85 @@
+import Quickshell
+import Quickshell.Wayland
+import QtQuick
+import qs.config
+import qs.services
+import qs.widgets
+
+Variants {
+    model: Quickshell.screens
+
+    PanelWindow {
+        id: win
+
+        property var modelData: null
+        readonly property string connector: win.modelData?.name ?? "Display"
+        readonly property int number: Math.max(1,
+            Displays.monitors.findIndex(monitor => monitor.name === win.connector) + 1)
+        readonly property string description: Displays.monitorNamed(win.connector)?.description ?? "Connected display"
+
+        screen: win.modelData
+        visible: Displays.identifying
+        implicitWidth: 260
+        implicitHeight: 172
+        color: "transparent"
+        exclusiveZone: 0
+        exclusionMode: ExclusionMode.Ignore
+        mask: Region {}
+
+        WlrLayershell.namespace: "qs-display-identify"
+        WlrLayershell.layer: WlrLayer.Overlay
+        WlrLayershell.keyboardFocus: WlrKeyboardFocus.None
+
+        Rectangle {
+            anchors.fill: parent
+            radius: Theme.popoverRadius
+            color: Theme.alpha(Theme.bgPopover, 0.96)
+            border.width: 1
+            border.color: Theme.alpha(Theme.fg, 0.14)
+
+            PrismEdge {
+                anchors.top: parent.top
+                anchors.left: parent.left
+                anchors.right: parent.right
+                inset: parent.radius
+            }
+
+            Column {
+                anchors.centerIn: parent
+                width: parent.width - 32
+                spacing: 4
+
+                Text {
+                    width: parent.width
+                    horizontalAlignment: Text.AlignHCenter
+                    text: String(win.number)
+                    color: Theme.fg
+                    font.family: Theme.fontFamily
+                    font.pixelSize: 68
+                    font.weight: Font.DemiBold
+                }
+
+                Text {
+                    width: parent.width
+                    horizontalAlignment: Text.AlignHCenter
+                    text: win.connector
+                    color: Theme.accentAlt
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeLarge
+                    font.weight: Font.DemiBold
+                    elide: Text.ElideRight
+                }
+
+                Text {
+                    width: parent.width
+                    horizontalAlignment: Text.AlignHCenter
+                    text: win.description
+                    color: Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                    elide: Text.ElideRight
+                }
+            }
+        }
+    }
+}
@@ -106,6 +106,20 @@ SettingsPage {
        }
    }

+    SettingsCard {
+        visible: Displays.monitors.length > 1
+        title: "Arrange displays"
+        subtitle: "Drag the screens into place. The primary display anchors the desktop at 0,0."
+
+        DisplayArrangement {
+            width: parent.width
+            displayService: Displays
+            selectedOutput: root.selectedOutput
+            interactionEnabled: !Displays.awaitingConfirmation && !Displays.busy
+            onSelectionRequested: output => root.selectedOutput = output
+        }
+    }
+
    SettingsCard {
        visible: Displays.monitors.length > 1
        title: "Connected display"
@@ -0,0 +1,137 @@
+import QtQuick
+import qs.config
+import qs.services
+
+Item {
+    id: root
+
+    required property var check
+    property bool issue: false
+    property bool divider: true
+    property int actionActivationCount: 0
+    signal actionRequested(var check)
+
+    readonly property bool repairWorking: Health.repairingId === root.check.id
+    readonly property bool repairFailed: root.check.status !== "ok"
+        && Health.lastRepair.checkId === root.check.id
+        && (Health.lastRepair.accepted === false || Health.lastRepair.exitCode !== 0)
+
+    objectName: `health-check-row:${root.issue ? "issue" : "quiet"}:${root.check.id}`
+    implicitHeight: 62
+
+    // The isolated contract uses the same signal path as a pointer or keyboard
+    // activation instead of calling HealthPage's action handler directly.
+    function activateAction(): bool {
+        if (!actionButton.visible || !actionButton.enabled)
+            return false;
+        root.actionActivationCount += 1;
+        actionButton.clicked();
+        return true;
+    }
+
+    function statusLabel(status: string): string {
+        if (status === "ok") return "Healthy";
+        if (status === "warning") return "Needs attention";
+        if (status === "error") return "Action required";
+        return "Not set up";
+    }
+
+    function statusColor(status: string): color {
+        if (status === "ok") return Theme.ok;
+        if (status === "warning") return Theme.warn;
+        if (status === "error") return Theme.danger;
+        return Theme.fgMuted;
+    }
+
+    function displayedStatus(): string {
+        if (root.repairWorking)
+            return "Working…";
+        if (root.repairFailed)
+            return "Repair failed";
+        return root.statusLabel(root.check.status);
+    }
+
+    Rectangle {
+        id: issueMark
+
+        visible: root.issue
+        width: 7
+        height: 7
+        radius: 4
+        anchors.left: parent.left
+        anchors.leftMargin: 1
+        anchors.verticalCenter: parent.verticalCenter
+        color: root.statusColor(root.check.status)
+        border.width: 1
+        border.color: Theme.alpha(Theme.bgPanel, 0.9)
+    }
+
+    Column {
+        anchors.left: parent.left
+        anchors.leftMargin: root.issue ? 22 : 0
+        anchors.right: trailing.left
+        anchors.rightMargin: 16
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: 3
+
+        Text {
+            width: parent.width
+            text: root.check.title
+            color: Theme.fg
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSize
+            font.weight: Font.Medium
+            elide: Text.ElideRight
+        }
+
+        Text {
+            width: parent.width
+            text: root.check.detail
+            color: Theme.fgDim
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+            elide: Text.ElideRight
+        }
+    }
+
+    Row {
+        id: trailing
+
+        anchors.right: parent.right
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: 12
+
+        Text {
+            objectName: `health-status-text:${root.issue ? "issue" : "quiet"}:${root.check.id}`
+            anchors.verticalCenter: parent.verticalCenter
+            text: root.displayedStatus()
+            color: root.statusColor(root.check.status)
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+        }
+
+        SettingsButton {
+            id: actionButton
+
+            objectName: `health-row-action:${root.issue ? "issue" : "quiet"}:${root.check.id}`
+            visible: root.check.action !== undefined
+            text: root.check.action?.label ?? ""
+            enabled: visible && !root.repairWorking && !Health.busy
+            activeFocusOnTab: enabled
+            border.width: activeFocus ? 2 : 1
+            border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+            onClicked: root.actionRequested(root.check)
+            Keys.onReturnPressed: if (enabled) root.actionRequested(root.check)
+            Keys.onSpacePressed: if (enabled) root.actionRequested(root.check)
+        }
+    }
+
+    Rectangle {
+        visible: root.divider
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.bottom: parent.bottom
+        height: 1
+        color: Theme.alpha(Theme.fg, 0.07)
+    }
+}
@@ -0,0 +1,458 @@
+import QtQuick
+import qs.config
+import qs.services
+
+SettingsPage {
+    id: root
+
+    objectName: "system-health-page"
+
+    title: "System Health"
+    lede: "Checks the parts of the desktop this app owns, and explains what needs attention."
+
+    property var pendingConfirmation: null
+    property string instructionTarget: ""
+
+    readonly property var issueChecks: Health.checks.filter(check => check.status === "warning" || check.status === "error")
+    readonly property var groups: [
+        {
+            group: "desktop-foundation",
+            title: "Desktop foundation",
+            subtitle: "Compositor, shell, portals, wallpaper, idle policy, and launcher."
+        },
+        {
+            group: "input-media",
+            title: "Input & media",
+            subtitle: "Sound, clipboard, capture, OCR, and display controls."
+        },
+        {
+            group: "integrations",
+            title: "Integrations",
+            subtitle: "Only configured integrations affect health."
+        },
+        {
+            group: "panama-tools",
+            title: "Desktop tools",
+            subtitle: "Tracked links, launcher commands, apps, and inhibitors."
+        }
+    ]
+    readonly property var applicationTargets: ({
+        "integration.nextcloud": "nextcloud",
+        "integration.rustdesk": "rustdesk",
+        "integration.kdeconnect": "kdeconnect",
+        "integration.bluebubbles": "bluebubbles"
+    })
+
+    function statusLabel(status: string): string {
+        if (status === "ok") return "Healthy";
+        if (status === "warning") return "Needs attention";
+        if (status === "error") return "Action required";
+        return "Not set up";
+    }
+
+    function checksForGroup(group: string): var {
+        return Health.checks.filter(check => check.group === group
+            && (check.status === "ok" || check.status === "unconfigured"));
+    }
+
+    function handleAction(check: var): void {
+        if (!check || !check.action)
+            return;
+
+        if (check.action.kind === "open") {
+            if (check.action.target) {
+                ShellState.openSettings(check.action.target);
+                return;
+            }
+            const application = root.applicationTargets[check.id];
+            if (application)
+                SystemSettings.openApplication(application);
+            return;
+        }
+
+        if (check.action.kind === "instructions") {
+            root.instructionTarget = check.action.target || "";
+            return;
+        }
+
+        if (check.action.kind !== "repair")
+            return;
+        if (check.action.confirm) {
+            root.pendingConfirmation = check;
+            return;
+        }
+        Health.repair(check.id, false);
+    }
+
+    function confirmRepair(): void {
+        const check = root.pendingConfirmation;
+        root.pendingConfirmation = null;
+        if (check)
+            Health.repair(check.id, false);
+    }
+
+    function descendants(item: var, prefix: string): var {
+        let matches = [];
+        if (!item)
+            return matches;
+        if (String(item.objectName || "").indexOf(prefix) === 0)
+            matches.push(item);
+        for (const child of item.children || [])
+            matches = matches.concat(root.descendants(child, prefix));
+        return matches;
+    }
+
+    function activateRenderedAction(id: string): bool {
+        const suffix = `:${id}`;
+        const rows = root.descendants(root, "health-check-row:").filter(row =>
+            row.visible && String(row.objectName).endsWith(suffix));
+        return rows.length === 1 && rows[0].activateAction();
+    }
+
+    function renderedFocusChain(): var {
+        // Repeater delegates enter Qt's tab chain lazily after their enabled
+        // binding changes at the end of a scan. Touch each rendered action's
+        // real next-focus link before traversing from the first hero control.
+        const renderedActions = root.descendants(root, "health-row-action:").filter(item =>
+            item.visible && item.enabled && item.activeFocusOnTab);
+        for (const action of renderedActions)
+            action.nextItemInFocusChain(true);
+
+        const starts = root.descendants(root, "health-copy-report-button").filter(item => item.visible && item.enabled);
+        if (starts.length !== 1)
+            return [];
+
+        const names = [];
+        const start = starts[0];
+        let current = start;
+        for (let index = 0; index < 128; index++) {
+            const name = String(current.objectName || "");
+            if (name !== "" && names.indexOf(name) < 0)
+                names.push(name);
+            current = current.nextItemInFocusChain(true);
+            if (!current || current === start)
+                break;
+        }
+        return names;
+    }
+
+    // Deterministic, read-only fixture seam used by the offscreen contract.
+    function uiDiagnostics(): var {
+        const summaries = root.descendants(root, "health-summary");
+        const rows = root.descendants(root, "health-check-row:").filter(row => row.visible);
+        const checkingLabels = root.descendants(root, "health-checking-label").filter(label => label.visible);
+        const confirmationSheets = root.descendants(root, "health-confirmation-sheet:").filter(sheet => sheet.visible);
+        const emptyGroups = root.descendants(root, "health-empty-group:").filter(label => label.visible);
+        const fedoraHandoffs = root.descendants(root, "health-fedora-handoff:").filter(row => row.visible);
+        return {
+            renderedRows: rows.map(row => {
+                const objectName = String(row.objectName);
+                const parts = objectName.split(":");
+                const statusTexts = root.descendants(row, "health-status-text:").filter(text => text.visible);
+                return {
+                    objectName: objectName,
+                    id: parts.slice(2).join(":"),
+                    section: parts[1],
+                    statusText: statusTexts.length === 1 ? statusTexts[0].text : ""
+                };
+            }),
+            summaryHeight: summaries.length > 0 ? summaries[0].height : 0,
+            rowHeights: rows.map(row => row.height),
+            checking: Health.busy,
+            checkingText: checkingLabels.length > 0 ? checkingLabels[0].text : "",
+            focusChain: root.renderedFocusChain(),
+            activatedRows: rows.filter(row => row.actionActivationCount > 0).map(row => String(row.objectName)),
+            emptyQuietGroups: emptyGroups.map(label => String(label.objectName).slice("health-empty-group:".length)),
+            fedoraHandoffs: fedoraHandoffs.map(row => ({
+                id: String(row.objectName).slice("health-fedora-handoff:".length),
+                label: row.label,
+                action: row.action
+            })),
+            confirmationVisible: confirmationSheets.length === 1,
+            confirmationId: confirmationSheets.length === 1
+                ? String(confirmationSheets[0].objectName).slice("health-confirmation-sheet:".length)
+                : ""
+        };
+    }
+
+    Component.onCompleted: Health.refresh()
+
+    header: Component {
+        Rectangle {
+            objectName: `health-confirmation-sheet:${root.pendingConfirmation ? root.pendingConfirmation.id : ""}`
+            visible: root.pendingConfirmation !== null
+            implicitHeight: visible ? confirmRow.implicitHeight + 28 : 0
+            radius: Theme.cardRadius
+            color: Theme.mix(Theme.bgPanel, Theme.warn, 0.1)
+            border.width: 1
+            border.color: Theme.alpha(Theme.warn, 0.34)
+
+            Row {
+                id: confirmRow
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                anchors.margins: 16
+                spacing: 14
+
+                Column {
+                    width: parent.width - cancelButton.width - repairButton.width - 28
+                    anchors.verticalCenter: parent.verticalCenter
+                    spacing: 3
+
+                    Text {
+                        width: parent.width
+                        text: root.pendingConfirmation
+                            ? `${root.pendingConfirmation.action.label}?`
+                            : "Restart the shell?"
+                        color: Theme.fg
+                        font.family: Theme.fontFamily
+                        font.pixelSize: Theme.fontSize
+                        font.weight: Font.DemiBold
+                    }
+
+                    Text {
+                        width: parent.width
+                        text: "The desktop chrome will disappear briefly and return when Quickshell restarts."
+                        color: Theme.fgDim
+                        font.family: Theme.fontFamily
+                        font.pixelSize: Theme.fontSizeSmall
+                        wrapMode: Text.WordWrap
+                    }
+                }
+
+                SettingsButton {
+                    id: cancelButton
+                    text: "Cancel"
+                    activeFocusOnTab: true
+                    border.width: activeFocus ? 2 : 1
+                    border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                    onClicked: root.pendingConfirmation = null
+                    Keys.onReturnPressed: root.pendingConfirmation = null
+                    Keys.onSpacePressed: root.pendingConfirmation = null
+                }
+
+                SettingsButton {
+                    id: repairButton
+                    text: root.pendingConfirmation ? root.pendingConfirmation.action.label : "Restart the shell"
+                    activeFocusOnTab: true
+                    border.width: activeFocus ? 2 : 1
+                    border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                    onClicked: root.confirmRepair()
+                    Keys.onReturnPressed: root.confirmRepair()
+                    Keys.onSpacePressed: root.confirmRepair()
+                }
+            }
+        }
+    }
+
+    HealthSummary {}
+
+    SettingsCard {
+        visible: root.issueChecks.length > 0
+        title: Health.status === "error" ? "Action required" : "Needs attention"
+        subtitle: Health.status === "error"
+            ? "Resolve these items first. Healthy systems remain listed below."
+            : "Nothing here prevents you from using the desktop."
+
+        Item {
+            width: parent.width
+            implicitHeight: issueRows.implicitHeight
+
+            Rectangle {
+                anchors.left: parent.left
+                anchors.leftMargin: 4
+                anchors.top: parent.top
+                anchors.topMargin: 25
+                anchors.bottom: parent.bottom
+                anchors.bottomMargin: 25
+                width: 1
+                visible: root.issueChecks.length > 1
+                color: Theme.alpha(Health.status === "error" ? Theme.danger : Theme.warn, 0.44)
+            }
+
+            Column {
+                id: issueRows
+                width: parent.width
+
+                Repeater {
+                    id: issueRepeater
+                    model: root.issueChecks
+
+                    HealthCheckRow {
+                        required property var modelData
+                        required property int index
+
+                        width: issueRows.width
+                        check: modelData
+                        issue: true
+                        divider: index < issueRepeater.count - 1
+                        onActionRequested: check => root.handleAction(check)
+                    }
+                }
+            }
+        }
+    }
+
+    SettingsCard {
+        visible: root.instructionTarget === "ddc-permissions"
+        title: "External monitor brightness"
+        subtitle: "The monitor reports DDC/CI support, but this session cannot reach the monitor bus."
+
+        Item {
+            width: parent.width
+            implicitHeight: Math.max(instructionCopy.implicitHeight, doneButton.implicitHeight) + 8
+
+            Text {
+                id: instructionCopy
+                anchors.left: parent.left
+                anchors.right: doneButton.left
+                anchors.rightMargin: 18
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Reload the installed udev rules and trigger the i2c-dev and DRM devices. Sign out and back in if monitor access is still unavailable."
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                wrapMode: Text.WordWrap
+            }
+
+            SettingsButton {
+                id: doneButton
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Done"
+                activeFocusOnTab: true
+                border.width: activeFocus ? 2 : 1
+                border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                onClicked: root.instructionTarget = ""
+                Keys.onReturnPressed: root.instructionTarget = ""
+                Keys.onSpacePressed: root.instructionTarget = ""
+            }
+        }
+    }
+
+    Grid {
+        id: groupGrid
+
+        width: parent.width
+        columns: width >= 700 ? 2 : 1
+        columnSpacing: 16
+        rowSpacing: 16
+
+        Repeater {
+            model: root.groups
+
+            SettingsCard {
+                required property var modelData
+                readonly property var quietChecks: root.checksForGroup(modelData.group)
+
+                width: groupGrid.columns === 2
+                    ? (groupGrid.width - groupGrid.columnSpacing) / 2
+                    : groupGrid.width
+                title: modelData.title
+                subtitle: modelData.subtitle
+
+                Column {
+                    id: groupRows
+                    width: parent.width
+
+                    Text {
+                        objectName: `health-empty-group:${modelData.group}`
+                        width: parent.width
+                        visible: quietChecks.length === 0
+                        text: "Items needing attention are listed above."
+                        color: Theme.fgMuted
+                        font.family: Theme.fontFamily
+                        font.pixelSize: Theme.fontSizeSmall
+                        topPadding: 8
+                        bottomPadding: 8
+                        wrapMode: Text.WordWrap
+                    }
+
+                    Repeater {
+                        id: groupRepeater
+                        model: quietChecks
+
+                        HealthCheckRow {
+                            required property var modelData
+                            required property int index
+
+                            width: groupRows.width
+                            check: modelData
+                            divider: index < groupRepeater.count - 1
+                            onActionRequested: check => root.handleAction(check)
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    SettingsCard {
+        title: "Fedora system settings"
+        subtitle: "These areas remain owned by Fedora and GNOME's mature system panels."
+
+        Item {
+            width: parent.width
+            implicitHeight: 42
+
+            Text {
+                anchors.left: parent.left
+                anchors.right: gnomeSettingsButton.left
+                anchors.rightMargin: 18
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Use GNOME Settings for the parts of the system this app does not manage."
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                wrapMode: Text.WordWrap
+            }
+
+            SettingsButton {
+                id: gnomeSettingsButton
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Open GNOME Settings"
+                activeFocusOnTab: true
+                border.width: activeFocus ? 2 : 1
+                border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                onClicked: SystemSettings.openGnomePanel("network")
+                Keys.onReturnPressed: SystemSettings.openGnomePanel("network")
+                Keys.onSpacePressed: SystemSettings.openGnomePanel("network")
+            }
+        }
+
+        ActionRow {
+            objectName: "health-fedora-handoff:users"
+            label: "Users"
+            detail: "Accounts, passwords, and automatic login"
+            action: "Open users"
+            onTriggered: SystemSettings.openGnomePanel("system", "users")
+        }
+
+        ActionRow {
+            objectName: "health-fedora-handoff:sharing"
+            label: "Sharing"
+            detail: "Remote desktop, media sharing, and remote login"
+            action: "Open sharing"
+            onTriggered: SystemSettings.openGnomePanel("sharing")
+        }
+
+        ActionRow {
+            objectName: "health-fedora-handoff:color"
+            label: "Colour profiles"
+            detail: "ICC profiles for displays, printers, and scanners"
+            action: "Open colour"
+            onTriggered: SystemSettings.openGnomePanel("color")
+        }
+
+        ActionRow {
+            objectName: "health-fedora-handoff:wellbeing"
+            label: "Digital wellbeing"
+            detail: "Screen time and break reminders"
+            action: "Open wellbeing"
+            divider: false
+            onTriggered: SystemSettings.openGnomePanel("wellbeing")
+        }
+    }
+}
@@ -0,0 +1,169 @@
+import QtQuick
+import qs.config
+import qs.services
+
+SettingsCard {
+    id: root
+
+    objectName: "health-summary"
+    implicitHeight: 126
+
+    readonly property int observationCount: Health.summary.warnings + Health.summary.errors
+    readonly property string heroTitle: {
+        if (Health.diagnosticUnavailable)
+            return "Health check unavailable";
+        if (Health.checks.length === 0)
+            return "Checking the desktop";
+        if (Health.status === "error")
+            return "Action required";
+        if (Health.status === "warning")
+            return "Needs attention";
+        return "Healthy";
+    }
+    readonly property string heroDetail: {
+        if (Health.diagnosticUnavailable)
+            return Health.lastError || "The latest health check could not be completed.";
+        if (Health.checks.length === 0)
+            return "Checking the desktop services, tools, and integrations this app owns.";
+        if (Health.status === "error")
+            return root.observationCount === 1
+                ? "One part of the desktop needs action."
+                : `${root.observationCount} parts of the desktop need action.`;
+        if (Health.status === "warning")
+            return root.observationCount === 1
+                ? "Your desktop is working. One feature needs a decision."
+                : `Your desktop is working. ${root.observationCount} features need a decision.`;
+        return "Desktop services and tools are working normally.";
+    }
+    readonly property color statusColor: {
+        if (Health.diagnosticUnavailable || Health.status === "error")
+            return Theme.danger;
+        if (Health.status === "warning")
+            return Theme.warn;
+        if (Health.checks.length === 0)
+            return Theme.fgMuted;
+        return Theme.ok;
+    }
+
+    function scanTime(): string {
+        const generatedAt = String(Health.snapshot.generatedAt || "");
+        if (generatedAt === "")
+            return "No completed check yet";
+        const date = new Date(generatedAt);
+        if (Number.isNaN(date.getTime()))
+            return "Last check completed";
+        return `Last checked ${date.toLocaleTimeString(Qt.locale(), Locale.ShortFormat)}`;
+    }
+
+    Item {
+        width: parent.width
+        implicitHeight: 96
+
+        Column {
+            anchors.left: parent.left
+            anchors.right: actions.left
+            anchors.rightMargin: 22
+            anchors.verticalCenter: parent.verticalCenter
+            spacing: 4
+
+            Text {
+                width: parent.width
+                text: Health.diagnosticUnavailable
+                    ? "DIAGNOSTICS"
+                    : root.observationCount > 0
+                        ? root.observationCount + (root.observationCount === 1 ? " OBSERVATION" : " OBSERVATIONS")
+                        : "PANAMA DESKTOP"
+                color: root.statusColor
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                font.weight: Font.DemiBold
+                font.letterSpacing: 1.15
+            }
+
+            Text {
+                width: parent.width
+                text: root.heroTitle
+                color: Theme.fg
+                font.family: Theme.fontFamily
+                font.pixelSize: 24
+                font.weight: Font.DemiBold
+                elide: Text.ElideRight
+            }
+
+            Text {
+                width: parent.width
+                text: root.heroDetail
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                elide: Text.ElideRight
+            }
+
+            Row {
+                spacing: 10
+
+                Text {
+                    text: root.scanTime()
+                    color: Theme.fgMuted
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                }
+
+                Text {
+                    objectName: "health-checking-label"
+                    visible: Health.busy
+                    text: "Checking…"
+                    color: Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                }
+
+                Text {
+                    visible: Health.lastCopyResult !== ""
+                    text: Health.lastCopyResult
+                    color: Health.lastCopyResult === "Report copied." ? Theme.ok : Theme.warn
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                }
+            }
+        }
+
+        Row {
+            id: actions
+
+            anchors.right: parent.right
+            anchors.verticalCenter: parent.verticalCenter
+            spacing: 8
+
+            SettingsButton {
+                id: copyButton
+
+                objectName: "health-copy-report-button"
+                visible: !Health.diagnosticUnavailable
+                text: "Copy report"
+                enabled: Health.checks.length > 0
+                activeFocusOnTab: enabled
+                border.width: activeFocus ? 2 : 1
+                border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                onClicked: Health.copyReport()
+                Keys.onReturnPressed: if (enabled) Health.copyReport()
+                Keys.onSpacePressed: if (enabled) Health.copyReport()
+            }
+
+            SettingsButton {
+                id: refreshButton
+
+                objectName: "health-refresh-button"
+                text: Health.diagnosticUnavailable ? "Retry" : "Refresh"
+                tone: Health.diagnosticUnavailable ? "normal" : "accent"
+                enabled: !Health.busy
+                activeFocusOnTab: enabled
+                border.width: activeFocus ? 2 : (tone === "accent" ? 0 : 1)
+                border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                onClicked: Health.refresh()
+                Keys.onReturnPressed: if (enabled) Health.refresh()
+                Keys.onSpacePressed: if (enabled) Health.refresh()
+            }
+        }
+    }
+}
@@ -117,12 +117,6 @@ SettingsPage {
        SliderRow { setting: "weatherRefreshMinutes"; divider: false }
    }

-    SettingsCard {
-        title: "System vitals"
-        subtitle: "Processor, memory, and graphics activity in the bar"
-        SliderRow { setting: "vitalsIntervalMs"; divider: false }
-    }
-
    Grid {
        id: summaryCards

@@ -0,0 +1,152 @@
+import Quickshell
+import QtQuick
+
+import qs.config
+import qs.services
+
+Rectangle {
+    id: root
+
+    property string backgroundMode: DesktopPreferences.get("lockBackgroundMode")
+    property int blurLevel: DesktopPreferences.get("lockBlurLevel")
+    property bool showClock: DesktopPreferences.get("lockShowClock")
+    property bool showDate: DesktopPreferences.get("lockShowDate")
+    property bool showUser: DesktopPreferences.get("lockShowUser")
+    property bool fadeOnEmpty: DesktopPreferences.get("lockFadeOnEmpty")
+    property bool use24Hour: DesktopPreferences.get("use24Hour")
+    property string wallpaperPath: Wallpaper.active !== ""
+        ? Wallpaper.active
+        : (Wallpaper.configured !== "" ? Wallpaper.configured : Wallpaper.shippedPath)
+
+    readonly property string previewMode: root.backgroundMode
+    readonly property real blurStrength: Math.max(0, Math.min(1, root.blurLevel / 5))
+    readonly property bool wallpaperVisible: wallpaper.visible
+    readonly property bool clockVisible: clockLabel.visible
+    readonly property bool dateVisible: dateLabel.visible
+    readonly property bool userVisible: userLabel.visible
+    readonly property bool passwordVisible: passwordField.visible
+
+    width: parent ? parent.width : 620
+    implicitHeight: 230
+    radius: Theme.cardRadius
+    clip: true
+    color: Theme.bg
+    border.width: 1
+    border.color: Theme.alpha(Theme.fg, 0.10)
+
+    Image {
+        id: wallpaper
+        anchors.fill: parent
+        visible: root.backgroundMode === "wallpaper"
+        source: visible && root.wallpaperPath !== "" ? root.wallpaperPath : ""
+        asynchronous: true
+        cache: true
+        fillMode: Image.PreserveAspectCrop
+        sourceSize.width: 960
+        sourceSize.height: 540
+    }
+
+    // Screenshot mode stays representative instead of taking a real desktop
+    // capture inside Settings. The layered window silhouettes communicate the
+    // selected softness without a live ShaderEffect or GPU repaint loop.
+    Rectangle {
+        anchors.fill: parent
+        visible: root.backgroundMode === "screenshot"
+        color: Theme.bgDark
+
+        Rectangle {
+            x: parent.width * 0.10
+            y: parent.height * 0.12
+            width: parent.width * 0.45
+            height: parent.height * 0.66
+            radius: 14 + root.blurStrength * 10
+            color: Theme.alpha(Theme.bgHighlight, 0.52 - root.blurStrength * 0.18)
+            border.width: 1
+            border.color: Theme.alpha(Theme.accent, 0.14)
+        }
+
+        Rectangle {
+            x: parent.width * 0.48
+            y: parent.height * 0.24
+            width: parent.width * 0.40
+            height: parent.height * 0.57
+            radius: 14 + root.blurStrength * 10
+            color: Theme.alpha(Theme.bgPanel, 0.64 - root.blurStrength * 0.20)
+            border.width: 1
+            border.color: Theme.alpha(Theme.accentSecondary, 0.13)
+        }
+    }
+
+    Rectangle {
+        anchors.fill: parent
+        color: root.backgroundMode === "wallpaper"
+            ? Theme.alpha(Theme.bg, 0.42)
+            : Theme.alpha(Theme.bg, 0.12 + root.blurStrength * 0.16)
+    }
+
+    Text {
+        id: clockLabel
+        anchors.horizontalCenter: parent.horizontalCenter
+        anchors.top: parent.top
+        anchors.topMargin: 26
+        visible: root.showClock
+        text: Qt.formatDateTime(clock.date, root.use24Hour ? "HH:mm" : "h:mm")
+        color: Theme.fg
+        font.family: Theme.fontFamily
+        font.pixelSize: 42
+        font.weight: Font.Light
+    }
+
+    Text {
+        id: dateLabel
+        anchors.horizontalCenter: parent.horizontalCenter
+        anchors.top: clockLabel.visible ? clockLabel.bottom : parent.top
+        anchors.topMargin: clockLabel.visible ? 1 : 35
+        visible: root.showDate
+        text: Qt.formatDateTime(clock.date, "dddd, MMMM d")
+        color: Theme.fgDim
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSizeSmall
+    }
+
+    Rectangle {
+        id: passwordField
+        anchors.horizontalCenter: parent.horizontalCenter
+        anchors.bottom: parent.bottom
+        anchors.bottomMargin: root.showUser ? 48 : 30
+        visible: !root.fadeOnEmpty
+        width: Math.min(270, parent.width * 0.48)
+        height: 36
+        radius: height / 2
+        color: Theme.alpha(Theme.bgPanel, 0.84)
+        border.width: 1
+        border.color: Theme.alpha(Theme.accent, 0.78)
+
+        Text {
+            anchors.centerIn: parent
+            text: "Password"
+            color: Theme.fgDim
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+            font.italic: true
+        }
+    }
+
+    Text {
+        id: userLabel
+        anchors.horizontalCenter: parent.horizontalCenter
+        anchors.bottom: parent.bottom
+        anchors.bottomMargin: 19
+        visible: root.showUser
+        text: Quickshell.env("USER") || "User"
+        color: Theme.alpha(Theme.fg, 0.90)
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSizeSmall
+        font.weight: Font.Medium
+    }
+
+    SystemClock {
+        id: clock
+        precision: SystemClock.Minutes
+    }
+}
@@ -31,7 +31,12 @@ SettingsPage {
        ChoiceRow { setting: "accelProfile" }
        ToggleRow { setting: "naturalScroll" }
        SliderRow { setting: "scrollFactor" }
-        ToggleRow { setting: "leftHanded"; divider: false }
+        ToggleRow { setting: "leftHanded" }
+        ToggleRow {
+            setting: "middleClickPaste"
+            detail: "Paste the primary selection in GTK and native Wayland applications; individual apps may choose not to support it"
+            divider: false
+        }
    }

    SettingsCard {
@@ -0,0 +1,122 @@
+// Online Accounts.
+//
+// GNOME's panel of the same name, except for one step. The accounts are GNOME
+// Online Accounts objects on D-Bus, the daemon already runs here, and listing,
+// per-service toggles and removal are all done natively on this page.
+//
+// Signing in to an OAuth provider is handed to GNOME's panel, because the
+// credentials are OAuth tokens and the code that obtains them ships without a
+// scriptable binding. That is stated on the page rather than hidden behind a
+// button that looks native, because a hand-off the user does not expect reads
+// as a bug.
+//
+// Accounts needing attention are surfaced first. GOA knows when a token has
+// expired and nothing outside its own panel says so, which is how an account
+// quietly stops syncing for weeks.
+
+import QtQuick
+import qs.config
+import qs.services
+
+SettingsPage {
+    id: root
+
+    title: "Online Accounts"
+    lede: OnlineAccounts.attentionCount > 0
+        ? OnlineAccounts.attentionCount + (OnlineAccounts.attentionCount === 1
+            ? " account needs you to sign in again."
+            : " accounts need you to sign in again.")
+        : "Accounts your mail, calendar, contacts, and files come from."
+
+    Component.onCompleted: if (!OnlineAccounts.scanned) OnlineAccounts.refresh()
+
+    SettingsCard {
+        visible: !OnlineAccounts.available
+        title: "Accounts unavailable"
+        subtitle: OnlineAccounts.lastError
+    }
+
+    SettingsCard {
+        visible: OnlineAccounts.scanned && OnlineAccounts.available && OnlineAccounts.accounts.length === 0
+        title: "No accounts yet"
+        subtitle: "Adding one lets mail, calendar, contacts, and file managers share a single sign-in."
+
+        ActionRow {
+            label: "Add an account"
+            detail: "Google, Nextcloud, Microsoft Exchange, IMAP, WebDAV, and Kerberos"
+            action: "Add account"
+            divider: false
+            onTriggered: SystemSettings.openGnomePanel("online-accounts")
+        }
+    }
+
+    Repeater {
+        model: OnlineAccounts.accounts
+
+        SettingsCard {
+            id: accountCard
+            required property var modelData
+
+            title: accountCard.modelData.identity || accountCard.modelData.providerName
+            subtitle: accountCard.modelData.needsAttention
+                ? accountCard.modelData.providerName + " · sign-in expired, so this account has stopped syncing"
+                : accountCard.modelData.providerName
+
+            // Only when it is true, because it is the one thing on this page
+            // that needs acting on.
+            ActionRow {
+                visible: accountCard.modelData.needsAttention
+                label: "Sign in again"
+                detail: "Re-authorising uses the provider's own sign-in page, which GNOME's panel hosts"
+                action: "Sign in"
+                onTriggered: SystemSettings.openGnomePanel("online-accounts")
+            }
+
+            Repeater {
+                model: accountCard.modelData.services
+
+                SettingRow {
+                    id: serviceRow
+                    required property var modelData
+                    required property int index
+
+                    label: serviceRow.modelData.label
+                    detail: serviceRow.modelData.enabled
+                        ? "Applications using " + serviceRow.modelData.label.toLowerCase() + " can see this account"
+                        : "Hidden from applications"
+                    controlWidth: 48
+
+                    SettingsToggle {
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        checked: serviceRow.modelData.enabled
+                        onToggled: value => OnlineAccounts.setService(
+                            accountCard.modelData.path, serviceRow.modelData.key, value)
+                    }
+                }
+            }
+
+            ActionRow {
+                label: "Remove this account"
+                detail: "Signs out and removes it from every application that was using it"
+                action: "Remove"
+                divider: false
+                onTriggered: OnlineAccounts.remove(accountCard.modelData.path)
+            }
+        }
+    }
+
+    SettingsCard {
+        visible: OnlineAccounts.available && OnlineAccounts.accounts.length > 0
+        title: "Add another account"
+        subtitle: "Signing in happens on the provider's own page. GNOME's panel hosts that step; everything after it is managed here."
+
+        ActionRow {
+            label: "Add an account"
+            detail: "Google, Nextcloud, Microsoft Exchange, IMAP, WebDAV, and Kerberos"
+            action: "Add account"
+            divider: false
+            onTriggered: SystemSettings.openGnomePanel("online-accounts")
+        }
+    }
+}
@@ -14,9 +14,43 @@ import qs.services
 SettingsPage {
    id: root

+    // Probing the power daemon is a D-Bus round trip, so it happens when the
+    // page opens rather than at shell startup.
+    Component.onCompleted: if (!PowerProfiles.scanned) PowerProfiles.refresh()
+
    title: "Power & Lock"
    lede: "When the screen turns off, when the session locks, and whether it ever sleeps."

+    // The same profiles GNOME's Power panel offers. Not a stored preference --
+    // the daemon owns it, it survives Panama restarts, and anything else on the
+    // system can change it, so a copy here would drift.
+    SettingsCard {
+        visible: PowerProfiles.available || PowerProfiles.lastError !== ""
+        title: "Power profile"
+        subtitle: PowerProfiles.degraded !== ""
+            ? "Performance is limited right now: " + PowerProfiles.degraded
+            : (PowerProfiles.available
+                ? "Applies to the whole system and persists across sessions."
+                : PowerProfiles.lastError)
+
+        Repeater {
+            model: PowerProfiles.profiles
+
+            SettingRow {
+                id: profileRow
+                required property var modelData
+                required property int index
+
+                label: PowerProfiles.label(profileRow.modelData)
+                detail: PowerProfiles.detail(profileRow.modelData)
+                value: profileRow.modelData === PowerProfiles.active ? "Active" : ""
+                divider: profileRow.index < PowerProfiles.profiles.length - 1
+                activatable: profileRow.modelData !== PowerProfiles.active && !PowerProfiles.busy
+                onActivated: PowerProfiles.set(profileRow.modelData)
+            }
+        }
+    }
+
    SettingsCard {
        title: "Idle behaviour"
        subtitle: IdleLock.managed
@@ -23,7 +23,12 @@ SettingsPage {
        ? "Screen lock, device access, and a machine whose security settings all check out."
        : "Screen lock, which applications can see you, and how this machine is protected."

-    Component.onCompleted: if (!DeviceSecurity.scanned) DeviceSecurity.refresh()
+    Component.onCompleted: {
+        if (!DeviceSecurity.scanned)
+            DeviceSecurity.refresh();
+        if (!Keyring.scanned)
+            Keyring.refresh();
+    }

    SettingsCard {
        title: "Screen lock"
@@ -33,6 +38,64 @@ SettingsPage {
        ToggleRow { setting: "lockOnSleep"; divider: false }
    }

+    // The login keyring, which nothing else surfaces.
+    //
+    // It is unlocked at sign-in by PAM, so this card normally just confirms
+    // that. It earns its place on the rare occasion it is not: a locked keyring
+    // breaks saved passwords everywhere at once, and does it without ever
+    // saying the word "keyring" -- you get a mail account that will not
+    // authenticate and a git push that cannot find its key.
+    SettingsCard {
+        visible: Keyring.scanned
+        title: "Saved passwords"
+        subtitle: !Keyring.available
+            ? "No secret service is answering, so saved passwords are unavailable."
+            : Keyring.locked
+                ? "The login keyring is locked. Saved passwords cannot be read until it is unlocked, and applications that need one will appear to fail for unrelated reasons."
+                : "The login keyring is unlocked, as it is after every normal sign-in."
+
+        // Two rows rather than one with a conditional button: a locked keyring
+        // needs an action, an unlocked one is a statement of fact, and ActionRow
+        // and TextRow already say exactly those two things.
+        ActionRow {
+            visible: Keyring.available && Keyring.locked
+            label: "Login keyring"
+            detail: "Unlock to restore access to stored passwords and keys"
+            action: Keyring.unlocking ? "Waiting…" : "Unlock"
+            enabled: !Keyring.unlocking
+            divider: Keyring.replacementDaemon || Keyring.lastError !== ""
+            onTriggered: Keyring.unlock()
+        }
+
+        TextRow {
+            visible: !(Keyring.available && Keyring.locked)
+            label: "Login keyring"
+            detail: Keyring.available
+                ? "Unlocked at sign-in by PAM, the same way GNOME does it"
+                : "No secret service is answering on this session"
+            value: Keyring.available ? "Unlocked" : "Unavailable"
+            divider: Keyring.replacementDaemon || Keyring.lastError !== ""
+        }
+
+        // Only shown when it is true, because it is a diagnostic rather than a
+        // setting: it means the daemon holding your secrets is not the one PAM
+        // started, so whatever unlocked it will not survive a restart.
+        SettingRow {
+            visible: Keyring.replacementDaemon
+            label: "Keyring service"
+            detail: "The original keyring service was replaced during this session, usually after it crashed. Signing out and back in restores the one PAM unlocks."
+            value: "Replaced"
+            divider: Keyring.lastError !== ""
+        }
+
+        SettingRow {
+            visible: Keyring.lastError !== ""
+            label: "Keyring problem"
+            detail: Keyring.lastError
+            divider: false
+        }
+    }
+
    SettingsCard {
        title: "Camera & microphone"
        subtitle: PrivacyState.anyActive
@@ -4,6 +4,33 @@ The control centre for everything Panama owns. Anything the system owns —
 hardware, accounts, printers — is delegated to GNOME Settings and labelled as
 such rather than half-reimplemented.

+## System Health
+
+The stable internal `services` route renders **System Health**. It is reachable
+from the Settings sidebar and its live 54px footer, the degraded-only bar
+indicator, and Vicinae's **Panama: Check System Health** command. Healthy scans
+reserve no bar space and produce no notification.
+
+`services/Health.qml` owns the last accepted redacted snapshot. It invokes
+`scripts/panama-doctor` for scans and bounded repairs, `wl-copy` only for an
+explicit **Copy Report**, and bounded `notify-send` only when an external repair
+fails. For a concise terminal view, run:
+
+```bash
+~/.config/quickshell/scripts/panama-doctor --summary
+```
+
+The helper diagnoses Panama-owned desktop services, dependencies, links, and
+configured integrations. It does not read secret values, clipboard or
+notification contents, calendar events, SSIDs, addresses, or arbitrary command
+output. Its repair interface is an authored allow-list: it never installs a
+package, runs `sudo`, deletes user data, or repairs a service Panama does not
+own. A repair remains degraded until a fresh scan observes recovery.
+
+The final card is the ownership boundary. Network configuration and the exact
+Users, Sharing, Colour profiles, and Digital wellbeing handoffs open GNOME
+Settings because Fedora's system services own those areas.
+
 ## Adding a setting

 One schema entry. That is the whole job.
@@ -32,6 +59,47 @@ If it is compositor-backed, add the matching `prefs.get("blurSize", 8)` in
 `hypr/looks.lua` so the Hyprland config still stands alone with no settings
 file.

+## Setting ownership
+
+Every preference has **one primary page**, derived from its schema `group` and
+the route in `services/SettingsSearch.qml`. Search results always open that
+owner. A control may appear on a second page only when the same adaptation is
+part of another established mental model; otherwise use a labelled handoff to
+the owner instead of duplicating it.
+
+### Intentional mirrors
+
+| Setting | Primary page | Mirror | Why the mirror earns its place |
+|---|---|---|---|
+| `animationsEnabled` | Appearance | Accessibility | Reduced motion belongs both to visual polish and motion accessibility. |
+| `cursorInactiveTimeout` | Mouse | Accessibility | Pointer visibility is configured with pointer behaviour but affects motor and visual access. |
+| `cursorSize` | Accessibility | Mouse | Large cursors are an accessibility adaptation that users also look for beside pointer controls. |
+| `inactiveOpacity` | Appearance | Accessibility | Window translucency is an appearance choice with a direct readability impact. |
+| `lockMinutes` | Power | Privacy | Idle timing owns the mechanism; privacy owns the expectation that the unattended desktop locks. |
+| `lockOnSleep` | Power | Privacy | Suspend owns the transition; privacy owns whether waking requires authentication. |
+
+Lock-screen visuals belong only to **Appearance**: background source, blur,
+clock, date, user name, and password-field presentation. **Power** owns when
+the session locks, while **Privacy** keeps only the established timing mirrors
+above. Visual controls must not be copied onto either page.
+
+**Displays** is the sole owner of mode, scale, rotation, arrangement, and primary role.
+Those values form one safety transaction: every connected output
+is applied, verified, confirmed, or restored together. Other pages may link to
+Displays, but must never expose a second geometry control or persist a partial
+layout.
+
+Mirrors must remain the same schema-backed control, never a second preference
+or a copied default. Additions to this table require a concrete discoverability
+reason and an update to `tests/quickshell/settings-ownership-contract.sh`.
+
+Window border colour follows the same ownership rule. The inactive border is a
+**scheme-relative role** owned by `ColorScheme.qml`: it changes only to retain
+neutral contrast in light and dark modes. The focused Prism border is the
+accent role owned by the visual theme (and, eventually, an accent picker).
+`ColorScheme.qml` must never write the focused border, so changing schemes
+cannot erase a user-selected accent.
+
 ## The rows

 | Component | For |
@@ -83,11 +151,12 @@ slot**, because that is the row's default property, so only the right-hand edge
 becomes clickable. Use `activatable: true` with `onActivated` for a whole-row
 target.

-**A copy of the Quickshell config shares the live shell's ID.** Quickshell
-derives the Shell ID from config *content*, not path, so
-`cp -a config/dot/quickshell $tmp && qs -p $tmp kill` kills the running
-desktop, and `qs -p $tmp ipc call …` can drive it. Harnesses that point at a
-single distinct `.qml` file are safe; copying the whole directory is not.
+**A content-identical Quickshell entry can share the live shell's ID.**
+Quickshell derives the Shell ID from config *content*, not path. Runtime
+harnesses therefore create a distinct semantic entry file, address that exact
+file with `qs -p`, and discover its PID from the exact Config path in
+`qs list --all`. They terminate only that recorded PID with `kill`; never use
+`qs kill` from a copied configuration.

 ## Where state lives

@@ -97,6 +166,7 @@ single distinct `.qml` file are safe; copying the whole directory is not.
 | `$XDG_STATE_HOME/panama/panama-home.json` | Home accessory favourites and aliases |
 | `$XDG_STATE_HOME/panama/backups/` | Settings snapshots |
 | `$XDG_STATE_HOME/panama/hypridle.conf` | Generated idle config |
+| `$XDG_STATE_HOME/panama/hyprlock.conf` | Generated lock-screen appearance |

 `SystemSettings.restoreDefaults()` spans all of them. A reset that silently
 skipped one would be worse than having no reset, because nothing would say so.
@@ -1,159 +0,0 @@
-import QtQuick
-import qs.config
-import qs.services
-
-SettingsPage {
-    title: "Startup & Services"
-    lede: "A clear view of the background tools that make the desktop feel complete."
-
-    function status(active: bool): string {
-        return active ? "Running" : "Stopped";
-    }
-
-    Item {
-        width: parent.width
-        implicitHeight: refresh.implicitHeight
-
-        SettingsButton {
-            id: refresh
-            anchors.right: parent.right
-            text: SystemSettings.busy ? "Refreshing…" : "Refresh"
-            enabled: !SystemSettings.busy
-            onClicked: SystemSettings.refresh()
-        }
-    }
-
-    SettingsCard {
-        title: "Your services"
-
-        SettingRow {
-            label: "Nextcloud"
-            detail: "File synchronization and tray status"
-            controlWidth: 190
-
-            Row {
-                anchors.right: parent.right
-                anchors.verticalCenter: parent.verticalCenter
-                spacing: 10
-                Text {
-                    anchors.verticalCenter: parent.verticalCenter
-                    text: status(SystemSettings.nextcloudActive)
-                    color: Theme.fgDim
-                    font.family: Theme.fontFamily
-                    font.pixelSize: Theme.fontSize
-                }
-                SettingsButton {
-                    text: "Open"
-                    onClicked: SystemSettings.openApplication("nextcloud")
-                }
-            }
-        }
-
-        SettingRow {
-            label: "RustDesk"
-            detail: "Remote access through the enabled system service"
-            controlWidth: 190
-
-            Row {
-                anchors.right: parent.right
-                anchors.verticalCenter: parent.verticalCenter
-                spacing: 10
-                Text {
-                    anchors.verticalCenter: parent.verticalCenter
-                    text: status(SystemSettings.rustdeskActive)
-                    color: Theme.fgDim
-                    font.family: Theme.fontFamily
-                    font.pixelSize: Theme.fontSize
-                }
-                SettingsButton {
-                    text: "Open"
-                    onClicked: SystemSettings.openApplication("rustdesk")
-                }
-            }
-        }
-
-        SettingRow {
-            label: "KDE Connect"
-            detail: "Phone pairing, clipboard, files, and remote controls"
-            divider: false
-            controlWidth: 190
-
-            Row {
-                anchors.right: parent.right
-                anchors.verticalCenter: parent.verticalCenter
-                spacing: 10
-                Text {
-                    anchors.verticalCenter: parent.verticalCenter
-                    text: status(SystemSettings.kdeconnectActive)
-                    color: Theme.fgDim
-                    font.family: Theme.fontFamily
-                    font.pixelSize: Theme.fontSize
-                }
-                SettingsButton {
-                    text: "Open"
-                    onClicked: SystemSettings.openApplication("kdeconnect")
-                }
-            }
-        }
-    }
-
-    SettingsCard {
-        title: "Desktop foundation"
-
-        TextRow {
-            label: "Hyprpaper"
-            detail: "Wallpaper service"
-            value: status(SystemSettings.hyprpaperActive)
-        }
-        TextRow {
-            label: "Hypridle"
-            detail: "Idle and lock policy"
-            value: status(SystemSettings.hypridleActive)
-        }
-        TextRow {
-            label: "Vicinae"
-            detail: "Spotlight-style launcher daemon"
-            value: status(SystemSettings.vicinaeActive)
-            divider: false
-        }
-    }
-
-    SettingsCard {
-        title: "Fedora system settings"
-        subtitle: "Panels this app does not own, because they configure system services rather than the desktop. Each row opens the panel that actually owns it. Printers and online accounts live with the rest of the network hardware, on Network & Devices."
-
-        // This was one row listing five subjects and opening the network panel
-        // regardless. Naming a panel and then not opening it is worse than not
-        // offering it: it looks like a broken button rather than a deliberate
-        // hand-off, and someone looking for printers had to know to navigate
-        // once GNOME Settings appeared on the wrong page.
-        ActionRow {
-            label: "Users"
-            detail: "Accounts, passwords, and automatic login"
-            action: "Open users"
-            onTriggered: SystemSettings.openGnomePanel("system", "users")
-        }
-
-        ActionRow {
-            label: "Sharing"
-            detail: "Remote desktop, media sharing, and remote login"
-            action: "Open sharing"
-            onTriggered: SystemSettings.openGnomePanel("sharing")
-        }
-
-        ActionRow {
-            label: "Colour profiles"
-            detail: "ICC profiles for displays, printers, and scanners"
-            action: "Open colour"
-            onTriggered: SystemSettings.openGnomePanel("color")
-        }
-
-        ActionRow {
-            label: "Digital wellbeing"
-            detail: "Screen time and break reminders"
-            action: "Open wellbeing"
-            divider: false
-            onTriggered: SystemSettings.openGnomePanel("wellbeing")
-        }
-    }
-}
@@ -11,6 +11,19 @@ Rectangle {
        && pageLoader.item.objectName === "home-phone-page"
        ? pageLoader.item.pageDiagnostics
        : ({})
+    readonly property var healthDiagnostics: pageLoader.status === Loader.Ready
+        && pageLoader.item
+        && pageLoader.item.objectName === "system-health-page"
+        ? pageLoader.item.uiDiagnostics()
+        : ({})
+
+    function requestHealthAction(id: string): bool {
+        if (pageLoader.status !== Loader.Ready
+                || !pageLoader.item
+                || pageLoader.item.objectName !== "system-health-page")
+            return false;
+        return pageLoader.item.activateRenderedAction(id);
+    }

    color: Theme.bg
    radius: 18
@@ -102,11 +115,12 @@ Rectangle {
            case "mouse": return mousePage;
            case "privacy": return privacyPage;
            case "region": return regionPage;
+            case "accounts": return onlineAccountsPage;
            case "accessibility": return accessibilityPage;
            case "power": return powerPage;
            case "datetime": return dateTimePage;
            case "applications": return applicationsPage;
-            case "services": return servicesPage;
+            case "services": return healthPage;
            case "about": return aboutPage;
            default: return homePage;
            }
@@ -159,7 +173,8 @@ Rectangle {
    Component { id: mousePage; MousePage {} }
    Component { id: privacyPage; PrivacyPage {} }
    Component { id: regionPage; RegionPage {} }
-    Component { id: servicesPage; ServicesPage {} }
+    Component { id: onlineAccountsPage; OnlineAccountsPage {} }
+    Component { id: healthPage; HealthPage {} }
    Component { id: aboutPage; AboutPage {} }

    Shortcut {
@@ -35,11 +35,12 @@ Rectangle {
        { page: "mouse", label: "Mouse & Touchpad", icon: "\u{F037D}" },
        { page: "privacy", label: "Privacy & Security", icon: "\u{F0483}" },
        { page: "region", label: "Region & Language", icon: "\u{F0AC2}" },
+        { page: "accounts", label: "Online Accounts", icon: "\u{F0004}" },
        { page: "accessibility", label: "Accessibility", icon: "\u{F0208}" },
        { page: "power", label: "Power & Lock", icon: "\u{F0425}" },
        { page: "datetime", label: "Date & Time", icon: "\u{F0954}" },
        { page: "applications", label: "Applications", icon: "\u{F003B}" },
-        { page: "services", label: "Startup & Services", icon: "\u{F0493}" },
+        { page: "services", label: "System Health", icon: "\u{F0493}" },
        { page: "about", label: "About", icon: "\u{F02FD}" }
    ]

@@ -291,8 +292,34 @@ Rectangle {
        anchors.right: parent.right
        anchors.bottom: parent.bottom
        height: 54
-        color: Theme.alpha(Theme.bg, 0.35)
-        border.width: 0
+        activeFocusOnTab: true
+        color: footerTap.hovered || activeFocus
+            ? Theme.alpha(Theme.fg, 0.07)
+            : Theme.alpha(Theme.bg, 0.35)
+        border.width: activeFocus ? 2 : 0
+        border.color: Theme.accent
+
+        function footerText(): string {
+            if (Health.checks.length === 0)
+                return Health.diagnosticUnavailable ? "Health check unavailable" : "Checking the desktop";
+            if (Health.status === "error")
+                return "Desktop needs attention";
+            if (Health.status === "warning") {
+                const count = Health.summary.warnings + Health.summary.errors;
+                return count + (count === 1 ? " health observation" : " health observations");
+            }
+            return "Desktop is healthy";
+        }
+
+        function footerColor(): color {
+            if (Health.checks.length === 0)
+                return Health.diagnosticUnavailable ? Theme.danger : Theme.fgMuted;
+            if (Health.status === "error")
+                return Theme.danger;
+            if (Health.status === "warning")
+                return Theme.warn;
+            return Theme.ok;
+        }

        Rectangle {
            width: 7
@@ -301,17 +328,28 @@ Rectangle {
            anchors.left: parent.left
            anchors.leftMargin: 19
            anchors.verticalCenter: parent.verticalCenter
-            color: Theme.ok
+            color: healthFooter.footerColor()
        }

        Text {
            anchors.left: parent.left
            anchors.leftMargin: 36
+            anchors.right: parent.right
+            anchors.rightMargin: 12
            anchors.verticalCenter: parent.verticalCenter
-            text: "Desktop is healthy"
+            text: healthFooter.footerText()
            color: Theme.fgDim
            font.family: Theme.fontFamily
            font.pixelSize: Theme.fontSizeSmall
+            elide: Text.ElideRight
        }
+
+        TapHandler {
+            id: footerTap
+            onTapped: root.pageRequested("services")
+        }
+
+        Keys.onReturnPressed: root.pageRequested("services")
+        Keys.onSpacePressed: root.pageRequested("services")
    }
 }
@@ -21,6 +21,25 @@ SettingsPage {
    // when nothing is being captured. Held here rather than per row so that
    // starting a new capture cancels any other.
    property string capturingChord: ""
+    readonly property string storedXkbOptions: String(DesktopPreferences.get("keyboardOptions") ?? "")
+
+    function xkbOptions(): var {
+        return root.storedXkbOptions
+            .split(",")
+            .map(option => option.trim())
+            .filter(option => option !== "");
+    }
+
+    function currentXkbOption(prefix: string): string {
+        return root.xkbOptions().find(option => option.indexOf(prefix) === 0) ?? "";
+    }
+
+    function setXkbOption(prefix: string, option: string): void {
+        const options = root.xkbOptions().filter(option => option.indexOf(prefix) !== 0);
+        if (option !== "")
+            options.push(option);
+        SystemSettings.commitPreference("keyboardOptions", options.join(","));
+    }

    title: "Input & Shortcuts"
    lede: "The Forge mental model, carried forward into native tiling."
@@ -35,6 +54,52 @@ SettingsPage {
        // they are real controls.
        TextEntryRow { setting: "keyboardLayout"; placeholder: "us" }
        TextEntryRow { setting: "keyboardVariant"; placeholder: "none" }
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Caps Lock"
+            detail: "Keep it conventional, or turn a prime keyboard position into Escape or Control"
+            current: root.currentXkbOption("caps:")
+            options: [
+                { value: "", label: "Standard" },
+                { value: "caps:escape_shifted_capslock", label: "Esc · Shift for Caps" },
+                { value: "caps:escape", label: "Escape" },
+                { value: "caps:ctrl_modifier", label: "Control" }
+            ]
+            onPicked: value => root.setXkbOption("caps:", value)
+        }
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Compose key"
+            detail: "Type accented characters and symbols with memorable key sequences"
+            current: root.currentXkbOption("compose:")
+            options: [
+                { value: "", label: "Off" },
+                { value: "compose:ralt", label: "Right Alt" },
+                { value: "compose:rwin", label: "Right Super" },
+                { value: "compose:menu", label: "Menu" }
+            ]
+            onPicked: value => root.setXkbOption("compose:", value)
+        }
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Layout switching"
+            detail: "Used when Keyboard layout contains more than one comma-separated layout"
+            current: root.currentXkbOption("grp:")
+            options: [
+                { value: "", label: "Off" },
+                { value: "grp:win_space_toggle", label: "Super + Space" },
+                { value: "grp:alt_shift_toggle", label: "Alt + Shift" },
+                { value: "grp:ctrl_shift_toggle", label: "Ctrl + Shift" },
+                { value: "grp:caps_toggle", label: "Caps Lock" }
+            ]
+            onPicked: value => root.setXkbOption("grp:", value)
+        }
+
+        // Presets preserve every option outside their own category. The raw
+        // value remains visible for less common xkeyboard-config features.
        TextEntryRow { setting: "keyboardOptions"; placeholder: "compose:ralt" }
        SliderRow { setting: "keyRepeatDelay" }
        SliderRow { setting: "keyRepeatRate" }
@@ -31,6 +31,15 @@ SettingsPage {
        }
    }

+    SettingsCard {
+        title: "Applications"
+        subtitle: "Control each application currently playing through PipeWire."
+
+        ApplicationMixer {
+            width: parent.width
+        }
+    }
+
    SettingsCard {
        title: "Sound feedback"
        subtitle: "Use the same event preferences as GTK and GNOME applications."
@@ -67,8 +76,8 @@ SettingsPage {
        title: "Advanced sound"

        ActionRow {
-            label: "Application volumes and profiles"
-            detail: "Open Fedora's complete sound panel"
+            label: "Device profiles"
+            detail: "Open Fedora's complete device profile panel"
            divider: false
            action: "Open panel"
            onTriggered: SystemSettings.openGnomePanel("sound")
@@ -0,0 +1,103 @@
+import QtQuick
+
+import qs.config
+import qs.services
+import qs.widgets
+
+Column {
+    id: root
+
+    property string mode: DesktopPreferences.get("wallpaperMode")
+    property var outputs: Wallpaper.outputNames()
+    property string selectedOutput: root.outputs.length > 0 ? root.outputs[0] : ""
+
+    property var setModeAction: function(mode) { Wallpaper.setMode(mode); }
+    property var setIntervalAction: function(minutes) { Wallpaper.setIntervalMinutes(minutes); }
+    property var setShuffleAction: function(enabled) { Wallpaper.setShuffle(enabled); }
+
+    width: parent ? parent.width : 620
+    spacing: 4
+
+    ChoiceGrid {
+        width: parent.width
+        label: "Wallpaper mode"
+        detail: "Use one image, rotate a collection, or choose per display"
+        options: PreferenceSchema.spec("wallpaperMode").options
+        current: root.mode
+        onPicked: value => root.setModeAction(value)
+    }
+
+    ChoiceGrid {
+        visible: root.mode === "per-monitor"
+        width: parent.width
+        label: "Display"
+        detail: "Choose which display the thumbnail grid assigns"
+        options: root.outputs.map(output => ({ value: output, label: output }))
+        current: root.selectedOutput
+        onPicked: value => root.selectedOutput = value
+    }
+
+    SettingRow {
+        visible: root.mode === "slideshow"
+        label: "Change background every"
+        detail: "Time between slideshow images"
+        controlWidth: 280
+
+        Item {
+            anchors.fill: parent
+
+            ValueSlider {
+                anchors.left: parent.left
+                anchors.right: intervalText.left
+                anchors.rightMargin: 10
+                anchors.verticalCenter: parent.verticalCenter
+                value: (DesktopPreferences.get("wallpaperIntervalMinutes") - 5) / 1435
+                onMoved: ratio => {
+                    const raw = 5 + ratio * 1435;
+                    root.setIntervalAction(Math.max(5, Math.min(1440, Math.round(raw / 5) * 5)));
+                }
+            }
+
+            Text {
+                id: intervalText
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                width: 62
+                text: DesktopPreferences.get("wallpaperIntervalMinutes") + " min"
+                color: Theme.fgDim
+                font.family: Theme.fontMono
+                font.features: Theme.tabularFigures
+                font.pixelSize: Theme.fontSizeSmall
+                horizontalAlignment: Text.AlignRight
+            }
+        }
+    }
+
+    SettingRow {
+        visible: root.mode === "slideshow"
+        label: "Shuffle"
+        detail: "Show every selected image before repeating"
+        divider: false
+        controlWidth: 48
+
+        SettingsToggle {
+            anchors.right: parent.right
+            anchors.verticalCenter: parent.verticalCenter
+            checked: DesktopPreferences.get("wallpaperShuffle") === true
+            onToggled: enabled => root.setShuffleAction(enabled)
+        }
+    }
+
+    Text {
+        width: parent.width
+        visible: root.mode === "slideshow"
+            && (DesktopPreferences.get("wallpaperSlideshowPaths") ?? []).length === 0
+        text: "Select two or more images below to begin a slideshow."
+        color: Theme.fgDim
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSizeSmall
+        horizontalAlignment: Text.AlignHCenter
+        topPadding: 5
+        bottomPadding: 8
+    }
+}
@@ -24,6 +24,14 @@ Item {
    // unreachable without a long scroll past pictures. Two rows by default,
    // all of them on request.
    property bool expanded: false
+    property string mode: DesktopPreferences.get("wallpaperMode")
+    property string selectedOutput: Wallpaper.outputNames()[0] ?? ""
+    property var activeByOutput: Wallpaper.activeByOutput
+    property var slideshowPaths: DesktopPreferences.get("wallpaperSlideshowPaths") ?? []
+    property var assignments: DesktopPreferences.get("wallpaperPerMonitor") ?? ({})
+    property var setSingleAction: function(path) { Wallpaper.setSingle(path); }
+    property var toggleSlideshowAction: function(path) { Wallpaper.toggleSlideshowPath(path); }
+    property var setAssignmentAction: function(output, path) { Wallpaper.setAssignment(output, path); }
    readonly property int collapsedRows: 2

    readonly property var shown: root.expanded
@@ -35,6 +43,27 @@ Item {
    readonly property int columns: Math.max(2, Math.floor(width / 190))
    readonly property real cellWidth: columns > 0 ? (width - (columns - 1) * 10) / columns : 160

+    function isCurrent(path: string): bool {
+        return root.activeByOutput[root.selectedOutput] === path;
+    }
+
+    function selected(path: string): bool {
+        if (root.mode === "slideshow")
+            return root.slideshowPaths.includes(path);
+        if (root.mode === "per-monitor")
+            return root.assignments[root.selectedOutput] === path;
+        return root.isCurrent(path);
+    }
+
+    function activate(path: string): void {
+        if (root.mode === "slideshow")
+            root.toggleSlideshowAction(path);
+        else if (root.mode === "per-monitor")
+            root.setAssignmentAction(root.selectedOutput, path);
+        else
+            root.setSingleAction(path);
+    }
+
    Grid {
        id: grid

@@ -50,7 +79,8 @@ Item {

                required property var modelData

-                readonly property bool current: Wallpaper.active === tile.modelData
+                readonly property bool current: root.isCurrent(tile.modelData)
+                readonly property bool member: root.mode === "slideshow" && root.selected(tile.modelData)

                width: root.cellWidth
                height: Math.round(root.cellWidth * 9 / 16)
@@ -114,6 +144,28 @@ Item {
                    border.color: Theme.accent
                }

+                Rectangle {
+                    anchors.top: parent.top
+                    anchors.right: parent.right
+                    anchors.margins: 8
+                    width: 24
+                    height: 24
+                    radius: 12
+                    visible: tile.member
+                    color: Theme.alpha(Theme.bgDark, 0.82)
+                    border.width: 1
+                    border.color: Theme.alpha(Theme.fg, 0.16)
+
+                    Text {
+                        anchors.centerIn: parent
+                        text: "✓"
+                        color: Theme.fg
+                        font.family: Theme.fontFamily
+                        font.pixelSize: 14
+                        font.weight: Font.DemiBold
+                    }
+                }
+
                Rectangle {
                    anchors.left: parent.left
                    anchors.right: parent.right
@@ -132,7 +184,9 @@ Item {
                        anchors.right: parent.right
                        anchors.bottom: parent.bottom
                        anchors.margins: 7
-                        text: tile.current ? "Current wallpaper" : Wallpaper.titleFor(tile.modelData)
+                        text: tile.current
+                            ? "Current wallpaper"
+                            : (tile.member ? "In slideshow" : Wallpaper.titleFor(tile.modelData))
                        color: tile.current ? Theme.accent : Theme.fg
                        font.family: Theme.fontFamily
                        font.pixelSize: Theme.fontSizeSmall
@@ -144,7 +198,7 @@ Item {
                HoverHandler { id: hover }

                TapHandler {
-                    onTapped: Wallpaper.set(tile.modelData)
+                    onTapped: root.activate(tile.modelData)
                }
            }
        }
@@ -10,7 +10,9 @@ DisplaysPage 1.0 DisplaysPage.qml
 HomePage 1.0 HomePage.qml
 NotificationsPage 1.0 NotificationsPage.qml
 ScreenIntelligencePage 1.0 ScreenIntelligencePage.qml
-ServicesPage 1.0 ServicesPage.qml
+HealthPage 1.0 HealthPage.qml
+HealthSummary 1.0 HealthSummary.qml
+HealthCheckRow 1.0 HealthCheckRow.qml
 SettingRow 1.0 SettingRow.qml
 SettingsCard 1.0 SettingsCard.qml
 SettingsButton 1.0 SettingsButton.qml
@@ -27,22 +29,29 @@ ChoiceRow 1.0 ChoiceRow.qml
 ActionRow 1.0 ActionRow.qml
 TextRow 1.0 TextRow.qml
 DesktopPreview 1.0 DesktopPreview.qml
+LockScreenPreview 1.0 LockScreenPreview.qml
 PowerPage 1.0 PowerPage.qml
 DateTimePage 1.0 DateTimePage.qml
 AccessibilityPage 1.0 AccessibilityPage.qml
 WallpaperPicker 1.0 WallpaperPicker.qml
+WallpaperControls 1.0 WallpaperControls.qml
 ApplicationsPage 1.0 ApplicationsPage.qml
+AutostartAppPicker 1.0 AutostartAppPicker.qml
 DockPinsEditor 1.0 DockPinsEditor.qml
 DockAppPicker 1.0 DockAppPicker.qml
 ShortcutCapture 1.0 ShortcutCapture.qml
 ChoiceGrid 1.0 ChoiceGrid.qml
 DisplayModePicker 1.0 DisplayModePicker.qml
+DisplayArrangement 1.0 DisplayArrangement.qml
+DisplayIdentify 1.0 DisplayIdentify.qml
 WifiPanel 1.0 WifiPanel.qml
 BluetoothPanel 1.0 BluetoothPanel.qml
 PasswordField 1.0 PasswordField.qml
 AudioBalance 1.0 AudioBalance.qml
 SoundDeviceList 1.0 SoundDeviceList.qml
 SoundDeviceRow 1.0 SoundDeviceRow.qml
+ApplicationMixer 1.0 ApplicationMixer.qml
+ApplicationVolumeRow 1.0 ApplicationVolumeRow.qml
 TimeOfDayRow 1.0 TimeOfDayRow.qml
 LocationPicker 1.0 LocationPicker.qml
 FontPicker 1.0 FontPicker.qml
@@ -51,3 +60,4 @@ TextEntryRow 1.0 TextEntryRow.qml
 PrivacyPage 1.0 PrivacyPage.qml
 RegionPage 1.0 RegionPage.qml
 SearchPicker 1.0 SearchPicker.qml
+OnlineAccountsPage 1.0 OnlineAccountsPage.qml
@@ -0,0 +1,129 @@
+// The Alt-Tab overlay.
+//
+// Deliberately a list of names rather than thumbnails: at a glance you are
+// looking for "the other terminal", and a row of small live previews is both
+// slower to read and considerably more expensive to draw than the gesture
+// deserves. The dock already renders app identity this way, so the two agree.
+//
+// Only present while a switch is in progress -- there is nothing to keep alive
+// between gestures, and a hidden always-loaded overlay is a surface that can
+// go wrong while nobody is looking at it.
+
+import Quickshell
+import Quickshell.Wayland
+import QtQuick
+import qs.config
+import qs.services
+import qs.widgets
+
+Loader {
+    id: root
+
+    // Plain `modelData`, not `required property var screen`. Variants supplies
+    // modelData, and shell.qml's own comment warns about exactly this: declaring
+    // `required property var screen` means the screen never resolves, the window
+    // is constructed and silently never maps, and NOTHING is logged. Bar and
+    // Dock both take the screen this way.
+    property var modelData: null
+
+    active: WindowSwitcherState.open
+    asynchronous: false
+
+    sourceComponent: PanelWindow {
+        screen: root.modelData
+        // Overlay so it sits above the focused window it is describing.
+        WlrLayershell.layer: WlrLayer.Overlay
+        WlrLayershell.namespace: "qs-switcher"
+        // Nothing here is clickable: the gesture is driven entirely from the
+        // keyboard, and taking input would steal focus from the compositor
+        // mid-switch, which is the one thing that would break it.
+        WlrLayershell.keyboardFocus: WlrKeyboardFocus.None
+        exclusionMode: ExclusionMode.Ignore
+        color: "transparent"
+
+        anchors { top: true; bottom: true; left: true; right: true }
+
+        Rectangle {
+            anchors.centerIn: parent
+            width: Math.min(560, parent.width - 96)
+            implicitHeight: layout.implicitHeight + 24
+            radius: Theme.cardRadius
+            color: Theme.alpha(Theme.bgPopover, 0.97)
+            border.width: 1
+            border.color: Theme.alpha(Theme.fg, 0.09)
+
+            Column {
+                id: layout
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                anchors.leftMargin: 12
+                anchors.rightMargin: 12
+                spacing: 2
+
+                Repeater {
+                    model: WindowSwitcherState.windows
+
+                    Rectangle {
+                        id: row
+
+                        required property var modelData
+                        required property int index
+
+                        readonly property bool current: row.index === WindowSwitcherState.index
+                        readonly property string appId: row.modelData?.wayland?.appId ?? ""
+                        readonly property var entry: DesktopEntries.heuristicLookup(row.appId)
+
+                        width: parent.width
+                        height: 44
+                        radius: 10
+                        border.width: 0
+                        color: row.current ? Theme.alpha(Theme.accent, 0.20) : "transparent"
+
+                        Image {
+                            id: icon
+                            anchors.left: parent.left
+                            anchors.leftMargin: 10
+                            anchors.verticalCenter: parent.verticalCenter
+                            width: 24
+                            height: 24
+                            sourceSize.width: 24
+                            sourceSize.height: 24
+                            source: row.entry?.icon ? Quickshell.iconPath(row.entry.icon, true) : ""
+                            visible: source !== ""
+                        }
+
+                        Text {
+                            anchors.left: icon.visible ? icon.right : parent.left
+                            anchors.leftMargin: icon.visible ? 12 : 14
+                            anchors.right: appName.left
+                            anchors.rightMargin: 12
+                            anchors.verticalCenter: parent.verticalCenter
+                            // A window with no title yet is still a window you
+                            // can switch to; naming it after its application is
+                            // better than an empty row.
+                            text: row.modelData?.title || row.entry?.name || row.appId
+                            elide: Text.ElideRight
+                            color: row.current ? Theme.fg : Theme.fgDim
+                            font.family: Theme.fontFamily
+                            font.pixelSize: Theme.fontSize
+                            font.weight: row.current ? Font.DemiBold : Font.Normal
+                        }
+
+                        Text {
+                            id: appName
+                            anchors.right: parent.right
+                            anchors.rightMargin: 12
+                            anchors.verticalCenter: parent.verticalCenter
+                            visible: (row.entry?.name ?? "") !== "" && row.entry.name !== row.modelData?.title
+                            text: row.entry?.name ?? ""
+                            color: Theme.fgMuted
+                            font.family: Theme.fontFamily
+                            font.pixelSize: Theme.fontSizeSmall
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+
+"""Online accounts, through GNOME Online Accounts.
+
+GOA is a daemon plus a D-Bus API, and it is already running in this session --
+gvfs activates it, and the four accounts on this machine work without
+gnome-shell involved anywhere. What GNOME owns is only the *panel*; the accounts
+themselves are ordinary D-Bus objects that anything may read and modify.
+
+So everything except the initial sign-in is available to us: listing accounts,
+turning individual services on and off, and removing an account. That is the
+whole Online Accounts panel apart from one OAuth handshake.
+
+Adding an account is the part that splits. The daemon's AddAccount takes
+credentials as an ARGUMENT -- it stores them, it does not obtain them. For
+password-based providers (Nextcloud, IMAP, WebDAV) that is a username and a
+password, which a settings app can reasonably collect. For Google it is an OAuth
+token, and the code that runs that exchange lives in libgoa-backend, which
+Fedora ships without a GIR binding -- reachable from C only. Reimplementing it
+would mean our own Google client credentials. So Google sign-in is handed to
+GNOME's panel, and only the sign-in.
+
+Usage:
+  panama-accounts list
+  panama-accounts set <object-path> <service> <true|false>
+  panama-accounts remove <object-path>
+"""
+
+import json
+import sys
+
+# Every service GOA models. The account object carries one interface per service
+# it supports, so presence of the interface is what "this account can do mail"
+# means -- there is no capability list to read.
+SERVICES = [
+    ("mail", "Mail", "get_mail", "mail_disabled"),
+    ("calendar", "Calendar", "get_calendar", "calendar_disabled"),
+    ("contacts", "Contacts", "get_contacts", "contacts_disabled"),
+    ("files", "Files", "get_files", "files_disabled"),
+    ("photos", "Photos", "get_photos", "photos_disabled"),
+    ("music", "Music", "get_music", "music_disabled"),
+    ("chat", "Chat", "get_chat", "chat_disabled"),
+]
+
+
+def load_client():
+    import gi
+
+    gi.require_version("Goa", "1.0")
+    from gi.repository import Goa
+
+    return Goa.Client.new_sync(None)
+
+
+def describe(obj):
+    account = obj.get_account()
+    services = []
+    for key, label, getter, disabled_prop in SERVICES:
+        if getattr(obj, getter)() is None:
+            continue
+        services.append({
+            "key": key,
+            "label": label,
+            "enabled": not getattr(account.props, disabled_prop),
+        })
+
+    return {
+        "path": obj.get_object_path(),
+        "provider": account.props.provider_type,
+        "providerName": account.props.provider_name,
+        # PresentationIdentity is the human one (an email address); Identity is
+        # the internal handle and is not always readable.
+        "identity": account.props.presentation_identity or account.props.identity,
+        # GOA raises this when stored credentials stop working -- an expired
+        # token, a changed password. It is the one piece of state a user must
+        # act on, and nothing else surfaces it.
+        "needsAttention": bool(account.props.attention_needed),
+        "services": services,
+    }
+
+
+def find(client, path):
+    for obj in client.get_accounts():
+        if obj.get_object_path() == path:
+            return obj
+    return None
+
+
+def main():
+    action = sys.argv[1] if len(sys.argv) > 1 else "list"
+
+    try:
+        client = load_client()
+    except Exception as error:  # noqa: BLE001 - any failure here means "no GOA"
+        # A machine without GOA is a legitimate state, not a crash.
+        print(json.dumps({
+            "accounts": [],
+            "error": f"GNOME Online Accounts is not available: {error}",
+        }))
+        return 0
+
+    if action == "list":
+        print(json.dumps({
+            "accounts": [describe(obj) for obj in client.get_accounts()],
+            "error": "",
+        }))
+        return 0
+
+    if action == "set":
+        if len(sys.argv) != 5:
+            print("usage: panama-accounts set <path> <service> <true|false>", file=sys.stderr)
+            return 2
+        path, service, value = sys.argv[2], sys.argv[3], sys.argv[4]
+        obj = find(client, path)
+        if obj is None:
+            print(f"panama-accounts: no account at {path}", file=sys.stderr)
+            return 1
+        match = next((s for s in SERVICES if s[0] == service), None)
+        if match is None:
+            print(f"panama-accounts: unknown service {service!r}", file=sys.stderr)
+            return 2
+        if getattr(obj, match[2])() is None:
+            print(f"panama-accounts: this account does not support {service}", file=sys.stderr)
+            return 1
+        # The property is "disabled", so enabling a service clears it.
+        setattr(obj.get_account().props, match[3], value.lower() not in ("true", "1", "yes"))
+        return 0
+
+    if action == "remove":
+        if len(sys.argv) != 3:
+            print("usage: panama-accounts remove <path>", file=sys.stderr)
+            return 2
+        obj = find(client, sys.argv[2])
+        if obj is None:
+            print(f"panama-accounts: no account at {sys.argv[2]}", file=sys.stderr)
+            return 1
+        obj.get_account().call_remove_sync(None)
+        return 0
+
+    print("usage: panama-accounts [list|set|remove]", file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -109,6 +109,7 @@ case "$action" in
    clipboard) qs ipc call clipboard open ;;
    overview) qs ipc call overview open ;;
    settings) qs ipc call settings open ;;
+    health) qs ipc call health open ;;

    dnd)
        state="$(qs ipc call notifications dnd)"
@@ -148,7 +149,7 @@ case "$action" in
        ;;
    *)
        printf 'Usage: panama-action {%s}\n' \
-            'control-center|notifications|calendar|clipboard|overview|settings|dnd|caffeine|night-light|focus-start|focus-end|capture|intelligence|screenshot|microphone|gallery|restart-shell' >&2
+            'control-center|notifications|calendar|clipboard|overview|settings|health|dnd|caffeine|night-light|focus-start|focus-end|capture|intelligence|screenshot|microphone|gallery|restart-shell' >&2
        exit 2
        ;;
 esac
@@ -37,8 +37,8 @@ def xdg_data_roots() -> list[Path]:
    return [data_home, *(Path(item) for item in data_dirs.split(":") if item)]


-def discovered_desktop_ids() -> set[str]:
-    desktop_ids: set[str] = set()
+def discovered_desktop_files() -> dict[str, Path]:
+    desktop_files: dict[str, Path] = {}
    for root in xdg_data_roots():
        applications = root / "applications"
        if not applications.is_dir():
@@ -47,8 +47,12 @@ def discovered_desktop_ids() -> set[str]:
            if not path.is_file():
                continue
            relative = path.relative_to(applications)
-            desktop_ids.add("-".join(relative.parts))
-    return desktop_ids
+            desktop_files.setdefault("-".join(relative.parts), path)
+    return desktop_files
+
+
+def discovered_desktop_ids() -> set[str]:
+    return set(discovered_desktop_files())


 def require_desktop_id(desktop_id: str, *, discovered: set[str]) -> None:
@@ -184,12 +188,7 @@ def set_default(role: str, desktop_id: str) -> None:
    run(command)


-def update_hidden(path: Path, *, hidden: bool) -> None:
-    try:
-        original = path.read_text(encoding="utf-8")
-    except (OSError, UnicodeError) as error:
-        raise BoundaryError("That autostart entry could not be read.") from error
-
+def with_hidden(original: str, *, hidden: bool) -> str:
    lines = original.splitlines()
    output: list[str] = []
    section = ""
@@ -216,24 +215,63 @@ def update_hidden(path: Path, *, hidden: bool) -> None:
        raise BoundaryError("That autostart entry is not a desktop file.")
    if not wrote_hidden:
        output.append(f"Hidden={'true' if hidden else 'false'}")
+    return "\n".join(output) + "\n"

-    mode = path.stat().st_mode
+
+def write_atomic(path: Path, text: str, *, mode: int) -> None:
+    temporary_path: Path | None = None
    try:
        with tempfile.NamedTemporaryFile(
            "w", encoding="utf-8", dir=path.parent, prefix=f".{path.name}.", delete=False
        ) as temporary:
-            temporary.write("\n".join(output) + "\n")
+            temporary.write(text)
            temporary.flush()
            os.fsync(temporary.fileno())
            temporary_path = Path(temporary.name)
        temporary_path.chmod(mode)
        os.replace(temporary_path, path)
    except OSError as error:
-        if "temporary_path" in locals():
+        if temporary_path is not None:
            temporary_path.unlink(missing_ok=True)
        raise BoundaryError("That autostart entry could not be updated.") from error


+def update_hidden(path: Path, *, hidden: bool) -> None:
+    try:
+        original = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as error:
+        raise BoundaryError("That autostart entry could not be read.") from error
+
+    mode = path.stat().st_mode
+    write_atomic(path, with_hidden(original, hidden=hidden), mode=mode)
+
+
+def add_autostart(desktop_id: str) -> None:
+    desktop_files = discovered_desktop_files()
+    require_desktop_id(desktop_id, discovered=set(desktop_files))
+    source = desktop_files[desktop_id]
+    directory = autostart_directory()
+    try:
+        directory.mkdir(parents=True, exist_ok=True)
+    except OSError as error:
+        raise BoundaryError("The user autostart directory could not be created.") from error
+
+    target = directory / desktop_id
+    if target.is_symlink():
+        raise BoundaryError("That autostart entry is not available.")
+    if target.exists():
+        if not target.is_file():
+            raise BoundaryError("That autostart entry is not available.")
+        update_hidden(target, hidden=False)
+        return
+
+    try:
+        original = source.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as error:
+        raise BoundaryError("That application could not be read.") from error
+    write_atomic(target, with_hidden(original, hidden=False), mode=0o644)
+
+
 def set_autostart(desktop_id: str, enabled_text: str) -> None:
    if enabled_text not in {"true", "false"}:
        raise BoundaryError("Autostart state must be true or false.")
@@ -260,10 +298,12 @@ def main(arguments: list[str]) -> int:
            set_default(arguments[1], arguments[2])
        elif len(arguments) == 3 and arguments[0] == "set-autostart":
            set_autostart(arguments[1], arguments[2])
+        elif len(arguments) == 2 and arguments[0] == "add-autostart":
+            add_autostart(arguments[1])
        else:
            raise BoundaryError(
                "Usage: panama-default-apps snapshot | set-default ROLE DESKTOP_ID | "
-                "set-autostart DESKTOP_ID true|false"
+                "set-autostart DESKTOP_ID true|false | add-autostart DESKTOP_ID"
            )
    except BoundaryError as error:
        print(str(error), file=sys.stderr)
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+
+"""Report installed cursor and icon themes from the standard XDG roots.
+
+This helper is intentionally read-only and argument-free. Theme paths come
+only from XDG_DATA_HOME and XDG_DATA_DIRS; directory symlinks are not followed.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+from pathlib import Path
+
+
+def icon_roots() -> list[Path]:
+    home = Path(os.environ.get("HOME") or "/nonexistent")
+    data_home = Path(os.environ.get("XDG_DATA_HOME") or home / ".local/share")
+    data_dirs = os.environ.get("XDG_DATA_DIRS") or "/usr/local/share:/usr/share"
+
+    roots = [data_home / "icons"]
+    roots.extend(Path(directory) / "icons" for directory in data_dirs.split(":") if directory)
+    # XDG paths are required to be absolute. Ignoring malformed relative
+    # entries also prevents the helper's working directory becoming an
+    # accidental caller-controlled search root.
+    return [root for root in roots if root.is_absolute()]
+
+
+def is_real_directory(path: Path) -> bool:
+    try:
+        return stat.S_ISDIR(path.lstat().st_mode)
+    except OSError:
+        return False
+
+
+def is_real_file(path: Path) -> bool:
+    try:
+        return stat.S_ISREG(path.lstat().st_mode)
+    except OSError:
+        return False
+
+
+def has_icon_directories(index_path: Path) -> bool:
+    try:
+        with index_path.open(encoding="utf-8", errors="replace") as handle:
+            for raw_line in handle:
+                line = raw_line.strip()
+                if line.startswith(("#", ";")) or "=" not in line:
+                    continue
+                key, value = line.split("=", 1)
+                if key.strip() == "Directories":
+                    return bool(value.strip())
+    except OSError:
+        return False
+    return False
+
+
+def catalog() -> dict[str, list[str]]:
+    cursor_themes: set[str] = set()
+    icon_themes: set[str] = set()
+
+    for root in icon_roots():
+        if not is_real_directory(root):
+            continue
+        try:
+            entries = list(os.scandir(root))
+        except OSError:
+            continue
+
+        for entry in entries:
+            if not entry.is_dir(follow_symlinks=False):
+                continue
+            theme = Path(entry.path)
+            if is_real_directory(theme / "cursors"):
+                cursor_themes.add(entry.name)
+
+            index_path = theme / "index.theme"
+            if is_real_file(index_path) and has_icon_directories(index_path):
+                icon_themes.add(entry.name)
+
+    return {
+        "cursorThemes": sorted(cursor_themes, key=str.casefold),
+        "iconThemes": sorted(icon_themes, key=str.casefold),
+    }
+
+
+def main() -> int:
+    if len(sys.argv) != 1:
+        print("panama-desktop-style takes no arguments", file=sys.stderr)
+        return 2
+    print(json.dumps(catalog(), ensure_ascii=False, separators=(",", ":")))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,909 @@
+#!/usr/bin/env python3
+
+"""Redacted diagnostics and bounded repairs for Panama-owned functionality."""
+
+from __future__ import annotations
+
+import argparse
+import ctypes
+import errno
+import json
+import os
+import re
+import secrets
+import signal
+import shutil
+import subprocess
+import sys
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from types import MappingProxyType
+from typing import Callable, Literal
+
+Status = Literal["ok", "warning", "error", "unconfigured"]
+Group = Literal["desktop-foundation", "input-media", "integrations", "panama-tools"]
+ActionKind = Literal["repair", "open", "instructions"]
+InhibitorRow = tuple[str, str, str, str, str, str, str, str]
+
+AT_FDCWD = -100
+RENAME_NOREPLACE = 1
+RENAME_EXCHANGE = 2
+
+
+@dataclass(frozen=True)
+class Action:
+    kind: ActionKind
+    label: str
+    confirm: bool = False
+    # Only authored Settings page IDs and instruction IDs are allowed here.
+    # Repair commands never receive a caller-controlled target.
+    target: str | None = None
+
+
+@dataclass(frozen=True)
+class Check:
+    id: str
+    group: Group
+    title: str
+    status: Status
+    detail: str
+    action: Action | None = None
+
+
+@dataclass(frozen=True)
+class DoctorConfig:
+    root: Path
+    home: Path
+    config_home: Path
+    state_home: Path
+    runtime_dir: Path
+    path: str
+    timeout: float
+
+    @property
+    def command_env(self) -> dict[str, str]:
+        environment = {
+            "PATH": self.path,
+            "HOME": str(self.home),
+            "XDG_CONFIG_HOME": str(self.config_home),
+            "XDG_STATE_HOME": str(self.state_home),
+            "XDG_RUNTIME_DIR": str(self.runtime_dir),
+        }
+        for name in PROBE_ENVIRONMENT_KEYS:
+            if value := os.environ.get(name):
+                environment[name] = value
+        return environment
+
+
+@dataclass(frozen=True)
+class CommandResult:
+    state: Literal["ok", "missing", "timeout", "failed", "unavailable"]
+    stdout: str = ""
+
+
+@dataclass(frozen=True)
+class RepairResult:
+    check_id: str
+    accepted: bool
+    exit_code: int
+    message: str
+
+    def as_json(self) -> dict[str, object]:
+        return {
+            "schemaVersion": 1,
+            "checkId": self.check_id,
+            "accepted": self.accepted,
+            "exitCode": self.exit_code,
+            "message": self.message,
+        }
+
+
+CHECK_ORDER = (
+    "desktop.hyprland", "desktop.quickshell", "desktop.notifications", "desktop.portals",
+    "desktop.hyprpaper", "desktop.hypridle", "desktop.hyprlock", "desktop.vicinae", "input.pipewire",
+    "input.clipboard", "input.wallpaper", "input.capture", "input.ocr", "input.brightness",
+    "integration.nextcloud", "integration.rustdesk", "integration.kdeconnect", "integration.bluebubbles",
+    "integration.home-assistant", "integration.calendar", "panama.runtime-links", "panama.vicinae-commands",
+    "panama.selected-terminal", "panama.selected-launcher", "panama.processes", "panama.caffeine",
+)
+
+SYSTEMCTL_COMMANDS = {
+    "hyprpaper": ("systemctl", "--user", "is-active", "--quiet", "hyprpaper.service"),
+    "hypridle": ("systemctl", "--user", "is-active", "--quiet", "hypridle.service"),
+    "vicinae": ("systemctl", "--user", "is-active", "--quiet", "vicinae.service"),
+    "pipewire": ("systemctl", "--user", "is-active", "--quiet", "pipewire.service"),
+    "nextcloud": ("systemctl", "--user", "is-active", "--quiet", "nextcloud.service"),
+    "rustdesk": ("systemctl", "--user", "is-active", "--quiet", "rustdesk.service"),
+}
+REPAIR_COMMANDS = MappingProxyType({
+    "desktop.hyprpaper": ("systemctl", "--user", "restart", "hyprpaper.service"),
+    "desktop.hypridle": ("systemctl", "--user", "restart", "hypridle.service"),
+    "desktop.vicinae": ("systemctl", "--user", "restart", "vicinae.service"),
+    "desktop.quickshell": ("panama-action", "restart-shell"),
+})
+RUNTIME_LINK_TARGETS = (
+    ("hypr", Path("config/dot/hypr")),
+    ("quickshell", Path("config/dot/quickshell")),
+    ("uwsm", Path("config/dot/uwsm")),
+    ("vicinae", Path("config/dot/vicinae")),
+)
+REPAIR_IDS = frozenset((*REPAIR_COMMANDS.keys(), "panama.runtime-links", "panama.vicinae-commands", "panama.caffeine"))
+PROCESS_NAMES = ("vicinae", "hyprpaper", "hypridle")
+VERSION_PATTERN = re.compile(r"\b\d+(?:\.\d+){0,3}(?:[-+._][A-Za-z0-9._-]+)?\b")
+REVISION_PATTERN = re.compile(r"\b[0-9a-f]{7,40}\b", re.IGNORECASE)
+PROBE_ENVIRONMENT_KEYS = (
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TZ",
+    "DBUS_SESSION_BUS_ADDRESS",
+    "WAYLAND_DISPLAY",
+    "DISPLAY",
+    "XAUTHORITY",
+    "PANAMA_DOCTOR_FIXTURE_STOPPED",
+    "PANAMA_DOCTOR_FIXTURE_PROCESSES",
+    "PANAMA_DOCTOR_FIXTURE_BUS",
+    "PANAMA_DOCTOR_FIXTURE_QS",
+    "PANAMA_DOCTOR_FIXTURE_QS_VERSION",
+    "PANAMA_DOCTOR_FIXTURE_BLUEBUBBLES",
+    "PANAMA_DOCTOR_FIXTURE_CALENDAR",
+    "PANAMA_DOCTOR_FIXTURE_BRIGHTNESS",
+    "PANAMA_DOCTOR_FIXTURE_CAFFEINE",
+)
+CHECK_TITLES = {
+    "desktop.hyprland": "Hyprland",
+    "desktop.quickshell": "Quickshell",
+    "desktop.notifications": "Notifications",
+    "desktop.portals": "Desktop portals",
+    "desktop.hyprpaper": "Hyprpaper",
+    "desktop.hypridle": "Hypridle",
+    "desktop.hyprlock": "Lock screen",
+    "desktop.vicinae": "Vicinae",
+    "input.pipewire": "PipeWire",
+    "input.clipboard": "Clipboard",
+    "input.wallpaper": "Wallpaper",
+    "input.capture": "Capture",
+    "input.ocr": "OCR",
+    "input.brightness": "External monitor brightness",
+    "integration.nextcloud": "Nextcloud",
+    "integration.rustdesk": "RustDesk",
+    "integration.kdeconnect": "KDE Connect",
+    "integration.bluebubbles": "BlueBubbles",
+    "integration.home-assistant": "Home Assistant",
+    "integration.calendar": "Calendar",
+    "panama.runtime-links": "Panama runtime links",
+    "panama.vicinae-commands": "Panama commands",
+    "panama.selected-terminal": "Selected terminal",
+    "panama.selected-launcher": "Selected launcher",
+    "panama.processes": "Panama processes",
+    "panama.caffeine": "Caffeine inhibitor",
+}
+
+
+def environment_path(name: str, default: Path) -> Path:
+    value = os.environ.get(name)
+    return Path(value).expanduser() if value else default
+
+
+def config_from_environment() -> DoctorConfig:
+    home = environment_path("PANAMA_DOCTOR_HOME", Path.home())
+    config_home = environment_path("PANAMA_DOCTOR_CONFIG_HOME", Path(os.environ.get("XDG_CONFIG_HOME", home / ".config")))
+    state_home = environment_path("PANAMA_DOCTOR_STATE_HOME", Path(os.environ.get("XDG_STATE_HOME", home / ".local/state")))
+    runtime_dir = environment_path("PANAMA_DOCTOR_RUNTIME_DIR", Path(os.environ.get("XDG_RUNTIME_DIR", "/run/user/0")))
+    root = environment_path("PANAMA_DOCTOR_ROOT", Path(__file__).resolve().parents[4])
+    try:
+        timeout = float(os.environ.get("PANAMA_DOCTOR_TIMEOUT", "3"))
+    except ValueError:
+        timeout = 3.0
+    return DoctorConfig(root, home, config_home, state_home, runtime_dir, os.environ.get("PANAMA_DOCTOR_PATH", os.environ.get("PATH", "")), max(0.05, min(timeout, 15.0)))
+
+
+def run_command(command: tuple[str, ...], config: DoctorConfig, cwd: Path | None = None) -> CommandResult:
+    """Run an authored read-only command without reporting its unparsed output."""
+    try:
+        completed = subprocess.run(command, capture_output=True, text=True, timeout=config.timeout, check=False, env=config.command_env, cwd=cwd)
+    except FileNotFoundError:
+        return CommandResult("missing")
+    except subprocess.TimeoutExpired:
+        return CommandResult("timeout")
+    except OSError:
+        return CommandResult("unavailable")
+    if completed.returncode != 0:
+        return CommandResult("failed")
+    return CommandResult("ok", completed.stdout)
+
+
+def run_repair_command(command: tuple[str, ...], config: DoctorConfig, cwd: Path | None = None) -> tuple[int, str]:
+    """Execute one authored repair argv and retain output only for strict parsing."""
+    try:
+        completed = subprocess.run(
+            command,
+            capture_output=True,
+            text=True,
+            timeout=config.timeout,
+            check=False,
+            env=config.command_env,
+            cwd=cwd,
+        )
+    except FileNotFoundError:
+        return 127, ""
+    except subprocess.TimeoutExpired:
+        return 124, ""
+    except OSError:
+        return 126, ""
+    exit_code = completed.returncode if 0 <= completed.returncode <= 255 else 1
+    return exit_code, completed.stdout
+
+
+def executable_exists(name: str, config: DoctorConfig) -> bool:
+    return shutil.which(name, path=config.path) is not None
+
+
+def action_json(action: Action) -> dict[str, object]:
+    result: dict[str, object] = {"kind": action.kind, "label": action.label, "confirm": action.confirm}
+    if action.target is not None:
+        result["target"] = action.target
+    return result
+
+
+def check_json(check: Check) -> dict[str, object]:
+    result: dict[str, object] = {"id": check.id, "group": check.group, "title": check.title, "status": check.status, "detail": check.detail}
+    if check.action is not None:
+        result["action"] = action_json(check.action)
+    return result
+
+
+def group_for(check_id: str) -> Group:
+    if check_id.startswith("desktop."):
+        return "desktop-foundation"
+    if check_id.startswith("input."):
+        return "input-media"
+    if check_id.startswith("integration."):
+        return "integrations"
+    return "panama-tools"
+
+
+def service_check(check_id: str, title: str, service: str, config: DoctorConfig, action: Action | None = None) -> Check:
+    result = run_command(SYSTEMCTL_COMMANDS[service], config)
+    if result.state == "ok":
+        return Check(check_id, group_for(check_id), title, "ok", "Service is active.")
+    if result.state in {"missing", "unavailable"}:
+        return Check(check_id, group_for(check_id), title, "error", "Required system service probe is unavailable.")
+    return Check(check_id, group_for(check_id), title, "warning", "Service is not active.", action)
+
+
+def ipc_target(config: DoctorConfig, target: str) -> CommandResult:
+    result = run_command(("qs", "ipc", "show"), config)
+    if result.state != "ok":
+        return result
+    return CommandResult("ok") if f"target {target}" in result.stdout.splitlines() else CommandResult("failed")
+
+
+def simple_ipc_check(check_id: str, title: str, target: str, config: DoctorConfig) -> Check:
+    result = ipc_target(config, target)
+    if result.state == "ok":
+        return Check(check_id, "input-media", title, "ok", "Panama IPC target is available.")
+    if result.state == "missing":
+        return Check(check_id, "input-media", title, "error", "Required Quickshell executable is unavailable.")
+    if result.state == "timeout":
+        return Check(check_id, "input-media", title, "warning", "Panama IPC probe timed out.")
+    return Check(check_id, "input-media", title, "warning", "Panama IPC target is unavailable.")
+
+
+def check_hyprland(config: DoctorConfig) -> Check:
+    if "hyprland" in os.environ.get("XDG_CURRENT_DESKTOP", "").casefold():
+        return Check("desktop.hyprland", "desktop-foundation", "Hyprland", "ok", "Hyprland session detected.")
+    return Check("desktop.hyprland", "desktop-foundation", "Hyprland", "error", "Hyprland session is not active.")
+
+
+def check_quickshell(config: DoctorConfig) -> Check:
+    result = run_command(("qs", "--version"), config)
+    repair = Action("repair", "Restart Panama", True)
+    if result.state == "ok" and VERSION_PATTERN.search(result.stdout):
+        return Check("desktop.quickshell", "desktop-foundation", "Quickshell", "ok", "Quickshell executable is available.")
+    if result.state == "missing":
+        return Check("desktop.quickshell", "desktop-foundation", "Quickshell", "error", "Required Quickshell executable is unavailable.", repair)
+    return Check("desktop.quickshell", "desktop-foundation", "Quickshell", "warning", "Quickshell probe returned an invalid result.", repair)
+
+
+def check_notifications(config: DoctorConfig) -> Check:
+    result = ipc_target(config, "notifications")
+    return Check("desktop.notifications", "desktop-foundation", "Notifications", "ok", "Notification service is available.") if result.state == "ok" else Check("desktop.notifications", "desktop-foundation", "Notifications", "warning", "Notification service is unavailable.")
+
+
+def check_portals(config: DoctorConfig) -> Check:
+    result = run_command(("busctl", "--user", "--no-pager", "list"), config)
+    if result.state == "ok" and any(line.startswith("org.freedesktop.portal.Desktop ") for line in result.stdout.splitlines()):
+        return Check("desktop.portals", "desktop-foundation", "Desktop portals", "ok", "Desktop portal service is available.")
+    detail = "Desktop portal probe timed out." if result.state == "timeout" else "Desktop portal probe is unavailable." if result.state == "missing" else "Desktop portal service is unavailable."
+    return Check("desktop.portals", "desktop-foundation", "Desktop portals", "warning", detail)
+
+
+def check_hyprlock(config: DoctorConfig) -> Check:
+    helper = config.root / "config/dot/quickshell/scripts/panama-lock"
+    tracked_fallback = config.config_home / "hypr/hyprlock.conf"
+    generated_config = config.state_home / "panama/hyprlock.conf"
+    # The doctor seals PATH for every probe. Invoke the authored helper with a
+    # fixed system-only PATH so its bash shebang and jq dependency remain
+    # available without inheriting arbitrary parent executables.
+    result = run_command(("/usr/bin/env", "PATH=/usr/bin:/bin", str(helper), "status"), config)
+
+    if result.state != "ok":
+        if tracked_fallback.is_file():
+            return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "warning", "Managed lock-screen status is unavailable; the tracked fallback remains available.")
+        return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "error", "No usable lock-screen configuration is available.")
+
+    try:
+        state = json.loads(result.stdout)
+        generated = state["generated"]
+        path = state["path"]
+        fallback = state["fallback"]
+        error = state["error"]
+        if not isinstance(generated, bool) or not isinstance(path, str) \
+                or not isinstance(fallback, bool) or not isinstance(error, str):
+            raise ValueError
+    except (json.JSONDecodeError, KeyError, TypeError, ValueError):
+        if tracked_fallback.is_file():
+            return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "warning", "Managed lock-screen status is invalid; the tracked fallback remains available.")
+        return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "error", "No usable lock-screen configuration is available.")
+
+    if generated and not fallback and generated_config.is_file():
+        return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "ok", "Managed lock-screen configuration is available.")
+    if tracked_fallback.is_file():
+        return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "warning", "The tracked lock-screen fallback is in use.")
+    return Check("desktop.hyprlock", "desktop-foundation", "Lock screen", "error", "No usable lock-screen configuration is available.")
+
+
+def check_brightness(config: DoctorConfig) -> Check:
+    result = run_command(("panama-brightness", "list"), config)
+    instructions = Action("instructions", "View setup instructions", target="ddc-permissions")
+    if result.state == "timeout":
+        return Check("input.brightness", "input-media", "External monitor brightness", "warning", "DDC/CI probe timed out.", instructions)
+    if result.state != "ok":
+        return Check("input.brightness", "input-media", "External monitor brightness", "warning", "DDC/CI support is unavailable.", instructions)
+    try:
+        listing = json.loads(result.stdout)
+        displays, error = listing["displays"], listing["error"]
+        if not isinstance(displays, list) or not isinstance(error, str):
+            raise ValueError
+    except (json.JSONDecodeError, KeyError, TypeError, ValueError):
+        return Check("input.brightness", "input-media", "External monitor brightness", "warning", "DDC/CI probe returned an invalid result.", instructions)
+    if error:
+        return Check("input.brightness", "input-media", "External monitor brightness", "warning", "No accessible DDC/CI bus.", instructions)
+    if not displays:
+        return Check("input.brightness", "input-media", "External monitor brightness", "unconfigured", "No DDC/CI display is configured.")
+    return Check("input.brightness", "input-media", "External monitor brightness", "ok", f"{len(displays)} DDC/CI display{'s' if len(displays) != 1 else ''} available.")
+
+
+def check_nextcloud(config: DoctorConfig) -> Check:
+    if not (config.config_home / "autostart" / "nextcloud.desktop").is_file():
+        return Check("integration.nextcloud", "integrations", "Nextcloud", "unconfigured", "Nextcloud autostart is not configured.")
+    return service_check("integration.nextcloud", "Nextcloud", "nextcloud", config, Action("open", "Open Nextcloud"))
+
+
+def check_rustdesk(config: DoctorConfig) -> Check:
+    if not executable_exists("rustdesk", config):
+        return Check("integration.rustdesk", "integrations", "RustDesk", "unconfigured", "RustDesk is not installed.")
+    return service_check("integration.rustdesk", "RustDesk", "rustdesk", config, Action("open", "Open RustDesk"))
+
+
+def check_kdeconnect(config: DoctorConfig) -> Check:
+    if not executable_exists("kdeconnect-cli", config):
+        return Check("integration.kdeconnect", "integrations", "KDE Connect", "unconfigured", "KDE Connect is not installed.")
+    result = run_command(("busctl", "--user", "--no-pager", "list"), config)
+    if result.state == "ok" and any(line.startswith("org.kde.kdeconnect ") for line in result.stdout.splitlines()):
+        return Check("integration.kdeconnect", "integrations", "KDE Connect", "ok", "KDE Connect service is available.")
+    return Check("integration.kdeconnect", "integrations", "KDE Connect", "warning", "KDE Connect service is unavailable.", Action("open", "Open KDE Connect"))
+
+
+def check_bluebubbles(config: DoctorConfig) -> Check:
+    result = run_command(("flatpak", "info", "app.bluebubbles.BlueBubbles"), config)
+    if result.state == "ok":
+        return Check("integration.bluebubbles", "integrations", "BlueBubbles", "ok", "BlueBubbles is installed.")
+    if result.state in {"missing", "failed"}:
+        return Check("integration.bluebubbles", "integrations", "BlueBubbles", "unconfigured", "BlueBubbles is not installed.")
+    return Check("integration.bluebubbles", "integrations", "BlueBubbles", "warning", "BlueBubbles installation probe timed out.", Action("open", "Open BlueBubbles"))
+
+
+def check_home_assistant(config: DoctorConfig) -> Check:
+    configured = all(name in os.environ for name in ("PANAMA_HOME_ASSISTANT_URL", "PANAMA_HOME_ASSISTANT_TOKEN"))
+    helper = config.config_home / "quickshell" / "scripts" / "panama-home-assistant"
+    if not configured:
+        return Check("integration.home-assistant", "integrations", "Home Assistant", "unconfigured", "Home Assistant is not configured.")
+    if not helper.is_file():
+        return Check("integration.home-assistant", "integrations", "Home Assistant", "warning", "Home Assistant bridge is unavailable.", Action("open", "Open Home settings", target="home-phone"))
+    return Check("integration.home-assistant", "integrations", "Home Assistant", "ok", "Home Assistant credentials are configured.")
+
+
+def check_calendar(config: DoctorConfig) -> Check:
+    result = run_command(("calendar-agenda", "probe"), config)
+    action = Action("open", "Open Date & Time", target="datetime")
+    if result.state == "missing":
+        return Check("integration.calendar", "integrations", "Calendar", "unconfigured", "Calendar integration is not installed.")
+    if result.state == "timeout":
+        return Check("integration.calendar", "integrations", "Calendar", "warning", "Calendar probe timed out.", action)
+    if result.state != "ok":
+        return Check("integration.calendar", "integrations", "Calendar", "warning", "Calendar probe failed.", action)
+    try:
+        enabled_sources = json.loads(result.stdout)["enabledSources"]
+        if not isinstance(enabled_sources, int) or isinstance(enabled_sources, bool):
+            raise ValueError
+    except (json.JSONDecodeError, KeyError, TypeError, ValueError):
+        return Check("integration.calendar", "integrations", "Calendar", "warning", "Calendar probe returned an invalid result.", action)
+    if enabled_sources <= 0:
+        return Check("integration.calendar", "integrations", "Calendar", "unconfigured", "No enabled calendar source is configured.")
+    return Check("integration.calendar", "integrations", "Calendar", "ok", f"{enabled_sources} enabled calendar source{'s' if enabled_sources != 1 else ''} configured.")
+
+
+def check_runtime_links(config: DoctorConfig) -> Check:
+    def valid_link(name: str, relative_source: Path) -> bool:
+        destination = config.config_home / name
+        source = config.root / relative_source
+        try:
+            return source.is_dir() and destination.is_symlink() \
+                and destination.resolve(strict=False) == source.resolve(strict=True)
+        except OSError:
+            return False
+
+    if any(not valid_link(name, relative_source) for name, relative_source in RUNTIME_LINK_TARGETS):
+        return Check("panama.runtime-links", "panama-tools", "Panama runtime links", "warning", "One or more Panama runtime links are unavailable.", Action("repair", "Repair runtime links"))
+    return Check("panama.runtime-links", "panama-tools", "Panama runtime links", "ok", "Panama runtime links are available.")
+
+
+def check_vicinae_commands(config: DoctorConfig) -> Check:
+    source = config.root / "config/local/share/vicinae/scripts"
+    installed = config.home / ".local/share/vicinae/scripts/panama"
+    try:
+        linked = source.is_dir() and installed.is_symlink() \
+            and installed.resolve(strict=False) == source.resolve(strict=True)
+    except OSError:
+        linked = False
+    if linked:
+        return Check("panama.vicinae-commands", "panama-tools", "Panama commands", "ok", "Panama Vicinae commands are linked.")
+    return Check("panama.vicinae-commands", "panama-tools", "Panama commands", "warning", "Panama Vicinae commands are not linked.", Action("repair", "Repair command link"))
+
+
+def executable_check(check_id: str, title: str, executable: str, config: DoctorConfig) -> Check:
+    if executable_exists(executable, config):
+        return Check(check_id, group_for(check_id), title, "ok", f"{title} executable is available.")
+    return Check(check_id, group_for(check_id), title, "warning", f"{title} executable is unavailable.")
+
+
+def check_processes(config: DoctorConfig) -> Check:
+    # `qs` is both the long-running shell and every short-lived IPC client.
+    # Counting it with pgrep races the other parallel health probes and reports
+    # duplicates whenever one of them happens to call `qs ipc`. The instance
+    # list is the authoritative view and contains only actual shells.
+    quickshell = run_command(("qs", "list"), config)
+    if quickshell.state == "ok":
+        quickshell_count = sum(
+            line.startswith("Instance ") for line in quickshell.stdout.splitlines()
+        )
+    elif quickshell.state == "failed":
+        quickshell_count = 0
+    else:
+        return Check("panama.processes", "panama-tools", "Panama processes", "warning", "Process probe is unavailable.")
+
+    counts: list[int] = [quickshell_count]
+    for name in PROCESS_NAMES:
+        result = run_command(("pgrep", "-u", str(os.getuid()), "-x", name), config)
+        if result.state == "ok":
+            pids = result.stdout.splitlines()
+            if not pids or any(not pid.isdecimal() for pid in pids):
+                return Check("panama.processes", "panama-tools", "Panama processes", "warning", "Process probe returned an invalid result.")
+            counts.append(len(pids))
+        elif result.state == "failed":
+            counts.append(0)
+        else:
+            return Check("panama.processes", "panama-tools", "Panama processes", "warning", "Process probe is unavailable.")
+    if any(count > 1 for count in counts):
+        return Check("panama.processes", "panama-tools", "Panama processes", "warning", "Duplicate Panama desktop processes detected.")
+    if counts[0] == 0:
+        return Check("panama.processes", "panama-tools", "Panama processes", "error", "Quickshell process is not running.")
+    return Check("panama.processes", "panama-tools", "Panama processes", "ok", "Panama desktop process counts are normal.")
+
+
+def check_caffeine(config: DoctorConfig) -> Check:
+    result = run_command(("systemd-inhibit", "--list", "--no-pager", "--no-legend"), config)
+    if result.state != "ok":
+        return Check("panama.caffeine", "panama-tools", "Caffeine inhibitor", "warning", "Caffeine inhibitor probe is unavailable.")
+    inhibitor_rows = parse_caffeine_rows(result.stdout, str(os.getuid()))
+    if inhibitor_rows is None:
+        return Check("panama.caffeine", "panama-tools", "Caffeine inhibitor", "warning", "Caffeine inhibitor probe returned an invalid result.")
+    inhibitors = len(dict.fromkeys(int(row[3]) for row in inhibitor_rows))
+    if inhibitors > 1:
+        return Check("panama.caffeine", "panama-tools", "Caffeine inhibitor", "warning", "Duplicate Panama Caffeine inhibitors detected.", Action("repair", "Release duplicate inhibitors"))
+    if inhibitors == 1:
+        return Check("panama.caffeine", "panama-tools", "Caffeine inhibitor", "ok", "One Panama Caffeine inhibitor is active.")
+    return Check("panama.caffeine", "panama-tools", "Caffeine inhibitor", "ok", "No Panama Caffeine inhibitor is active.")
+
+
+def parse_version(result: CommandResult, pattern: re.Pattern[str] = VERSION_PATTERN) -> str:
+    match = pattern.search(result.stdout) if result.state == "ok" else None
+    return match.group(0) if match else "unavailable"
+
+
+def context_versions(config: DoctorConfig) -> list[dict[str, str]]:
+    hyprland = run_command(("hyprctl", "version"), config)
+    quickshell = run_command(("qs", "--version"), config)
+    revision = run_command(("git", "rev-parse", "--short", "HEAD"), config, config.root)
+    fedora = "unavailable"
+    try:
+        match = re.search(r"^VERSION_ID=\"?([^\n\"]+)", Path("/etc/os-release").read_text(encoding="utf-8"), re.MULTILINE)
+        if match and re.fullmatch(r"[0-9.]+", match.group(1)):
+            fedora = match.group(1)
+    except OSError:
+        pass
+    return [{"id": "hyprland", "version": parse_version(hyprland)}, {"id": "quickshell", "version": parse_version(quickshell)}, {"id": "fedora", "version": fedora}, {"id": "panama", "version": parse_version(revision, REVISION_PATTERN)}]
+
+
+def unavailable_check(check_id: str) -> Check:
+    return Check(check_id, group_for(check_id), CHECK_TITLES[check_id], "warning", "Diagnostic probe could not be completed.")
+
+
+def unavailable_versions() -> list[dict[str, str]]:
+    return [{"id": name, "version": "unavailable"} for name in ("hyprland", "quickshell", "fedora", "panama")]
+
+
+def collect_checks(config: DoctorConfig) -> list[Check]:
+    probes: dict[str, Callable[[], Check]] = {
+        "desktop.hyprland": lambda: check_hyprland(config), "desktop.quickshell": lambda: check_quickshell(config), "desktop.notifications": lambda: check_notifications(config), "desktop.portals": lambda: check_portals(config),
+        "desktop.hyprpaper": lambda: service_check("desktop.hyprpaper", "Hyprpaper", "hyprpaper", config, Action("repair", "Restart Hyprpaper")), "desktop.hypridle": lambda: service_check("desktop.hypridle", "Hypridle", "hypridle", config, Action("repair", "Restart Hypridle")), "desktop.hyprlock": lambda: check_hyprlock(config), "desktop.vicinae": lambda: service_check("desktop.vicinae", "Vicinae", "vicinae", config, Action("repair", "Restart Vicinae")), "input.pipewire": lambda: service_check("input.pipewire", "PipeWire", "pipewire", config),
+        "input.clipboard": lambda: simple_ipc_check("input.clipboard", "Clipboard", "clipboard", config), "input.wallpaper": lambda: simple_ipc_check("input.wallpaper", "Wallpaper", "wallpaper", config), "input.capture": lambda: simple_ipc_check("input.capture", "Capture", "capture", config), "input.ocr": lambda: executable_check("input.ocr", "OCR", "tesseract", config), "input.brightness": lambda: check_brightness(config),
+        "integration.nextcloud": lambda: check_nextcloud(config), "integration.rustdesk": lambda: check_rustdesk(config), "integration.kdeconnect": lambda: check_kdeconnect(config), "integration.bluebubbles": lambda: check_bluebubbles(config), "integration.home-assistant": lambda: check_home_assistant(config), "integration.calendar": lambda: check_calendar(config),
+        "panama.runtime-links": lambda: check_runtime_links(config), "panama.vicinae-commands": lambda: check_vicinae_commands(config), "panama.selected-terminal": lambda: executable_check("panama.selected-terminal", "Selected terminal", "kitty", config), "panama.selected-launcher": lambda: executable_check("panama.selected-launcher", "Selected launcher", "vicinae", config), "panama.processes": lambda: check_processes(config), "panama.caffeine": lambda: check_caffeine(config),
+    }
+    with ThreadPoolExecutor(max_workers=8) as executor:
+        futures = {check_id: executor.submit(probes[check_id]) for check_id in CHECK_ORDER}
+        checks: list[Check] = []
+        for check_id in CHECK_ORDER:
+            try:
+                checks.append(futures[check_id].result())
+            except Exception:
+                checks.append(unavailable_check(check_id))
+        return checks
+
+
+def snapshot(config: DoctorConfig) -> dict[str, object]:
+    try:
+        checks = collect_checks(config)
+    except Exception:
+        checks = [unavailable_check(check_id) for check_id in CHECK_ORDER]
+    counts = {status: sum(check.status == status for check in checks) for status in ("ok", "warning", "error", "unconfigured")}
+    overall: Literal["healthy", "warning", "error"] = "error" if counts["error"] else "warning" if counts["warning"] else "healthy"
+    session = "hyprland" if "hyprland" in os.environ.get("XDG_CURRENT_DESKTOP", "").casefold() else "other"
+    try:
+        versions = context_versions(config)
+    except Exception:
+        versions = unavailable_versions()
+    return {"schemaVersion": 1, "generatedAt": datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z"), "summary": {"status": overall, "healthy": counts["ok"], "warnings": counts["warning"], "errors": counts["error"], "unconfigured": counts["unconfigured"]}, "context": {"session": session, "versions": versions}, "checks": [check_json(check) for check in checks]}
+
+
+def repair_authored_command(check_id: str, config: DoctorConfig) -> RepairResult:
+    command = REPAIR_COMMANDS[check_id]
+    exit_code, _ = run_repair_command(command, config)
+    message = "Repair completed. A fresh health check will verify recovery." if exit_code == 0 \
+        else "The authored repair command could not be completed."
+    return RepairResult(check_id, True, exit_code, message)
+
+
+def lexical_path(path: Path) -> Path:
+    """Normalize dot segments without following any filesystem symlink."""
+    return Path(os.path.abspath(os.fspath(path)))
+
+
+def lexical_link_target(destination: Path) -> Path:
+    target = Path(os.readlink(destination))
+    return lexical_path(target if target.is_absolute() else destination.parent / target)
+
+
+def renameat2(source: Path, destination: Path, flags: int) -> None:
+    """Call Linux renameat2 with fixed flags selected by authored code."""
+    libc = ctypes.CDLL(None, use_errno=True)
+    function = getattr(libc, "renameat2", None)
+    if function is None:
+        raise OSError(errno.ENOSYS, "renameat2 is unavailable")
+    function.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
+    function.restype = ctypes.c_int
+    result = function(
+        AT_FDCWD,
+        os.fsencode(source),
+        AT_FDCWD,
+        os.fsencode(destination),
+        flags,
+    )
+    if result != 0:
+        error = ctypes.get_errno()
+        raise OSError(error, os.strerror(error), destination)
+
+
+def rename_exchange(source: Path, destination: Path) -> None:
+    renameat2(source, destination, RENAME_EXCHANGE)
+
+
+def rename_noreplace(source: Path, destination: Path) -> None:
+    renameat2(source, destination, RENAME_NOREPLACE)
+
+
+def create_symlink_candidate(destination: Path, source: Path) -> Path:
+    """Create one unpredictable authored sibling candidate symlink."""
+    for _ in range(32):
+        candidate = destination.with_name(
+            f".panama-link-{destination.name}-{os.getpid()}-{secrets.token_hex(8)}"
+        )
+        try:
+            os.symlink(source, candidate, target_is_directory=True)
+            return candidate
+        except FileExistsError:
+            continue
+    raise OSError("Could not allocate an authored temporary link")
+
+
+def cleanup_candidate(candidate: Path) -> None:
+    try:
+        candidate.unlink()
+    except FileNotFoundError:
+        pass
+
+
+def install_absent_symlink(destination: Path, source: Path) -> Literal["repaired", "blocked", "failed"]:
+    candidate = create_symlink_candidate(destination, source)
+    try:
+        try:
+            rename_noreplace(candidate, destination)
+        except FileExistsError:
+            return "blocked"
+        except OSError:
+            return "failed"
+        return "repaired"
+    finally:
+        cleanup_candidate(candidate)
+
+
+def exchange_owned_symlink(
+    destination: Path,
+    source: Path,
+    authored_sources: frozenset[Path],
+) -> Literal["repaired", "blocked", "failed"]:
+    """Exchange first, then validate the exact object removed from destination."""
+    candidate = create_symlink_candidate(destination, source)
+    exchanged = False
+    rolled_back = False
+    try:
+        try:
+            rename_exchange(candidate, destination)
+            exchanged = True
+        except OSError:
+            return "failed"
+
+        try:
+            old_is_authored = candidate.is_symlink() \
+                and lexical_link_target(candidate) in authored_sources
+        except OSError:
+            old_is_authored = False
+        if old_is_authored:
+            cleanup_candidate(candidate)
+            return "repaired"
+
+        try:
+            rename_exchange(candidate, destination)
+            rolled_back = True
+        except OSError:
+            # The displaced object remains at the unpredictable candidate path;
+            # never unlink it when rollback could not restore ownership.
+            return "failed"
+
+        try:
+            restored_candidate_is_ours = candidate.is_symlink() \
+                and lexical_link_target(candidate) == source
+        except OSError:
+            restored_candidate_is_ours = False
+        if not restored_candidate_is_ours:
+            return "failed"
+        cleanup_candidate(candidate)
+        return "blocked"
+    finally:
+        if not exchanged or rolled_back:
+            try:
+                if candidate.is_symlink() and lexical_link_target(candidate) == source:
+                    cleanup_candidate(candidate)
+            except OSError:
+                pass
+
+
+def repair_runtime_links(config: DoctorConfig) -> RepairResult:
+    root = lexical_path(config.root)
+    sources = [(name, lexical_path(config.root / relative_source)) for name, relative_source in RUNTIME_LINK_TARGETS]
+    if any(not source.is_dir() for _, source in sources):
+        return RepairResult("panama.runtime-links", True, 1, "Tracked Panama link destinations are unavailable.")
+    if any(not source.is_relative_to(root) for _, source in sources):
+        return RepairResult("panama.runtime-links", True, 1, "Tracked Panama link destinations are invalid.")
+    authored_sources = frozenset(source for _, source in sources)
+
+    try:
+        config.config_home.mkdir(parents=True, exist_ok=True)
+    except OSError:
+        return RepairResult("panama.runtime-links", True, 1, "Panama runtime links could not be accessed.")
+
+    blocked = False
+    failed = False
+    for name, source in sources:
+        destination = config.config_home / name
+        try:
+            if destination.is_symlink():
+                current_target = lexical_link_target(destination)
+                if current_target == source:
+                    continue
+                if current_target not in authored_sources:
+                    blocked = True
+                    continue
+                outcome = exchange_owned_symlink(destination, source, authored_sources)
+                blocked = blocked or outcome == "blocked"
+                failed = failed or outcome == "failed"
+            elif destination.exists():
+                # A regular file or directory is user-owned unless proven
+                # otherwise. Report it, but never replace it.
+                blocked = True
+            else:
+                outcome = install_absent_symlink(destination, source)
+                blocked = blocked or outcome == "blocked"
+                failed = failed or outcome == "failed"
+        except OSError:
+            failed = True
+
+    if failed:
+        return RepairResult("panama.runtime-links", True, 1, "One or more Panama runtime links could not be recreated.")
+    if blocked:
+        return RepairResult("panama.runtime-links", True, 1, "A user-owned runtime path is blocking a Panama link.")
+    return RepairResult("panama.runtime-links", True, 0, "Panama runtime links were recreated. A fresh health check will verify them.")
+
+
+def repair_vicinae_commands(config: DoctorConfig) -> RepairResult:
+    helper = config.root / "setup/scripts/link-vicinae-scripts"
+    if not helper.is_file():
+        return RepairResult("panama.vicinae-commands", True, 127, "The authored Vicinae link helper is unavailable.")
+    exit_code, _ = run_repair_command((str(helper),), config, config.root)
+    message = "Panama commands were relinked. A fresh health check will verify them." if exit_code == 0 \
+        else "Panama commands could not be relinked."
+    return RepairResult("panama.vicinae-commands", True, exit_code, message)
+
+
+def parse_caffeine_rows(output: str, uid: str) -> list[InhibitorRow] | None:
+    inhibitor_rows: list[InhibitorRow] = []
+    for line in output.splitlines():
+        parts = line.split()
+        if len(parts) < 2 or parts[0] != "Panama" or parts[1] != uid:
+            continue
+        if len(parts) != 8:
+            if "Caffeine" in parts:
+                return None
+            continue
+        if parts[6] != "Caffeine" or parts[7] != "block":
+            continue
+        if not parts[3].isdecimal():
+            return None
+        inhibitor_rows.append(tuple(parts))
+    return inhibitor_rows
+
+
+def close_pidfds(pidfds: list[int]) -> None:
+    for pidfd in pidfds:
+        try:
+            os.close(pidfd)
+        except OSError:
+            pass
+
+
+def signal_caffeine_pidfds(
+    pidfds: list[int],
+    sender: Callable[..., None] | None = None,
+) -> Literal["released", "preflight-failed", "incomplete"]:
+    send = sender or signal.pidfd_send_signal
+    for pidfd in pidfds:
+        try:
+            send(pidfd, 0, None, 0)
+        except (OSError, ValueError):
+            return "preflight-failed"
+
+    incomplete = False
+    for pidfd in pidfds:
+        try:
+            send(pidfd, signal.SIGTERM, None, 0)
+        except ProcessLookupError:
+            continue
+        except OSError as error:
+            if error.errno != errno.ESRCH:
+                incomplete = True
+        except ValueError:
+            incomplete = True
+    return "incomplete" if incomplete else "released"
+
+
+def repair_caffeine(config: DoctorConfig) -> RepairResult:
+    list_command = ("systemd-inhibit", "--list", "--no-pager", "--no-legend")
+    list_exit, output = run_repair_command(list_command, config)
+    if list_exit != 0:
+        return RepairResult("panama.caffeine", True, list_exit, "Caffeine inhibitors could not be inspected.")
+
+    uid = str(os.getuid())
+    inhibitor_rows = parse_caffeine_rows(output, uid)
+    if inhibitor_rows is None:
+        return RepairResult("panama.caffeine", True, 1, "Caffeine inhibitor metadata was invalid; nothing was released.")
+    inhibitor_pids = list(dict.fromkeys(int(row[3]) for row in inhibitor_rows))
+
+    if len(inhibitor_pids) <= 1:
+        return RepairResult("panama.caffeine", True, 0, "No duplicate Panama Caffeine inhibitors needed release.")
+
+    duplicates = inhibitor_pids[1:]
+    if not hasattr(os, "pidfd_open") or not hasattr(signal, "pidfd_send_signal"):
+        return RepairResult("panama.caffeine", True, 1, "Safe Caffeine inhibitor release is unavailable on this system.")
+
+    pidfds: list[int] = []
+    try:
+        try:
+            pidfds = [os.pidfd_open(pid, 0) for pid in duplicates]
+        except (OSError, ValueError):
+            return RepairResult("panama.caffeine", True, 1, "A duplicate inhibitor changed before it could be safely released.")
+
+        second_exit, second_output = run_repair_command(list_command, config)
+        if second_exit != 0:
+            return RepairResult("panama.caffeine", True, second_exit, "Caffeine inhibitors could not be revalidated; nothing was released.")
+        second_rows = parse_caffeine_rows(second_output, uid)
+        if second_rows is None or second_rows != inhibitor_rows:
+            return RepairResult("panama.caffeine", True, 1, "Caffeine inhibitor metadata changed; nothing was released.")
+
+        signal_outcome = signal_caffeine_pidfds(pidfds)
+        if signal_outcome == "preflight-failed":
+            return RepairResult("panama.caffeine", True, 1, "A duplicate inhibitor changed before it could be safely released.")
+        if signal_outcome == "incomplete":
+            return RepairResult("panama.caffeine", True, 1, "One or more duplicate inhibitors could not be released.")
+    finally:
+        close_pidfds(pidfds)
+    return RepairResult("panama.caffeine", True, 0, "Duplicate Panama Caffeine inhibitors were released. A fresh health check will verify recovery.")
+
+
+def repair(check_id: str, config: DoctorConfig) -> RepairResult:
+    if check_id in REPAIR_COMMANDS:
+        return repair_authored_command(check_id, config)
+    if check_id == "panama.runtime-links":
+        return repair_runtime_links(config)
+    if check_id == "panama.vicinae-commands":
+        return repair_vicinae_commands(config)
+    if check_id == "panama.caffeine":
+        return repair_caffeine(config)
+    return RepairResult(check_id, False, 2, "This health check has no authored repair.")
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description="Panama system diagnostics and bounded repairs")
+    output = parser.add_mutually_exclusive_group()
+    output.add_argument("--json", action="store_true")
+    output.add_argument("--summary", action="store_true")
+    parser.add_argument("--repair", metavar="CHECK_ID")
+    args = parser.parse_args(argv)
+
+    if args.repair is not None:
+        if args.repair not in REPAIR_IDS or args.summary:
+            result = RepairResult(args.repair, False, 2, "This health check has no authored repair.")
+        else:
+            try:
+                result = repair(args.repair, config_from_environment())
+            except Exception:
+                result = RepairResult(args.repair, True, 1, "The authored repair could not be completed.")
+        print(json.dumps(result.as_json(), separators=(",", ":"), sort_keys=False))
+        return result.exit_code
+
+    result = snapshot(config_from_environment())
+    if args.summary:
+        summary = result["summary"]
+        assert isinstance(summary, dict)
+        print(f"Panama system health: {summary['status']} ({summary['healthy']} ok, {summary['warnings']} warnings, {summary['errors']} errors, {summary['unconfigured']} unconfigured)")
+    else:
+        print(json.dumps(result, separators=(",", ":"), sort_keys=False))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))
@@ -59,7 +59,7 @@ generate() {
        printf '# The shipped defaults live in the Panama repo at config/dot/hypr/hypridle.conf.\n\n'

        printf 'general {\n'
-        printf '    lock_cmd = pidof hyprlock || hyprlock\n'
+        printf '    lock_cmd = pidof hyprlock || ~/.config/quickshell/scripts/panama-lock run\n'
        if [[ "$lock_on_sleep" == "true" ]]; then
            printf '    before_sleep_cmd = loginctl lock-session\n'
        fi
@@ -25,6 +25,9 @@ PLUGIN_ACTIONS = {
    "kdeconnect_share": "share",
 }
 DEVICE_OBJECT_PREFIX = "/modules/kdeconnect/devices"
+DEVICE_OBJECT_LINE = re.compile(
+    rf"(?P<path>{re.escape(DEVICE_OBJECT_PREFIX)}/(?P<id>[A-Fa-f0-9]{{32,64}}))$"
+)
 Runner = Callable[..., subprocess.CompletedProcess[str]]


@@ -107,6 +110,13 @@ def parse_string_property(output: str) -> str:
    return parts[1] if len(parts) == 2 and parts[0] == "s" else ""


+def parse_bool_property(output: str) -> bool | None:
+    parts = output.split()
+    if len(parts) != 2 or parts[0] != "b" or parts[1] not in {"true", "false"}:
+        return None
+    return parts[1] == "true"
+
+
 def run_command(
    command: list[str],
    *,
@@ -179,6 +189,82 @@ def reported_type(device_id: str, runner: Runner = subprocess.run) -> str:
    return parse_string_property(result.stdout) if result.returncode == 0 else ""


+def device_property(
+    device_id: str,
+    member: str,
+    runner: Runner = subprocess.run,
+) -> subprocess.CompletedProcess[str]:
+    return run_command(
+        [
+            "busctl",
+            "--user",
+            "get-property",
+            "org.kde.kdeconnect",
+            device_object(device_id),
+            "org.kde.kdeconnect.device",
+            member,
+        ],
+        runner=runner,
+    )
+
+
+def dbus_device_ids(runner: Runner = subprocess.run) -> list[str]:
+    try:
+        result = run_command(
+            ["busctl", "--user", "tree", "org.kde.kdeconnect"],
+            runner=runner,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return []
+    if result.returncode != 0:
+        return []
+    return [
+        match.group("id")
+        for line in result.stdout.splitlines()
+        if (match := DEVICE_OBJECT_LINE.search(line.strip())) is not None
+    ]
+
+
+def dbus_devices(runner: Runner = subprocess.run) -> list[dict[str, object]]:
+    devices: list[dict[str, object]] = []
+    for device_id in dbus_device_ids(runner):
+        try:
+            name_result = device_property(device_id, "name", runner)
+            type_result = device_property(device_id, "type", runner)
+            paired_result = device_property(device_id, "isPaired", runner)
+            reachable_result = device_property(device_id, "isReachable", runner)
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            continue
+        name = parse_string_property(name_result.stdout) if name_result.returncode == 0 else ""
+        device_type = parse_string_property(type_result.stdout) if type_result.returncode == 0 else ""
+        paired = parse_bool_property(paired_result.stdout) if paired_result.returncode == 0 else None
+        reachable = parse_bool_property(reachable_result.stdout) if reachable_result.returncode == 0 else None
+        if not name or paired is not True or reachable is None:
+            continue
+        try:
+            plugins = device_plugins(device_id, runner)
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            plugins = []
+        actions = sorted(
+            {
+                action
+                for plugin, action in PLUGIN_ACTIONS.items()
+                if plugin in plugins
+            }
+        )
+        devices.append(
+            {
+                "id": device_id,
+                "name": name,
+                "type": device_type or inferred_type(name),
+                "paired": paired,
+                "reachable": reachable,
+                "actions": actions,
+            }
+        )
+    return devices
+
+
 def collect_status(runner: Runner = subprocess.run) -> dict[str, object]:
    try:
        listing = run_command(
@@ -200,15 +286,24 @@ def collect_status(runner: Runner = subprocess.run) -> dict[str, object]:
            continue
        device_id = match.group("id")
        try:
-            device = normalize_device_line(
-                line,
-                device_plugins(device_id, runner),
-                reported_type(device_id, runner),
-            )
+            plugins = device_plugins(device_id, runner)
+            device_type = reported_type(device_id, runner)
+        except (FileNotFoundError, subprocess.TimeoutExpired):
+            plugins = []
+            device_type = ""
+        try:
+            device = normalize_device_line(line, plugins, device_type)
        except ValueError:
            continue
        devices.append(device)

+    known_ids = {str(device["id"]) for device in devices}
+    devices.extend(
+        device
+        for device in dbus_devices(runner)
+        if str(device["id"]) not in known_ids
+    )
+
    devices.sort(
        key=lambda device: (
            not bool(device["reachable"]),
@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+
+"""The login keyring's lock state, and a way to unlock it.
+
+Why this exists
+---------------
+GNOME unlocks the login keyring at sign-in through pam_gnome_keyring, and so
+does this desktop -- the PAM stack is GDM's and it works. What GNOME also has,
+and a bare Hyprland session does not, is anywhere to SEE that it failed.
+
+It does fail, rarely. gnome-keyring-daemon can crash (an upstream abort in
+service_method_open_session, seen once here), and when it does, D-Bus activates
+a replacement. That replacement never received the login password, so the login
+keyring comes back LOCKED in the middle of a session that unlocked it correctly
+at login. Everything that stores a secret then starts failing in ways that do
+not mention keyrings at all: a mail client that will not authenticate, a git
+push that cannot find its key, an integration that reports "not configured".
+
+So this reports the state plainly and offers the one action that fixes it.
+
+Unlocking prompts
+-----------------
+`unlock` asks the Secret Service to unlock, which raises the gcr password
+dialog. That is deliberate: the password is not ours to store or handle, and it
+never passes through this script. The dialog is the same one GNOME shows.
+
+Note that a locked keyring makes a NON-INTERACTIVE caller appear to hang -- it
+is not hung, it is waiting for a dialog nobody is looking at. That is worth
+knowing before debugging one for an hour.
+
+Usage:
+  panama-keyring status   -> {"available", "locked", "collections", "daemon"}
+  panama-keyring unlock   -> raises the password prompt; prints the new state
+"""
+
+import json
+import os
+import re
+import sys
+
+
+def daemon_origin():
+    """Whether the running secrets daemon came from PAM or from D-Bus activation.
+
+    A D-Bus-activated daemon is the signature of the crash-and-replace case
+    above: it is the one that cannot have the login password. PAM's daemon lives
+    outside the app slice, so the cgroup tells the two apart.
+    """
+    try:
+        for pid in os.listdir("/proc"):
+            if not pid.isdigit():
+                continue
+            try:
+                with open(f"/proc/{pid}/cmdline", "rb") as handle:
+                    cmdline = handle.read().decode("utf-8", "replace")
+            except OSError:
+                continue
+            if "gnome-keyring-daemon" not in cmdline:
+                continue
+            try:
+                with open(f"/proc/{pid}/cgroup", "r") as handle:
+                    cgroup = handle.read()
+            except OSError:
+                return "unknown"
+            if re.search(r"dbus-.*org\.freedesktop\.secrets", cgroup):
+                return "dbus"
+            return "pam"
+    except OSError:
+        pass
+    return "none"
+
+
+def load_service():
+    import gi
+
+    gi.require_version("Secret", "1")
+    from gi.repository import Secret
+
+    return Secret, Secret.Service.get_sync(Secret.ServiceFlags.LOAD_COLLECTIONS, None)
+
+
+def report(service, Secret):
+    collections = [
+        {"label": c.get_label(), "locked": c.get_locked()}
+        for c in service.get_collections()
+    ]
+    # The login keyring is the one that matters; the others are per-application
+    # stores that manage their own unlocking.
+    login = next((c for c in collections if c["label"] == "Login"), None)
+    return {
+        "available": True,
+        "locked": bool(login["locked"]) if login else False,
+        "hasLogin": login is not None,
+        "collections": collections,
+        "daemon": daemon_origin(),
+        "error": "",
+    }
+
+
+def main():
+    action = sys.argv[1] if len(sys.argv) > 1 else "status"
+    if action not in ("status", "unlock"):
+        print("usage: panama-keyring [status|unlock]", file=sys.stderr)
+        return 2
+
+    try:
+        Secret, service = load_service()
+    except Exception as error:  # noqa: BLE001 - any failure here is "no keyring"
+        # No Secret Service at all is a legitimate state, not a crash: report it
+        # so the UI can say so instead of showing an empty card.
+        print(json.dumps({
+            "available": False, "locked": False, "hasLogin": False,
+            "collections": [], "daemon": daemon_origin(),
+            "error": f"The secret service is not answering: {error}",
+        }))
+        return 0
+
+    if action == "unlock":
+        login = next(
+            (c for c in service.get_collections() if c.get_label() == "Login"), None)
+        if login is not None and login.get_locked():
+            try:
+                # Blocks until the dialog is answered or dismissed.
+                service.unlock_sync([login], None)
+            except Exception as error:  # noqa: BLE001
+                state = report(service, Secret)
+                state["error"] = f"The keyring was not unlocked: {error}"
+                print(json.dumps(state))
+                return 0
+            # The collection object caches its state; re-read it.
+            Secret, service = load_service()
+
+    print(json.dumps(report(service, Secret)))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,346 @@
+#!/usr/bin/env bash
+
+# Generates Panama's hyprlock configuration into the state directory. The
+# tracked config is never rewritten and remains the fallback if generation
+# fails, so a malformed preference can never leave the session without a
+# working locker.
+
+set -euo pipefail
+
+config_home="${XDG_CONFIG_HOME:-$HOME/.config}"
+state_home="${XDG_STATE_HOME:-$HOME/.local/state}"
+settings="$config_home/panama/settings.json"
+state_dir="$state_home/panama"
+generated="$state_dir/hyprlock.conf"
+status_file="$state_dir/hyprlock-status.json"
+fallback="$config_home/hypr/hyprlock.conf"
+temporary="$generated.tmp.$$"
+status_temporary="$status_file.tmp.$$"
+
+settings_valid=false
+
+cleanup() {
+    rm -f "$temporary" "$status_temporary" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+read_string() {
+    local key="$1" default="$2" value
+    if [[ "$settings_valid" != true ]]; then
+        printf '%s' "$default"
+        return
+    fi
+    value="$(jq -er --arg key "$key" \
+        'if has($key) and (.[$key] | type) == "string" then .[$key] else empty end' \
+        "$settings" 2>/dev/null)" || value="$default"
+    printf '%s' "$value"
+}
+
+read_bool() {
+    local key="$1" default="$2" value
+    if [[ "$settings_valid" != true ]]; then
+        printf '%s' "$default"
+        return
+    fi
+    value="$(jq -er --arg key "$key" \
+        'if has($key) and (.[$key] | type) == "boolean" then (.[$key] | tostring) else empty end' \
+        "$settings" 2>/dev/null)" || value="$default"
+    printf '%s' "$value"
+}
+
+read_int() {
+    local key="$1" default="$2" low="$3" high="$4" value
+    if [[ "$settings_valid" != true ]]; then
+        printf '%s' "$default"
+        return
+    fi
+    value="$(jq -er --arg key "$key" \
+        'if has($key) and (.[$key] | type) == "number" and (.[$key] | floor) == .[$key]
+         then (.[$key] | tostring) else empty end' "$settings" 2>/dev/null)" || value="$default"
+    if [[ ! "$value" =~ ^-?[0-9]+$ ]] || (( value < low || value > high )); then
+        value="$default"
+    fi
+    printf '%s' "$value"
+}
+
+read_object() {
+    local key="$1"
+    if [[ "$settings_valid" != true ]]; then
+        printf '{}'
+        return
+    fi
+    jq -c --arg key "$key" \
+        'if has($key) and (.[$key] | type) == "object" then .[$key] else {} end' \
+        "$settings" 2>/dev/null || printf '{}'
+}
+
+valid_path() {
+    [[ "$1" == /* && "$1" != *","* && "$1" != *$'\n'* ]]
+}
+
+load_preferences() {
+    if [[ -r "$settings" ]] && jq -e 'type == "object"' "$settings" >/dev/null 2>&1; then
+        settings_valid=true
+    else
+        settings_valid=false
+    fi
+
+    background_mode="$(read_string lockBackgroundMode screenshot)"
+    [[ "$background_mode" == screenshot || "$background_mode" == wallpaper || "$background_mode" == solid ]] \
+        || background_mode=screenshot
+
+    blur_level="$(read_int lockBlurLevel 3 0 5)"
+    show_clock="$(read_bool lockShowClock true)"
+    show_date="$(read_bool lockShowDate true)"
+    show_user="$(read_bool lockShowUser true)"
+    fade_on_empty="$(read_bool lockFadeOnEmpty false)"
+    use_24_hour="$(read_bool use24Hour false)"
+
+    color_scheme="$(read_string colorScheme dark)"
+    [[ "$color_scheme" == dark || "$color_scheme" == light ]] || color_scheme=dark
+
+    wallpaper_mode="$(read_string wallpaperMode single)"
+    [[ "$wallpaper_mode" == single || "$wallpaper_mode" == slideshow || "$wallpaper_mode" == per-monitor ]] \
+        || wallpaper_mode=single
+    wallpaper_path="$(read_string wallpaperPath '')"
+    if ! valid_path "$wallpaper_path"; then
+        wallpaper_path="$HOME/Pictures/Wallpapers/faroe_islands.jpg"
+    fi
+    wallpaper_assignments="$(read_object wallpaperPerMonitor)"
+
+    case "$blur_level" in
+        0) blur_passes=0; blur_size=1 ;;
+        1) blur_passes=1; blur_size=3 ;;
+        2) blur_passes=2; blur_size=5 ;;
+        3) blur_passes=3; blur_size=8 ;;
+        4) blur_passes=4; blur_size=10 ;;
+        5) blur_passes=5; blur_size=12 ;;
+    esac
+
+    if [[ "$color_scheme" == light ]]; then
+        background_color='rgba(225, 226, 231, 1.0)'
+        foreground_color='rgba(55, 96, 191, 1.0)'
+        dim_color='rgba(97, 114, 176, 1.0)'
+        accent_color='rgba(46, 125, 233, 1.0)'
+        accent_ring_color='rgba(46, 125, 233, 0.9)'
+        error_color='rgba(245, 42, 101, 1.0)'
+        field_color='rgba(208, 213, 227, 0.85)'
+        dim_hex='6172b0'
+        error_hex='f52a65'
+    else
+        background_color='rgba(34, 36, 54, 1.0)'
+        foreground_color='rgba(200, 211, 245, 1.0)'
+        dim_color='rgba(130, 139, 184, 1.0)'
+        accent_color='rgba(130, 170, 255, 1.0)'
+        accent_ring_color='rgba(130, 170, 255, 0.9)'
+        error_color='rgba(255, 117, 127, 1.0)'
+        field_color='rgba(46, 47, 61, 0.85)'
+        dim_hex='828bb8'
+        error_hex='ff757f'
+    fi
+}
+
+monitor_names() {
+    hyprctl -j monitors 2>/dev/null \
+        | jq -r '.[]? | .name | select(type == "string") | select(test("^[A-Za-z0-9_.-]+$"))' \
+        2>/dev/null || true
+}
+
+emit_background() {
+    local monitor="$1" path="$2"
+    printf 'background {\n'
+    printf '    monitor = %s\n' "$monitor"
+    if [[ -n "$path" ]]; then
+        printf '    path = %s\n' "$path"
+    fi
+    printf '    blur_passes = %s\n' "$blur_passes"
+    printf '    blur_size = %s\n' "$blur_size"
+    printf '    noise = 0.0117\n'
+    printf '    contrast = 0.9\n'
+    printf '    brightness = 0.8\n'
+    printf '    vibrancy = 0.17\n'
+    printf '    vibrancy_darkness = 0.05\n'
+    printf '    color = %s\n' "$background_color"
+    printf '    zindex = -1\n'
+    printf '}\n\n'
+}
+
+emit_backgrounds() {
+    local output assigned saw_output=false
+    case "$background_mode" in
+        screenshot)
+            emit_background '' screenshot
+            ;;
+        solid)
+            emit_background '' ''
+            ;;
+        wallpaper)
+            while IFS= read -r output; do
+                [[ -n "$output" ]] || continue
+                saw_output=true
+                assigned="$wallpaper_path"
+                if [[ "$wallpaper_mode" == per-monitor ]]; then
+                    candidate="$(jq -r --arg output "$output" \
+                        'if has($output) and (.[$output] | type) == "string" then .[$output] else "" end' \
+                        <<<"$wallpaper_assignments" 2>/dev/null || true)"
+                    if valid_path "$candidate"; then
+                        assigned="$candidate"
+                    fi
+                fi
+                emit_background "$output" "$assigned"
+            done < <(monitor_names)
+            if [[ "$saw_output" != true ]]; then
+                emit_background '' "$wallpaper_path"
+            fi
+            ;;
+    esac
+}
+
+emit_config() {
+    printf '# Generated by Panama. Do not edit.\n\n'
+    printf 'general {\n'
+    printf '    hide_cursor = true\n'
+    printf '    fractional_scaling = 2\n'
+    printf '    screencopy_mode = 0\n'
+    printf '    fail_timeout = 2000\n'
+    printf '}\n\n'
+    printf 'auth {\n'
+    printf '    pam:enabled = true\n'
+    printf '    pam:module = hyprlock\n'
+    printf '}\n\n'
+
+    emit_backgrounds
+
+    if [[ "$show_clock" == true ]]; then
+        printf 'label {\n'
+        printf '    monitor =\n'
+        if [[ "$use_24_hour" == true ]]; then
+            printf '    text = cmd[update:1000] date +"%%H:%%M"\n'
+        else
+            printf '    text = cmd[update:1000] date +"%%-I:%%M"\n'
+        fi
+        printf '    color = %s\n' "$foreground_color"
+        printf '    font_size = 120\n'
+        printf '    font_family = Adwaita Sans Light\n'
+        printf '    position = 0, 260\n'
+        printf '    halign = center\n'
+        printf '    valign = center\n'
+        printf '}\n\n'
+    fi
+
+    if [[ "$show_date" == true ]]; then
+        printf 'label {\n'
+        printf '    monitor =\n'
+        printf '    text = cmd[update:60000] date +"%%A, %%B %%-d"\n'
+        printf '    color = %s\n' "$dim_color"
+        printf '    font_size = 24\n'
+        printf '    font_family = Adwaita Sans\n'
+        printf '    position = 0, 160\n'
+        printf '    halign = center\n'
+        printf '    valign = center\n'
+        printf '}\n\n'
+    fi
+
+    printf 'input-field {\n'
+    printf '    monitor =\n'
+    printf '    size = 340, 52\n'
+    printf '    position = 0, -40\n'
+    printf '    halign = center\n'
+    printf '    valign = center\n'
+    printf '    outline_thickness = 2\n'
+    printf '    rounding = 26\n'
+    printf '    outer_color = %s\n' "$accent_ring_color"
+    printf '    inner_color = %s\n' "$field_color"
+    printf '    font_color = %s\n' "$foreground_color"
+    printf '    check_color = %s\n' "$accent_color"
+    printf '    fail_color = %s\n' "$error_color"
+    printf '    dots_size = 0.25\n'
+    printf '    dots_spacing = 0.3\n'
+    printf '    dots_center = true\n'
+    printf '    placeholder_text = <span foreground="##%s"><i>Password</i></span>\n' "$dim_hex"
+    printf '    fail_text = <span foreground="##%s"><i>$FAIL ($ATTEMPTS)</i></span>\n' "$error_hex"
+    printf '    fade_on_empty = %s\n' "$fade_on_empty"
+    printf '    hide_input = false\n'
+    printf '}\n\n'
+
+    if [[ "$show_user" == true ]]; then
+        printf 'label {\n'
+        printf '    monitor =\n'
+        printf '    text = $USER\n'
+        printf '    color = %s\n' "$foreground_color"
+        printf '    font_size = 16\n'
+        printf '    font_family = Adwaita Sans\n'
+        printf '    position = 0, -110\n'
+        printf '    halign = center\n'
+        printf '    valign = center\n'
+        printf '}\n'
+    fi
+}
+
+write_status() {
+    local generated_value="$1" path_value="$2" fallback_value="$3" error_value="$4"
+    mkdir -p "$state_dir" 2>/dev/null || return 0
+    [[ -w "$state_dir" ]] || return 0
+    jq -nc --argjson generated "$generated_value" --arg path "$path_value" \
+        --argjson fallback "$fallback_value" --arg error "$error_value" \
+        '{generated:$generated,path:$path,fallback:$fallback,error:$error}' \
+        >"$status_temporary" 2>/dev/null || return 0
+    mv "$status_temporary" "$status_file" 2>/dev/null || true
+}
+
+generate() {
+    load_preferences
+    mkdir -p "$state_dir" || return 1
+    if ! emit_config >"$temporary"; then
+        rm -f "$temporary" 2>/dev/null || true
+        write_status false "$fallback" true "The lock-screen configuration could not be generated."
+        return 1
+    fi
+    if [[ ! -s "$temporary" ]] \
+        || ! rg -q '^auth \{' "$temporary" \
+        || ! rg -q '^background \{' "$temporary" \
+        || ! rg -q '^input-field \{' "$temporary"; then
+        rm -f "$temporary"
+        write_status false "$fallback" true "The lock-screen configuration could not be generated."
+        return 1
+    fi
+    if ! mv "$temporary" "$generated"; then
+        rm -f "$temporary" 2>/dev/null || true
+        write_status false "$fallback" true "The lock-screen configuration could not be generated."
+        return 1
+    fi
+    write_status true "$generated" false ""
+}
+
+status() {
+    if [[ -r "$status_file" ]] \
+        && jq -e '.generated | type == "boolean"' "$status_file" >/dev/null 2>&1 \
+        && jq -e '.path | type == "string"' "$status_file" >/dev/null 2>&1; then
+        jq -c '{generated,path,fallback:(.fallback == true),error:(.error // "")}' "$status_file"
+    elif [[ -s "$generated" ]]; then
+        jq -nc --arg path "$generated" '{generated:true,path:$path,fallback:false,error:""}'
+    else
+        jq -nc --arg path "$fallback" \
+            '{generated:false,path:$path,fallback:true,error:"The generated lock-screen configuration is unavailable."}'
+    fi
+}
+
+case "${1:-status}" in
+    generate)
+        generate
+        ;;
+    status)
+        status
+        ;;
+    run)
+        if generate >/dev/null 2>&1; then
+            exec hyprlock -c "$generated"
+        fi
+        write_status false "$fallback" true "The lock-screen configuration could not be generated."
+        exec hyprlock -c "$fallback"
+        ;;
+    *)
+        printf 'usage: panama-lock [generate|status|run]\n' >&2
+        exit 2
+        ;;
+esac
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# System power profile, via the PowerProfiles D-Bus API.
+#
+# GNOME's Power panel offers Balanced / Performance / Power Saver; this is the
+# same daemon behind it. On Fedora 44 the implementation is tuned-ppd rather
+# than power-profiles-daemon, but it serves the same net.hadess.PowerProfiles
+# interface, which is why this talks to the interface rather than to either
+# binary -- powerprofilesctl is not even installed here.
+#
+# Setting a profile needs no privileges: the daemon accepts a property write
+# from the active session user.
+#
+# Usage:
+#   panama-power-profile list        -> {"profiles":[...],"active":"...","degraded":"..."}
+#   panama-power-profile set <name>
+#
+# PerformanceDegraded is reported because it is the one thing that makes the
+# choice a lie: a thermally throttled laptop reports "performance" while
+# behaving otherwise, and GNOME surfaces exactly this. It is an empty string
+# when nothing is wrong.
+
+set -uo pipefail
+
+readonly BUS_NAME=net.hadess.PowerProfiles
+readonly OBJECT=/net/hadess/PowerProfiles
+
+emit_error() {
+    printf '{"profiles":[],"active":"","degraded":"","error":%s}\n' "$(jq -Rn --arg e "$1" '$e')"
+    exit 0
+}
+
+command -v busctl >/dev/null 2>&1 || emit_error 'busctl is not available'
+
+property() {
+    busctl get-property "$BUS_NAME" "$OBJECT" "$BUS_NAME" "$1" 2>/dev/null
+}
+
+cmd_list() {
+    # A machine with no power-profiles daemon is a normal state -- plenty of
+    # desktops have none -- so it is reported rather than treated as a failure.
+    busctl status "$BUS_NAME" >/dev/null 2>&1 \
+        || emit_error 'No power profile service is running. GNOME uses power-profiles-daemon; Fedora ships tuned-ppd.'
+
+    local active degraded profiles
+    active="$(property ActiveProfile | sed 's/^s //; s/"//g')"
+    degraded="$(property PerformanceDegraded | sed 's/^s //; s/"//g')"
+
+    # Profiles is an array of dicts, which busctl renders flat:
+    #   v aa{sv} 3 2 "Profile" s "power-saver" "Driver" s "tuned" 2 "Profile" ...
+    # so each profile is the string following its own "Profile" marker. Matching
+    # the marker matters: "Driver" values sit in the same stream, and on this
+    # machine the driver is called "tuned", which a looser pattern happily
+    # reports as a fourth profile that does not exist.
+    profiles="$(property Profiles \
+        | grep -oE '"Profile" s "[a-z-]+"' \
+        | sed 's/.*s "//; s/"$//' \
+        | awk '!seen[$0]++')"
+
+    [[ -n "$profiles" ]] || emit_error 'The power profile service reported no profiles.'
+
+    jq -cn \
+        --arg active "$active" \
+        --arg degraded "$degraded" \
+        --argjson profiles "$(printf '%s\n' "$profiles" | jq -Rn '[inputs | select(length > 0)]')" \
+        '{profiles: $profiles, active: $active, degraded: $degraded, error: ""}'
+}
+
+cmd_set() {
+    local profile="${1:-}"
+    # Constrained rather than passed through: this reaches a system service.
+    [[ "$profile" =~ ^[a-z-]+$ ]] || {
+        printf 'panama-power-profile: refusing a profile name with unexpected characters\n' >&2
+        return 2
+    }
+    busctl set-property "$BUS_NAME" "$OBJECT" "$BUS_NAME" ActiveProfile s "$profile" 2>&1 >/dev/null \
+        | head -2 >&2
+    return 0
+}
+
+case "${1:-list}" in
+    list) cmd_list ;;
+    set)  shift; cmd_set "${1:-}" ;;
+    *)    printf 'usage: panama-power-profile [list|set <profile>]\n' >&2; exit 2 ;;
+esac
@@ -11,6 +11,11 @@
 # Terminals are the notable exception -- they predate the standard and carry
 # their own palettes. kitty is handled here.
 #
+# GTK3 is the other one. Under GNOME, gnome-settings-daemon publishes the theme
+# over XSETTINGS; under Hyprland nothing does, so ~/.config/gtk-3.0/settings.ini
+# is authoritative for GTK3 applications. Pinned to dark, it contradicted the
+# scheme in light mode, so it is generated from a template here instead.
+#
 #   panama-theme-apps dark|light
 #
 # kitty gets it twice: the generated include file so terminals opened later
@@ -26,6 +31,137 @@ case "$scheme" in
    *) printf 'usage: panama-theme-apps [dark|light]\n' >&2; exit 2 ;;
 esac

+# ── hyprlock ─────────────────────────────────────────────────────────────────
+# The lock screen. hyprlock is launched fresh on every lock (`pidof hyprlock ||
+# hyprlock`), so it reads this file each time and needs no restart.
+#
+# It takes rgba(r, g, b, a) in DECIMAL, not hex, so the palette is expressed as
+# "R, G, B" triples here rather than the hex used everywhere else. The two
+# _HEX values are the exception: they sit inside Pango markup, where hyprlock
+# wants ##rrggbb.
+lock_dir="${XDG_CONFIG_HOME:-$HOME/.config}/hypr"
+lock_template="$lock_dir/hyprlock.conf.template"
+
+if [[ "$scheme" == "light" ]]; then
+    lock_fg="55, 96, 191"        # #3760bf
+    lock_muted="97, 114, 176"    # #6172b0
+    lock_accent="46, 125, 233"   # #2e7de9
+    lock_error="245, 42, 101"    # #f52a65
+    lock_bg="225, 226, 231"      # #e1e2e7
+    lock_field="208, 213, 227"   # #d0d5e3
+    lock_muted_hex="6172b0"
+    lock_error_hex="f52a65"
+else
+    lock_fg="200, 211, 245"      # #c8d3f5
+    lock_muted="130, 139, 184"   # #828bb8
+    lock_accent="130, 170, 255"  # #82aaff
+    lock_error="255, 117, 127"   # #ff757f
+    lock_bg="34, 36, 54"         # #222436
+    lock_field="46, 47, 61"      # #2e2f3d
+    lock_muted_hex="828bb8"
+    lock_error_hex="ff757f"
+fi
+
+status_hyprlock="skipped"
+if [[ -r "$lock_template" ]]; then
+    # Written atomically: a lock triggered mid-write would otherwise read a
+    # truncated config and fall back to hyprlock's own defaults, which is a
+    # bright grey screen with none of this desktop's identity.
+    if sed -e "s/@FG@/$lock_fg/g" \
+           -e "s/@MUTED@/$lock_muted/g" \
+           -e "s/@ACCENT@/$lock_accent/g" \
+           -e "s/@ERROR@/$lock_error/g" \
+           -e "s/@BG@/$lock_bg/g" \
+           -e "s/@FIELD@/$lock_field/g" \
+           -e "s/@MUTED_HEX@/$lock_muted_hex/g" \
+           -e "s/@ERROR_HEX@/$lock_error_hex/g" \
+           "$lock_template" >"$lock_dir/hyprlock.conf.tmp" 2>/dev/null \
+        && mv "$lock_dir/hyprlock.conf.tmp" "$lock_dir/hyprlock.conf" 2>/dev/null; then
+        status_hyprlock="written"
+    else
+        rm -f "$lock_dir/hyprlock.conf.tmp"
+        status_hyprlock="failed"
+    fi
+fi
+
+# ── tmux ─────────────────────────────────────────────────────────────────────
+# Generated like kitty's: tmux.conf sources current-theme.conf, and that file is
+# machine state rather than configuration. Running servers are re-sourced so an
+# open session changes now instead of at next launch -- tmux applies a
+# source-file to every attached client immediately.
+tmux_dir="${XDG_CONFIG_HOME:-$HOME/.config}/tmux"
+tmux_theme="$tmux_dir/themes/tokyonight-moon.conf"
+[[ "$scheme" == "light" ]] && tmux_theme="$tmux_dir/themes/tokyonight-day.conf"
+
+status_tmux="skipped"
+if [[ -r "$tmux_theme" ]]; then
+    if cp "$tmux_theme" "$tmux_dir/current-theme.conf.tmp" 2>/dev/null \
+        && mv "$tmux_dir/current-theme.conf.tmp" "$tmux_dir/current-theme.conf" 2>/dev/null; then
+        status_tmux="written"
+        # Only if a server is actually running; `tmux source-file` would
+        # otherwise start one just to theme it.
+        if command -v tmux >/dev/null 2>&1 && tmux has-session 2>/dev/null; then
+            tmux source-file "$tmux_dir/current-theme.conf" 2>/dev/null \
+                && status_tmux="applied to running sessions"
+        fi
+    else
+        rm -f "$tmux_dir/current-theme.conf.tmp"
+        status_tmux="failed"
+    fi
+fi
+
+# ── btop ─────────────────────────────────────────────────────────────────────
+# Only the color_theme line is rewritten, in place. btop OWNS btop.conf -- it
+# rewrites the whole file on exit -- so the config is not symlinked into Panama
+# and not replaced wholesale here; just this one value is edited, and btop keeps
+# it on the next write.
+#
+# btop reads its theme once at startup, so a running instance keeps the old
+# colours until it is restarted. That is acceptable for a monitor you open when
+# you want it, and forcing a restart would kill a process the user is watching.
+btop_conf="${XDG_CONFIG_HOME:-$HOME/.config}/btop/btop.conf"
+btop_theme="tokyonight-moon"
+[[ "$scheme" == "light" ]] && btop_theme="tokyonight-day"
+
+status_btop="skipped"
+if [[ -w "$btop_conf" ]]; then
+    if sed -i "s|^color_theme *=.*|color_theme = \"$btop_theme\"|" "$btop_conf" 2>/dev/null; then
+        status_btop="written"
+    else
+        status_btop="failed"
+    fi
+fi
+
+# ── GTK ──────────────────────────────────────────────────────────────────────
+# adw-gtk3, not Adwaita: no Adwaita GTK theme is installed on Fedora 44, and
+# naming a theme that does not exist makes GTK fall back to its light default --
+# which made dark mode silently produce light windows.
+if [[ "$scheme" == "light" ]]; then
+    gtk_theme="adw-gtk3"
+    prefer_dark=0
+else
+    gtk_theme="adw-gtk3-dark"
+    prefer_dark=1
+fi
+
+status_gtk="skipped"
+for gtk_version in 3.0 4.0; do
+    gtk_dir="${XDG_CONFIG_HOME:-$HOME/.config}/gtk-$gtk_version"
+    template="$gtk_dir/settings.ini.template"
+    [[ -r "$template" ]] || continue
+
+    # Written atomically: a GTK application starting mid-write would otherwise
+    # read a truncated file and fall back to defaults.
+    if sed -e "s/@GTK_THEME@/$gtk_theme/" -e "s/@PREFER_DARK@/$prefer_dark/" "$template" \
+        >"$gtk_dir/settings.ini.tmp" 2>/dev/null \
+        && mv "$gtk_dir/settings.ini.tmp" "$gtk_dir/settings.ini" 2>/dev/null; then
+        status_gtk="written"
+    else
+        rm -f "$gtk_dir/settings.ini.tmp"
+        status_gtk="failed"
+    fi
+done
+
 kitty_dir="${XDG_CONFIG_HOME:-$HOME/.config}/kitty"
 theme_file="$kitty_dir/themes/tokyonight-moon.conf"
 [[ "$scheme" == "light" ]] && theme_file="$kitty_dir/themes/tokyonight-day.conf"
@@ -54,4 +190,14 @@ if [[ -r "$theme_file" ]]; then
    fi
 fi

-printf '{"scheme":"%s","kitty":"%s"}\n' "$scheme" "$status_kitty"
+# Every target reports what actually happened. A helper that says only
+# "kitty: applied" while silently skipping three other applications is how a
+# half-applied theme goes unnoticed.
+jq -cn \
+    --arg scheme "$scheme" \
+    --arg kitty "$status_kitty" \
+    --arg gtk "$status_gtk" \
+    --arg btop "$status_btop" \
+    --arg tmux "$status_tmux" \
+    --arg hyprlock "$status_hyprlock" \
+    '{scheme: $scheme, kitty: $kitty, gtk: $gtk, btop: $btop, tmux: $tmux, hyprlock: $hyprlock}'
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+
+# A QR code for a saved Wi-Fi network, so a guest can join by pointing a camera.
+#
+# GNOME's Wi-Fi panel has this and it is the single most-used thing in it.
+# The payload is the de-facto WIFI: URI that Android and iOS both scan:
+#
+#   WIFI:T:WPA;S:<ssid>;P:<passphrase>;H:<hidden>;;
+#
+# HANDLING THE PASSPHRASE
+#
+# This image contains the network password in machine-readable form. Anyone who
+# can read the file can read the password, so:
+#
+#   * it is written under XDG_RUNTIME_DIR, which is 0700 and on tmpfs, so it
+#     never reaches disk and disappears at logout -- not /tmp, which is shared;
+#   * it is created with umask 077;
+#   * the passphrase is never printed, never passed as an argument (argv is
+#     world-readable via /proc), and never appears in an error message.
+#
+# It is piped to qrencode on stdin for that last reason.
+#
+# Usage:
+#   panama-wifi-qr list        -> {"networks":[{"name","ssid","shareable"}]}
+#   panama-wifi-qr qr <name>   -> {"path":"/run/user/…/….png"}
+
+set -uo pipefail
+
+emit_error() {
+    printf '{"networks":[],"path":"","error":%s}\n' "$(jq -Rn --arg e "$1" '$e')"
+    exit 0
+}
+
+command -v nmcli >/dev/null 2>&1 || emit_error 'NetworkManager is not available'
+command -v qrencode >/dev/null 2>&1 || emit_error 'qrencode is not installed, so a Wi-Fi QR code cannot be drawn'
+
+cmd_list() {
+    local rows=() name ssid psk
+    while IFS= read -r name; do
+        [[ -n "$name" ]] || continue
+        ssid="$(nmcli -g 802-11-wireless.ssid connection show "$name" 2>/dev/null)"
+        [[ -n "$ssid" ]] || ssid="$name"
+
+        # Only networks whose passphrase this user can actually read are
+        # shareable. An enterprise network has no passphrase to share at all,
+        # and a QR code for one would simply not work.
+        psk="$(nmcli -s -g 802-11-wireless-security.psk connection show "$name" 2>/dev/null)"
+
+        rows+=("$(jq -cn --arg name "$name" --arg ssid "$ssid" \
+            --argjson shareable "$([[ -n "$psk" ]] && echo true || echo false)" \
+            '{name: $name, ssid: $ssid, shareable: $shareable}')")
+    done < <(nmcli -t -f NAME,TYPE connection show 2>/dev/null \
+        | awk -F: '$2 == "802-11-wireless" { print $1 }')
+
+    if [[ ${#rows[@]} -eq 0 ]]; then
+        printf '{"networks":[],"path":"","error":"No saved Wi-Fi networks."}\n'
+        return 0
+    fi
+    printf '{"networks":[%s],"path":"","error":""}\n' "$(IFS=,; printf '%s' "${rows[*]}")"
+}
+
+# The WIFI: URI reserves \ ; , : and ", each escaped with a backslash. An SSID
+# containing a semicolon would otherwise terminate the field early and produce a
+# QR code for a different network entirely.
+#
+# Trailing newlines are stripped as well. nmcli terminates every value with one,
+# and left in place it lands INSIDE the payload -- the code still decodes here,
+# but a newline in the middle of a WIFI: URI is not something every phone's
+# scanner tolerates, and the failure would look like "the QR code just does not
+# work on my phone".
+escape_field() {
+    sed -e 's/\\/\\\\/g' -e 's/;/\\;/g' -e 's/,/\\,/g' -e 's/:/\\:/g' -e 's/"/\\"/g' \
+        | tr -d '\n'
+}
+
+cmd_qr() {
+    local name="${1:-}"
+    [[ -n "$name" ]] || emit_error 'no network named'
+
+    local ssid hidden psk_file payload_file out_dir out_file
+    ssid="$(nmcli -g 802-11-wireless.ssid connection show "$name" 2>/dev/null)"
+    [[ -n "$ssid" ]] || emit_error "There is no saved network called \"$name\"."
+
+    hidden="$(nmcli -g 802-11-wireless.hidden connection show "$name" 2>/dev/null)"
+    [[ "$hidden" == "yes" ]] && hidden=true || hidden=false
+
+    out_dir="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/panama"
+    umask 077
+    mkdir -p "$out_dir" 2>/dev/null || emit_error 'could not create the runtime directory'
+    chmod 700 "$out_dir" 2>/dev/null || true
+
+    # Named after the connection, hashed, so repeated shares reuse one file
+    # instead of accumulating images of the password.
+    out_file="$out_dir/wifi-$(printf '%s' "$name" | sha256sum | cut -c1-16).png"
+
+    # Built in a file rather than a variable that could be echoed, and piped to
+    # qrencode on stdin so the passphrase never appears in argv.
+    payload_file="$(mktemp "$out_dir/payload.XXXXXX")" || emit_error 'could not create a temporary file'
+    trap 'rm -f "$payload_file"' RETURN
+
+    {
+        printf 'WIFI:T:WPA;S:'
+        printf '%s' "$ssid" | escape_field
+        printf ';P:'
+        nmcli -s -g 802-11-wireless-security.psk connection show "$name" 2>/dev/null | escape_field
+        printf ';H:%s;;' "$hidden"
+    } >"$payload_file"
+
+    if ! qrencode -o "$out_file" -s 8 -m 2 -l M <"$payload_file" 2>/dev/null; then
+        emit_error "Could not generate a QR code for \"$name\"."
+    fi
+    chmod 600 "$out_file" 2>/dev/null || true
+
+    jq -cn --arg path "$out_file" '{networks: [], path: $path, error: ""}'
+}
+
+case "${1:-list}" in
+    list) cmd_list ;;
+    qr)   shift; cmd_qr "${1:-}" ;;
+    *)    printf 'usage: panama-wifi-qr [list|qr <name>]\n' >&2; exit 2 ;;
+esac
@@ -25,25 +25,14 @@ import qs.config
 Singleton {
    id: root

-    property string cursorTheme: ""
    property string lastError: ""

-    readonly property bool busy: themeQuery.running || runner.running || root.pending.length > 0
+    readonly property bool busy: runner.running || root.pending.length > 0

+    readonly property string cursorTheme: DesktopPreferences.get("cursorTheme")
    readonly property int cursorSize: DesktopPreferences.get("cursorSize")
    readonly property real textScale: DesktopPreferences.get("textScale")

-    Process {
-        id: themeQuery
-        command: ["gsettings", "get", "org.gnome.desktop.interface", "cursor-theme"]
-        stdout: StdioCollector {
-            onStreamFinished: {
-                // gsettings quotes strings: 'oreo_blue_cursors'
-                root.cursorTheme = this.text.trim().replace(/^'|'$/g, "");
-            }
-        }
-    }
-
    // A short queue, because applying one setting takes several commands and
    // Process runs one at a time.
    property var pending: []
@@ -71,7 +60,6 @@ Singleton {
    }

    Component.onCompleted: {
-        themeQuery.running = true;
        settle.restart();
    }

@@ -102,9 +90,6 @@ Singleton {
            ["gsettings", "set", "org.gnome.desktop.interface", "cursor-size", size],
            ["gsettings", "set", "org.gnome.desktop.interface", "text-scaling-factor", String(root.textScale)]
        ];
-        // setcursor needs a theme name; skip it rather than guess if gsettings
-        // has not answered yet. The next change will catch up.
-        if (root.cursorTheme !== "")
        commands.push(["hyprctl", "setcursor", root.cursorTheme, size]);
        root.enqueue(commands);
    }
@@ -8,6 +8,8 @@ import Quickshell
 import Quickshell.Services.Pipewire
 import QtQuick

+import "AudioStreams.js" as AudioStreams
+
 Singleton {
    id: root

@@ -18,6 +20,13 @@ Singleton {
        !node.isStream
        && (node.type & PwNodeType.AudioSource) === PwNodeType.AudioSource)

+    readonly property var playbackStreams: Pipewire.nodes.values.filter(node =>
+        node.ready && node.audio
+        && (node.type & PwNodeType.AudioOutStream) === PwNodeType.AudioOutStream)
+
+    readonly property var applications: AudioStreams.group(
+        root.playbackStreams, PwNodeType.AudioOutStream)
+
    function nodes(output: bool): var {
        return output ? root.outputs : root.inputs;
    }
@@ -40,4 +49,20 @@ Singleton {
            return "Unknown device";
        return node.description || node.nickname || node.name || "Unknown device";
    }
+
+    function applicationVolume(application: var): real {
+        return AudioStreams.volume(application);
+    }
+
+    function applicationMuted(application: var): bool {
+        return AudioStreams.muted(application);
+    }
+
+    function setApplicationVolume(application: var, value: real): bool {
+        return AudioStreams.setVolume(application, value);
+    }
+
+    function setApplicationMuted(application: var, muted: bool): bool {
+        return AudioStreams.setMuted(application, muted);
+    }
 }
@@ -0,0 +1,72 @@
+function property(node, key) {
+    const value = node && node.properties ? node.properties[key] : "";
+    return typeof value === "string" ? value.trim() : "";
+}
+
+function groupKey(node) {
+    return property(node, "application.id")
+        || property(node, "application.process.binary")
+        || property(node, "application.name")
+        || `node:${node.id}`;
+}
+
+function label(node) {
+    return property(node, "application.name")
+        || String(node.description || "").trim()
+        || property(node, "media.name")
+        || "Unknown application";
+}
+
+function icon(node) {
+    return property(node, "application.icon_name")
+        || "audio-x-generic-symbolic";
+}
+
+function group(nodes, audioOutStreamFlag) {
+    const groups = [];
+    const byKey = {};
+    for (const node of nodes || []) {
+        if (!node || node.ready !== true || !node.audio
+                || (node.type & audioOutStreamFlag) !== audioOutStreamFlag)
+            continue;
+        const key = groupKey(node);
+        if (!byKey[key]) {
+            byKey[key] = { key, label: label(node), icon: icon(node), nodes: [] };
+            groups.push(byKey[key]);
+        }
+        byKey[key].nodes.push(node);
+    }
+    return groups;
+}
+
+function audioNodes(application) {
+    return (application && application.nodes || []).filter(node => node && node.audio);
+}
+
+function volume(application) {
+    const nodes = audioNodes(application);
+    return nodes.length === 0 ? 0
+        : nodes.reduce((sum, node) => sum + node.audio.volume, 0) / nodes.length;
+}
+
+function muted(application) {
+    const nodes = audioNodes(application);
+    return nodes.length > 0 && nodes.every(node => node.audio.muted === true);
+}
+
+function setVolume(application, value) {
+    const next = Math.max(0, Math.min(1, Number(value)));
+    if (!Number.isFinite(next)) return false;
+    const nodes = audioNodes(application);
+    for (const node of nodes) {
+        node.audio.muted = false;
+        node.audio.volume = next;
+    }
+    return nodes.length > 0;
+}
+
+function setMuted(application, mutedValue) {
+    const nodes = audioNodes(application);
+    for (const node of nodes) node.audio.muted = mutedValue === true;
+    return nodes.length > 0;
+}
@@ -24,6 +24,11 @@ Singleton {
    readonly property string appThemePath: Quickshell.shellDir + "/scripts/panama-theme-apps"

    readonly property bool dark: DesktopPreferences.get("colorScheme") !== "light"
+    // A neutral contrast role, not an accent. The focused Prism border belongs
+    // to the visual theme and must remain untouched when this role changes.
+    readonly property string inactiveBorderDark: "rgba(3b426199)"
+    readonly property string inactiveBorderLight: "rgba(a8aecb99)"
+    readonly property string inactiveBorder: root.dark ? root.inactiveBorderDark : root.inactiveBorderLight
    property string lastError: ""

    // Applied one command at a time: Process runs a single command, and several
@@ -78,21 +83,31 @@ Singleton {
        root.lastError = "";

        const scheme = root.dark ? "prefer-dark" : "prefer-light";
-        // Adwaita's light and dark are the same theme; only the preference and
-        // the -dark suffix differ, so applications that honour either agree.
-        const gtkTheme = root.dark ? "Adwaita-dark" : "Adwaita";
+
+        // adw-gtk3, not Adwaita. This is the bug that made dark mode look
+        // broken while light mode looked fine:
+        //
+        // Neither "Adwaita" nor "Adwaita-dark" is an installed theme on Fedora
+        // 44 -- only adw-gtk3 and adw-gtk3-dark are. Naming a theme that does
+        // not exist makes GTK fall back to its built-in default, which is
+        // LIGHT. So asking for light accidentally worked, asking for dark
+        // silently produced light, and applications that take their cue from
+        // the GTK theme rather than the portal -- Chromium and Electron, when
+        // built against GTK -- stayed light no matter what the portal said.
+        //
+        // gtk-theme-contract asserts these names are actually installed,
+        // because the failure mode is silent in exactly this way.
+        const gtkTheme = root.dark ? "adw-gtk3-dark" : "adw-gtk3";

        const commands = [
            ["gsettings", "set", "org.gnome.desktop.interface", "color-scheme", scheme],
            ["gsettings", "set", "org.gnome.desktop.interface", "gtk-theme", gtkTheme]
        ];

-        // Unfocused window borders. The focused border is the prism gradient and
-        // is already scheme-independent; the inactive one is a flat neutral that
-        // would be invisible against the opposite background.
-        const inactive = root.dark ? "rgba(3b426199)" : "rgba(a8aecb99)";
+        // Unfocused window borders need scheme-relative contrast. The focused
+        // Prism border is deliberately owned by the accent/theme layer.
        commands.push(["hyprctl", "eval",
-            `hl.config({ general = { col = { inactive_border = "${inactive}" } } })`]);
+            `hl.config({ general = { col = { inactive_border = "${root.inactiveBorder}" } } })`]);

        // Applications that predate org.freedesktop.appearance and carry their
        // own palettes -- terminals, chiefly. Everything that reads the portal
@@ -33,11 +33,16 @@ Singleton {
    }

    readonly property var wiredDevice: {
+        let fallback = null;
        for (const device of Networking.devices.values) {
-            if (device.type === DeviceType.Wired)
+            if (device.type !== DeviceType.Wired)
+                continue;
+            if (device.connected)
                return device;
+            if (!fallback)
+                fallback = device;
        }
-        return null;
+        return fallback;
    }

    readonly property var adapter: Bluetooth.defaultAdapter
@@ -98,5 +98,16 @@ Singleton {
        mutationProcess.exec([root.helper, "set-autostart", desktopId, String(enabled)]);
    }

+    function addAutostart(desktopId: string): void {
+        if (root.busy)
+            return;
+        if (!root.knownDesktopId(desktopId)) {
+            root.lastError = "Choose an installed application.";
+            return;
+        }
+        root.lastError = "";
+        mutationProcess.exec([root.helper, "add-autostart", desktopId]);
+    }
+
    Component.onCompleted: root.refresh()
 }
@@ -0,0 +1,260 @@
+pragma Singleton
+
+// Application-facing desktop style.
+//
+// Panama owns the durable choices; gsettings is an output boundary for GTK
+// and applications that follow GNOME's desktop schemas. Commands are arrays,
+// values are validated before storage, and no user text is ever sent through a
+// shell. Hyprland's pointer setting stays live through Accessibility.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+import qs.config
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-desktop-style"
+
+    // SearchPicker consumes [{ value, label, detail }]. Keep the raw names as
+    // a separate allow-list so a caller cannot smuggle a display label into a
+    // stored theme name.
+    property var cursorThemes: []
+    property var iconThemes: []
+    property var cursorThemeNames: []
+    property var iconThemeNames: []
+    property bool catalogLoaded: false
+    property bool scanning: false
+    property bool startupApplied: false
+    property string lastError: ""
+
+    property var pending: []
+    readonly property bool busy: root.scanning || catalogProcess.running
+        || runner.running || root.pending.length > 0
+    readonly property int preferenceRevision: DesktopPreferences.revision
+
+    readonly property string cursorTheme: DesktopPreferences.get("cursorTheme")
+    readonly property string iconTheme: DesktopPreferences.get("iconTheme")
+    readonly property string applicationFont: DesktopPreferences.get("applicationFont")
+    readonly property string documentFont: DesktopPreferences.get("documentFont")
+    readonly property string monospaceFont: DesktopPreferences.get("monospaceFont")
+
+    Process {
+        id: catalogProcess
+
+        stdout: StdioCollector {
+            onStreamFinished: root.acceptCatalog(this.text)
+        }
+
+        onExited: (exitCode, exitStatus) => {
+            root.scanning = false;
+            if (exitCode !== 0) {
+                root.catalogLoaded = false;
+                root.lastError = "Installed icon and pointer themes could not be read.";
+            }
+        }
+    }
+
+    Process {
+        id: runner
+
+        onExited: (exitCode, exitStatus) => {
+            if (exitCode !== 0)
+                root.lastError = "One desktop style setting could not be applied.";
+            root.drain();
+        }
+    }
+
+    Component.onCompleted: {
+        root.ensureStarted();
+        // Accessing the singleton here keeps its existing hyprctl setcursor
+        // path alive for cursor-theme changes as well as cursor-size changes.
+        Accessibility.applyAll();
+    }
+
+    Timer {
+        id: startupApply
+        interval: 1200
+        onTriggered: {
+            root.startupApplied = true;
+            root.applyAll();
+        }
+    }
+
+    Connections {
+        target: DesktopPreferences
+        function onRevisionChanged(): void { applyCoalesce.restart(); }
+    }
+
+    Timer {
+        id: applyCoalesce
+        interval: 180
+        onTriggered: root.applyAll()
+    }
+
+    function ensureStarted(): void {
+        if (!root.catalogLoaded && !root.scanning)
+            root.refreshCatalog();
+        if (!root.startupApplied && !startupApply.running)
+            startupApply.restart();
+    }
+
+    function refreshCatalog(): void {
+        if (catalogProcess.running)
+            return;
+        root.scanning = true;
+        catalogProcess.exec([root.helperPath]);
+    }
+
+    function acceptCatalog(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            if (!parsed || !Array.isArray(parsed.cursorThemes) || !Array.isArray(parsed.iconThemes))
+                throw new Error("invalid catalog shape");
+
+            const cursors = parsed.cursorThemes.filter(name =>
+                typeof name === "string" && PreferenceSchema.coerce("cursorTheme", name) !== undefined);
+            const icons = parsed.iconThemes.filter(name =>
+                typeof name === "string" && PreferenceSchema.coerce("iconTheme", name) !== undefined);
+            root.cursorThemeNames = cursors;
+            root.iconThemeNames = icons;
+            root.cursorThemes = cursors.map(name => ({
+                value: name,
+                label: name,
+                detail: "Pointer theme"
+            }));
+            root.iconThemes = icons.map(name => ({
+                value: name,
+                label: name,
+                detail: "Application icon theme"
+            }));
+            root.catalogLoaded = true;
+            root.lastError = "";
+        } catch (error) {
+            root.cursorThemes = [];
+            root.iconThemes = [];
+            root.cursorThemeNames = [];
+            root.iconThemeNames = [];
+            root.catalogLoaded = false;
+            root.lastError = "Installed icon and pointer themes could not be read.";
+        }
+        root.scanning = false;
+    }
+
+    function drain(): void {
+        if (runner.running || root.pending.length === 0)
+            return;
+        const next = root.pending[0];
+        root.pending = root.pending.slice(1);
+        runner.exec(next);
+    }
+
+    function enqueue(commands: var): void {
+        // A fresh revision supersedes commands that have not started yet. The
+        // currently running command is allowed to finish, then the newest full
+        // state is replayed in a deterministic order.
+        root.pending = commands;
+        root.drain();
+    }
+
+    // GVariant accepts JSON-style quoted strings. JSON.stringify escapes every
+    // quote, backslash, and control character, and the schema patterns further
+    // constrain stored font/theme names. Arguments still travel directly to
+    // gsettings rather than through a shell.
+    function gvariant(value: var): string {
+        if (typeof value === "boolean")
+            return value ? "true" : "false";
+        if (typeof value === "number")
+            return String(value);
+        return JSON.stringify(String(value));
+    }
+
+    function fontName(familyKey: string, sizeKey: string): string {
+        return `${DesktopPreferences.get(familyKey)} ${DesktopPreferences.get(sizeKey)}`;
+    }
+
+    function buttonLayout(): string {
+        const side = DesktopPreferences.get("titlebarButtonSide");
+        const maximize = DesktopPreferences.get("titlebarMaximizeButton") === true;
+
+        // Tokens are fixed. Only their side and whether maximize is present
+        // vary, so preference data can never become command syntax.
+        if (side === "left")
+            return (maximize ? "close,maximize" : "close") + ":appmenu";
+        return "appmenu:" + (maximize ? "maximize,close" : "close");
+    }
+
+    function setting(schema: string, key: string, value: var): var {
+        return ["gsettings", "set", schema, key, root.gvariant(value)];
+    }
+
+    function applyAll(): void {
+        root.lastError = "";
+        root.enqueue([
+            root.setting("org.gnome.desktop.interface", "icon-theme", root.iconTheme),
+            root.setting("org.gnome.desktop.interface", "cursor-theme", root.cursorTheme),
+            root.setting("org.gnome.desktop.interface", "font-name",
+                         root.fontName("applicationFont", "applicationFontSize")),
+            root.setting("org.gnome.desktop.interface", "document-font-name",
+                         root.fontName("documentFont", "documentFontSize")),
+            root.setting("org.gnome.desktop.interface", "monospace-font-name",
+                         root.fontName("monospaceFont", "monospaceFontSize")),
+            root.setting("org.gnome.desktop.interface", "font-hinting",
+                         DesktopPreferences.get("fontHinting")),
+            root.setting("org.gnome.desktop.interface", "font-antialiasing",
+                         DesktopPreferences.get("fontAntialiasing")),
+            root.setting("org.gnome.desktop.interface", "gtk-enable-primary-paste",
+                         DesktopPreferences.get("middleClickPaste")),
+            root.setting("org.gnome.desktop.wm.preferences", "button-layout", root.buttonLayout()),
+            root.setting("org.gnome.desktop.wm.preferences", "action-double-click-titlebar",
+                         DesktopPreferences.get("titlebarDoubleClick"))
+        ]);
+    }
+
+    function storeCatalogChoice(key: string, value: string, allowed: var, kind: string): bool {
+        if (!root.catalogLoaded || allowed.indexOf(value) < 0) {
+            root.lastError = `That ${kind} theme is not installed.`;
+            return false;
+        }
+        if (!DesktopPreferences.set(key, value)) {
+            root.lastError = `That ${kind} theme name could not be saved.`;
+            return false;
+        }
+        root.lastError = "";
+        return true;
+    }
+
+    function setCursorTheme(value: string): bool {
+        return root.storeCatalogChoice("cursorTheme", value, root.cursorThemeNames, "pointer");
+    }
+
+    function setIconTheme(value: string): bool {
+        return root.storeCatalogChoice("iconTheme", value, root.iconThemeNames, "icon");
+    }
+
+    function storeFont(key: string, family: string, allowed: var, kind: string): bool {
+        if (allowed.indexOf(family) < 0) {
+            root.lastError = `That ${kind} font is not installed.`;
+            return false;
+        }
+        if (!DesktopPreferences.set(key, family)) {
+            root.lastError = `That ${kind} font name could not be saved.`;
+            return false;
+        }
+        root.lastError = "";
+        return true;
+    }
+
+    function setApplicationFont(family: string): bool {
+        return root.storeFont("applicationFont", family, Fonts.interfaceFonts, "application");
+    }
+
+    function setDocumentFont(family: string): bool {
+        return root.storeFont("documentFont", family, Fonts.interfaceFonts, "document");
+    }
+
+    function setMonospaceFont(family: string): bool {
+        return root.storeFont("monospaceFont", family, Fonts.monospaceFonts, "monospace");
+    }
+}
@@ -0,0 +1,166 @@
+function logicalSize(record) {
+    if (!record)
+        return { width: 0, height: 0 };
+
+    const width = Number(record.width);
+    const height = Number(record.height);
+    const scale = Number(record.scale);
+    const transform = Number(record.transform);
+    if (!Number.isFinite(width) || !Number.isFinite(height)
+            || !Number.isFinite(scale) || scale <= 0)
+        return { width: 0, height: 0 };
+
+    const rotated = transform === 1 || transform === 3;
+    return {
+        width: (rotated ? height : width) / scale,
+        height: (rotated ? width : height) / scale
+    };
+}
+
+function validCoordinate(value) {
+    return Number.isFinite(value) && Number.isInteger(value)
+        && value >= -100000 && value <= 100000;
+}
+
+function validate(layout) {
+    if (!Array.isArray(layout) || layout.length === 0)
+        return false;
+
+    const names = {};
+    let primaryCount = 0;
+    for (const record of layout) {
+        if (!record || typeof record.name !== "string"
+                || !/^[A-Za-z0-9_.-]+$/.test(record.name)
+                || names[record.name])
+            return false;
+        names[record.name] = true;
+
+        if (!Number.isFinite(record.width) || record.width <= 0
+                || !Number.isFinite(record.height) || record.height <= 0
+                || !Number.isFinite(record.scale) || record.scale <= 0
+                || !Number.isInteger(record.transform)
+                || record.transform < 0 || record.transform > 3
+                || !validCoordinate(record.x) || !validCoordinate(record.y)
+                || typeof record.primary !== "boolean")
+            return false;
+
+        const size = logicalSize(record);
+        if (!Number.isFinite(size.width) || size.width <= 0
+                || !Number.isFinite(size.height) || size.height <= 0)
+            return false;
+        if (record.primary)
+            primaryCount += 1;
+    }
+    return primaryCount === 1;
+}
+
+function cloneLayout(layout) {
+    return (layout || []).map(record => Object.assign({}, record));
+}
+
+function normalize(layout) {
+    const result = cloneLayout(layout);
+    const primary = result.find(record => record.primary === true);
+    if (!primary)
+        return result;
+    const anchorX = primary.x;
+    const anchorY = primary.y;
+    for (const record of result) {
+        record.x -= anchorX;
+        record.y -= anchorY;
+    }
+    return result;
+}
+
+function bounds(layout) {
+    if (!Array.isArray(layout) || layout.length === 0)
+        return { x: 0, y: 0, width: 0, height: 0 };
+
+    let left = Infinity;
+    let top = Infinity;
+    let right = -Infinity;
+    let bottom = -Infinity;
+    for (const record of layout) {
+        const size = logicalSize(record);
+        left = Math.min(left, record.x);
+        top = Math.min(top, record.y);
+        right = Math.max(right, record.x + size.width);
+        bottom = Math.max(bottom, record.y + size.height);
+    }
+    return { x: left, y: top, width: right - left, height: bottom - top };
+}
+
+function snap(layout, movingName, threshold) {
+    const result = cloneLayout(layout);
+    const moving = result.find(record => record.name === movingName);
+    if (!moving)
+        return result;
+
+    const limit = Number.isFinite(threshold) && threshold >= 0 ? threshold : 16;
+    const movingSize = logicalSize(moving);
+    const movingXEdges = [moving.x, moving.x + movingSize.width];
+    const movingYEdges = [moving.y, moving.y + movingSize.height];
+    const stationary = result
+        .filter(record => record.name !== movingName)
+        .sort((left, right) => left.name.localeCompare(right.name));
+
+    let bestX = null;
+    let bestY = null;
+    for (const record of stationary) {
+        const size = logicalSize(record);
+        const xEdges = [record.x, record.x + size.width];
+        const yEdges = [record.y, record.y + size.height];
+        for (const source of movingXEdges) {
+            for (const target of xEdges) {
+                const delta = target - source;
+                const distance = Math.abs(delta);
+                if (distance <= limit && (bestX === null || distance < bestX.distance))
+                    bestX = { delta, distance };
+            }
+        }
+        for (const source of movingYEdges) {
+            for (const target of yEdges) {
+                const delta = target - source;
+                const distance = Math.abs(delta);
+                if (distance <= limit && (bestY === null || distance < bestY.distance))
+                    bestY = { delta, distance };
+            }
+        }
+    }
+
+    if (bestX !== null)
+        moving.x += bestX.delta;
+    if (bestY !== null)
+        moving.y += bestY.delta;
+    return result;
+}
+
+function canvasRects(layout, canvasWidth, canvasHeight, padding) {
+    const desktopBounds = bounds(layout);
+    const inset = Math.max(0, Number(padding) || 0);
+    const availableWidth = Math.max(0, Number(canvasWidth) - inset * 2);
+    const availableHeight = Math.max(0, Number(canvasHeight) - inset * 2);
+    const scale = desktopBounds.width > 0 && desktopBounds.height > 0
+        ? Math.min(availableWidth / desktopBounds.width,
+            availableHeight / desktopBounds.height)
+        : 0;
+    const contentWidth = desktopBounds.width * scale;
+    const contentHeight = desktopBounds.height * scale;
+    const originX = inset + (availableWidth - contentWidth) / 2;
+    const originY = inset + (availableHeight - contentHeight) / 2;
+    return {
+        bounds: desktopBounds,
+        scale,
+        rects: (layout || []).map(record => {
+            const size = logicalSize(record);
+            return {
+                name: record.name,
+                x: originX + (record.x - desktopBounds.x) * scale,
+                y: originY + (record.y - desktopBounds.y) * scale,
+                width: size.width * scale,
+                height: size.height * scale,
+                primary: record.primary === true
+            };
+        })
+    };
+}
@@ -21,6 +21,7 @@ import Quickshell
 import Quickshell.Io
 import QtQuick
 import qs.config
+import "DisplayLayout.js" as DisplayLayout

 Singleton {
    id: root
@@ -31,25 +32,25 @@ Singleton {
    property string lastError: ""

    // Set while a change is applied but not yet confirmed.
-    property string pendingOutput: ""
-    property var pendingPrevious: null
-    property var pendingRequested: null
+    property var pendingPreviousLayout: null
+    property var pendingRequestedLayout: null
    property bool pendingVerified: false
    property bool revertQueued: false
-    property var revertExpected: null
+    property var revertExpectedLayout: null
    property string revertReason: ""
    property bool revertVerificationActive: false
    property int operationGeneration: 0
    property int revertGeneration: -1
    property bool externalChangeBlocked: false
    property int secondsLeft: 0
+    property bool identifying: false

-    readonly property bool awaitingConfirmation: root.pendingOutput !== ""
+    readonly property bool awaitingConfirmation: root.pendingRequestedLayout !== null
    readonly property bool canConfirm: root.awaitingConfirmation
        && root.pendingVerified
        && !root.busy
    readonly property bool busy: query.running || applyRun.running || revertRun.running
-        || root.revertExpected !== null
+        || root.revertExpectedLayout !== null

    readonly property int confirmSeconds: 15

@@ -123,9 +124,24 @@ Singleton {
        return false;
    }

+    function identify(): void {
+        root.identifying = true;
+        identifyTimer.restart();
+    }
+
    function parse(text: string, generation: int): void {
        try {
            const raw = JSON.parse(text);
+            const stored = DesktopPreferences.get("displays");
+            const persisted = stored && typeof stored === "object" ? stored : {};
+            const persistedPrimaries = raw.filter(monitor => {
+                const entry = persisted[monitor.name ?? ""];
+                return root.isPersistedLayoutEntry(entry) && entry.primary === true;
+            });
+            const origin = raw.find(monitor => monitor.x === 0 && monitor.y === 0);
+            const primaryName = persistedPrimaries.length === 1
+                ? persistedPrimaries[0].name
+                : (origin?.name ?? raw[0]?.name ?? "");
            root.monitors = raw.map(monitor => {
                const modes = root.normaliseModes(monitor.availableModes ?? []);
                const width = monitor.width ?? 0;
@@ -144,31 +160,35 @@ Singleton {
                    mode: current?.mode ?? `${width}x${height}@${refreshRate}`,
                    scale: monitor.scale ?? 1,
                    transform: monitor.transform ?? 0,
+                    x: Number.isInteger(monitor.x) ? monitor.x : 0,
+                    y: Number.isInteger(monitor.y) ? monitor.y : 0,
+                    primary: monitor.name === primaryName,
                    currentFormat: monitor.currentFormat ?? "",
                    colorPreset: monitor.colorManagementPreset ?? "",
                    vrr: monitor.vrr === true,
                    modes: modes
                };
            });
-            if (root.awaitingConfirmation && root.pendingRequested
-                    && root.matchesRequest(root.monitorNamed(root.pendingOutput), root.pendingRequested)) {
+            if (root.awaitingConfirmation && root.pendingRequestedLayout
+                    && generation === root.operationGeneration
+                    && root.matchesLayout(root.monitors, root.pendingRequestedLayout)) {
                root.pendingVerified = true;
                verifyTimer.stop();
                root.lastError = "";
            } else if (root.revertVerificationActive
                    && generation === root.revertGeneration
-                    && root.revertExpected
-                    && root.matchesRequest(root.monitorNamed(root.revertExpected.output), root.revertExpected)) {
+                    && root.revertExpectedLayout
+                    && root.matchesLayout(root.monitors, root.revertExpectedLayout)) {
                revertVerifyTimer.stop();
                root.revertVerificationActive = false;
                root.revertGeneration = -1;
-                root.revertExpected = null;
+                root.revertExpectedLayout = null;
                if (root.revertReason === "")
                    root.lastError = "";
                else
                    root.lastError = root.revertReason;
                root.revertReason = "";
-            } else if (!root.awaitingConfirmation && !root.revertExpected && (
+            } else if (!root.awaitingConfirmation && !root.revertExpectedLayout && (
                    root.lastError === "Could not read the connected displays."
                    || root.lastError === "The display list could not be read.")) {
                root.lastError = "";
@@ -216,6 +236,17 @@ Singleton {
        return root.monitors.find(monitor => monitor.name === name) ?? null;
    }

+    function isPersistedLayoutEntry(entry: var): bool {
+        return !!entry && typeof entry === "object"
+            && root.modeParts(entry.mode) !== null
+            && Number.isFinite(entry.scale) && entry.scale > 0
+            && Number.isInteger(entry.transform)
+            && entry.transform >= 0 && entry.transform <= 3
+            && Number.isInteger(entry.x) && entry.x >= -100000 && entry.x <= 100000
+            && Number.isInteger(entry.y) && entry.y >= -100000 && entry.y <= 100000
+            && typeof entry.primary === "boolean";
+    }
+
    function modeParts(mode: string): var {
        const match = String(mode).match(/^(\d+)x(\d+)@(\d+(?:\.\d+)?)$/);
        if (!match)
@@ -250,16 +281,41 @@ Singleton {
            choices[0]);
    }

-    function matchesRequest(monitor: var, requested: var): bool {
-        if (!monitor || !requested || monitor.name !== requested.output)
+    function currentLayout(): var {
+        return root.monitors.map(monitor => ({
+            name: monitor.name,
+            width: monitor.width,
+            height: monitor.height,
+            refreshRate: monitor.refreshRate,
+            mode: monitor.mode,
+            scale: monitor.scale,
+            transform: monitor.transform,
+            x: monitor.x,
+            y: monitor.y,
+            primary: monitor.primary === true
+        }));
+    }
+
+    function matchesLayout(monitors: var, layout: var): bool {
+        if (!Array.isArray(monitors) || !Array.isArray(layout)
+                || monitors.length !== layout.length)
            return false;
+        const expected = Array.from(layout).sort((a, b) => a.name.localeCompare(b.name));
+        const actual = Array.from(monitors).sort((a, b) => a.name.localeCompare(b.name));
+        for (let index = 0; index < expected.length; index++) {
+            const requested = expected[index];
+            const monitor = actual[index];
            const parts = root.modeParts(requested.mode);
-        return !!parts
-            && monitor.width === parts.width
-            && monitor.height === parts.height
-            && Math.abs(monitor.refreshRate - parts.refresh) < 0.01
-            && Math.abs(monitor.scale - requested.scale) < 0.001
-            && monitor.transform === requested.transform;
+            if (!parts || monitor.name !== requested.name
+                    || monitor.width !== parts.width
+                    || monitor.height !== parts.height
+                    || Math.abs(monitor.refreshRate - parts.refresh) >= 0.01
+                    || Math.abs(monitor.scale - requested.scale) >= 0.001
+                    || monitor.transform !== requested.transform
+                    || monitor.x !== requested.x || monitor.y !== requested.y)
+                return false;
+        }
+        return true;
    }

    function modeIsCurrent(monitor: var, candidate: var): bool {
@@ -269,10 +325,48 @@ Singleton {
            && Math.abs(monitor.refreshRate - candidate.refresh) < 0.01;
    }

-    // Applies immediately and starts the countdown. Nothing is stored yet: the
-    // settings file is only written by confirm().
+    function validRequestedLayout(layout: var): bool {
+        if (!DisplayLayout.validate(layout) || layout.length !== root.monitors.length)
+            return false;
+        const currentNames = root.monitors.map(monitor => monitor.name).sort();
+        const requestedNames = layout.map(record => record.name).sort();
+        if (JSON.stringify(currentNames) !== JSON.stringify(requestedNames))
+            return false;
+        return layout.every(record => {
+            const monitor = root.monitorNamed(record.name);
+            const parts = root.modeParts(record.mode);
+            return !!monitor && !!parts
+                && record.width === parts.width && record.height === parts.height
+                && monitor.modes.some(candidate => candidate.mode === record.mode)
+                && root.isScaleClean(record.mode, record.scale)
+                && root.transforms.some(candidate => candidate.value === record.transform);
+        });
+    }
+
+    // One-field controls remain callers of the complete-layout transaction.
+    // Their edit is cloned into the current layout so every output's position
+    // participates in apply, verification, and rollback.
    function apply(output: string, mode: string, scale: real, transform: int): bool {
-        if (root.externalChangeBlocked) {
+        const layout = root.currentLayout();
+        const record = layout.find(candidate => candidate.name === output);
+        const parts = root.modeParts(mode);
+        if (!record || !parts) {
+            root.lastError = record ? "That display does not offer that mode." : "That display is not connected.";
+            return false;
+        }
+        record.mode = mode;
+        record.width = parts.width;
+        record.height = parts.height;
+        record.refreshRate = parts.refresh;
+        record.scale = scale;
+        record.transform = transform;
+        return root.applyLayout(layout);
+    }
+
+    // Applies immediately and starts the countdown. Nothing is stored yet: the
+    // complete connected layout is only written by confirm().
+    function applyLayout(layout: var, protectedOperation: bool): bool {
+        if (root.externalChangeBlocked && protectedOperation !== true) {
            root.lastError = "Wait for Settings to finish restoring before changing a display.";
            return false;
        }
@@ -284,58 +378,53 @@ Singleton {
            root.lastError = "Finish the current display change first.";
            return false;
        }
-        const monitor = root.monitorNamed(output);
-        if (!monitor) {
-            root.lastError = "That display is not connected.";
-            return false;
-        }
-        if (!monitor.modes.some(candidate => candidate.mode === mode)) {
-            root.lastError = "That display does not offer that mode.";
-            return false;
-        }
-        if (!root.isScaleClean(mode, scale)) {
-            root.lastError = "That scale does not divide this resolution cleanly.";
-            return false;
-        }
-        if (!root.transforms.some(candidate => candidate.value === transform)) {
-            root.lastError = "That rotation is not one Panama offers.";
+        const normalized = DisplayLayout.normalize(layout);
+        if (!root.validRequestedLayout(normalized)) {
+            root.lastError = "That complete display layout is not valid for the connected displays.";
            return false;
        }

-        root.pendingPrevious = {
-            output: output,
-            mode: monitor.mode,
-            scale: monitor.scale,
-            transform: monitor.transform
-        };
+        root.pendingPreviousLayout = root.currentLayout();
        root.operationGeneration++;
-        root.pendingRequested = {
-            output: output,
-            mode: mode,
-            scale: scale,
-            transform: transform
-        };
-        root.pendingOutput = output;
+        root.pendingRequestedLayout = normalized;
        root.pendingVerified = false;
        root.revertQueued = false;
        root.secondsLeft = root.confirmSeconds;
        root.lastError = "";
        countdown.restart();

-        root.push(output, mode, scale, transform);
+        root.pushLayout(normalized, applyRun);
        return true;
    }

-    function push(output: string, mode: string, scale: real, transform: int): void {
-        // Values are validated above and the output name comes from the
-        // compositor's own list, so nothing user-authored reaches the payload.
-        applyRun.exec(["hyprctl", "eval",
-            `hl.monitor({ output = "${output}", mode = "${mode}", scale = ${scale}, transform = ${transform} })`]);
+    // Settings restore holds the external-change lock while it proves a
+    // snapshot. This narrow entry point authorizes that one transaction while
+    // keeping every user-facing control blocked until restore settles.
+    function applyProtectedLayout(layout: var): bool {
+        return root.applyLayout(layout, true);
+    }
+
+    function makePrimary(output: string): bool {
+        const layout = root.currentLayout();
+        if (!layout.some(record => record.name === output)) {
+            root.lastError = "That display is not connected.";
+            return false;
+        }
+        for (const record of layout)
+            record.primary = record.name === output;
+        return root.applyLayout(DisplayLayout.normalize(layout));
+    }
+
+    function pushLayout(layout: var, runner: var): void {
+        const payload = layout.map(record =>
+            `hl.monitor({ output = "${record.name}", mode = "${record.mode}", position = "${record.x}x${record.y}", scale = ${record.scale}, transform = ${record.transform} })`
+        ).join("; ");
+        runner.exec(["hyprctl", "eval", payload]);
    }

    function confirm(): bool {
-        if (!root.canConfirm || !root.matchesRequest(
-                root.monitorNamed(root.pendingOutput), root.pendingRequested)) {
+        if (!root.canConfirm
+                || !root.matchesLayout(root.monitors, root.pendingRequestedLayout)) {
            if (root.awaitingConfirmation)
                root.lastError = "Wait for the display to finish applying before keeping it.";
            return false;
@@ -343,11 +432,16 @@ Singleton {

        const stored = DesktopPreferences.get("displays");
        const next = Object.assign({}, (stored && typeof stored === "object") ? stored : {});
-        next[root.pendingOutput] = {
-            mode: root.pendingRequested.mode,
-            scale: root.pendingRequested.scale,
-            transform: root.pendingRequested.transform
+        for (const record of root.pendingRequestedLayout) {
+            next[record.name] = {
+                mode: record.mode,
+                scale: record.scale,
+                transform: record.transform,
+                x: record.x,
+                y: record.y,
+                primary: record.primary
            };
+        }
        if (!DesktopPreferences.set("displays", next)) {
            root.lastError = "That display setting could not be saved. Revert it and try again.";
            return false;
@@ -361,9 +455,8 @@ Singleton {
    function clearPending(): void {
        countdown.stop();
        verifyTimer.stop();
-        root.pendingOutput = "";
-        root.pendingPrevious = null;
-        root.pendingRequested = null;
+        root.pendingPreviousLayout = null;
+        root.pendingRequestedLayout = null;
        root.pendingVerified = false;
        root.revertQueued = false;
        root.secondsLeft = 0;
@@ -390,16 +483,25 @@ Singleton {
    }

    function performRevert(): void {
-        const previous = root.pendingPrevious;
+        const connected = {};
+        for (const monitor of root.monitors)
+            connected[monitor.name] = true;
+        const previous = (root.pendingPreviousLayout || [])
+            .filter(record => connected[record.name])
+            .map(record => Object.assign({}, record));
+        if (previous.length > 0 && !previous.some(record => record.primary)) {
+            const origin = previous.find(record => record.x === 0 && record.y === 0);
+            (origin || previous[0]).primary = true;
+        }
        root.operationGeneration++;
        root.revertGeneration = root.operationGeneration;
-        root.revertExpected = previous;
+        root.revertExpectedLayout = previous.length > 0 ? previous : null;
        root.revertVerificationActive = false;
        root.clearPending();
-        if (previous) {
-            revertRun.exec(["hyprctl", "eval",
-                `hl.monitor({ output = "${previous.output}", mode = "${previous.mode}", scale = ${previous.scale}, transform = ${previous.transform} })`]);
-        }
+        if (previous.length > 0)
+            root.pushLayout(previous, revertRun);
+        else
+            root.lastError = root.revertReason;
    }

    // Clears any stored override for an output so it returns to the value
@@ -418,6 +520,26 @@ Singleton {
        return !!(stored && typeof stored === "object" && stored[output] !== undefined);
    }

+    function verificationTimedOut(): void {
+        root.revertWithMessage("The display did not apply that setting, so Panama restored the previous one.");
+    }
+
+    function revertVerificationTimedOut(): void {
+        revertVerifyTimer.stop();
+        root.revertVerificationActive = false;
+        root.revertGeneration = -1;
+        root.revertExpectedLayout = null;
+        root.revertReason = "";
+        root.lastError = "The previous display setting could not be verified. Open Displays and restore it manually.";
+    }
+
+    Timer {
+        id: identifyTimer
+        interval: 3000
+        repeat: false
+        onTriggered: root.identifying = false
+    }
+
    Timer {
        id: verifyTimer
        property int attempts: 0
@@ -427,7 +549,7 @@ Singleton {
        onTriggered: {
            ticks++;
            if (ticks > 50) {
-                root.revertWithMessage("The display did not apply that setting, so Panama restored the previous one.");
+                root.verificationTimedOut();
                return;
            }
            if (root.refresh())
@@ -444,12 +566,7 @@ Singleton {
        onTriggered: {
            ticks++;
            if (ticks > 50) {
-                stop();
-                root.revertVerificationActive = false;
-                root.revertGeneration = -1;
-                root.revertExpected = null;
-                root.revertReason = "";
-                root.lastError = "The previous display setting could not be verified. Open Displays and restore it manually.";
+                root.revertVerificationTimedOut();
                return;
            }
            if (root.refresh())
@@ -0,0 +1,444 @@
+pragma Singleton
+
+// The health helper is deliberately not a state owner. This singleton accepts
+// complete, typed snapshots and keeps the last valid one available while a
+// later scan or repair fails.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    property var snapshot: ({})
+    property var checks: []
+    property var summary: ({ status: "healthy", healthy: 0, warnings: 0, errors: 0, unconfigured: 0 })
+    property string status: "healthy"
+    property bool diagnosticUnavailable: false
+    property bool queuedRefresh: false
+    property int generation: 0
+    property int acceptedGeneration: 0
+    property string lastError: ""
+    property string repairingId: ""
+    property var lastRepair: ({})
+    property string lastCopyResult: ""
+    property bool startupScanEnabled: true
+    property bool postRepairScanPending: false
+
+    readonly property bool actionable: root.status === "warning" || root.status === "error"
+    readonly property bool busy: scanProcess.running || repairProcess.running || root.postRepairScanPending
+    readonly property string helperPath: Quickshell.env("PANAMA_HEALTH_HELPER")
+        || Quickshell.shellDir + "/scripts/panama-doctor"
+    readonly property var statuses: ["ok", "warning", "error", "unconfigured"]
+    readonly property var groups: ["desktop-foundation", "input-media", "integrations", "panama-tools"]
+    readonly property var overallStatuses: ["healthy", "warning", "error"]
+    readonly property var settingsTargets: ["home-phone", "datetime"]
+    readonly property var instructionTargets: ["ddc-permissions"]
+
+    Process {
+        id: scanProcess
+
+        property int scanGeneration: 0
+        property string outputText: ""
+        property int exitCode: -1
+        property bool exited: false
+        property bool streamFinished: false
+        property bool settled: false
+
+        stdout: StdioCollector {
+            id: scanOutput
+            property int generation: 0
+            onStreamFinished: {
+                scanProcess.outputText = this.text;
+                scanProcess.scanGeneration = generation;
+                scanProcess.streamFinished = true;
+                root.settleScan();
+            }
+        }
+
+        onExited: (exitCode, exitStatus) => {
+            scanProcess.exitCode = exitCode;
+            scanProcess.exited = true;
+            root.settleScan();
+        }
+    }
+
+    Process {
+        id: repairProcess
+
+        property string checkId: ""
+        property bool external: false
+        property string outputText: ""
+        property int exitCode: -1
+        property bool exited: false
+        property bool streamFinished: false
+        property bool settled: false
+
+        stdout: StdioCollector {
+            onStreamFinished: {
+                repairProcess.outputText = this.text;
+                repairProcess.streamFinished = true;
+                root.settleRepair();
+            }
+        }
+
+        onExited: (exitCode, exitStatus) => {
+            repairProcess.exitCode = exitCode;
+            repairProcess.exited = true;
+            root.settleRepair();
+        }
+    }
+
+    Process {
+        id: copyProcess
+
+        property string payload: ""
+
+        onStarted: copyProcess.write(copyProcess.payload)
+        onExited: (exitCode, exitStatus) => {
+            root.lastCopyResult = exitCode === 0
+                ? "Report copied."
+                : "Could not copy the health report."
+            copyProcess.payload = ""
+        }
+    }
+
+    Process {
+        id: failureNotification
+    }
+
+    Timer {
+        id: startupScan
+        interval: 2200
+        repeat: false
+        running: root.startupScanEnabled
+        onTriggered: root.refresh()
+    }
+
+    function refresh(): bool {
+        if (root.postRepairScanPending)
+            return false;
+        if (scanProcess.running || repairProcess.running) {
+            root.queuedRefresh = true;
+            return false;
+        }
+
+        root.generation += 1;
+        scanProcess.scanGeneration = root.generation;
+        scanProcess.outputText = "";
+        scanProcess.exitCode = -1;
+        scanProcess.exited = false;
+        scanProcess.streamFinished = false;
+        scanProcess.settled = false;
+        scanOutput.generation = root.generation;
+        scanProcess.exec([root.helperPath, "--json"]);
+        return true;
+    }
+
+    function settleScan(): void {
+        if (scanProcess.settled || !scanProcess.exited || !scanProcess.streamFinished)
+            return;
+        scanProcess.settled = true;
+        root.finishScan(scanProcess.exitCode, scanProcess.scanGeneration, scanProcess.outputText);
+    }
+
+    function finishScan(exitCode: int, scanGeneration: int, text: string): void {
+        if (exitCode === 0)
+            root.consumeSnapshot(text, scanGeneration);
+        else
+            root.rejectSnapshot("Panama diagnostics could not be read. Try refreshing.");
+
+        if (!root.queuedRefresh)
+            return;
+        root.queuedRefresh = false;
+        root.refresh();
+    }
+
+    function consumeSnapshot(text: string, scanGeneration: int): bool {
+        if (scanGeneration < root.acceptedGeneration)
+            return false;
+
+        let candidate;
+        try {
+            candidate = JSON.parse(text.trim());
+        } catch (error) {
+            root.rejectSnapshot("Panama diagnostics returned an unreadable response.");
+            return false;
+        }
+
+        if (!root.validSnapshot(candidate)) {
+            root.rejectSnapshot("Panama diagnostics returned an invalid response.");
+            return false;
+        }
+
+        const accepted = root.safeSnapshot(candidate);
+        root.snapshot = accepted;
+        root.checks = accepted.checks;
+        root.summary = accepted.summary;
+        root.status = accepted.summary.status;
+        root.acceptedGeneration = scanGeneration;
+        root.diagnosticUnavailable = false;
+        root.lastError = "";
+        return true;
+    }
+
+    function rejectSnapshot(message: string): void {
+        root.diagnosticUnavailable = true;
+        root.lastError = message;
+    }
+
+    function safeSnapshot(candidate: var): var {
+        return {
+            schemaVersion: 1,
+            generatedAt: candidate.generatedAt,
+            summary: {
+                status: candidate.summary.status,
+                healthy: candidate.summary.healthy,
+                warnings: candidate.summary.warnings,
+                errors: candidate.summary.errors,
+                unconfigured: candidate.summary.unconfigured
+            },
+            context: {
+                session: candidate.context.session,
+                versions: candidate.context.versions.map(version => ({
+                    id: version.id,
+                    version: version.version
+                }))
+            },
+            checks: candidate.checks.map(check => root.safeCheck(check))
+        };
+    }
+
+    function safeCheck(candidate: var): var {
+        const check = {
+            id: candidate.id,
+            group: candidate.group,
+            title: candidate.title,
+            status: candidate.status,
+            detail: candidate.detail
+        };
+        if (candidate.action !== undefined)
+            check.action = root.safeAction(candidate.action);
+        return check;
+    }
+
+    function safeAction(candidate: var): var {
+        const action = {
+            kind: candidate.kind,
+            label: candidate.label,
+            confirm: candidate.confirm
+        };
+        if (Object.prototype.hasOwnProperty.call(candidate, "target"))
+            action.target = candidate.target;
+        return action;
+    }
+
+    function repair(id: string, external: bool): bool {
+        if (root.busy)
+            return false;
+
+        const check = root.checks.find(candidate => candidate.id === id);
+        if (!check || !check.action || check.action.kind !== "repair")
+            return false;
+        if (external && check.action.confirm)
+            return false;
+
+        root.repairingId = id;
+        root.lastError = "";
+        repairProcess.checkId = id;
+        repairProcess.external = external;
+        repairProcess.outputText = "";
+        repairProcess.exitCode = -1;
+        repairProcess.exited = false;
+        repairProcess.streamFinished = false;
+        repairProcess.settled = false;
+        repairProcess.exec([root.helperPath, "--repair", id, "--json"]);
+        return true;
+    }
+
+    function settleRepair(): void {
+        if (repairProcess.settled || !repairProcess.exited || !repairProcess.streamFinished)
+            return;
+        repairProcess.settled = true;
+        root.finishRepair(
+            repairProcess.exitCode,
+            repairProcess.checkId,
+            repairProcess.external,
+            repairProcess.outputText
+        );
+    }
+
+    function finishRepair(exitCode: int, id: string, external: bool, text: string): void {
+        let candidate;
+        try {
+            candidate = JSON.parse(text.trim());
+        } catch (error) {
+            candidate = null;
+        }
+
+        const result = root.validRepairResult(candidate, id, exitCode)
+            ? {
+                schemaVersion: 1,
+                checkId: candidate.checkId,
+                accepted: candidate.accepted,
+                exitCode: candidate.exitCode,
+                message: candidate.message
+            }
+            : {
+                schemaVersion: 1,
+                checkId: id,
+                accepted: false,
+                exitCode: exitCode,
+                message: "Panama returned an invalid repair response."
+            };
+        const failed = !result.accepted || result.exitCode !== 0;
+        root.repairingId = "";
+        root.lastRepair = result;
+        root.lastError = failed ? result.message : "";
+        if (failed && external && !failureNotification.running) {
+                failureNotification.exec([
+                    "notify-send", "-a", "Panama", "-i", "dialog-error-symbolic",
+                    "Panama action failed", "The requested health repair could not be completed."
+                ]);
+        }
+
+        // Any refresh requested while the repair was running is satisfied by
+        // this one observed post-repair scan. Process exit alone never changes
+        // the accepted check rows.
+        root.queuedRefresh = false;
+        root.postRepairScanPending = true;
+        Qt.callLater(root.startPostRepairScan);
+    }
+
+    function startPostRepairScan(): void {
+        root.postRepairScanPending = false;
+        root.queuedRefresh = false;
+        root.refresh();
+    }
+
+    function validRepairResult(candidate: var, id: string, processExitCode: int): bool {
+        if (!root.plainObject(candidate))
+            return false;
+        const keys = Object.keys(candidate).sort();
+        const expectedKeys = ["accepted", "checkId", "exitCode", "message", "schemaVersion"];
+        if (keys.length !== expectedKeys.length
+                || !keys.every((key, index) => key === expectedKeys[index]))
+            return false;
+        return candidate.schemaVersion === 1
+            && candidate.checkId === id
+            && typeof candidate.accepted === "boolean"
+            && Number.isInteger(candidate.exitCode)
+            && candidate.exitCode === processExitCode
+            && typeof candidate.message === "string"
+            && candidate.message.length > 0;
+    }
+
+    function copyReport(): bool {
+        if (copyProcess.running)
+            return false;
+        copyProcess.payload = JSON.stringify(root.snapshot, null, 2);
+        root.lastCopyResult = "";
+        copyProcess.exec(["wl-copy"]);
+        return true;
+    }
+
+    function diagnostics(): var {
+        return {
+            status: root.status,
+            summary: root.summary,
+            busy: root.busy,
+            diagnosticUnavailable: root.diagnosticUnavailable,
+            queuedRefresh: root.queuedRefresh,
+            generation: root.generation,
+            acceptedGeneration: root.acceptedGeneration,
+            repairingId: root.repairingId,
+            lastRepair: root.lastRepair,
+            lastError: root.lastError,
+            checks: root.checks.map(check => check.id),
+            checkStates: root.checks.map(check => ({ id: check.id, status: check.status }))
+        };
+    }
+
+    function validSnapshot(candidate: var): bool {
+        if (!root.plainObject(candidate)
+                || candidate.schemaVersion !== 1
+                || typeof candidate.generatedAt !== "string" || candidate.generatedAt.length === 0
+                || !root.validSummary(candidate.summary)
+                || !root.validContext(candidate.context)
+                || !Array.isArray(candidate.checks) || candidate.checks.length === 0)
+            return false;
+
+        const ids = {};
+        const counts = { ok: 0, warning: 0, error: 0, unconfigured: 0 };
+        for (const check of candidate.checks) {
+            if (!root.validCheck(check) || ids[check.id])
+                return false;
+            ids[check.id] = true;
+            counts[check.status] += 1;
+        }
+
+        const computedStatus = counts.error > 0 ? "error" : counts.warning > 0 ? "warning" : "healthy";
+        return candidate.summary.healthy === counts.ok
+            && candidate.summary.warnings === counts.warning
+            && candidate.summary.errors === counts.error
+            && candidate.summary.unconfigured === counts.unconfigured
+            && candidate.summary.status === computedStatus;
+    }
+
+    function validSummary(candidate: var): bool {
+        if (!root.plainObject(candidate) || root.overallStatuses.indexOf(candidate.status) < 0)
+            return false;
+        for (const key of ["healthy", "warnings", "errors", "unconfigured"]) {
+            if (!Number.isInteger(candidate[key]) || candidate[key] < 0)
+                return false;
+        }
+        return true;
+    }
+
+    function validContext(candidate: var): bool {
+        if (!root.plainObject(candidate)
+                || ["hyprland", "other"].indexOf(candidate.session) < 0
+                || !Array.isArray(candidate.versions))
+            return false;
+        return candidate.versions.every(version => root.plainObject(version)
+            && typeof version.id === "string" && version.id.length > 0
+            && typeof version.version === "string" && version.version.length > 0);
+    }
+
+    function validCheck(candidate: var): bool {
+        if (!root.plainObject(candidate)
+                || !/^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+$/.test(candidate.id)
+                || root.groups.indexOf(candidate.group) < 0
+                || root.statuses.indexOf(candidate.status) < 0
+                || typeof candidate.title !== "string" || candidate.title.length === 0
+                || typeof candidate.detail !== "string" || candidate.detail.length === 0)
+            return false;
+        return candidate.action === undefined || root.validAction(candidate.action);
+    }
+
+    function validAction(candidate: var): bool {
+        if (!root.plainObject(candidate)
+                || ["repair", "open", "instructions"].indexOf(candidate.kind) < 0
+                || typeof candidate.label !== "string" || candidate.label.length === 0
+                || typeof candidate.confirm !== "boolean")
+            return false;
+
+        const allowedKeys = ["kind", "label", "confirm", "target"];
+        if (!Object.keys(candidate).every(key => allowedKeys.indexOf(key) >= 0))
+            return false;
+
+        const hasTarget = Object.prototype.hasOwnProperty.call(candidate, "target");
+        if (!hasTarget)
+            return true;
+        if (typeof candidate.target !== "string" || candidate.target.length === 0 || candidate.kind === "repair")
+            return false;
+        return candidate.kind === "open"
+            ? root.settingsTargets.indexOf(candidate.target) >= 0
+            : root.instructionTargets.indexOf(candidate.target) >= 0;
+    }
+
+    function plainObject(value: var): bool {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+}
@@ -0,0 +1,83 @@
+pragma Singleton
+
+// The login keyring's lock state.
+//
+// The keyring is unlocked at sign-in by pam_gnome_keyring, exactly as it is
+// under GNOME. What a bare Hyprland session lacks is anywhere to see when that
+// has stopped being true.
+//
+// It stops being true rarely but expensively: gnome-keyring-daemon can crash,
+// D-Bus activates a replacement, and the replacement never received the login
+// password -- so the keyring is locked in the middle of a session that unlocked
+// it correctly. Nothing announces this. What the user sees instead is a mail
+// account that will not authenticate, a git push that cannot find its key, or
+// an integration reporting "not configured", none of which mention keyrings.
+//
+// Checked on demand and after an unlock, not polled: the state changes only
+// when a daemon dies or a password is entered.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-keyring"
+
+    property bool available: false
+    property bool locked: false
+    property bool scanned: false
+    property bool unlocking: false
+    property string lastError: ""
+
+    // "pam" when the daemon that holds the keyring is the one PAM started at
+    // login, "dbus" when it is a D-Bus-activated replacement -- which is the
+    // signature of the crash case, and worth showing, because a dbus daemon
+    // that is currently unlocked was unlocked by hand and will not survive.
+    property string daemon: ""
+
+    readonly property bool replacementDaemon: root.daemon === "dbus"
+
+    function refresh(): void {
+        if (!query.running)
+            query.running = true;
+    }
+
+    // Raises the standard password dialog. The password never passes through
+    // Panama -- the Secret Service prompts, the same way it does under GNOME.
+    function unlock(): void {
+        if (root.unlocking)
+            return;
+        root.unlocking = true;
+        unlockProcess.running = true;
+    }
+
+    function absorb(text: string): void {
+        try {
+            const parsed = JSON.parse(text);
+            root.available = parsed.available === true;
+            root.locked = parsed.locked === true;
+            root.daemon = String(parsed.daemon ?? "");
+            root.lastError = String(parsed.error ?? "");
+        } catch (error) {
+            root.available = false;
+            root.lastError = "Could not read the keyring helper's output.";
+            console.warn("Keyring: could not parse helper output:", error);
+        }
+        root.scanned = true;
+    }
+
+    Process {
+        id: query
+        command: [root.helperPath, "status"]
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+    }
+
+    Process {
+        id: unlockProcess
+        command: [root.helperPath, "unlock"]
+        stdout: StdioCollector { onStreamFinished: root.absorb(this.text) }
+        onExited: root.unlocking = false
+    }
+}
@@ -0,0 +1,132 @@
+pragma Singleton
+
+// Generated lock-screen state. Visual preferences are coalesced into one
+// helper invocation, while the last valid status remains visible if a helper
+// response is malformed.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.config
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-lock"
+
+    property bool generated: false
+    property string path: ""
+    property bool fallback: true
+    property string lastError: ""
+    property string watchedSignature: ""
+    property bool regenerateAfterCurrent: false
+
+    readonly property bool busy: generateProcess.running || statusProcess.running
+
+    function preferenceSignature(): string {
+        DesktopPreferences.revision;
+        return JSON.stringify([
+            DesktopPreferences.get("lockBackgroundMode"),
+            DesktopPreferences.get("lockBlurLevel"),
+            DesktopPreferences.get("lockShowClock"),
+            DesktopPreferences.get("lockShowDate"),
+            DesktopPreferences.get("lockShowUser"),
+            DesktopPreferences.get("lockFadeOnEmpty"),
+            DesktopPreferences.get("use24Hour"),
+            DesktopPreferences.get("colorScheme"),
+            DesktopPreferences.get("wallpaperPath"),
+            DesktopPreferences.get("wallpaperMode"),
+            DesktopPreferences.get("wallpaperPerMonitor")
+        ]);
+    }
+
+    function applyStatus(text: string): void {
+        try {
+            const state = JSON.parse(text);
+            if (!state || typeof state.generated !== "boolean"
+                    || typeof state.path !== "string" || state.path.length === 0)
+                throw new Error("invalid lock status");
+            root.generated = state.generated;
+            root.path = state.path;
+            root.fallback = state.fallback === true;
+            root.lastError = typeof state.error === "string" ? state.error : "";
+        } catch (error) {
+            root.lastError = "The lock-screen configuration could not be read.";
+        }
+    }
+
+    function refresh(): void {
+        if (!statusProcess.running)
+            statusProcess.exec([root.helperPath, "status"]);
+    }
+
+    function regenerate(): void {
+        if (generateProcess.running) {
+            root.regenerateAfterCurrent = true;
+            return;
+        }
+        generateProcess.exec([root.helperPath, "generate"]);
+    }
+
+    Process {
+        id: statusProcess
+
+        property bool parsed: false
+
+        onRunningChanged: {
+            if (running)
+                parsed = false;
+        }
+
+        stdout: StdioCollector {
+            onStreamFinished: {
+                statusProcess.parsed = true;
+                root.applyStatus(this.text);
+            }
+        }
+
+        onExited: (exitCode, exitStatus) => {
+            if (exitCode !== 0 && !statusProcess.parsed)
+                root.lastError = "The lock-screen configuration could not be read.";
+        }
+    }
+
+    Process {
+        id: generateProcess
+
+        onExited: (exitCode, exitStatus) => {
+            if (exitCode !== 0)
+                root.lastError = "The lock-screen configuration could not be generated.";
+            root.refresh();
+            if (root.regenerateAfterCurrent) {
+                root.regenerateAfterCurrent = false;
+                regenerateTimer.restart();
+            }
+        }
+    }
+
+    Connections {
+        target: DesktopPreferences
+
+        function onRevisionChanged(): void {
+            const signature = root.preferenceSignature();
+            if (signature === root.watchedSignature)
+                return;
+            root.watchedSignature = signature;
+            regenerateTimer.restart();
+        }
+    }
+
+    Timer {
+        id: regenerateTimer
+        interval: 250
+        onTriggered: root.regenerate()
+    }
+
+    Component.onCompleted: {
+        root.watchedSignature = root.preferenceSignature();
+        root.refresh();
+        regenerateTimer.restart();
+    }
+}
@@ -0,0 +1,95 @@
+pragma Singleton
+
+// Online accounts, via GNOME Online Accounts.
+//
+// The daemon already runs in this session -- gvfs activates it, and accounts
+// work without gnome-shell anywhere. Only the panel was GNOME's; the accounts
+// are D-Bus objects anything may read and modify. So listing, per-service
+// toggles, and removal all happen here, natively.
+//
+// Signing in is the exception, and only for OAuth providers. The daemon's
+// AddAccount takes credentials as an argument rather than obtaining them, and
+// the code that runs Google's OAuth exchange lives in libgoa-backend, which
+// Fedora ships without a GIR binding. So that one step is handed to GNOME's
+// panel and the user comes straight back here.
+//
+// Read on demand and after every change: accounts are added and removed by
+// people, not by the system, so there is nothing to poll for.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-accounts"
+
+    // [{ path, provider, providerName, identity, needsAttention, services: [{key,label,enabled}] }]
+    property var accounts: []
+    property bool scanned: false
+    property bool busy: false
+    property string lastError: ""
+
+    // Accounts whose stored credentials have stopped working -- an expired
+    // token, a changed password. GOA knows, and nothing outside its own panel
+    // ever says so, which is how an account quietly stops syncing for weeks.
+    readonly property int attentionCount: root.accounts.filter(a => a.needsAttention).length
+
+    readonly property bool available: root.lastError === ""
+
+    function refresh(): void {
+        if (!list.running)
+            list.running = true;
+    }
+
+    // Enabling a service clears GOA's "disabled" flag; the helper owns that
+    // inversion so the UI can speak in terms of what is on.
+    function setService(path: string, service: string, enabled: bool): void {
+        if (root.busy)
+            return;
+        root.busy = true;
+        write.command = [root.helperPath, "set", path, service, enabled ? "true" : "false"];
+        write.running = true;
+    }
+
+    function remove(path: string): void {
+        if (root.busy)
+            return;
+        root.busy = true;
+        write.command = [root.helperPath, "remove", path];
+        write.running = true;
+    }
+
+    Process {
+        id: list
+        command: [root.helperPath, "list"]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    root.accounts = Array.isArray(parsed.accounts) ? parsed.accounts : [];
+                    root.lastError = String(parsed.error ?? "");
+                } catch (error) {
+                    root.accounts = [];
+                    root.lastError = "Could not read the accounts helper's output.";
+                    console.warn("OnlineAccounts: could not parse helper output:", error);
+                }
+                root.scanned = true;
+            }
+        }
+    }
+
+    Process {
+        id: write
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+        // Re-read rather than assuming the write landed: GOA may refuse, and a
+        // toggle that sprang back is the honest outcome.
+        onExited: {
+            root.busy = false;
+            root.refresh();
+        }
+    }
+}
@@ -0,0 +1,107 @@
+pragma Singleton
+
+// The system power profile: power-saver, balanced, or performance.
+//
+// The same daemon GNOME's Power panel drives. On Fedora 44 the implementation
+// is tuned-ppd rather than power-profiles-daemon, but it serves the same
+// net.hadess.PowerProfiles interface -- so this talks to the interface, not to
+// either binary. powerprofilesctl is not installed here at all.
+//
+// Not a stored preference. The profile lives in the daemon, survives Panama
+// restarts, and can be changed by anything else on the system; keeping a copy
+// in settings.json would mean restoring a value the daemon had moved past.
+// Same reasoning as monitor brightness.
+//
+// Read on demand and after each change. The daemon does emit PropertiesChanged,
+// but subscribing to it would mean holding a bus connection open for a value
+// that changes only when someone chooses it.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-power-profile"
+
+    property var profiles: []
+    property string active: ""
+    property bool scanned: false
+    property bool busy: false
+    property string lastError: ""
+
+    // Non-empty when the machine cannot actually deliver the profile it is set
+    // to -- thermal throttling, or a laptop running on battery. Worth showing,
+    // because otherwise "performance" is a claim the hardware is not honouring.
+    property string degraded: ""
+
+    readonly property bool available: root.profiles.length > 0
+
+    // Presentation lives here rather than in the page so the Control Center and
+    // Settings cannot disagree about what a profile is called.
+    function label(profile: string): string {
+        switch (profile) {
+        case "power-saver": return "Power Saver";
+        case "balanced": return "Balanced";
+        case "performance": return "Performance";
+        default: return profile;
+        }
+    }
+
+    function detail(profile: string): string {
+        switch (profile) {
+        case "power-saver": return "Reduces performance to save energy and run quieter";
+        case "balanced": return "Standard behaviour, scaling up only when needed";
+        case "performance": return "Holds higher clocks, using more power and making more noise";
+        default: return "";
+        }
+    }
+
+    function refresh(): void {
+        if (!query.running)
+            query.running = true;
+    }
+
+    function set(profile: string): void {
+        if (root.busy || profile === root.active)
+            return;
+        root.busy = true;
+        apply.command = [root.helperPath, "set", profile];
+        apply.running = true;
+    }
+
+    Process {
+        id: query
+        command: [root.helperPath, "list"]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    root.profiles = Array.isArray(parsed.profiles) ? parsed.profiles : [];
+                    root.active = String(parsed.active ?? "");
+                    root.degraded = String(parsed.degraded ?? "");
+                    root.lastError = String(parsed.error ?? "");
+                } catch (error) {
+                    root.profiles = [];
+                    root.lastError = "Could not read the power profile helper's output.";
+                    console.warn("PowerProfiles: could not parse helper output:", error);
+                }
+                root.scanned = true;
+            }
+        }
+    }
+
+    Process {
+        id: apply
+        stderr: StdioCollector {
+            onStreamFinished: if (this.text.trim() !== "") root.lastError = this.text.trim()
+        }
+        // Re-read rather than assuming: the daemon may refuse, or may land on a
+        // different profile than the one asked for.
+        onExited: {
+            root.busy = false;
+            root.refresh();
+        }
+    }
+}
@@ -41,20 +41,28 @@ Singleton {
    property var readDisplays: function() { return DesktopPreferences.get("displays"); }
    property var protectDisplays: function(value) { return DesktopPreferences.set("displays", value); }
    property var displayBusy: function() { return Displays.busy || Displays.awaitingConfirmation; }
+    property var readLiveDisplayLayout: function() { return Displays.currentLayout(); }
+    property var applyDisplayLayout: function(layout) { return Displays.applyProtectedLayout(layout); }
+    property var displayCanConfirm: function() { return Displays.canConfirm; }
+    property var confirmDisplayLayout: function() { return Displays.confirm(); }
    property var setDisplayBlocked: function(blocked) { Displays.externalChangeBlocked = blocked; }
+    property var applyIdle: function() { IdleLock.apply(); }
+    property var idleBusy: function() { return IdleLock.busy; }
    property var applyCompositor: function() { SystemSettings.applyPersistedDisplayPolicy(); }
    property var reloadKeybinds: function() { Keybinds.applyReload(); }
    property var keybindsReloading: function() { return Keybinds.reloading; }
    property var systemBusy: function() { return SystemSettings.busy; }
-    property var currentWallpaper: function() {
-        return String(DesktopPreferences.get("wallpaperPath") ?? "");
-    }
-    property var applyWallpaper: function(path) { Wallpaper.set(path); }
+    property var applyWallpaperPolicy: function() { Wallpaper.applyCurrentPolicy(false); }
+    property var wallpaperBusy: function() { return Wallpaper.busy; }
+    property var regenerateLock: function() { LockScreen.regenerate(); }
+    property var lockBusy: function() { return LockScreen.busy; }
    property var reloadShell: function() { Quickshell.reload(false); }
    property var protectedDisplays: ({})
+    property var protectedDisplayLayout: []
+    property var pendingRestoredLayout: null

    readonly property bool busy: listQuery.running || actionRun.running
-        || applyRestoredState.running || settleReload.running
+        || settleDisplayRestore.running || applyRestoredState.running || settleReload.running

    Process {
        id: listQuery
@@ -89,18 +97,21 @@ Singleton {
                if (actionRun.restoring) {
                    root.setDisplayBlocked(false);
                    root.protectedDisplays = ({});
+                    root.protectedDisplayLayout = [];
                }
                return;
            }
            root.lastAction = actionRun.restoring ? "restored" : "saved";
            if (actionRun.restoring) {
-                const homeReloaded = root.handleRestoreOutput(actionRun.outputText);
-                root.lastError = homeReloaded
-                    ? ""
-                    : "Desktop settings were restored, but Home favourites could not be reloaded.";
-                if (!homeReloaded) {
+                const restoreAccepted = root.handleRestoreOutput(actionRun.outputText);
+                if (restoreAccepted)
+                    root.lastError = "";
+                else if (root.lastError === "")
+                    root.lastError = "Desktop settings were restored, but Home favourites could not be reloaded.";
+                if (!restoreAccepted) {
                    root.setDisplayBlocked(false);
                    root.protectedDisplays = ({});
+                    root.protectedDisplayLayout = [];
                }
            } else
                root.lastError = "";
@@ -108,6 +119,28 @@ Singleton {
        }
    }

+    Timer {
+        id: settleDisplayRestore
+        property int attempts: 0
+        interval: 100
+        repeat: true
+        onTriggered: {
+            attempts++;
+            if (root.displayCanConfirm()) {
+                stop();
+                if (!root.confirmDisplayLayout()) {
+                    root.failDisplayRestore("The restored display layout could not be confirmed.");
+                    return;
+                }
+                root.pendingRestoredLayout = null;
+                root.beginRestoredStateReplay();
+            } else if (!root.displayBusy() || attempts >= 180) {
+                stop();
+                root.failDisplayRestore("The restored display layout could not be verified.");
+            }
+        }
+    }
+
    Timer {
        id: applyRestoredState
        interval: 80
@@ -116,9 +149,11 @@ Singleton {
            // DesktopPreferences.reload() invalidates reactive shell bindings.
            // These services also own state outside QML and need an explicit
            // replay: compositor options, Lua-generated binds, and hyprpaper.
-            root.applyCompositor();
+            root.applyIdle();
+            root.regenerateLock();
+            root.applyWallpaperPolicy();
            root.reloadKeybinds();
-            root.applyWallpaper(root.currentWallpaper());
+            root.applyCompositor();

            settleReload.attempts = 0;
            settleReload.restart();
@@ -135,10 +170,12 @@ Singleton {
            // Let the current instances finish their external writes before a
            // soft reload replaces them. The cap keeps a failed external tool
            // from leaving restored Home state stale indefinitely.
-            if ((!root.keybindsReloading() && !root.systemBusy()) || attempts >= 30) {
+            if ((!root.idleBusy() && !root.keybindsReloading() && !root.systemBusy()
+                    && !root.wallpaperBusy() && !root.lockBusy()) || attempts >= 30) {
                stop();
                root.setDisplayBlocked(false);
                root.protectedDisplays = ({});
+                root.protectedDisplayLayout = [];
                root.reloadShell();
            }
        }
@@ -177,11 +214,76 @@ Singleton {
        if (!root.reloadHomeState(text))
            return false;
        root.reloadDesktop();
-        if (!root.protectDisplays(root.protectedDisplays))
-            return false;
-        applyRestoredState.restart();
+        const restoredLayout = root.layoutFromStoredDisplays(root.readDisplays());
+        if (restoredLayout === null || root.layoutsEqual(
+                restoredLayout, root.protectedDisplayLayout)) {
+            root.beginRestoredStateReplay();
            return true;
        }
+        root.pendingRestoredLayout = restoredLayout;
+        if (!root.applyDisplayLayout(restoredLayout))
+            return root.failDisplayRestore("The restored display layout was rejected.");
+        settleDisplayRestore.attempts = 0;
+        settleDisplayRestore.restart();
+        return true;
+    }
+
+    function beginRestoredStateReplay(): void {
+        applyRestoredState.restart();
+    }
+
+    function layoutFromStoredDisplays(stored: var): var {
+        if (!stored || typeof stored !== "object")
+            return null;
+        const current = root.readLiveDisplayLayout();
+        if (!Array.isArray(current) || current.length === 0)
+            return null;
+        const layout = [];
+        for (const live of current) {
+            const entry = stored[live.name];
+            const match = String(entry?.mode ?? "").match(
+                /^(\d+)x(\d+)@(\d+(?:\.\d+)?)$/);
+            if (!entry || !match || !Number.isFinite(entry.scale) || entry.scale <= 0
+                    || !Number.isInteger(entry.transform)
+                    || entry.transform < 0 || entry.transform > 3
+                    || !Number.isInteger(entry.x) || !Number.isInteger(entry.y)
+                    || typeof entry.primary !== "boolean")
+                return null;
+            layout.push(Object.assign({}, live, {
+                width: Number(match[1]),
+                height: Number(match[2]),
+                refreshRate: Number(match[3]),
+                mode: entry.mode,
+                scale: entry.scale,
+                transform: entry.transform,
+                x: entry.x,
+                y: entry.y,
+                primary: entry.primary
+            }));
+        }
+        return layout.filter(record => record.primary).length === 1 ? layout : null;
+    }
+
+    function layoutsEqual(left: var, right: var): bool {
+        if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length)
+            return false;
+        const fields = ["name", "mode", "scale", "transform", "x", "y", "primary"];
+        const a = Array.from(left).sort((x, y) => x.name.localeCompare(y.name));
+        const b = Array.from(right).sort((x, y) => x.name.localeCompare(y.name));
+        return a.every((record, index) => fields.every(
+            field => record[field] === b[index][field]));
+    }
+
+    function failDisplayRestore(message: string): bool {
+        root.pendingRestoredLayout = null;
+        if (!root.protectDisplays(root.protectedDisplays))
+            message += " The original display preference also could not be restored.";
+        root.setDisplayBlocked(false);
+        root.protectedDisplays = ({});
+        root.protectedDisplayLayout = [];
+        root.lastError = message;
+        return false;
+    }

    // Restore output carries the canonical Home state. Reconstructing through
    // these methods keeps validation and persistence inside HomePreferences;
@@ -250,6 +352,8 @@ Singleton {
        const currentDisplays = root.readDisplays();
        root.protectedDisplays = JSON.parse(JSON.stringify(
            currentDisplays && typeof currentDisplays === "object" ? currentDisplays : {}));
+        root.protectedDisplayLayout = JSON.parse(JSON.stringify(
+            root.readLiveDisplayLayout() ?? []));
        root.setDisplayBlocked(true);
        actionRun.restoring = true;
        actionRun.exec([root.helperPath, "restore", name]);
@@ -17,15 +17,24 @@ import qs.config
 Singleton {
    id: root

+    // SettingsSearch is part of the always-constructed sidebar. Touching the
+    // desktop-style service here gives application preferences their startup
+    // replay even when Appearance is not the page that opens first.
+    Component.onCompleted: DesktopStyle.ensureStarted()
+
    // Which page shows the settings in a given schema group. A group with no
    // entry here still appears in results and routes to Home rather than being
    // dropped, so adding a group can never make a setting unreachable.
    readonly property var groupPages: ({
        "clock": "appearance",
        "vitals": "appearance",
+        "typography": "appearance",
+        "themes": "appearance",
+        "titlebar": "appearance",
        "windows": "appearance",
        "effects": "appearance",
        "wallpaper": "appearance",
+        "lockAppearance": "appearance",
        "dock": "desktop",
        "focus": "desktop",
        "display": "displays",
@@ -36,7 +45,10 @@ Singleton {
        "pointer": "mouse",
        "touchpad": "mouse",
        "multitasking": "desktop",
-        "weather": "appearance",
+        "edges": "desktop",
+        "master": "desktop",
+        "notices": "desktop",
+        "weather": "home",
        "notifications": "notifications",
        "capture": "screen-intelligence"
    })
@@ -52,7 +64,15 @@ Singleton {
        { label: "Printers", detail: "Managed by GNOME Settings", page: "connectivity" },
        { label: "Default applications", detail: "Browser, mail, files", page: "applications" },
        { label: "Restore defaults", detail: "Return every Panama setting to its shipped value", page: "desktop" },
-        { label: "Keyboard shortcuts", detail: "Every shortcut the compositor has bound", page: "shortcuts" }
+        { label: "Keyboard shortcuts", detail: "Every shortcut the compositor has bound", page: "shortcuts" },
+        { label: "System Health", detail: "Check Panama services, integrations, tools, and recovery actions", page: "services" },
+        { label: "Copy health report", detail: "Copy a redacted Panama doctor report", page: "services" },
+        { label: "Lock screen background", detail: "Choose a blurred desktop, wallpaper, or solid colour", page: "appearance" },
+        { label: "Password field", detail: "Choose whether the empty lock-screen field stays visible", page: "appearance" },
+        { label: "Per-display wallpaper", detail: "Assign a different image to each connected display", page: "appearance" },
+        { label: "Arrange displays", detail: "Drag connected displays into their physical positions", page: "displays" },
+        { label: "Monitor position", detail: "Set where each display sits in the desktop", page: "displays" },
+        { label: "Primary display", detail: "Choose the display that anchors the desktop", page: "displays" }
    ]

    function pageFor(group: string): string {
@@ -80,7 +100,8 @@ Singleton {
        for (const entry of PreferenceSchema.entries) {
            if (entry.internal)
                continue;
-            const haystack = `${entry.label} ${entry.detail ?? ""} ${entry.group}`.toLowerCase();
+            const optionLabels = (entry.options ?? []).map(option => option.label).join(" ");
+            const haystack = `${entry.label} ${entry.detail ?? ""} ${entry.group} ${optionLabels}`.toLowerCase();
            if (haystack.indexOf(needle) >= 0)
                add(entry.label, entry.detail ?? "", root.pageFor(entry.group), "setting");
        }
@@ -97,8 +118,16 @@ Singleton {

        // Exact prefix matches first: typing "blur" should put "Blur" above
        // "Blur radius", and both above a setting that merely mentions blur in
-        // its explanation.
+        // its explanation. An exact enum option also leads: "slideshow" is a
+        // mode choice, so Wallpaper mode belongs above the interval row that
+        // merely explains it.
        return results.sort((a, b) => {
+            const aSpec = PreferenceSchema.entries.find(entry => entry.label === a.label);
+            const bSpec = PreferenceSchema.entries.find(entry => entry.label === b.label);
+            const ao = (aSpec?.options ?? []).some(option => option.label.toLowerCase() === needle);
+            const bo = (bSpec?.options ?? []).some(option => option.label.toLowerCase() === needle);
+            if (ao !== bo)
+                return ao ? -1 : 1;
            const al = a.label.toLowerCase();
            const bl = b.label.toLowerCase();
            const ap = al === needle ? 0 : (al.indexOf(needle) === 0 ? 1 : 2);
@@ -92,7 +92,7 @@ Singleton {
    }

    function openSettings(page: string): void {
-        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accessibility", "power", "datetime", "applications", "services", "about"];
+        const allowed = ["home", "appearance", "displays", "connectivity", "home-phone", "desktop", "sound", "notifications", "screen-intelligence", "shortcuts", "mouse", "privacy", "region", "accounts", "accessibility", "power", "datetime", "applications", "services", "about"];
        root.settingsPage = allowed.indexOf(page) >= 0 ? page : "home";
        DesktopPreferences.set("lastPage", root.settingsPage);
        root.settingsOpen = true;
@@ -42,6 +42,8 @@ Singleton {
    property var reloadKeybinds: function() { Keybinds.applyReload(); }
    property var keybindsReloading: function() { return Keybinds.reloading; }
    property var applyWallpaper: function(path) { Wallpaper.set(path); }
+    property var regenerateLock: function() { LockScreen.regenerate(); }
+    property var lockBusy: function() { return LockScreen.busy; }

    readonly property bool busy: monitorQuery.running || serviceQuery.running || versionQuery.running
        || configWrite.running || configVerify.running || bluebubblesQuery.running
@@ -273,6 +275,15 @@ Singleton {
    // decides, and config/dot/hypr/prefs.lua does the same conversion via
    // prefs.getInt so both sides agree.
    function hyprValue(entry: var, value: var): var {
+        // Some options are phrased as a negative by the compositor -- the four
+        // Hyprland notices are all `disable_x` -- while the setting reads as
+        // "show x", because a switch labelled "Disable splash text" that must
+        // be ON to hide something is a small cruelty. `invert` bridges the two,
+        // in exactly one place, so nothing downstream has to remember which
+        // options are backwards.
+        if (entry.hypr.invert === true && typeof value === "boolean")
+            value = !value;
+
        if (typeof value === "boolean" && entry.hypr.readAs !== "bool")
            return value ? 1 : 0;
        return value;
@@ -300,6 +311,24 @@ Singleton {
            return value ? "true" : "false";
        if (typeof value === "number")
            return String(value);
+
+        // A gradient is the one setting whose Lua form is not a scalar. The
+        // stubs declare it as `string|{colors:string[], angle?:number}`, and
+        // the string form only ever carries ONE stop -- writing
+        // "rgba(a) rgba(b) 45deg" as a string is accepted and silently keeps
+        // the previous value, which is how a two-stop write looks like it
+        // worked and did nothing. Multi-stop must be the table form.
+        if (value && typeof value === "object" && Array.isArray(value.colors)) {
+            const stops = value.colors
+                .map(stop => `"${String(stop).replace(/["\\]/g, "")}"`)
+                .join(", ");
+            const angle = Number(value.angle);
+            return `{ colors = { ${stops} }` + (isFinite(angle) ? `, angle = ${angle} }` : ` }`);
+        }
+
+        // A vec2 reaches Lua as a two-element table.
+        if (Array.isArray(value) && value.length === 2)
+            return `{ ${Number(value[0])}, ${Number(value[1])} }`;
        // Strings only reach here after the schema's pattern check; quoting is
        // belt-and-braces rather than the primary defence.
        return `"${String(value).replace(/["\\]/g, "")}"`;
@@ -309,7 +338,15 @@ Singleton {
        const parts = [];
        for (const name in node) {
            const child = node[name];
-            parts.push(`${name} = ${typeof child === "string" ? child : root.serialiseTable(child)}`);
+            // A leaf arrives pre-serialised as a string; anything else is
+            // either a nested section or a structured value (gradient, vec2)
+            // that serialiseValue knows how to render.
+            const rendered = typeof child === "string"
+                ? child
+                : (Array.isArray(child) || (child && child.colors !== undefined)
+                    ? root.serialiseValue(child)
+                    : root.serialiseTable(child));
+            parts.push(`${name} = ${rendered}`);
        }
        return `{ ${parts.join(", ")} }`;
    }
@@ -353,6 +390,59 @@ Singleton {
        root.drainQueue();
    }

+    // Gradients are written in one notation and read back in another, so they
+    // cannot be compared directly the way every other type can.
+    //
+    //   written:  { colors = { "rgba(3b426199)" }, angle = 45 }
+    //   read:     "993b4261 45deg"
+    //
+    // The stops swap to AARRGGBB order, lose their wrapper, and the angle is
+    // always appended even when it was never given. Comparing the raw strings
+    // reports every gradient write as rejected, which is what would have
+    // happened had this been added with readAs: "str".
+    function gradientMatches(expected: var, observed: string): bool {
+        if (typeof observed !== "string")
+            return false;
+        return root.normaliseGradient(expected) === root.normaliseGradient(observed);
+    }
+
+    // Both notations reduced to "aarrggbb aarrggbb Ndeg".
+    function normaliseGradient(value: var): string {
+        const stops = [];
+        let angle = 0;
+
+        const readStop = function (text: string): void {
+            const rgba = String(text).match(/rgba?\(\s*([0-9a-fA-F]{6,8})\s*\)/);
+            if (rgba) {
+                let hex = rgba[1].toLowerCase();
+                // rgb() has no alpha; the compositor reports it as fully opaque.
+                if (hex.length === 6)
+                    hex = hex + "ff";
+                // RRGGBBAA in, AARRGGBB out.
+                stops.push(hex.slice(6, 8) + hex.slice(0, 6));
+                return;
+            }
+            const bare = String(text).match(/^([0-9a-fA-F]{8})$/);
+            if (bare) {
+                stops.push(bare[1].toLowerCase());
+                return;
+            }
+            const deg = String(text).match(/^(-?[0-9.]+)deg$/);
+            if (deg)
+                angle = Number(deg[1]);
+        };
+
+        if (value && typeof value === "object" && Array.isArray(value.colors)) {
+            value.colors.forEach(readStop);
+            if (value.angle !== undefined && isFinite(Number(value.angle)))
+                angle = Number(value.angle);
+        } else {
+            String(value).trim().split(/\s+/).forEach(readStop);
+        }
+
+        return stops.join(" ") + " " + angle + "deg";
+    }
+
    function matchesObserved(entry: var, value: var, answer: var): bool {
        if (!answer)
            return false;
@@ -370,6 +460,12 @@ Singleton {
        case "css":
            // Gaps read back as a box, e.g. "10 10 10 10".
            return Number(String(answer.css).trim().split(/\s+/)[0]) === expected;
+        case "gradient":
+            return root.gradientMatches(expected, answer.gradient);
+        case "vec2":
+            return Array.isArray(answer.vec2) && Array.isArray(expected)
+                && Number(answer.vec2[0]) === Number(expected[0])
+                && Number(answer.vec2[1]) === Number(expected[1]);
        }
        return false;
    }
@@ -413,16 +509,13 @@ Singleton {
            return false;
        }

-        const currentDisplays = root.readDisplays();
-        const protectedDisplays = JSON.parse(JSON.stringify(
-            currentDisplays && typeof currentDisplays === "object" ? currentDisplays : {}));
        root.setDisplayBlocked(true);
        DesktopPreferences.resetDesktopDefaults();
-        if (!root.protectDisplays(protectedDisplays)) {
-            root.setDisplayBlocked(false);
-            root.lastError = "The current display setting could not be protected during reset.";
-            return false;
-        }
+
+        // Do not apply geometry during a reset: doing so would need the same
+        // visible confirmation transaction as the Displays page. Clearing the
+        // stored records is still important, though, so the next session uses
+        // Panama's shipped DP-2 placement and automatic placement elsewhere.

        // Home accessories keep their own store (panama-home.json), so a reset
        // that only cleared the schema store would silently leave a customised
@@ -443,6 +536,7 @@ Singleton {
            root.applyPersistedDisplayPolicy();
            root.reloadKeybinds();
            root.applyWallpaper(String(DesktopPreferences.get("wallpaperPath") ?? ""));
+            root.regenerateLock();
            resetRelease.attempts = 0;
            resetRelease.restart();
        }
@@ -455,7 +549,7 @@ Singleton {
        repeat: true
        onTriggered: {
            attempts++;
-            if ((!root.keybindsReloading() && !root.busy) || attempts >= 50) {
+            if ((!root.keybindsReloading() && !root.busy && !root.lockBusy()) || attempts >= 50) {
                stop();
                root.setDisplayBlocked(false);
            }
@@ -1,43 +1,55 @@
 pragma Singleton

-// The desktop background.
-//
-// hyprpaper owns the actual painting; this owns choosing. Two things are worth
-// knowing about hyprpaper 0.8:
-//
-//   * Its IPC is much smaller than the documentation for older versions
-//     suggests. `wallpaper <output>,<path>` and `listactive` work; `preload`,
-//     `listloaded`, `unload`, and `reload` all answer "invalid hyprpaper
-//     request". So there is no preload step -- setting is a single call.
-//   * hyprpaper.conf lives in the Panama repo via the ~/.config/hypr symlink,
-//     so it cannot be rewritten at runtime without dirtying a tracked file.
-//     The chosen wallpaper therefore lives in the shared settings store like
-//     every other preference, and is re-applied when the shell starts.
-//
-// The argument is "<output>,<path>", so a path containing a comma would be
-// parsed as a different request. The schema's pattern rejects those, and the
-// value is passed as a single argv element rather than through a shell.
+// Verified wallpaper policy application. hyprpaper 0.8 applies one output per
+// IPC call, so Panama queues every connected output and persists a policy only
+// after listactive confirms the complete map.

 import Quickshell
 import Quickshell.Io
 import QtQuick
+
+import "WallpaperPolicy.js" as WallpaperPolicy
 import qs.config

 Singleton {
    id: root

-    // Absolute paths of candidate images, newest first.
    property var available: []
-    property string active: ""
+    property var activeByOutput: ({})
    property string lastError: ""
    property bool scanning: false
+    property var transaction: null
+    property bool startupRestoreEnabled: true
+    property var outputOverride: null
+    property var candidateOverride: null
+    property string slideshowPath: ""
+    property int slideshowIndex: -1
+    property var shuffleBag: []
+    property int slideshowIntervalOverrideMs: 0
+    property bool pendingHotplugReapply: false

    readonly property string configured: DesktopPreferences.get("wallpaperPath")
    readonly property string shippedPath: `${Quickshell.env("HOME")}/Pictures/Wallpapers/faroe_islands.jpg`
+    readonly property string active: {
+        const outputs = root.outputNames();
+        if (outputs.length > 0 && root.activeByOutput[outputs[0]])
+            return root.activeByOutput[outputs[0]];
+        const paths = Object.values(root.activeByOutput);
+        return paths.length > 0 ? paths[0] : "";
+    }
+    readonly property bool busy: root.transaction !== null
+        || applyProcess.running || verifyProcess.running
+    readonly property var slideshowCollection: WallpaperPolicy.validCollection(
+        DesktopPreferences.get("wallpaperSlideshowPaths") ?? [], root.candidates([]))
+    readonly property bool slideshowTimerRunning: slideshowTimer.running
+    readonly property string outputSignature: root.outputNames().slice().sort().join("|")
+
+    property var outputNames: function() {
+        if (Array.isArray(root.outputOverride))
+            return root.outputOverride.slice();
+        return Quickshell.screens.map(screen => screen.name).filter(name => !!name);
+    }

-    // Directories searched for wallpapers, in order. Screenshots are
-    // deliberately excluded: a folder of 300 screenshots is not a wallpaper
-    // picker, and including it made the grid useless on this machine.
    readonly property var searchRoots: [
        `${Quickshell.env("HOME")}/Pictures/Wallpapers`,
        `${Quickshell.env("HOME")}/Pictures/Backgrounds`,
@@ -47,20 +59,14 @@ Singleton {

    Process {
        id: scan
-
-        // -print0 would be safer against odd filenames, but the schema already
-        // rejects paths containing commas or newlines, and this list is only
-        // ever offered as candidates -- the value that gets stored is validated
-        // again on the way in.
        command: ["bash", "-lc",
            "find " + root.searchRoots.map(dir => `'${dir}'`).join(" ")
            + " -maxdepth 2 -type f \\( -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.png' -o -iname '*.webp' \\)"
            + " -printf '%T@ %p\\n' 2>/dev/null | sort -rn | cut -d' ' -f2- | head -60"]
-
        stdout: StdioCollector {
            onStreamFinished: {
-                const paths = this.text.split("\n").map(line => line.trim()).filter(line => line.length > 0);
-                root.available = paths;
+                root.available = this.text.split("\n")
+                    .map(line => line.trim()).filter(line => line.length > 0);
                root.scanning = false;
            }
        }
@@ -71,40 +77,36 @@ Singleton {
        command: ["hyprctl", "hyprpaper", "listactive"]
        stdout: StdioCollector {
            onStreamFinished: {
-                // "DP-2: /path/to/image.jpg", one line per output.
-                const first = this.text.split("\n").find(line => line.indexOf(":") > 0);
-                root.active = first ? first.slice(first.indexOf(":") + 1).trim() : "";
+                const parsed = root.parseActive(this.text);
+                if (parsed !== null)
+                    root.activeByOutput = parsed;
            }
        }
    }

-    // hyprpaper requires an explicit output name: the "<empty>,<path>" form that
-    // older versions accepted as "all outputs" is silently ignored by 0.8, so a
-    // wallpaper set that way appears to succeed and never changes. Outputs are
-    // therefore walked one at a time.
    Process {
-        id: apply
-
-        property string requested: ""
-        property string storedValue: ""
-        property var remaining: []
-
+        id: applyProcess
        onExited: (exitCode, exitStatus) => {
+            if (root.transaction === null)
+                return;
            if (exitCode !== 0) {
-                root.lastError = "hyprpaper could not load that image.";
-                apply.remaining = [];
+                root.lastError = "Hyprpaper did not apply that background.";
+                root.transaction = null;
+                root.schedulePendingHotplug();
                return;
            }
-            if (apply.remaining.length > 0) {
-                const next = apply.remaining[0];
-                apply.remaining = apply.remaining.slice(1);
-                apply.exec(["hyprctl", "hyprpaper", "wallpaper", `${next},${apply.requested}`]);
-                return;
+            root.drainTransaction();
        }
-            root.lastError = "";
-            DesktopPreferences.set("wallpaperPath", apply.storedValue);
-            root.refreshActive();
    }
+
+    Process {
+        id: verifyProcess
+        property string outputText: ""
+        onStarted: outputText = ""
+        stdout: StdioCollector {
+            onStreamFinished: verifyProcess.outputText = this.text
+        }
+        onExited: (exitCode, exitStatus) => root.finishVerification(exitCode)
    }

    Component.onCompleted: {
@@ -113,20 +115,43 @@ Singleton {
        restore.restart();
    }

-    // hyprpaper is started by the compositor's autostart, so it may not be
-    // listening yet when the shell comes up. Re-applying the stored choice
-    // after a short delay makes the wallpaper survive a reboot without needing
-    // hyprpaper.conf to know about it.
    Timer {
        id: restore
        interval: 1500
        onTriggered: {
-            const stored = root.configured;
-            if (stored !== "" && stored !== root.active)
-                root.set(stored);
+            if (root.startupRestoreEnabled)
+                root.applyCurrentPolicy(false);
        }
    }

+    Timer {
+        id: slideshowTimer
+        interval: root.slideshowIntervalOverrideMs > 0
+            ? root.slideshowIntervalOverrideMs
+            : DesktopPreferences.get("wallpaperIntervalMinutes") * 60000
+        repeat: true
+        running: DesktopPreferences.get("wallpaperMode") === "slideshow"
+            && root.slideshowCollection.length >= 2 && !root.busy
+        onTriggered: root.advanceSlideshow()
+    }
+
+    Timer {
+        id: outputSettle
+        interval: 350
+        onTriggered: {
+            if (root.busy) {
+                root.pendingHotplugReapply = true;
+                return;
+            }
+            root.applyCurrentPolicy(false);
+        }
+    }
+
+    onOutputSignatureChanged: {
+        if (Object.keys(root.activeByOutput).length > 0)
+            outputSettle.restart();
+    }
+
    function rescan(): void {
        if (scan.running)
            return;
@@ -135,37 +160,268 @@ Singleton {
    }

    function refreshActive(): void {
-        if (!activeQuery.running)
+        if (!activeQuery.running && !root.busy)
            activeQuery.running = true;
    }

-    // Applies to every connected output. Returns false when the path is not one
-    // the schema will accept, so a caller can report the refusal.
-    function set(path: string): bool {
-        const effectivePath = path === "" ? root.shippedPath : path;
-        if (PreferenceSchema.coerce("wallpaperPath", effectivePath) === undefined) {
-            root.lastError = "That file path cannot be used as a wallpaper.";
+    function candidates(extra: var): var {
+        const result = [];
+        const discovered = Array.isArray(root.candidateOverride)
+            ? root.candidateOverride : root.available;
+        for (const path of discovered.concat([root.shippedPath, root.configured]).concat(extra || [])) {
+            if (typeof path === "string" && /^\/[^,\n]+$/.test(path) && !result.includes(path))
+                result.push(path);
+        }
+        return result;
+    }
+
+    function currentPolicy(): var {
+        return {
+            mode: DesktopPreferences.get("wallpaperMode") ?? "single",
+            globalPath: root.configured === "" ? root.shippedPath : root.configured,
+            collection: DesktopPreferences.get("wallpaperSlideshowPaths") ?? [],
+            intervalMinutes: DesktopPreferences.get("wallpaperIntervalMinutes") ?? 30,
+            shuffle: DesktopPreferences.get("wallpaperShuffle") !== false,
+            assignments: DesktopPreferences.get("wallpaperPerMonitor") ?? ({}),
+            slideshowPath: root.slideshowPath !== "" ? root.slideshowPath : root.active
+        };
+    }
+
+    function normalisePolicy(policy: var): var {
+        if (!policy || typeof policy !== "object")
+            return null;
+        const mode = ["single", "slideshow", "per-monitor"].includes(policy.mode)
+            ? policy.mode : "single";
+        const rawGlobal = policy.globalPath === "" ? root.shippedPath : policy.globalPath;
+        const candidatePaths = root.candidates([rawGlobal]
+            .concat(policy.collection || [])
+            .concat(Object.values(policy.assignments || {}))
+            .concat([policy.slideshowPath || ""]));
+        if (!WallpaperPolicy.validPath(rawGlobal, candidatePaths))
+            return null;
+        return {
+            mode,
+            globalPath: rawGlobal,
+            storedPath: rawGlobal === root.shippedPath ? "" : rawGlobal,
+            collection: WallpaperPolicy.validCollection(policy.collection || [], candidatePaths),
+            intervalMinutes: Math.max(5, Math.min(1440, Number(policy.intervalMinutes) || 30)),
+            shuffle: policy.shuffle !== false,
+            assignments: WallpaperPolicy.validAssignments(policy.assignments || {}, candidatePaths),
+            slideshowPath: WallpaperPolicy.validPath(policy.slideshowPath, candidatePaths)
+                ? policy.slideshowPath : rawGlobal,
+            nextShuffleBag: Array.isArray(policy.nextShuffleBag)
+                ? policy.nextShuffleBag.slice() : root.shuffleBag.slice(),
+            nextSlideshowIndex: Number.isInteger(policy.nextSlideshowIndex)
+                ? policy.nextSlideshowIndex : root.slideshowIndex,
+            candidates: candidatePaths
+        };
+    }
+
+    function applyPolicy(policy: var, persist: bool, automatic: bool): bool {
+        if (root.busy)
+            return false;
+        const normalised = root.normalisePolicy(policy);
+        if (normalised === null) {
+            root.lastError = "That wallpaper policy is not valid.";
            return false;
        }
-        if (apply.running)
-            return false;
-
-        apply.requested = effectivePath;
-        apply.storedValue = path;
-
-        const outputs = Quickshell.screens.map(screen => screen.name).filter(name => !!name);
+        const outputs = root.outputNames();
        if (outputs.length === 0) {
            root.lastError = "No display to set a wallpaper on.";
            return false;
        }
-
-        apply.remaining = outputs.slice(1);
-        apply.exec(["hyprctl", "hyprpaper", "wallpaper", `${outputs[0]},${effectivePath}`]);
+        const expected = WallpaperPolicy.effectiveMap(
+            normalised.mode, normalised.globalPath, normalised.slideshowPath,
+            normalised.assignments, outputs, normalised.candidates);
+        if (Object.keys(expected).length !== outputs.length
+                || Object.values(expected).some(path => path === "")) {
+            root.lastError = "That wallpaper policy is not valid.";
+            return false;
+        }
+        root.lastError = "";
+        root.transaction = {
+            expected,
+            remaining: outputs.slice(),
+            policy: normalised,
+            persist: persist === true,
+            automatic: automatic === true
+        };
+        root.drainTransaction();
        return true;
    }

-    // The display name for a path: the file's own name, without extension,
-    // with separators turned into spaces.
+    function drainTransaction(): void {
+        if (root.transaction === null || applyProcess.running || verifyProcess.running)
+            return;
+        if (root.transaction.remaining.length === 0) {
+            verifyProcess.exec(["hyprctl", "hyprpaper", "listactive"]);
+            return;
+        }
+        const output = root.transaction.remaining[0];
+        root.transaction.remaining = root.transaction.remaining.slice(1);
+        applyProcess.exec([
+            "hyprctl", "hyprpaper", "wallpaper",
+            `${output},${root.transaction.expected[output]}`
+        ]);
+    }
+
+    function parseActive(text: string): var {
+        const result = {};
+        const lines = String(text).split("\n").map(line => line.trim()).filter(line => line !== "");
+        for (const line of lines) {
+            const match = line.match(/^([A-Za-z0-9_.-]+): (\/[^,\n]+)$/);
+            if (!match || result[match[1]] !== undefined)
+                return null;
+            result[match[1]] = match[2];
+        }
+        return result;
+    }
+
+    function finishVerification(exitCode: int): void {
+        if (root.transaction === null)
+            return;
+        const observed = exitCode === 0 ? root.parseActive(verifyProcess.outputText) : null;
+        const expected = root.transaction.expected;
+        const matches = observed !== null
+            && Object.keys(observed).length === Object.keys(expected).length
+            && Object.keys(expected).every(output => observed[output] === expected[output]);
+        if (!matches) {
+            root.lastError = "Hyprpaper did not confirm that background.";
+            root.transaction = null;
+            root.schedulePendingHotplug();
+            return;
+        }
+
+        const completed = root.transaction;
+        root.activeByOutput = observed;
+        root.transaction = null;
+        root.lastError = "";
+        if (completed.automatic) {
+            root.slideshowPath = completed.policy.slideshowPath;
+            root.shuffleBag = completed.policy.nextShuffleBag;
+            root.slideshowIndex = completed.policy.nextSlideshowIndex;
+        }
+        if (completed.persist)
+            root.persistPolicy(completed.policy);
+        root.schedulePendingHotplug();
+    }
+
+    function persistPolicy(policy: var): void {
+        DesktopPreferences.set("wallpaperMode", policy.mode);
+        DesktopPreferences.set("wallpaperPath", policy.storedPath);
+        DesktopPreferences.set("wallpaperSlideshowPaths", policy.collection);
+        DesktopPreferences.set("wallpaperIntervalMinutes", policy.intervalMinutes);
+        DesktopPreferences.set("wallpaperShuffle", policy.shuffle);
+        DesktopPreferences.set("wallpaperPerMonitor", policy.assignments);
+    }
+
+    function applyCurrentPolicy(persist: bool): bool {
+        return root.applyPolicy(root.currentPolicy(), persist === true, false);
+    }
+
+    function schedulePendingHotplug(): void {
+        if (!root.pendingHotplugReapply)
+            return;
+        root.pendingHotplugReapply = false;
+        outputSettle.restart();
+    }
+
+    function advanceSlideshow(): bool {
+        if (root.busy)
+            return false;
+        const collection = root.slideshowCollection;
+        if (collection.length < 2)
+            return false;
+
+        const current = root.slideshowPath !== ""
+            ? root.slideshowPath
+            : (root.active !== "" ? root.active : collection[0]);
+        const policy = root.currentPolicy();
+        policy.mode = "slideshow";
+        policy.collection = collection;
+
+        if (DesktopPreferences.get("wallpaperShuffle") !== false) {
+            const next = WallpaperPolicy.shuffledNext(
+                collection, root.shuffleBag, current, Math.random);
+            policy.slideshowPath = next.path;
+            policy.nextShuffleBag = next.bag;
+            policy.nextSlideshowIndex = collection.indexOf(next.path);
+        } else {
+            policy.slideshowPath = WallpaperPolicy.orderedNext(collection, current);
+            policy.nextShuffleBag = [];
+            policy.nextSlideshowIndex = collection.indexOf(policy.slideshowPath);
+        }
+        return root.applyPolicy(policy, false, true);
+    }
+
+    function setSingle(path: string): bool {
+        const effectivePath = path === "" ? root.shippedPath : path;
+        const allowed = root.candidates([]);
+        if (!WallpaperPolicy.validPath(effectivePath, allowed)) {
+            root.lastError = "That file path cannot be used as a wallpaper.";
+            return false;
+        }
+        const policy = root.currentPolicy();
+        policy.mode = "single";
+        policy.globalPath = effectivePath;
+        policy.slideshowPath = effectivePath;
+        return root.applyPolicy(policy, true, false);
+    }
+
+    function setMode(mode: string): bool {
+        if (!["single", "slideshow", "per-monitor"].includes(mode))
+            return false;
+        const policy = root.currentPolicy();
+        policy.mode = mode;
+        if (mode === "slideshow") {
+            const collection = WallpaperPolicy.validCollection(
+                policy.collection, root.candidates([]));
+            if (!collection.includes(policy.slideshowPath))
+                policy.slideshowPath = collection[0] || policy.globalPath;
+        }
+        return root.applyPolicy(policy, true, false);
+    }
+
+    function setAssignment(output: string, path: string): bool {
+        if (!root.outputNames().includes(output)
+                || !WallpaperPolicy.validPath(path, root.candidates([])))
+            return false;
+        const policy = root.currentPolicy();
+        policy.mode = "per-monitor";
+        policy.assignments = Object.assign({}, policy.assignments);
+        policy.assignments[output] = path;
+        return root.applyPolicy(policy, true, false);
+    }
+
+    function toggleSlideshowPath(path: string): bool {
+        if (!WallpaperPolicy.validPath(path, root.candidates([])))
+            return false;
+        const policy = root.currentPolicy();
+        const collection = WallpaperPolicy.validCollection(policy.collection, root.candidates([]));
+        policy.collection = collection.includes(path)
+            ? collection.filter(candidate => candidate !== path)
+            : collection.concat([path]);
+        policy.mode = "slideshow";
+        if (!policy.collection.includes(policy.slideshowPath))
+            policy.slideshowPath = policy.collection[0] || policy.globalPath;
+        return root.applyPolicy(policy, true, false);
+    }
+
+    function setIntervalMinutes(minutes: int): bool {
+        const value = PreferenceSchema.coerce("wallpaperIntervalMinutes", minutes);
+        return value !== undefined
+            && DesktopPreferences.set("wallpaperIntervalMinutes", value);
+    }
+
+    function setShuffle(enabled: bool): bool {
+        return DesktopPreferences.set("wallpaperShuffle", enabled === true);
+    }
+
+    // Compatibility boundary used by backup/reset and the existing picker.
+    function set(path: string): bool {
+        return root.setSingle(path);
+    }
+
    function titleFor(path: string): string {
        const file = String(path).split("/").pop();
        return file.replace(/\.[^.]+$/, "").replace(/[_-]+/g, " ");
@@ -0,0 +1,97 @@
+function validPath(path, candidates) {
+    if (typeof path !== "string" || !/^\/[^,\n]+$/.test(path))
+        return false;
+    return (candidates || []).includes(path);
+}
+
+function validCollection(paths, candidates) {
+    const result = [];
+    const seen = {};
+    for (const path of paths || []) {
+        if (!validPath(path, candidates) || seen[path])
+            continue;
+        seen[path] = true;
+        result.push(path);
+    }
+    return result;
+}
+
+function validAssignments(assignments, candidates) {
+    const result = {};
+    if (!assignments || typeof assignments !== "object" || Array.isArray(assignments))
+        return result;
+    for (const output of Object.keys(assignments)) {
+        if (!/^[A-Za-z0-9_.-]+$/.test(output))
+            continue;
+        const path = assignments[output];
+        if (validPath(path, candidates))
+            result[output] = path;
+    }
+    return result;
+}
+
+function effectiveMap(mode, globalPath, slideshowPath, assignments, outputs, candidates) {
+    const result = {};
+    const fallback = validPath(globalPath, candidates)
+        ? globalPath
+        : ((candidates || [])[0] || "");
+    const selectedAssignments = validAssignments(assignments, candidates);
+    const slideshow = validPath(slideshowPath, candidates) ? slideshowPath : fallback;
+    for (const output of outputs || []) {
+        if (typeof output !== "string" || !/^[A-Za-z0-9_.-]+$/.test(output))
+            continue;
+        if (mode === "per-monitor")
+            result[output] = selectedAssignments[output] || fallback;
+        else if (mode === "slideshow")
+            result[output] = slideshow;
+        else
+            result[output] = fallback;
+    }
+    return result;
+}
+
+function orderedNext(collection, current) {
+    const paths = collection || [];
+    if (paths.length === 0)
+        return "";
+    const index = paths.indexOf(current);
+    return paths[(index + 1 + paths.length) % paths.length];
+}
+
+function shuffledBag(collection, random) {
+    const result = Array.from(collection || []);
+    const nextRandom = typeof random === "function" ? random : Math.random;
+    for (let index = result.length - 1; index > 0; index--) {
+        const swap = Math.floor(Math.max(0, Math.min(0.999999999, nextRandom())) * (index + 1));
+        const value = result[index];
+        result[index] = result[swap];
+        result[swap] = value;
+    }
+    return result;
+}
+
+function shuffledNext(collection, bag, current, random) {
+    const paths = Array.from(collection || []);
+    if (paths.length === 0)
+        return { path: "", bag: [] };
+
+    const remaining = [];
+    const seen = {};
+    for (const path of bag || []) {
+        if (!paths.includes(path) || seen[path])
+            continue;
+        seen[path] = true;
+        remaining.push(path);
+    }
+    if (remaining.length === 0)
+        remaining.push(...shuffledBag(paths, random));
+
+    if (remaining.length > 1 && remaining[0] === current) {
+        const replacement = remaining.findIndex(path => path !== current);
+        const value = remaining[0];
+        remaining[0] = remaining[replacement];
+        remaining[replacement] = value;
+    }
+
+    return { path: remaining[0], bag: remaining.slice(1) };
+}
@@ -0,0 +1,99 @@
+pragma Singleton
+
+// A QR code for a saved Wi-Fi network, so a guest can join by pointing a phone
+// at the screen. GNOME's Wi-Fi panel has this and it is the most-used thing in
+// it; reading a passphrase aloud is the alternative.
+//
+// The generated image contains the network password in machine-readable form,
+// so the helper writes it under XDG_RUNTIME_DIR -- 0700, on tmpfs, gone at
+// logout -- rather than anywhere persistent. Nothing here ever holds the
+// passphrase itself; this service only ever sees a file path.
+//
+// Generated on demand. Producing a QR for every saved network up front would
+// mean writing images of passwords nobody asked to see.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-wifi-qr"
+
+    // [{ name, ssid, shareable }]
+    property var networks: []
+    property bool scanned: false
+    property string lastError: ""
+
+    // The network whose code is on screen, and where its image is. Empty when
+    // nothing is being shared.
+    property string sharing: ""
+    property string imagePath: ""
+
+    readonly property var shareable: root.networks.filter(n => n.shareable)
+
+    function refresh(): void {
+        if (!list.running)
+            list.running = true;
+    }
+
+    function share(name: string): void {
+        if (generate.running)
+            return;
+        // Cache-bust: the helper reuses one file per network, so a QML Image
+        // pointed at the same path would keep showing the previous render.
+        root.imagePath = "";
+        root.sharing = name;
+        generate.command = [root.helperPath, "qr", name];
+        generate.running = true;
+    }
+
+    function stopSharing(): void {
+        root.sharing = "";
+        root.imagePath = "";
+    }
+
+    Process {
+        id: list
+        command: [root.helperPath, "list"]
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    root.networks = Array.isArray(parsed.networks) ? parsed.networks : [];
+                    root.lastError = String(parsed.error ?? "");
+                } catch (error) {
+                    root.networks = [];
+                    root.lastError = "Could not read the Wi-Fi helper's output.";
+                    console.warn("WifiShare: could not parse helper output:", error);
+                }
+                root.scanned = true;
+            }
+        }
+    }
+
+    Process {
+        id: generate
+        stdout: StdioCollector {
+            onStreamFinished: {
+                try {
+                    const parsed = JSON.parse(this.text);
+                    const path = String(parsed.path ?? "");
+                    const error = String(parsed.error ?? "");
+                    if (error !== "" || path === "") {
+                        root.lastError = error !== "" ? error : "No QR code was produced.";
+                        root.sharing = "";
+                        return;
+                    }
+                    root.lastError = "";
+                    root.imagePath = path;
+                } catch (error) {
+                    root.lastError = "Could not read the generated QR code's path.";
+                    root.sharing = "";
+                    console.warn("WifiShare: could not parse helper output:", error);
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,134 @@
+pragma Singleton
+
+// Alt-Tab, with something on screen while you do it.
+//
+// Named WindowSwitcherState rather than WindowSwitcher: the overlay component
+// in modules/switcher already owns that name, and a singleton sharing it is
+// silently shadowed wherever both are imported -- the same failure that made an
+// earlier Locale singleton resolve to QML's built-in type instead.
+//
+// Super+Tab already cycled windows; nothing was drawn, so you were choosing
+// blind and could only confirm by arriving. This holds the selection while a
+// switch is in progress and lets the overlay render it.
+//
+// MOST-RECENTLY-USED ORDER
+//
+// The list is ordered by when each window last had focus, not by when it was
+// opened, because that is what makes the gesture useful: one Tab returns to the
+// window you just came from, which is the overwhelmingly common case. Creation
+// order would send you to whichever window happens to be first in Hyprland's
+// list, which is arbitrary from the user's point of view.
+//
+// Hyprland does not report an MRU order, so it is tracked here: every time a
+// toplevel becomes active it moves to the front. Addresses are used as the key
+// because they are stable for a window's lifetime, where titles and app ids are
+// not.
+//
+// HOW A SWITCH ENDS
+//
+// The compositor fires a bind on Super RELEASE, which commits. That is the only
+// way to know the gesture is over -- there is no "modifier released" signal
+// otherwise. It means close() runs on every Super release in the session, so it
+// must be cheap and a no-op when nothing is open.
+
+import Quickshell
+import Quickshell.Hyprland
+import QtQuick
+
+Singleton {
+    id: root
+
+    property bool open: false
+    property int index: 0
+
+    // Window addresses, most recently focused first.
+    property var recent: []
+
+    // The switch candidates, resolved fresh each time the gesture starts.
+    property var windows: []
+
+    readonly property var selected: (root.index >= 0 && root.index < root.windows.length)
+        ? root.windows[root.index] : null
+
+    // Ordered by the MRU list, with anything unseen appended in Hyprland's own
+    // order so a brand new window is still reachable.
+    function orderedWindows(): var {
+        const all = (Hyprland.toplevels?.values ?? []).filter(t => t && t.wayland && t.wayland.appId);
+        const byAddress = {};
+        for (const toplevel of all)
+            byAddress[String(toplevel.address)] = toplevel;
+
+        const ordered = [];
+        for (const address of root.recent) {
+            const match = byAddress[address];
+            if (match) {
+                ordered.push(match);
+                delete byAddress[address];
+            }
+        }
+        for (const toplevel of all)
+            if (byAddress[String(toplevel.address)])
+                ordered.push(toplevel);
+        return ordered;
+    }
+
+    // Starts the gesture if it is not already running, then steps. The first
+    // Tab lands on the PREVIOUS window rather than the current one, which is
+    // what every other implementation of this gesture does.
+    function step(forward: bool): void {
+        if (!root.open) {
+            root.windows = root.orderedWindows();
+            if (root.windows.length < 2)
+                return;
+            root.open = true;
+            root.index = forward ? 1 : root.windows.length - 1;
+            return;
+        }
+
+        if (root.windows.length === 0)
+            return;
+        const count = root.windows.length;
+        root.index = forward
+            ? (root.index + 1) % count
+            : (root.index - 1 + count) % count;
+    }
+
+    // Runs on every Super release in the session, so it does as little as
+    // possible when no switch is in progress.
+    function commit(): void {
+        if (!root.open)
+            return;
+        const target = root.selected;
+        root.open = false;
+        root.windows = [];
+        root.index = 0;
+        if (target && target.wayland)
+            target.wayland.activate();
+    }
+
+    function cancel(): void {
+        root.open = false;
+        root.windows = [];
+        root.index = 0;
+    }
+
+    // Focus changes maintain the MRU order. This runs whether or not a switch
+    // is in progress, because ordinary clicking between windows is most of how
+    // the order is established.
+    Connections {
+        target: Hyprland
+        function onActiveToplevelChanged(): void {
+            const active = Hyprland.activeToplevel;
+            if (!active || !active.address)
+                return;
+            const address = String(active.address);
+            const next = [address];
+            for (const existing of root.recent)
+                if (existing !== address)
+                    next.push(existing);
+            // Bounded: a session can accumulate a lot of closed addresses, and
+            // this list is only ever used to order what is currently open.
+            root.recent = next.slice(0, 64);
+        }
+    }
+}
--- a/Show More
+++ b/Show More