Close the gaps the cross-UI audit found

Audited bar, dock, quick settings, date menu and Settings for three
things: a setting reachable in one UI but not another, a setting that
exists but is unreachable anywhere, and UI that states something false.

Night Light was fully exposed in Quick Settings and had no control
anywhere in Settings. It now has a card on Displays, where GNOME also
puts it, with on/off, schedule, times and temperature.

Adding those controls would have shipped the exact defect this audit
exists to find. NightLight declared enabled, temperature and automatic
as bindings on the store, but toggle() assigns to them, and an
assignment destroys a QML binding permanently -- so the service wrote to
the store and never read from it again. The Settings controls would have
written values the service ignored, while Quick Settings kept working.
It now follows the store. Every other service was swept for the same
pattern; this was the only one.

The night light schedule was two hardcoded literals, so the hours could
not be changed. They are schema keys now, with a row that renders 17.5
as "5:30 PM" and honours the 24-hour preference rather than showing a
decimal nobody reads as a time.

keyboardLayout was in the schema and read by input.lua but had no
control anywhere: configurable in principle, unreachable in practice. It
is surfaced on Input & Shortcuts as read-only, with the reason, because
it needs a compositor reload and a control implying instant apply would
be a smaller lie but still a lie.

Caffeine was a Quick Settings toggle mentioned only in a subtitle in
Settings. It has a real control now.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/hypr/monitors.lua

@@ -17,11 +17,88 @@
 -- overrides.lua) and read the notes in that file first.
 -- ─────────────────────────────────────────────────────────────────────────────
 
+local prefs = require("prefs")
+
+-- Per-output overrides written by Panama Settings, keyed by output name:
+--   { ["DP-2"] = { mode = "3840x2160@60", scale = 2, transform = 0 } }
+--
+-- Only mode, scale, and transform are read. Colour management and bit depth
+-- stay here, because those are the settings with a documented reason attached
+-- (see the header) rather than preferences, and a settings page has no way to
+-- explain the screencopy tradeoff at the moment you would be changing it.
+local displays = prefs.get("displays", {})
+if type(displays) ~= "table" then
+    displays = {}
+end
+
+local function mode_dimensions(mode)
+    if type(mode) ~= "string" then
+        return nil, nil
+    end
+    local width, height, refresh = mode:match("^(%d+)x(%d+)@(%d+%.%d+)$")
+    if width == nil then
+        width, height, refresh = mode:match("^(%d+)x(%d+)@(%d+)$")
+    end
+    width, height, refresh = tonumber(width), tonumber(height), tonumber(refresh)
+    if width == nil or height == nil or refresh == nil
+        or width <= 0 or height <= 0 or refresh <= 0 then
+        return nil, nil
+    end
+    return width, height
+end
+
+local function valid_mode(mode)
+    local width = mode_dimensions(mode)
+    return width ~= nil
+end
+
+local function valid_scale(mode, scale)
+    local width, height = mode_dimensions(mode)
+    if width == nil or type(scale) ~= "number" or scale ~= scale
+        or scale <= 0 or scale > 4 then
+        return false
+    end
+    local logical_width = width / scale
+    local logical_height = height / scale
+    return math.abs(logical_width - math.floor(logical_width + 0.5)) < 0.0001
+        and math.abs(logical_height - math.floor(logical_height + 0.5)) < 0.0001
+end
+
+local function valid_transform(transform)
+    return type(transform) == "number"
+        and transform == math.floor(transform)
+        and transform >= 0
+        and transform <= 3
+end
+
+local function display_entry(output)
+    if type(output) ~= "string" or output == ""
+        or output:match("^[%w_.-]+$") == nil then
+        return nil
+    end
+    local entry = displays[output]
+    if type(entry) ~= "table" then
+        return nil
+    end
+    if not valid_mode(entry.mode)
+        or not valid_scale(entry.mode, entry.scale)
+        or not valid_transform(entry.transform) then
+        return nil
+    end
+    return entry
+end
+
+local shipped_mode = "4500x3000@60"
+local shipped_scale = 1.5
+local shipped_transform = 0
+local dp2 = display_entry("DP-2")
+
 hl.monitor({
     output   = "DP-2",
-    mode     = "4500x3000@60",
+    mode     = dp2 and dp2.mode or shipped_mode,
     position = "0x0",
-    scale    = 1.5,
+    scale    = dp2 and dp2.scale or shipped_scale,
+    transform = dp2 and dp2.transform or shipped_transform,
 
     -- 10-bit output. 4500x3000@60 at 10bpc is ~24 Gbps, right at the edge of
     -- DP 1.4 HBR3, so this relies on DSC. If the display fails to light up or
@@ -32,6 +109,24 @@ hl.monitor({
     cm = "auto",
 })
 
+-- Other connected outputs use the same validated per-output store. They keep
+-- automatic placement and the compositor's normal colour policy; DP-2 alone
+-- carries the panel-specific 10-bit policy documented above.
+for output, _ in pairs(displays) do
+    if output ~= "DP-2" then
+        local entry = display_entry(output)
+        if entry ~= nil then
+            hl.monitor({
+                output = output,
+                mode = entry.mode,
+                position = "auto",
+                scale = entry.scale,
+                transform = entry.transform,
+            })
+        end
+    end
+end
+
 -- Any monitor not named above: sane defaults rather than nothing.
 hl.monitor({
     output   = "",

config/dot/quickshell/config/PreferenceSchema.qml

@@ -369,6 +369,23 @@ Singleton {
             detail: "Requires your password when the machine wakes"
         },
 
+        // ── Night light schedule ────────────────────────────────────────────
+        // Hours as decimals, so 17.5 is half past five. Wrapping past midnight
+        // is normal here and is what the shipped values do: on at 17:00, off at
+        // 10:00 the following morning.
+        {
+            key: "nightLightFrom", type: "real", def: 17.0, min: 0, max: 23.5, step: 0.5,
+            group: "nightLight",
+            label: "Turns on at",
+            detail: "Only used when Night Light follows a schedule"
+        },
+        {
+            key: "nightLightTo", type: "real", def: 10.0, min: 0, max: 23.5, step: 0.5,
+            group: "nightLight",
+            label: "Turns off at",
+            detail: "A time earlier than the start simply means the next morning"
+        },
+
         // ── Accessibility ───────────────────────────────────────────────────
         // Backed by gsettings so GTK applications agree with the shell, and
         // pushed to the compositor as well where it has its own notion.
@@ -508,6 +525,34 @@ Singleton {
             detail: "Shortcuts you have moved from their shipped chord"
         },
 
+        // ── Display configuration ───────────────────────────────────────────
+        // { "<output>": { mode, scale, transform } }, applied by
+        // hypr/monitors.lua on top of the shipped values. Colour management and
+        // bit depth are deliberately not here: those carry a documented
+        // screencopy tradeoff that a settings page cannot explain at the moment
+        // you would be changing it.
+        {
+            key: "displays", type: "json", def: ({}), group: "display",
+            internal: true,
+            label: "Display configuration",
+            detail: "Resolution, scale, and rotation per connected display"
+        },
+
+        // ── Per-application notification rules ──────────────────────────────
+        // { "<appId>": { enabled, showOnLockScreen, showContentOnLockScreen } }
+        //
+        // Absent means "no rule", which is not the same as a rule that allows
+        // everything: a new application must be able to notify without needing
+        // an entry written for it first. services/Notifs.qml treats a missing
+        // entry as permissive and Do Not Disturb remains an override on top,
+        // rather than being duplicated per application.
+        {
+            key: "notificationAppRules", type: "json", def: ({}), group: "notifications",
+            internal: true,
+            label: "Application notification rules",
+            detail: "Per-application notification and lock-screen visibility preferences"
+        },
+
         // ── Internal ────────────────────────────────────────────────────────
         {
             key: "lastPage", type: "string", def: "home", group: "internal",

config/dot/quickshell/config/Settings.qml

@@ -46,8 +46,8 @@ Singleton {
     // ── Night light ─────────────────────────────────────────────────────────
     // Matches the (disabled) GNOME schedule: 3500K from 17:00 to 10:00.
     readonly property int nightLightTemperature: DesktopPreferences.get("nightLightTemperature")
-    readonly property real nightLightFrom: 17.0
-    readonly property real nightLightTo: 10.0
+    readonly property real nightLightFrom: DesktopPreferences.get("nightLightFrom")
+    readonly property real nightLightTo: DesktopPreferences.get("nightLightTo")
     readonly property bool nightLightEnabledByDefault: DesktopPreferences.get("nightLightEnabled")
 
     // ── Notifications ───────────────────────────────────────────────────────

config/dot/quickshell/connectivity-harness.qml

@@ -0,0 +1,28 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.services
+
+ShellRoot {
+    IpcHandler {
+        target: "connectivity-test"
+
+        function status(): string {
+            return JSON.stringify({
+                wifiDevice: Connectivity.wifiDevice ? Connectivity.wifiDevice.name : "",
+                wiredDevice: Connectivity.wiredDevice ? Connectivity.wiredDevice.name : "",
+                wiredConnected: !!(Connectivity.wiredDevice && Connectivity.wiredDevice.connected),
+                networks: Connectivity.networks.length,
+                activeSsid: Connectivity.activeNetwork ? Connectivity.activeNetwork.name : "",
+                activeStrength: Connectivity.activeNetwork ? Connectivity.activeNetwork.signalStrength : -1,
+                activeLabel: Connectivity.activeNetwork ? Connectivity.signalLabel(Connectivity.activeNetwork.signalStrength) : "",
+                adapter: Connectivity.adapter ? true : false,
+                btDevices: Connectivity.bluetoothDevices.length
+            });
+        }
+
+        function labelFor(strength: real): string { return Connectivity.signalLabel(strength); }
+        function setActive(on: bool): void { Connectivity.active = on; }
+    }
+}

config/dot/quickshell/displays-harness.qml

@@ -0,0 +1,75 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.config
+import qs.services
+
+ShellRoot {
+    IpcHandler {
+        target: "displays-test"
+
+        function status(): string {
+            const monitor = Displays.monitors.length > 0 ? Displays.monitors[0] : null;
+            return JSON.stringify({
+                count: Displays.monitors.length,
+                name: monitor ? monitor.name : "",
+                width: monitor ? monitor.width : 0,
+                height: monitor ? monitor.height : 0,
+                refresh: monitor ? monitor.refreshRate : 0,
+                mode: monitor ? monitor.mode : "",
+                scale: monitor ? monitor.scale : 0,
+                transform: monitor ? monitor.transform : -1,
+                modes: monitor ? monitor.modes.length : 0,
+                awaiting: Displays.awaitingConfirmation,
+                canConfirm: Displays.canConfirm,
+                secondsLeft: Displays.secondsLeft,
+                lastError: Displays.lastError,
+                overridden: monitor ? Displays.isOverridden(monitor.name) : false
+            });
+        }
+
+        function applyScale(scale: real): bool {
+            const monitor = Displays.monitors[0];
+            if (!monitor) return false;
+            const mode = monitor.mode;
+            return Displays.apply(monitor.name, mode, scale, monitor.transform);
+        }
+
+        function refreshIdentityFixture(): string {
+            const modes = Displays.normaliseModes([
+                "[email protected]",
+                "[email protected]"
+            ]);
+            const monitor = { width: 1920, height: 1080, refreshRate: 59.94 };
+            return JSON.stringify({
+                count: modes.length,
+                modes: modes.map(mode => mode.mode),
+                selected: modes.filter(mode => Displays.modeIsCurrent(monitor, mode)).map(mode => mode.mode)
+            });
+        }
+
+        function applyBad(kind: string): bool {
+            const monitor = Displays.monitors[0];
+            if (!monitor) return false;
+            const mode = monitor.mode;
+            if (kind === "mode") return Displays.apply(monitor.name, "9999x9999@240", monitor.scale, monitor.transform);
+            if (kind === "scale") return Displays.apply(monitor.name, mode, 1.37, monitor.transform);
+            if (kind === "dirtyScale") {
+                const dirty = Displays.scales.find(scale => !Displays.isScaleClean(mode, scale));
+                return dirty === undefined ? false : Displays.apply(monitor.name, mode, dirty, monitor.transform);
+            }
+            if (kind === "transform") return Displays.apply(monitor.name, mode, monitor.scale, 9);
+            if (kind === "output") return Displays.apply("NOPE-1", mode, monitor.scale, monitor.transform);
+            return false;
+        }
+
+        function confirmChange(): bool { return Displays.confirm(); }
+        function revertChange(): void { Displays.revert(); }
+        function forget(): void {
+            const monitor = Displays.monitors[0];
+            if (monitor) Displays.forget(monitor.name);
+        }
+        function refresh(): void { Displays.refresh(); }
+    }
+}

config/dot/quickshell/modules/quicksettings/AudioDeviceList.qml

@@ -6,6 +6,7 @@ import QtQuick
 import Quickshell
 import Quickshell.Services.Pipewire
 import qs.config
+import qs.services
 
 Item {
     id: root
@@ -16,23 +17,12 @@ Item {
 
     implicitHeight: list.implicitHeight
 
-    readonly property var nodes: {
-        return Pipewire.nodes.values.filter(n => {
-            if (n.isStream)
-                return false;
-            // Sources have to be filtered on the type flags: !isSink also
-            // matches video nodes (webcams show up here otherwise).
-            return root.output ? n.isSink : (n.type & PwNodeType.AudioSource) === PwNodeType.AudioSource;
-        });
-    }
+    readonly property var nodes: root.output ? AudioDevices.outputs : AudioDevices.inputs
 
-    readonly property var current: root.output ? Pipewire.defaultAudioSink : Pipewire.defaultAudioSource
+    readonly property var current: AudioDevices.current(root.output)
 
     function select(node): void {
-        if (root.output)
-            Pipewire.preferredDefaultAudioSink = node;
-        else
-            Pipewire.preferredDefaultAudioSource = node;
+        AudioDevices.select(root.output, node)
     }
 
     ScrollColumn {
@@ -52,7 +42,7 @@ Item {
                 implicitHeight: 38
                 icon: root.output ? "audio-speakers-symbolic" : "audio-input-microphone-symbolic"
                 iconFallback: "audio-card-symbolic"
-                label: nodeRow.modelData.description || nodeRow.modelData.nickname || nodeRow.modelData.name
+                label: AudioDevices.label(nodeRow.modelData)
                 selected: nodeRow.modelData === root.current
                 onClicked: root.select(nodeRow.modelData)
             }

config/dot/quickshell/modules/settings/AudioBalance.qml

@@ -0,0 +1,72 @@
+import QtQuick
+import Quickshell
+import Quickshell.Services.Pipewire
+import qs.config
+import qs.widgets
+
+SettingRow {
+    id: root
+
+    property var node: null
+
+    label: "Balance"
+    detail: "Adjust the left and right channels"
+    controlWidth: 270
+    visible: root.available
+    divider: false
+
+    PwObjectTracker {
+        objects: root.node ? [root.node] : []
+    }
+
+    function channelIndex(channel): int {
+        if (!root.node?.audio)
+            return -1;
+        const channels = root.node.audio.channels;
+        for (let index = 0; index < channels.length; index++) {
+            if (channels[index] === channel)
+                return index;
+        }
+        return -1;
+    }
+
+    readonly property int leftIndex: root.channelIndex(PwAudioChannel.FrontLeft)
+    readonly property int rightIndex: root.channelIndex(PwAudioChannel.FrontRight)
+    readonly property bool available: root.node?.audio
+        && root.leftIndex >= 0 && root.rightIndex >= 0
+        && root.node.audio.volumes.length > Math.max(root.leftIndex, root.rightIndex)
+
+    readonly property real position: {
+        if (!root.available)
+            return 0.5;
+        const left = root.node.audio.volumes[root.leftIndex];
+        const right = root.node.audio.volumes[root.rightIndex];
+        const level = Math.max(left, right);
+        if (level <= 0.001)
+            return 0.5;
+        return right >= left ? 0.5 + (1 - left / level) * 0.5
+                             : 0.5 - (1 - right / level) * 0.5;
+    }
+
+    function setBalance(value: real): void {
+        if (!root.available)
+            return;
+        const next = Array.from(root.node.audio.volumes);
+        const level = Math.max(next[root.leftIndex], next[root.rightIndex], 0.001);
+        if (value < 0.5) {
+            next[root.leftIndex] = level;
+            next[root.rightIndex] = level * value * 2;
+        } else {
+            next[root.leftIndex] = level * (1 - value) * 2;
+            next[root.rightIndex] = level;
+        }
+        root.node.audio.volumes = next;
+    }
+
+    ValueSlider {
+        anchors.fill: parent
+        value: root.position
+        icon: "audio-speakers-symbolic"
+        onMoved: value => root.setBalance(value)
+    }
+}

config/dot/quickshell/modules/settings/BluetoothPanel.qml

@@ -0,0 +1,95 @@
+// Bluetooth, at page size.
+//
+// Paired devices first, because reconnecting to something you already own is
+// what you are here for nine times out of ten; discovered devices follow.
+// Battery is shown where BlueZ reports it, which is the one thing people
+// routinely open a terminal for.
+
+import QtQuick
+import Quickshell
+import Quickshell.Bluetooth
+import qs.config
+import qs.services
+
+Column {
+    id: root
+
+    spacing: 0
+
+    function primaryAction(device: var): void {
+        if (device.connected) {
+            device.disconnect();
+            return;
+        }
+        if (device.paired) {
+            device.connect();
+            return;
+        }
+        device.pair();
+    }
+
+    function stateLabel(device: var): string {
+        if (device.pairing)
+            return "Pairing…";
+        if (device.connected)
+            return device.batteryAvailable
+                ? `Connected · ${Math.round(device.battery * 100)}% battery`
+                : "Connected";
+        if (device.paired)
+            return "Paired";
+        return device.address || "Not paired";
+    }
+
+    Repeater {
+        model: Connectivity.bluetoothDevices
+
+        SettingRow {
+            id: entry
+
+            required property var modelData
+            required property int index
+
+            width: parent.width
+            label: entry.modelData.name || entry.modelData.address || "Unknown device"
+            detail: root.stateLabel(entry.modelData)
+            divider: entry.index < Connectivity.bluetoothDevices.length - 1
+            controlWidth: 200
+            activatable: !entry.modelData.pairing
+            onActivated: root.primaryAction(entry.modelData)
+
+            Row {
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                spacing: 7
+
+                SettingsButton {
+                    anchors.verticalCenter: parent.verticalCenter
+                    enabled: !entry.modelData.pairing
+                    text: entry.modelData.connected
+                        ? "Disconnect"
+                        : (entry.modelData.paired ? "Connect" : "Pair")
+                    onClicked: root.primaryAction(entry.modelData)
+                }
+
+                SettingsButton {
+                    anchors.verticalCenter: parent.verticalCenter
+                    visible: entry.modelData.paired
+                    text: "Forget"
+                    onClicked: entry.modelData.forget()
+                }
+            }
+        }
+    }
+
+    SettingRow {
+        width: parent.width
+        visible: Connectivity.bluetoothDevices.length === 0
+        label: !Connectivity.adapter
+            ? "No Bluetooth adapter"
+            : (Connectivity.adapter.enabled ? "Looking for devices…" : "Bluetooth is off")
+        detail: Connectivity.adapter && !Connectivity.adapter.enabled
+            ? "Turn it on above to discover devices"
+            : "Put the device into pairing mode to make it appear"
+        divider: false
+    }
+}

config/dot/quickshell/modules/settings/ChoiceGrid.qml

@@ -0,0 +1,118 @@
+// A row of choices that wraps, for options that do not fit a segmented control.
+//
+// ChoiceRow puts two or three options on one line. Scales and rotations are
+// more numerous and their labels are wider, so they wrap into a grid rather
+// than shrinking to illegibility on a narrow, tiled window.
+//
+// Unlike ChoiceRow this is not schema-bound: it reports a value and lets the
+// caller decide what to do with it, because a display change has to go through
+// an apply-then-confirm cycle rather than straight into the store.
+
+import QtQuick
+import qs.config
+
+Column {
+    id: root
+
+    property string label: ""
+    property string detail: ""
+    property var options: []
+    property var current: null
+    property bool enabled: true
+    property bool divider: true
+
+    signal picked(var value)
+
+    spacing: 9
+    bottomPadding: 12
+
+    Column {
+        width: parent.width
+        spacing: 3
+
+        Text {
+            width: parent.width
+            text: root.label
+            color: Theme.fg
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSize
+            font.weight: Font.Medium
+        }
+        Text {
+            width: parent.width
+            visible: root.detail !== ""
+            text: root.detail
+            color: Theme.fgDim
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+            wrapMode: Text.WordWrap
+        }
+    }
+
+    Flow {
+        width: parent.width
+        spacing: 7
+
+        Repeater {
+            model: root.options
+
+            Rectangle {
+                id: option
+
+                required property var modelData
+
+                readonly property bool selected: root.current === option.modelData.value
+
+                implicitWidth: Math.max(78, caption.implicitWidth + 26)
+                implicitHeight: 32
+                radius: 9
+                opacity: root.enabled ? 1 : 0.45
+                color: option.selected ? "transparent" : Theme.alpha(Theme.fg, hover.hovered && root.enabled ? 0.11 : 0.06)
+                border.width: option.selected ? 1 : 0
+                border.color: Theme.alpha(Theme.accent, 0.5)
+
+                // The prism marks the selection here as everywhere else.
+                Rectangle {
+                    anchors.fill: parent
+                    radius: parent.radius
+                    visible: option.selected
+                    border.width: 0
+                    gradient: Gradient {
+                        orientation: Gradient.Horizontal
+                        GradientStop { position: 0.0; color: Theme.alpha(Theme.accent, 0.28) }
+                        GradientStop { position: 1.0; color: Theme.alpha(Theme.accentSecondary, 0.28) }
+                    }
+                }
+
+                Text {
+                    id: caption
+                    anchors.centerIn: parent
+                    text: option.modelData.label
+                    color: option.selected ? Theme.fg : Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.features: Theme.tabularFigures
+                    font.pixelSize: Theme.fontSize
+                    font.weight: option.selected ? Font.DemiBold : Font.Normal
+                }
+
+                HoverHandler {
+                    id: hover
+                    enabled: root.enabled
+                    cursorShape: Qt.PointingHandCursor
+                }
+
+                TapHandler {
+                    enabled: root.enabled && !option.selected
+                    onTapped: root.picked(option.modelData.value)
+                }
+            }
+        }
+    }
+
+    Rectangle {
+        width: parent.width
+        height: 1
+        visible: root.divider
+        color: Theme.alpha(Theme.fg, 0.065)
+    }
+}

config/dot/quickshell/modules/settings/ConnectivityPage.qml

@@ -1,92 +1,124 @@
+// Network & Devices.
+//
+// Wi-Fi and Bluetooth are handled here rather than delegated. Everything goes
+// through Quickshell.Networking and Quickshell.Bluetooth -- NetworkManager and
+// BlueZ over DBus -- and nothing shells out to nmcli or bluetoothctl. That was
+// the founding requirement for this desktop: never having to drop to a terminal
+// to join a network.
+//
+// Scanning follows this page being on screen. Wi-Fi scanning and especially
+// Bluetooth discovery hold the radio, and doing either for a list nobody is
+// looking at is battery and airtime spent on nothing.
+
 import QtQuick
+import Quickshell
 import Quickshell.Networking
-import Quickshell.Bluetooth
 import qs.config
 import qs.services
-import qs.modules.quicksettings
 
 SettingsPage {
     id: root
 
     title: "Network & Devices"
-    lede: "Connect graphically—no terminal workflow required."
+    lede: Connectivity.activeNetwork
+        ? "Connected to " + Connectivity.activeNetwork.name
+        : "Wi-Fi, Bluetooth, and the things Fedora owns."
 
-    readonly property var wifiDevice: {
-        for (const device of Networking.devices.values) {
-            if (device.type === DeviceType.Wifi)
-                return device;
-        }
-        return null;
-    }
-    readonly property var bluetoothAdapter: Bluetooth.defaultAdapter
+    // Drive the scanners only while this page is the one being shown.
+    Component.onCompleted: Connectivity.active = true
+    Component.onDestruction: Connectivity.active = false
 
     SettingsCard {
-        title: "Wi‑Fi"
-        subtitle: Networking.wifiEnabled ? "Available networks" : "Wireless networking is off"
+        title: "Wired"
+        visible: Connectivity.wiredDevice !== null
+
+        TextRow {
+            label: "Ethernet"
+            detail: Connectivity.wiredDevice ? Connectivity.wiredDevice.name : ""
+            value: Connectivity.wiredDevice && Connectivity.wiredDevice.connected ? "Connected" : "Not connected"
+            divider: false
+        }
+    }
+
+    SettingsCard {
+        title: "Wi-Fi"
+        // A Wi-Fi switch reading "On" above the words "No Wi-Fi adapter" is a
+        // contradiction; with no radio the card simply does not belong.
+        visible: Connectivity.wifiDevice !== null
+        subtitle: "Networks are re-scanned while this page is open."
 
         SettingRow {
-            label: "Wi‑Fi"
-            detail: root.wifiDevice ? "Managed by NetworkManager" : "No wireless adapter found"
+            label: "Wi-Fi"
+            detail: Connectivity.wifiEnabled ? "On" : "Off"
             controlWidth: 48
+            divider: Connectivity.wifiEnabled
 
             SettingsToggle {
                 anchors.right: parent.right
                 anchors.verticalCenter: parent.verticalCenter
-                checked: Networking.wifiEnabled
-                enabled: Networking.wifiHardwareEnabled
+                checked: Connectivity.wifiEnabled
+                enabled: Connectivity.wifiAvailable
                 onToggled: value => Networking.wifiEnabled = value
             }
         }
 
-        WifiList {
+        WifiPanel {
             width: parent.width
-            device: root.wifiDevice
-            active: true
-            maxHeight: 240
-        }
-
-        ActionRow {
-            label: "Advanced network settings"
-            detail: "VPN, wired profiles, DNS, and connection details"
-            divider: false
-            action: "Open panel"
-            onTriggered: SystemSettings.openGnomePanel("network")
+            visible: Connectivity.wifiEnabled
         }
     }
 
     SettingsCard {
         title: "Bluetooth"
-        subtitle: root.bluetoothAdapter?.enabled ? "Nearby and paired devices" : "Bluetooth is off"
+        visible: Connectivity.adapter !== null
+        subtitle: "Discovery runs while this page is open."
 
         SettingRow {
             label: "Bluetooth"
-            detail: root.bluetoothAdapter ? "Pair and reconnect without leaving Settings" : "No Bluetooth adapter found"
+            detail: Connectivity.adapter
+                ? (Connectivity.adapter.enabled ? "On" : "Off")
+                : "Unavailable"
             controlWidth: 48
+            divider: !!(Connectivity.adapter && Connectivity.adapter.enabled)
 
             SettingsToggle {
                 anchors.right: parent.right
                 anchors.verticalCenter: parent.verticalCenter
-                checked: root.bluetoothAdapter?.enabled ?? false
-                enabled: root.bluetoothAdapter !== null
+                checked: !!(Connectivity.adapter && Connectivity.adapter.enabled)
+                enabled: Connectivity.adapter !== null
                 onToggled: value => {
-                    if (root.bluetoothAdapter)
-                        root.bluetoothAdapter.enabled = value;
+                    if (Connectivity.adapter)
+                        Connectivity.adapter.enabled = value;
                 }
             }
         }
 
-        BluetoothList {
+        BluetoothPanel {
             width: parent.width
-            active: true
-            maxHeight: 220
+            visible: !!(Connectivity.adapter && Connectivity.adapter.enabled)
         }
+    }
+
+    SettingsCard {
+        title: "Owned by Fedora"
+        subtitle: "VPNs, per-connection routing, printers, and online accounts are configured by GNOME's panels, which are installed and searchable."
 
         ActionRow {
-            label: "Advanced Bluetooth settings"
-            detail: "Device details and system-level options"
+            label: "Network connections"
+            detail: "VPN, proxies, and per-connection settings"
+            action: "Open"
+            onTriggered: SystemSettings.openGnomePanel("network")
+        }
+        ActionRow {
+            label: "Printers"
+            action: "Open"
+            onTriggered: SystemSettings.openGnomePanel("printers")
+        }
+        ActionRow {
+            label: "Online accounts"
+            action: "Open"
             divider: false
-            action: "Open panel"
-            onTriggered: SystemSettings.openGnomePanel("bluetooth")
+            onTriggered: SystemSettings.openGnomePanel("online-accounts")
         }
     }
 }

config/dot/quickshell/modules/settings/DisplayModePicker.qml

@@ -0,0 +1,120 @@
+// The resolution list for one display.
+//
+// Grouped by resolution with refresh rates beside it, rather than a flat list
+// of "[email protected]" strings: this panel reports 35 modes, many of which
+// differ only in refresh-rate rounding, and a flat list of those is a wall of
+// near-identical text rather than a choice.
+
+import QtQuick
+import qs.config
+import qs.services
+
+Column {
+    id: root
+
+    property var monitor: null
+    property bool enabled: true
+
+    spacing: 0
+
+    readonly property var grouped: {
+        if (!root.monitor)
+            return [];
+        const buckets = {};
+        const order = [];
+        for (const mode of root.monitor.modes) {
+            const key = mode.label;
+            if (!buckets[key]) {
+                buckets[key] = { label: key, width: mode.width, height: mode.height, rates: [] };
+                order.push(key);
+            }
+            buckets[key].rates.push(mode);
+        }
+        return order.map(key => buckets[key]);
+    }
+
+    Repeater {
+        model: root.grouped
+
+        SettingRow {
+            id: resolution
+
+            required property var modelData
+            required property int index
+
+            readonly property bool isCurrent: root.monitor
+                && root.monitor.width === resolution.modelData.width
+                && root.monitor.height === resolution.modelData.height
+
+            label: resolution.modelData.label
+            detail: resolution.isCurrent ? "Current resolution" : ""
+            controlWidth: Math.max(120, resolution.modelData.rates.length * 84)
+            divider: resolution.index < root.grouped.length - 1
+
+            Row {
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                spacing: 6
+
+                Repeater {
+                    model: resolution.modelData.rates
+
+                    Rectangle {
+                        id: rate
+
+                        required property var modelData
+
+                        readonly property bool selected: resolution.isCurrent
+                            && Displays.modeIsCurrent(root.monitor, rate.modelData)
+
+                        implicitWidth: Math.max(74, rateCaption.implicitWidth + 22)
+                        implicitHeight: 30
+                        radius: 9
+                        opacity: root.enabled ? 1 : 0.45
+                        color: rate.selected ? "transparent" : Theme.alpha(Theme.fg, rateHover.hovered && root.enabled ? 0.11 : 0.06)
+                        border.width: rate.selected ? 1 : 0
+                        border.color: Theme.alpha(Theme.accent, 0.5)
+
+                        Rectangle {
+                            anchors.fill: parent
+                            radius: parent.radius
+                            visible: rate.selected
+                            border.width: 0
+                            gradient: Gradient {
+                                orientation: Gradient.Horizontal
+                                GradientStop { position: 0.0; color: Theme.alpha(Theme.accent, 0.28) }
+                                GradientStop { position: 1.0; color: Theme.alpha(Theme.accentSecondary, 0.28) }
+                            }
+                        }
+
+                        Text {
+                            id: rateCaption
+                            anchors.centerIn: parent
+                            text: rate.modelData.refreshLabel
+                            color: rate.selected ? Theme.fg : Theme.fgDim
+                            font.family: Theme.fontFamily
+                            font.features: Theme.tabularFigures
+                            font.pixelSize: Theme.fontSizeSmall
+                            font.weight: rate.selected ? Font.DemiBold : Font.Normal
+                        }
+
+                        HoverHandler {
+                            id: rateHover
+                            enabled: root.enabled
+                            cursorShape: Qt.PointingHandCursor
+                        }
+
+                        TapHandler {
+                            enabled: root.enabled && !rate.selected
+                            onTapped: Displays.apply(
+                                root.monitor.name,
+                                rate.modelData.mode,
+                                Displays.nearestCleanScale(rate.modelData.mode, root.monitor.scale),
+                                root.monitor.transform)
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

config/dot/quickshell/modules/settings/DisplaysPage.qml

@@ -1,81 +1,232 @@
+// Displays.
+//
+// Resolution, refresh rate, scale, and rotation, plus the gaming display
+// policy that was already here.
+//
+// Every geometry change goes through an apply-then-confirm countdown. This is
+// the one page where a wrong value can leave the screen unreadable or blank,
+// and no other control in the app can undo it once that happens. Confirming is
+// what writes the choice to the settings store; letting the countdown run
+// leaves nothing behind.
+
 import QtQuick
 import qs.config
 import qs.services
 import qs.widgets
 
 SettingsPage {
+    id: root
+
     title: "Displays"
     lede: SystemSettings.monitorDescription || "Reading the active display…"
 
-    SettingsCard {
-        title: SystemSettings.monitorName || "Active display"
-        subtitle: `${SystemSettings.monitorWidth} × ${SystemSettings.monitorHeight} at ${SystemSettings.monitorRefreshRate.toFixed(0)} Hz · ${SystemSettings.monitorScale.toFixed(1)}× scale · ${SystemSettings.monitorFormat}`
-        TextRow { label: "Color mode"; detail: "Wide-gamut SDR desktop at 10-bit"; value: SystemSettings.colorPreset || "wide" }
-        TextRow { label: "Variable refresh"; detail: SystemSettings.monitorVrrActive ? "Active for current fullscreen content" : "Ready when game or video content requests it"; value: SystemSettings.monitorVrrActive ? "Active" : "Standby"; divider: false }
+    property string selectedOutput: ""
+    readonly property var monitor: Displays.monitorNamed(root.selectedOutput)
+        ?? (Displays.monitors.length > 0 ? Displays.monitors[0] : null)
+    readonly property string currentMode: root.monitor
+        ? root.monitor.mode
+        : ""
+
+    function syncSelectedOutput(): void {
+        if (!Displays.monitorNamed(root.selectedOutput))
+            root.selectedOutput = Displays.monitors.length > 0 ? Displays.monitors[0].name : "";
+    }
+
+    Component.onCompleted: root.syncSelectedOutput()
+    Connections {
+        target: Displays
+        function onMonitorsChanged(): void { root.syncSelectedOutput(); }
+    }
+
+    // The confirmation sits above everything, because while it is counting down
+    // it is the only thing that matters on this page.
+    header: Component {
+        Rectangle {
+            visible: Displays.awaitingConfirmation
+            implicitHeight: visible ? confirmRow.implicitHeight + 28 : 0
+            radius: Theme.cardRadius
+            color: Theme.mix(Theme.bgPanel, Theme.warn, 0.12)
+            border.width: 1
+            border.color: Theme.alpha(Theme.warn, 0.4)
+
+            Row {
+                id: confirmRow
+                anchors.left: parent.left
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                anchors.margins: 16
+                spacing: 14
+
+                Column {
+                    width: parent.width - keepButton.width - revertButton.width - 28
+                    anchors.verticalCenter: parent.verticalCenter
+                    spacing: 3
+
+                    Text {
+                        width: parent.width
+                        text: "Keep this display setting?"
+                        color: Theme.fg
+                        font.family: Theme.fontFamily
+                        font.pixelSize: Theme.fontSize
+                        font.weight: Font.DemiBold
+                    }
+                    Text {
+                        width: parent.width
+                        text: "Reverting in " + Displays.secondsLeft + (Displays.secondsLeft === 1 ? " second" : " seconds")
+                            + " if you do nothing. If you cannot read this, just wait."
+                        color: Theme.fgDim
+                        font.family: Theme.fontFamily
+                        font.features: Theme.tabularFigures
+                        font.pixelSize: Theme.fontSizeSmall
+                        wrapMode: Text.WordWrap
+                    }
+                }
+
+                SettingsButton {
+                    id: revertButton
+                    anchors.verticalCenter: parent.verticalCenter
+                    text: "Revert now"
+                    onClicked: Displays.revert()
+                }
+                SettingsButton {
+                    id: keepButton
+                    anchors.verticalCenter: parent.verticalCenter
+                    text: "Keep"
+                    enabled: Displays.canConfirm
+                    onClicked: Displays.confirm()
+                }
+            }
+        }
     }
 
     SettingsCard {
-        title: "Gaming display policy"
-        subtitle: "These values apply immediately and are restored when Panama starts."
-        SettingRow {
-                    label: "Game-aware HDR"
-                    detail: "Enter HDR only for fullscreen content that requests it"
-                    controlWidth: 48
-                    SettingsToggle { anchors.right: parent.right; anchors.verticalCenter: parent.verticalCenter; checked: SystemSettings.autoHdr; onToggled: value => SystemSettings.setAutoHdr(value) }
-        }
-        SettingRow {
-                    label: "Content-aware VRR"
-                    detail: "Enable variable refresh only for game and video content"
-                    controlWidth: 48
-                    SettingsToggle { anchors.right: parent.right; anchors.verticalCenter: parent.verticalCenter; checked: SystemSettings.vrrPolicy === 3; onToggled: value => SystemSettings.setVrrPolicy(value ? 3 : 0) }
-        }
-        SettingRow {
-                    label: "Direct scanout for games"
-                    detail: "Bypass compositing only for windows classified as games"
+        visible: Displays.monitors.length > 1
+        title: "Connected display"
+        subtitle: "Choose the output whose resolution, scale, and rotation you want to adjust."
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Display"
+            options: Displays.monitors.map(monitor => ({
+                value: monitor.name,
+                label: monitor.description || monitor.name
+            }))
+            current: root.monitor ? root.monitor.name : ""
+            enabled: !Displays.awaitingConfirmation && !Displays.busy
             divider: false
-                    controlWidth: 48
-                    SettingsToggle { anchors.right: parent.right; anchors.verticalCenter: parent.verticalCenter; checked: SystemSettings.directScanoutPolicy === 2; onToggled: value => SystemSettings.setDirectScanoutPolicy(value ? 2 : 0) }
+            onPicked: value => root.selectedOutput = value
+        }
+    }
+
+    SettingsCard {
+        title: root.monitor ? root.monitor.name : (SystemSettings.monitorName || "Active display")
+        subtitle: root.monitor
+            ? `${root.monitor.description} · ${root.monitor.width} × ${root.monitor.height} at ${Math.round(root.monitor.refreshRate)} Hz · ${root.monitor.scale.toFixed(2)}× scale`
+            : "Reading the active display…"
+
+        TextRow {
+            label: "Color mode"
+            detail: "Wide-gamut SDR at 10-bit. Full-time HDR is left to the Hyprland config: it currently breaks screenshots, OBS, and the lock screen's blurred background."
+            value: root.monitor
+                ? `${root.monitor.colorPreset || "standard"} · ${root.monitor.currentFormat || "detecting format"}`
+                : "Detecting"
+        }
+        TextRow {
+            label: "Variable refresh"
+            detail: root.monitor && root.monitor.vrr
+                ? "Active on this output for current fullscreen content"
+                : "This output is ready when game or video content requests it"
+            value: root.monitor && root.monitor.vrr ? "Active" : "Standby"
+            divider: Displays.isOverridden(root.monitor ? root.monitor.name : "")
+        }
+        ActionRow {
+            visible: Displays.isOverridden(root.monitor ? root.monitor.name : "")
+            label: "Using a custom display setting"
+            detail: "Forget it to go back to the resolution and scale Panama ships"
+            action: "Forget"
+            divider: false
+            onTriggered: Displays.forget(root.monitor.name)
+        }
+    }
+
+    SettingsCard {
+        visible: root.monitor !== null
+        title: "Resolution"
+        subtitle: "Applied straight away, then reverted automatically unless you confirm."
+
+        DisplayModePicker {
+            width: parent.width
+            monitor: root.monitor
+            enabled: !Displays.awaitingConfirmation && !Displays.busy
+        }
+    }
+
+    SettingsCard {
+        visible: root.monitor !== null
+        title: "Scale and rotation"
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Scale"
+            detail: "Fractional scales that do not divide the resolution into whole pixels are rejected by the compositor, so only clean ones are offered."
+            options: Displays.scalesForMode(root.currentMode)
+                .map(scale => ({ value: scale, label: scale.toFixed(2) + "×" }))
+            current: root.monitor ? root.monitor.scale : 1
+            enabled: !Displays.awaitingConfirmation && !Displays.busy
+            onPicked: value => root.applyWith({ scale: value })
+        }
+
+        ChoiceGrid {
+            width: parent.width
+            label: "Rotation"
+            options: Displays.transforms
+            current: root.monitor ? root.monitor.transform : 0
+            enabled: !Displays.awaitingConfirmation && !Displays.busy
+            divider: false
+            onPicked: value => root.applyWith({ transform: value })
         }
     }
 
     SettingsCard {
         title: "Night Light"
-        SettingRow {
-                    label: "Warm display colors"
-                    detail: NightLight.automatic ? "Following the evening schedule" : "Manual control"
-                    controlWidth: 48
-                    SettingsToggle { anchors.right: parent.right; anchors.verticalCenter: parent.verticalCenter; checked: NightLight.active; onToggled: NightLight.toggle() }
-        }
-        SettingRow {
-                    label: "Color temperature"
-                    detail: `${NightLight.temperature} K`
-                    divider: false
-                    controlWidth: 230
-                    ValueSlider {
-                        anchors.fill: parent
-                        value: (6500 - NightLight.temperature) / 4000
-                        icon: "weather-clear-night-symbolic"
-                        onMoved: value => NightLight.temperature = Math.round((6500 - value * 4000) / 50) * 50
-                    }
-        }
+        subtitle: NightLight.active
+            ? "On now, warming the display to reduce blue light."
+            : "Warms the display in the evening to reduce blue light."
+
+        ToggleRow { setting: "nightLightEnabled" }
+        ToggleRow { setting: "nightLightAutomatic" }
+        TimeOfDayRow { setting: "nightLightFrom" }
+        TimeOfDayRow { setting: "nightLightTo" }
+        SliderRow { setting: "nightLightTemperature"; divider: false }
     }
 
-    Rectangle {
-        width: parent.width
-        height: warningText.implicitHeight + 30
-        radius: Theme.cardRadius
-        color: Theme.alpha(Theme.warn, 0.085)
-        border.width: 1
-        border.color: Theme.alpha(Theme.warn, 0.22)
-        Text {
-            id: warningText
-            anchors.fill: parent
-            anchors.margins: 15
-            text: "Full-time desktop HDR stays unavailable here because the current compositor path can break screenshots, OBS, Sunshine, and lock-screen capture. Game-aware HDR keeps the desktop dependable without giving up HDR games."
-            color: Theme.mix(Theme.fg, Theme.warn, 0.25)
-            font.family: Theme.fontFamily
-            font.pixelSize: Theme.fontSizeSmall
-            wrapMode: Text.WordWrap
+    SettingsCard {
+        title: "Gaming display policy"
+        subtitle: "Applied immediately and restored when Panama starts."
+
+        ToggleRow { setting: "autoHdr" }
+        ChoiceRow { setting: "vrrPolicy" }
+        ChoiceRow { setting: "directScanoutPolicy"; divider: false }
     }
+
+    SettingsCard {
+        visible: Displays.lastError !== ""
+        title: "Display problem"
+        subtitle: Displays.lastError
+    }
+
+    // Applies a change to one field, keeping the others at what is in effect.
+    function applyWith(change: var): void {
+        if (!root.monitor)
+            return;
+        const mode = change.mode ?? root.currentMode;
+        const requestedScale = change.scale ?? root.monitor.scale;
+        Displays.apply(
+            root.monitor.name,
+            mode,
+            Displays.isScaleClean(mode, requestedScale)
+                ? requestedScale
+                : Displays.nearestCleanScale(mode, requestedScale),
+            change.transform ?? root.monitor.transform);
     }
 }

config/dot/quickshell/modules/settings/HomeFavoriteCard.qml

@@ -9,93 +9,61 @@ Rectangle {
     required property string sourceName
     required property int index
     required property bool featured
+    required property bool canMoveEarlier
+    required property bool canMoveLater
 
     signal aliasCommitted(string id, string alias)
     signal removeRequested(string id)
     signal moveRequested(string id, int targetIndex)
 
-    readonly property bool dragging: dragHandler.active
-
     implicitHeight: 108
     radius: Theme.cardRadius
-    color: root.dragging
-        ? Theme.mix(Theme.bgDark, Theme.accent, 0.09)
-        : Theme.alpha(Theme.bgDark, 0.7)
-    border.width: root.dragging ? 2 : 1
-    border.color: root.dragging
-        ? Theme.alpha(Theme.accent, 0.82)
-        : Theme.alpha(Theme.fg, 0.07)
-    z: root.dragging ? 10 : 0
-
-    transform: Translate {
-        x: root.dragging ? dragHandler.translation.x : 0
-        y: root.dragging ? dragHandler.translation.y : 0
-    }
+    color: Theme.alpha(Theme.bgDark, 0.7)
+    border.width: 1
+    border.color: Theme.alpha(Theme.fg, 0.07)
 
     PrismEdge {
         anchors.top: parent.top
         anchors.left: parent.left
         anchors.right: parent.right
         inset: root.radius
-        opacity: root.dragging ? 0.82 : 0.2
+        opacity: 0.2
     }
 
-    Rectangle {
-        id: dragHandle
+    Column {
+        id: reorderControls
         anchors.left: parent.left
-        anchors.leftMargin: 11
+        anchors.leftMargin: 8
         anchors.verticalCenter: parent.verticalCenter
         width: 30
-        height: 42
-        radius: 9
-        activeFocusOnTab: true
-        color: root.dragging || activeFocus
-            ? Theme.alpha(Theme.accent, 0.14)
-            : (handleMouse.containsMouse ? Theme.alpha(Theme.fg, 0.09) : Theme.alpha(Theme.fg, 0.045))
-        border.width: activeFocus ? 2 : 1
-        border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.06)
+        spacing: 4
 
-        Text {
-            anchors.centerIn: parent
-            text: "⠿"
-            color: root.dragging ? Theme.accent : Theme.fgDim
-            font.family: Theme.fontFamily
-            font.pixelSize: 16
+        SettingsButton {
+            width: 30
+            height: 29
+            text: "↑"
+            enabled: root.canMoveEarlier
+            activeFocusOnTab: enabled
+            onClicked: root.moveRequested(root.favorite.id, root.index - 1)
+            Keys.onReturnPressed: if (enabled) root.moveRequested(root.favorite.id, root.index - 1)
+            Keys.onSpacePressed: if (enabled) root.moveRequested(root.favorite.id, root.index - 1)
         }
 
-        MouseArea {
-            id: handleMouse
-            anchors.fill: parent
-            hoverEnabled: true
-            acceptedButtons: Qt.NoButton
-            cursorShape: Qt.SizeAllCursor
-        }
-
-        DragHandler {
-            id: dragHandler
-            target: null
-            onActiveChanged: {
-                if (!active)
-                    root.commitDrag();
-            }
-        }
-
-        Keys.onPressed: event => {
-            if (event.key === Qt.Key_Left || event.key === Qt.Key_Up) {
-                root.moveRequested(root.favorite.id, Math.max(0, root.index - 1));
-                event.accepted = true;
-            } else if (event.key === Qt.Key_Right || event.key === Qt.Key_Down) {
-                const grid = root.GridView.view;
-                const lastIndex = grid ? grid.count - 1 : root.index;
-                root.moveRequested(root.favorite.id, Math.min(lastIndex, root.index + 1));
-                event.accepted = true;
-            }
+        SettingsButton {
+            width: 30
+            height: 29
+            text: "↓"
+            enabled: root.canMoveLater
+            activeFocusOnTab: enabled
+            onClicked: root.moveRequested(root.favorite.id, root.index + 1)
+            Keys.onReturnPressed: if (enabled) root.moveRequested(root.favorite.id, root.index + 1)
+            Keys.onSpacePressed: if (enabled) root.moveRequested(root.favorite.id, root.index + 1)
         }
     }
 
     Rectangle {
         id: aliasFrame
-        anchors.left: dragHandle.right
+        anchors.left: reorderControls.right
         anchors.leftMargin: 10
         anchors.right: removeButton.left
         anchors.rightMargin: 12
@@ -188,16 +156,4 @@ Rectangle {
         Keys.onReturnPressed: root.removeRequested(root.favorite.id)
         Keys.onSpacePressed: root.removeRequested(root.favorite.id)
     }
-
-    function commitDrag(): void {
-        const grid = root.GridView.view;
-        if (!grid || grid.count <= 0)
-            return;
-        const centerX = root.x + dragHandler.translation.x + root.width / 2;
-        const centerY = root.y + dragHandler.translation.y + root.height / 2;
-        const modelCount = grid.count;
-        const column = Math.max(0, Math.min(1, Math.floor(centerX / grid.cellWidth)));
-        const row = Math.max(0, Math.floor(centerY / grid.cellHeight));
-        root.moveRequested(root.favorite.id, Math.min(modelCount - 1, row * 2 + column));
-    }
 }

config/dot/quickshell/modules/settings/HomePhonePage.qml

@@ -43,10 +43,200 @@ SettingsPage {
         return "Home Assistant is unavailable";
     }
 
+    function saveHomeAssistantConfig(): void {
+        HomeAssistantConfig.save(
+            homeUrlInput.text,
+            homeEntitiesInput.text,
+            homeTokenInput.text
+        );
+    }
+
+    Connections {
+        target: HomeAssistantConfig
+
+        function onConfigurationSaved(): void {
+            homeTokenInput.clear();
+            homeUrlInput.text = HomeAssistantConfig.url;
+            homeEntitiesInput.text = HomeAssistantConfig.entities.join(", ");
+        }
+    }
+
     SettingsCard {
         title: "Home Assistant"
         subtitle: root.homeStatus()
 
+        SettingRow {
+            label: "Connection"
+            detail: HomeAssistantConfig.tokenConfigured
+                ? "A long-lived access token is stored privately"
+                : "Paste a long-lived access token to connect"
+            value: HomeAssistantConfig.configured ? "Configured" : "Not configured"
+        }
+
+        SettingRow {
+            label: "Server URL"
+            detail: "The local or remote address of Home Assistant"
+            controlWidth: 330
+
+            Rectangle {
+                anchors.fill: parent
+                radius: Theme.pillRadius
+                color: Theme.alpha(Theme.fg, 0.07)
+                border.width: homeUrlInput.activeFocus ? 2 : 1
+                border.color: homeUrlInput.activeFocus
+                    ? Theme.alpha(Theme.accent, 0.55) : "transparent"
+
+                TextInput {
+                    id: homeUrlInput
+                    anchors.fill: parent
+                    anchors.leftMargin: 12
+                    anchors.rightMargin: 12
+                    activeFocusOnTab: true
+                    text: HomeAssistantConfig.url
+                    color: Theme.fg
+                    selectionColor: Theme.alpha(Theme.accent, 0.5)
+                    selectedTextColor: Theme.fg
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSize
+                    verticalAlignment: TextInput.AlignVCenter
+                    clip: true
+
+                    Text {
+                        anchors.fill: parent
+                        visible: homeUrlInput.text === ""
+                        text: "https://homeassistant.local:8123"
+                        color: Theme.fgMuted
+                        font: homeUrlInput.font
+                        verticalAlignment: Text.AlignVCenter
+                        elide: Text.ElideRight
+                    }
+                }
+            }
+        }
+
+        SettingRow {
+            label: "Access token"
+            detail: HomeAssistantConfig.tokenConfigured
+                ? "Stored · leave blank to keep it"
+                : "Create one in your Home Assistant profile"
+            controlWidth: 330
+
+            PasswordField {
+                id: homeTokenInput
+                anchors.fill: parent
+                placeholder: HomeAssistantConfig.tokenConfigured
+                    ? "Stored token" : "Long-lived access token"
+                onAccepted: root.saveHomeAssistantConfig()
+            }
+        }
+
+        Column {
+            width: parent.width
+            spacing: 7
+            topPadding: 10
+            bottomPadding: 12
+
+            Text {
+                width: parent.width
+                text: "Light entities"
+                color: Theme.fg
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSize
+                font.weight: Font.Medium
+            }
+
+            Text {
+                width: parent.width
+                text: "Comma-separated entity IDs. These define the discoverable light catalog."
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                wrapMode: Text.WordWrap
+            }
+
+            Rectangle {
+                width: parent.width
+                height: 72
+                radius: 10
+                color: Theme.alpha(Theme.fg, 0.055)
+                border.width: homeEntitiesInput.activeFocus ? 2 : 1
+                border.color: homeEntitiesInput.activeFocus
+                    ? Theme.alpha(Theme.accent, 0.55) : Theme.alpha(Theme.fg, 0.06)
+
+                TextEdit {
+                    id: homeEntitiesInput
+                    anchors.fill: parent
+                    anchors.margins: 10
+                    activeFocusOnTab: true
+                    text: HomeAssistantConfig.entities.join(", ")
+                    color: Theme.fg
+                    selectionColor: Theme.alpha(Theme.accent, 0.5)
+                    selectedTextColor: Theme.fg
+                    font.family: Theme.fontMono
+                    font.pixelSize: Theme.fontSizeSmall
+                    wrapMode: TextEdit.Wrap
+                    clip: true
+
+                    Text {
+                        anchors.fill: parent
+                        visible: homeEntitiesInput.text === ""
+                        text: "light.living_room, light.kitchen"
+                        color: Theme.fgMuted
+                        font: homeEntitiesInput.font
+                        wrapMode: Text.WordWrap
+                    }
+                }
+            }
+        }
+
+        Text {
+            width: parent.width
+            visible: HomeAssistantConfig.lastError !== ""
+            text: HomeAssistantConfig.lastError
+            color: Theme.danger
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSizeSmall
+            wrapMode: Text.WordWrap
+            bottomPadding: 9
+        }
+
+        SettingRow {
+            label: "Private configuration"
+            detail: "Saved with owner-only permissions in Panama's private environment file"
+            controlWidth: 216
+
+            Row {
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                spacing: 8
+
+                SettingsButton {
+                    id: clearTokenButton
+                    text: "Clear token"
+                    enabled: HomeAssistantConfig.tokenConfigured && !HomeAssistantConfig.busy
+                    activeFocusOnTab: enabled
+                    border.width: activeFocus ? 2 : 1
+                    border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                    onClicked: HomeAssistantConfig.clearToken()
+                    Keys.onReturnPressed: if (enabled) HomeAssistantConfig.clearToken()
+                    Keys.onSpacePressed: if (enabled) HomeAssistantConfig.clearToken()
+                }
+
+                SettingsButton {
+                    id: saveHomeConfigButton
+                    text: HomeAssistantConfig.busy ? "Saving…" : "Save"
+                    tone: "accent"
+                    enabled: !HomeAssistantConfig.busy
+                    activeFocusOnTab: enabled
+                    border.width: activeFocus ? 2 : 0
+                    border.color: activeFocus ? Theme.fg : "transparent"
+                    onClicked: root.saveHomeAssistantConfig()
+                    Keys.onReturnPressed: if (enabled) root.saveHomeAssistantConfig()
+                    Keys.onSpacePressed: if (enabled) root.saveHomeAssistantConfig()
+                }
+            }
+        }
+
         SettingRow {
             label: "Light catalog"
             detail: "Panama reads light state through the Home Assistant helper."
@@ -122,6 +312,8 @@ SettingsPage {
                 })
                 sourceName: modelData.sourceName
                 featured: index < 4
+                canMoveEarlier: index > 0
+                canMoveLater: index < favoritesGrid.count - 1
                 onAliasCommitted: (id, alias) => HomePreferences.setAlias(id, alias)
                 onMoveRequested: (id, targetIndex) => HomePreferences.move(id, targetIndex)
                 onRemoveRequested: id => HomePreferences.remove(id)

config/dot/quickshell/modules/settings/NotificationsPage.qml

@@ -50,10 +50,89 @@ SettingsPage {
         SliderRow { setting: "maxVisibleToasts"; divider: false }
     }
 
+    SettingsCard {
+        title: "Application rules"
+        subtitle: "Apps appear here after they send a notification."
+
+        TextRow {
+            visible: Notifs.applications.length === 0
+            label: "No applications remembered yet"
+            detail: "Application controls will appear after the first notification arrives."
+            divider: false
+        }
+
+        Repeater {
+            model: Notifs.applications
+
+            Column {
+                required property var modelData
+
+                readonly property var app: modelData
+
+                width: parent.width
+
+                SettingRow {
+                    label: app.name
+                    detail: app.id
+                    controlWidth: 48
+
+                    SettingsToggle {
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        checked: Notifs.appRule(app.id).enabled
+                        onToggled: value => Notifs.setAppRule(app.id, { enabled: value })
+                    }
+                }
+
+                SettingRow {
+                    label: "Show on lock screen"
+                    detail: "Allow this app's notifications on the lock screen"
+                    controlWidth: 48
+
+                    SettingsToggle {
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        checked: Notifs.appRule(app.id).showOnLockScreen
+                        onToggled: value => Notifs.setAppRule(app.id, { showOnLockScreen: value })
+                    }
+                }
+
+                SettingRow {
+                    label: "Show content on lock screen"
+                    detail: "Show message details when this app is visible there"
+                    divider: false
+                    controlWidth: 48
+
+                    SettingsToggle {
+                        anchors.right: parent.right
+                        anchors.verticalCenter: parent.verticalCenter
+                        checked: Notifs.appRule(app.id).showContentOnLockScreen
+                        onToggled: value => Notifs.setAppRule(app.id, { showContentOnLockScreen: value })
+                    }
+                }
+            }
+        }
+    }
+
     SettingsCard {
         title: "Focus sessions"
         subtitle: "A focus session binds quiet mode and Caffeine to the current workspace."
 
+        SettingRow {
+            label: "Keep the screen awake"
+            detail: Caffeine.enabled
+                ? "The display will not blank or lock while this is on"
+                : "Idle timings on Power & Lock apply normally"
+            controlWidth: 48
+
+            SettingsToggle {
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                checked: Caffeine.enabled
+                onToggled: value => Caffeine.enabled = value
+            }
+        }
+
         SettingRow {
             id: durationRow
 

config/dot/quickshell/modules/settings/PasswordField.qml

@@ -0,0 +1,106 @@
+// A password entry with a reveal toggle.
+//
+// Deliberately not the clipboard popover's SearchField with different text: a
+// Wi-Fi key typed into a field that echoes it is readable by anyone behind you,
+// and a search glyph in front of a password prompt is simply wrong. Masked by
+// default, revealable while held, because the reason people want to see it is
+// to check a character they just typed.
+
+import QtQuick
+import qs.config
+
+Rectangle {
+    id: root
+
+    property alias text: input.text
+    property string placeholder: "Password"
+    property bool revealed: false
+
+    signal accepted
+
+    implicitHeight: 32
+    radius: Theme.pillRadius
+    color: Theme.alpha(Theme.fg, 0.07)
+    // Not left at 0 so the focus ring has something to animate. See the note in
+    // modules/clipboard/SearchField.qml.
+    border.width: 1
+    border.color: input.activeFocus ? Theme.alpha(Theme.accent, 0.55) : "transparent"
+
+    Behavior on border.color {
+        ColorAnimation { duration: Theme.durFast }
+    }
+
+    function grab(): void {
+        input.forceActiveFocus();
+    }
+
+    function clear(): void {
+        input.text = "";
+        root.revealed = false;
+    }
+
+    TextInput {
+        id: input
+
+        anchors.left: parent.left
+        anchors.leftMargin: 13
+        anchors.right: revealButton.left
+        anchors.rightMargin: 8
+        anchors.verticalCenter: parent.verticalCenter
+
+        activeFocusOnTab: true
+        color: Theme.fg
+        selectionColor: Theme.alpha(Theme.accent, 0.5)
+        selectedTextColor: Theme.fg
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSize
+        echoMode: root.revealed ? TextInput.Normal : TextInput.Password
+        passwordCharacter: "•"
+        clip: true
+
+        onAccepted: root.accepted()
+
+        Text {
+            anchors.fill: parent
+            verticalAlignment: Text.AlignVCenter
+            visible: input.text === ""
+            text: root.placeholder
+            color: Theme.fgMuted
+            font.family: Theme.fontFamily
+            font.pixelSize: Theme.fontSize
+            elide: Text.ElideRight
+        }
+    }
+
+    Rectangle {
+        id: revealButton
+
+        anchors.right: parent.right
+        anchors.rightMargin: 5
+        anchors.verticalCenter: parent.verticalCenter
+        width: 26
+        height: 24
+        radius: 7
+        color: revealHover.hovered ? Theme.alpha(Theme.fg, 0.12) : "transparent"
+        border.width: 0
+        visible: input.text !== ""
+
+        Text {
+            anchors.centerIn: parent
+            // Nerd Font eye / eye-slash. fontMono is used for icon glyphs only.
+            text: root.revealed ? "\u{F070}" : "\u{F06E}"
+            font.family: Theme.fontMono
+            font.pixelSize: 12
+            color: root.revealed ? Theme.accent : Theme.fgMuted
+        }
+
+        HoverHandler {
+            id: revealHover
+            cursorShape: Qt.PointingHandCursor
+        }
+
+        TapHandler {
+            onTapped: root.revealed = !root.revealed
+        }
+    }
+}

config/dot/quickshell/modules/settings/SettingsPage.qml

@@ -28,11 +28,31 @@ Item {
     // scrolls -- the Appearance page pins its live preview here.
     property Component header: null
 
+    Loader {
+        id: pinnedHeader
+
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.top: parent.top
+        anchors.leftMargin: 34
+        anchors.rightMargin: 34
+        anchors.topMargin: 30
+        active: root.header !== null
+        sourceComponent: root.header
+        z: 1
+    }
+
     Flickable {
-        anchors.fill: parent
+        id: pageScroll
+
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.top: pinnedHeader.implicitHeight > 0 ? pinnedHeader.bottom : parent.top
+        anchors.bottom: parent.bottom
+        anchors.topMargin: pinnedHeader.implicitHeight > 0 ? 16 : 0
         clip: true
         contentWidth: width
-        contentHeight: layout.implicitHeight + 64
+        contentHeight: layout.implicitHeight + (pinnedHeader.implicitHeight > 0 ? 34 : 64)
         boundsBehavior: Flickable.StopAtBounds
 
         Column {
@@ -40,15 +60,9 @@ Item {
 
             width: parent.width - 68
             x: 34
-            y: 30
+            y: pinnedHeader.implicitHeight > 0 ? 0 : 30
             spacing: 16
 
-            Loader {
-                width: parent.width
-                active: root.header !== null
-                sourceComponent: root.header
-            }
-
             Text {
                 width: parent.width
                 visible: root.title !== ""

config/dot/quickshell/modules/settings/ShortcutsPage.qml

@@ -28,6 +28,11 @@ SettingsPage {
     SettingsCard {
         title: "Keyboard"
 
+        TextRow {
+            label: "Keyboard layout"
+            detail: "XKB layout name. Changing it needs a compositor reload, so it is shown here rather than offered as a control that appears to apply instantly."
+            value: Settings ? DesktopPreferences.get("keyboardLayout") : "us"
+        }
         SliderRow { setting: "keyRepeatDelay" }
         SliderRow { setting: "keyRepeatRate" }
         ToggleRow { setting: "numlockByDefault"; divider: false }

config/dot/quickshell/modules/settings/SoundDeviceList.qml

@@ -0,0 +1,40 @@
+import QtQuick
+import Quickshell.Services.Pipewire
+import qs.config
+import qs.services
+
+Column {
+    id: root
+
+    property bool output: true
+    readonly property var nodes: AudioDevices.nodes(root.output)
+    readonly property var current: AudioDevices.current(root.output)
+
+    width: parent ? parent.width : 620
+    spacing: 8
+
+    Repeater {
+        model: root.nodes
+
+        SoundDeviceRow {
+            required property var modelData
+
+            width: root.width
+            node: modelData
+            output: root.output
+            selected: modelData === root.current
+        }
+    }
+
+    Text {
+        width: parent.width
+        visible: root.nodes.length === 0
+        text: Pipewire.ready ? "No audio devices found" : "Discovering audio devices…"
+        color: Theme.fgDim
+        font.family: Theme.fontFamily
+        font.pixelSize: Theme.fontSize
+        horizontalAlignment: Text.AlignHCenter
+        topPadding: 18
+        bottomPadding: 18
+    }
+}

config/dot/quickshell/modules/settings/SoundDeviceRow.qml

@@ -0,0 +1,168 @@
+import QtQuick
+import Quickshell
+import Quickshell.Services.Pipewire
+import qs.config
+import qs.widgets
+import qs.services
+import qs.modules.quicksettings
+
+Rectangle {
+    id: root
+
+    required property var node
+    property bool output: true
+    property bool selected: false
+
+    implicitHeight: root.output || !root.selected ? 88 : 105
+    radius: Theme.cardRadius
+    color: root.selected ? Theme.alpha(Theme.accent, 0.09) : Theme.alpha(Theme.fg, 0.025)
+    border.width: 1
+    border.color: root.selected ? Theme.alpha(Theme.accent, 0.34) : Theme.alpha(Theme.fg, 0.07)
+
+    PwObjectTracker {
+        objects: root.node ? [root.node] : []
+    }
+
+    PwNodePeakMonitor {
+        id: inputPeak
+        node: root.node
+        enabled: !root.output && root.selected
+    }
+
+    readonly property real volume: root.node?.audio?.volume ?? 0
+    readonly property bool muted: root.node?.audio?.muted ?? false
+
+    function iconName(): string {
+        if (!root.output)
+            return root.muted ? "microphone-sensitivity-muted-symbolic" : "audio-input-microphone-symbolic";
+        if (root.muted || root.volume <= 0.001)
+            return "audio-volume-muted-symbolic";
+        if (root.volume < 0.34)
+            return "audio-volume-low-symbolic";
+        if (root.volume < 0.67)
+            return "audio-volume-medium-symbolic";
+        return "audio-volume-high-symbolic";
+    }
+
+    Row {
+        id: heading
+        anchors.left: parent.left
+        anchors.right: parent.right
+        anchors.top: parent.top
+        anchors.leftMargin: 12
+        anchors.rightMargin: 10
+        anchors.topMargin: 8
+        height: 28
+        spacing: 10
+
+        ThemedIcon {
+            anchors.verticalCenter: parent.verticalCenter
+            size: 20
+            icon: root.output ? "audio-speakers-symbolic" : "audio-input-microphone-symbolic"
+            iconFallback: "audio-card-symbolic"
+            tint: root.selected ? Theme.accent : Theme.fg
+        }
+
+        Column {
+            width: Math.max(0, parent.width - 20 - useButton.width - parent.spacing * 2)
+            anchors.verticalCenter: parent.verticalCenter
+            spacing: 1
+
+            Text {
+                width: parent.width
+                text: AudioDevices.label(root.node)
+                color: Theme.fg
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSize
+                font.weight: root.selected ? Font.DemiBold : Font.Medium
+                elide: Text.ElideRight
+            }
+
+            Text {
+                width: parent.width
+                visible: root.node.nickname && root.node.nickname !== AudioDevices.label(root.node)
+                text: root.node.nickname ?? ""
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                elide: Text.ElideRight
+            }
+        }
+
+        SettingsButton {
+            id: useButton
+            anchors.verticalCenter: parent.verticalCenter
+            width: root.selected ? 78 : 64
+            text: root.selected ? "Default" : "Use"
+            enabled: !root.selected
+            onClicked: AudioDevices.select(root.output, root.node)
+        }
+    }
+
+    IconButton {
+        id: muteButton
+        anchors.left: parent.left
+        anchors.leftMargin: 8
+        anchors.top: heading.bottom
+        anchors.topMargin: 7
+        size: 30
+        iconSize: 17
+        icon: root.iconName()
+        iconFallback: root.output ? "audio-volume-high-symbolic" : "audio-input-microphone-symbolic"
+        onClicked: {
+            if (root.node?.audio)
+                root.node.audio.muted = !root.node.audio.muted;
+        }
+    }
+
+    ValueSlider {
+        id: volumeSlider
+        anchors.left: muteButton.right
+        anchors.leftMargin: 7
+        anchors.right: volumeText.left
+        anchors.rightMargin: 10
+        anchors.verticalCenter: muteButton.verticalCenter
+        value: root.muted ? 0 : root.volume
+        onMoved: value => {
+            if (!root.node?.audio)
+                return;
+            root.node.audio.muted = false;
+            root.node.audio.volume = value;
+        }
+    }
+
+    Text {
+        id: volumeText
+        anchors.right: parent.right
+        anchors.rightMargin: 12
+        anchors.verticalCenter: muteButton.verticalCenter
+        width: 38
+        text: Math.round(root.volume * 100) + "%"
+        color: Theme.fgDim
+        font.family: Theme.fontMono
+        font.features: Theme.tabularFigures
+        font.pixelSize: Theme.fontSizeSmall
+        horizontalAlignment: Text.AlignRight
+    }
+
+    Rectangle {
+        anchors.left: volumeSlider.left
+        anchors.right: volumeText.right
+        anchors.top: muteButton.bottom
+        anchors.topMargin: 5
+        height: 5
+        radius: height / 2
+        visible: !root.output && root.selected
+        color: Theme.alpha(Theme.fg, 0.10)
+
+        Rectangle {
+            anchors.left: parent.left
+            anchors.top: parent.top
+            anchors.bottom: parent.bottom
+            width: parent.width * Math.max(0, Math.min(1, inputPeak.peak))
+            radius: parent.radius
+            color: inputPeak.peak > 0.88 ? Theme.danger : Theme.accentSecondary
+
+        }
+    }
+}

config/dot/quickshell/modules/settings/SoundPage.qml

@@ -1,8 +1,6 @@
 import QtQuick
-import Quickshell.Services.Pipewire
 import qs.config
 import qs.services
-import qs.modules.quicksettings
 
 SettingsPage {
     title: "Sound"
@@ -10,43 +8,58 @@ SettingsPage {
 
     SettingsCard {
         title: "Output"
-        subtitle: Pipewire.defaultAudioSink?.description ?? "No output device"
+        subtitle: AudioDevices.current(true)?.description ?? "No output device"
 
-        AudioSlider {
-            width: parent.width
-            node: Pipewire.defaultAudioSink
-            output: true
-        }
-        Rectangle {
-            width: parent.width
-            height: 1
-            color: Theme.alpha(Theme.fg, 0.06)
-        }
-        AudioDeviceList {
+        SoundDeviceList {
             width: parent.width
             output: true
-            maxHeight: 190
+        }
+
+        AudioBalance {
+            width: parent.width
+            node: AudioDevices.current(true)
         }
     }
 
     SettingsCard {
         title: "Input"
-        subtitle: Pipewire.defaultAudioSource?.description ?? "No input device"
+        subtitle: AudioDevices.current(false)?.description ?? "No input device"
 
-        AudioSlider {
-            width: parent.width
-            node: Pipewire.defaultAudioSource
-            output: false
-        }
-        Rectangle {
-            width: parent.width
-            height: 1
-            color: Theme.alpha(Theme.fg, 0.06)
-        }
-        AudioDeviceList {
+        SoundDeviceList {
             width: parent.width
             output: false
-            maxHeight: 160
+        }
+    }
+
+    SettingsCard {
+        title: "Sound feedback"
+        subtitle: "Use the same event preferences as GTK and GNOME applications."
+
+        SettingRow {
+            label: "Event sounds"
+            detail: "Play alerts and interface event sounds"
+            controlWidth: 42
+
+            SettingsToggle {
+                anchors.fill: parent
+                checked: SoundFeedback.eventSounds
+                enabled: !SoundFeedback.busy
+                onToggled: checked => SoundFeedback.setEventSounds(checked)
+            }
+        }
+
+        SettingRow {
+            label: "Input feedback"
+            detail: "Play sounds for supported typing and input events"
+            controlWidth: 42
+            divider: false
+
+            SettingsToggle {
+                anchors.fill: parent
+                checked: SoundFeedback.inputFeedback
+                enabled: !SoundFeedback.busy
+                onToggled: checked => SoundFeedback.setInputFeedback(checked)
+            }
         }
     }
 

config/dot/quickshell/modules/settings/TimeOfDayRow.qml

@@ -0,0 +1,31 @@
+// A time of day, stored as a decimal hour.
+//
+// SliderRow would render 17.5 as "17.50", which is not how anyone reads a
+// clock. This is the same control with the readout formatted as a time, so the
+// night light schedule says "5:30 PM" rather than a number you have to convert.
+//
+// Honours the 24-hour clock preference, because a user who has asked for 18:30
+// everywhere else should not be shown 6:30 PM here.
+
+import QtQuick
+import qs.config
+import qs.services
+
+SliderRow {
+    id: root
+
+    // SliderRow renders `unit` after the number; a time needs the whole readout
+    // replaced, so the formatting is done here instead.
+    function display(value: real): string {
+        const hour = Math.floor(value);
+        const minute = Math.round((value - hour) * 60);
+        const padded = String(minute).padStart(2, "0");
+
+        if (Settings.use24Hour)
+            return `${String(hour).padStart(2, "0")}:${padded}`;
+
+        const suffix = hour < 12 ? "AM" : "PM";
+        const twelve = hour % 12 === 0 ? 12 : hour % 12;
+        return `${twelve}:${padded} ${suffix}`;
+    }
+}

config/dot/quickshell/modules/settings/WifiPanel.qml

@@ -0,0 +1,177 @@
+// Wi-Fi, at page size.
+//
+// The quick settings version is a popover: a compact list you glance at. This
+// is the one you sit in front of when a network is not behaving, so each row
+// carries what you would otherwise open a terminal to find out — signal,
+// security, and whether it is a network this machine already knows.
+//
+// Joining a secured network reveals an inline password field rather than
+// failing silently, which is the one interaction the popover already got right
+// and is worth keeping identical.
+
+import QtQuick
+import Quickshell
+import Quickshell.Networking
+import qs.config
+import qs.services
+import qs.widgets
+
+Column {
+    id: root
+
+    spacing: 0
+
+    // SSID whose password field is open, and the last failure.
+    property string passwordFor: ""
+    property string failedSsid: ""
+    property string failedText: ""
+
+    function activate(network: var): void {
+        root.failedSsid = "";
+        if (network.connected)
+            return;
+        if (network.known || !Connectivity.isSecured(network)) {
+            root.passwordFor = "";
+            network.connect();
+            return;
+        }
+        root.passwordFor = root.passwordFor === network.name ? "" : network.name;
+    }
+
+    Repeater {
+        model: Connectivity.networks
+
+        Column {
+            id: entry
+
+            required property var modelData
+            required property int index
+
+            width: parent.width
+
+            SettingRow {
+                width: parent.width
+
+                label: entry.modelData.name || "Hidden network"
+                detail: {
+                    const bits = [];
+                    if (entry.modelData.connected)
+                        bits.push("Connected");
+                    else if (entry.modelData.known)
+                        bits.push("Saved");
+                    bits.push(Connectivity.signalLabel(entry.modelData.signalStrength));
+                    bits.push(Connectivity.securityLabel(entry.modelData));
+                    return bits.join(" · ");
+                }
+                divider: entry.index < Connectivity.networks.length - 1 || root.passwordFor === entry.modelData.name
+                controlWidth: 190
+                activatable: !entry.modelData.connected
+                onActivated: root.activate(entry.modelData)
+
+                Row {
+                    anchors.right: parent.right
+                    anchors.verticalCenter: parent.verticalCenter
+                    spacing: 7
+
+                    Text {
+                        anchors.verticalCenter: parent.verticalCenter
+                        visible: entry.modelData.connected
+                        text: "Connected"
+                        color: Theme.accent
+                        font.family: Theme.fontFamily
+                        font.pixelSize: Theme.fontSize
+                        font.weight: Font.DemiBold
+                    }
+
+                    SettingsButton {
+                        anchors.verticalCenter: parent.verticalCenter
+                        visible: entry.modelData.connected
+                        text: "Disconnect"
+                        onClicked: entry.modelData.disconnect()
+                    }
+
+                    SettingsButton {
+                        anchors.verticalCenter: parent.verticalCenter
+                        visible: !entry.modelData.connected
+                        text: entry.modelData.known ? "Connect" : "Join"
+                        onClicked: root.activate(entry.modelData)
+                    }
+                }
+            }
+
+            // The password field for this network, when it is the one being
+            // joined. Inline rather than a dialog: a dialog over a tiled window
+            // is a worse place to type than the row you just clicked.
+            Item {
+                width: parent.width
+                height: root.passwordFor === entry.modelData.name ? 54 : 0
+                visible: height > 0
+                clip: true
+
+                onVisibleChanged: {
+                    if (visible)
+                        password.grab();
+                    else
+                        password.clear();
+                }
+
+                PasswordField {
+                    id: password
+                    anchors.left: parent.left
+                    anchors.right: joinButton.left
+                    anchors.rightMargin: 8
+                    anchors.verticalCenter: parent.verticalCenter
+                    placeholder: "Password for " + (entry.modelData.name || "network")
+                    onAccepted: joinButton.join()
+                }
+
+                SettingsButton {
+                    id: joinButton
+                    anchors.right: parent.right
+                    anchors.verticalCenter: parent.verticalCenter
+                    text: "Join"
+
+                    function join(): void {
+                        entry.modelData.connect(password.text);
+                        root.passwordFor = "";
+                        password.text = "";
+                    }
+
+                    onClicked: joinButton.join()
+                }
+            }
+
+            Text {
+                width: parent.width
+                visible: root.failedSsid === entry.modelData.name
+                leftPadding: 2
+                bottomPadding: 8
+                text: root.failedText
+                color: Theme.warn
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+            }
+
+            Connections {
+                target: entry.modelData
+                function onConnectionFailed(reason): void {
+                    root.failedSsid = entry.modelData.name;
+                    root.failedText = Connectivity.connectionFailureText(reason);
+                    root.passwordFor = entry.modelData.name;
+                }
+            }
+        }
+    }
+
+    SettingRow {
+        width: parent.width
+        visible: Connectivity.networks.length === 0
+        label: !Connectivity.wifiDevice
+            ? "No Wi-Fi adapter"
+            : (Connectivity.wifiEnabled ? "Looking for networks…" : "Wi-Fi is off")
+        detail: Connectivity.wifiDevice && !Connectivity.wifiEnabled
+            ? "Turn it on above to see what is nearby"
+            : ""
+        divider: false
+    }
+}

config/dot/quickshell/modules/settings/qmldir

@@ -35,3 +35,12 @@ ApplicationsPage 1.0 ApplicationsPage.qml
 DockPinsEditor 1.0 DockPinsEditor.qml
 DockAppPicker 1.0 DockAppPicker.qml
 ShortcutCapture 1.0 ShortcutCapture.qml
+ChoiceGrid 1.0 ChoiceGrid.qml
+DisplayModePicker 1.0 DisplayModePicker.qml
+WifiPanel 1.0 WifiPanel.qml
+BluetoothPanel 1.0 BluetoothPanel.qml
+PasswordField 1.0 PasswordField.qml
+AudioBalance 1.0 AudioBalance.qml
+SoundDeviceList 1.0 SoundDeviceList.qml
+SoundDeviceRow 1.0 SoundDeviceRow.qml
+TimeOfDayRow 1.0 TimeOfDayRow.qml

config/dot/quickshell/scripts/panama-home-assistant

@@ -192,8 +192,17 @@ def resolve_config(
     env: Mapping[str, str] | None = None,
     legacy: Callable[[], Config] = load_legacy_config,
 ) -> Config:
+    # An explicitly supplied environment is the WHOLE environment. Reading the
+    # user's private env file underneath it makes callers -- tests especially --
+    # depend on whatever happens to be in that file: adding a real
+    # PANAMA_HOME_ASSISTANT_ENTITIES to it silently overrode a fixture that was
+    # asserting the legacy fallback. Production passes env=None and still gets
+    # the file.
+    if env is None:
         private_env = read_panama_env()
-    private_env.update(dict(os.environ if env is None else env))
+        private_env.update(dict(os.environ))
+    else:
+        private_env = dict(env)
 
     url_value = private_env.get("PANAMA_HOME_ASSISTANT_URL", "").strip()
     token_value = private_env.get("PANAMA_HOME_ASSISTANT_TOKEN", "").strip()

config/dot/quickshell/scripts/panama-home-assistant-config

@@ -0,0 +1,255 @@
+#!/usr/bin/env python3
+
+"""Read and atomically update Panama's private Home Assistant settings.
+
+Secret values are accepted only as a single JSON object on stdin and are never
+returned. The command line therefore remains safe to inspect with ps(1).
+"""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import pathlib
+import re
+import shlex
+import sys
+import tempfile
+import urllib.parse
+from collections.abc import Mapping, Sequence
+from typing import Any
+
+
+KEY_URL = "PANAMA_HOME_ASSISTANT_URL"
+KEY_TOKEN = "PANAMA_HOME_ASSISTANT_TOKEN"
+KEY_ENTITIES = "PANAMA_HOME_ASSISTANT_ENTITIES"
+TARGET_KEYS = (KEY_URL, KEY_TOKEN, KEY_ENTITIES)
+ASSIGNMENT = re.compile(
+    r"^(?P<prefix>\s*(?:export\s+)?)(?P<key>[A-Za-z_][A-Za-z0-9_]*)\s*=(?P<value>.*)$"
+)
+ENTITY_ID = re.compile(r"^[a-z_]+\.[a-z0-9_]+$")
+DEFAULT_ENV = pathlib.Path(__file__).resolve().parents[3] / "bash/env"
+
+
+class ConfigError(RuntimeError):
+    """An error code safe to display without including submitted values."""
+
+
+def env_path() -> pathlib.Path:
+    override = os.environ.get("PANAMA_HOME_ASSISTANT_ENV_FILE", "")
+    return pathlib.Path(override) if override else DEFAULT_ENV
+
+
+def parse_assignment(raw: str) -> str | None:
+    try:
+        parsed = shlex.split(raw, comments=True, posix=True)
+    except ValueError:
+        return None
+    return parsed[0] if len(parsed) == 1 else None
+
+
+def read_values(path: pathlib.Path) -> dict[str, str]:
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except FileNotFoundError:
+        return {}
+    except OSError as error:
+        raise ConfigError("read-failed") from error
+
+    values: dict[str, str] = {}
+    for line in lines:
+        match = ASSIGNMENT.match(line)
+        if not match or match.group("key") not in TARGET_KEYS:
+            continue
+        value = parse_assignment(match.group("value"))
+        if value is not None:
+            values[match.group("key")] = value
+    return values
+
+
+def normalize_url(value: Any) -> str:
+    if not isinstance(value, str):
+        raise ConfigError("invalid-url")
+    normalized = value.strip().rstrip("/")
+    if not normalized:
+        return ""
+    parsed = urllib.parse.urlsplit(normalized)
+    if (
+        parsed.scheme not in {"http", "https"}
+        or not parsed.hostname
+        or parsed.username
+        or parsed.password
+    ):
+        raise ConfigError("invalid-url")
+    return normalized
+
+
+def normalize_token(value: Any) -> str:
+    if not isinstance(value, str) or "\x00" in value or "\n" in value or "\r" in value:
+        raise ConfigError("invalid-token")
+    return value.strip()
+
+
+def normalize_entities(value: Any) -> tuple[str, ...]:
+    if isinstance(value, str):
+        candidates: Sequence[Any] = re.split(r"[,\n]", value)
+    elif isinstance(value, list):
+        candidates = value
+    else:
+        raise ConfigError("invalid-entities")
+
+    entities: list[str] = []
+    for candidate in candidates:
+        if not isinstance(candidate, str):
+            raise ConfigError("invalid-entities")
+        entity_id = candidate.strip()
+        if not entity_id:
+            continue
+        if not ENTITY_ID.fullmatch(entity_id):
+            raise ConfigError("invalid-entities")
+        if entity_id not in entities:
+            entities.append(entity_id)
+    return tuple(entities)
+
+
+def public_state(values: Mapping[str, str]) -> dict[str, object]:
+    try:
+        url = normalize_url(values.get(KEY_URL, ""))
+        entities = list(normalize_entities(values.get(KEY_ENTITIES, "")))
+        error = ""
+    except ConfigError as config_error:
+        url = ""
+        entities = []
+        error = str(config_error)
+    token_configured = bool(values.get(KEY_TOKEN, "").strip())
+    return {
+        "ok": error == "",
+        "configured": bool(url and token_configured),
+        "tokenConfigured": token_configured,
+        "url": url,
+        "entities": entities,
+        "error": error,
+    }
+
+
+def render_updated(original: str, updates: Mapping[str, str]) -> str:
+    lines = original.splitlines(keepends=True)
+    rendered: list[str] = []
+    replaced: set[str] = set()
+
+    for line in lines:
+        content = line.rstrip("\r\n")
+        ending = line[len(content) :]
+        match = ASSIGNMENT.match(content)
+        key = match.group("key") if match else ""
+        if key not in updates:
+            rendered.append(line)
+            continue
+        if key in replaced:
+            continue
+        rendered.append(f"export {key}={shlex.quote(updates[key])}{ending or os.linesep}")
+        replaced.add(key)
+
+    if rendered and not rendered[-1].endswith(("\n", "\r")):
+        rendered[-1] += os.linesep
+    for key in TARGET_KEYS:
+        if key in updates and key not in replaced:
+            rendered.append(f"export {key}={shlex.quote(updates[key])}{os.linesep}")
+    return "".join(rendered)
+
+
+def atomic_write(path: pathlib.Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary_name = tempfile.mkstemp(prefix=".env.", dir=path.parent)
+    temporary = pathlib.Path(temporary_name)
+    try:
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+            stream.write(text)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
+        os.chmod(path, 0o600)
+        directory_fd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory_fd)
+        finally:
+            os.close(directory_fd)
+    finally:
+        try:
+            temporary.unlink()
+        except FileNotFoundError:
+            pass
+
+
+def read_payload() -> dict[str, Any]:
+    line = sys.stdin.buffer.readline(1_048_577)
+    if not line or len(line) > 1_048_576:
+        raise ConfigError("invalid-payload")
+    try:
+        payload = json.loads(line)
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise ConfigError("invalid-payload") from error
+    if not isinstance(payload, dict):
+        raise ConfigError("invalid-payload")
+    return payload
+
+
+def write_payload(path: pathlib.Path, payload: Mapping[str, Any]) -> dict[str, object]:
+    allowed = {"url", "token", "entities"}
+    if not set(payload).issubset(allowed) or not payload:
+        raise ConfigError("invalid-payload")
+
+    updates: dict[str, str] = {}
+    if "url" in payload:
+        updates[KEY_URL] = normalize_url(payload["url"])
+    if "token" in payload:
+        updates[KEY_TOKEN] = normalize_token(payload["token"])
+    if "entities" in payload:
+        updates[KEY_ENTITIES] = ",".join(normalize_entities(payload["entities"]))
+
+    lock_path = path.with_name("." + path.name + ".lock")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    lock_fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        os.fchmod(lock_fd, 0o600)
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            original = path.read_text(encoding="utf-8")
+        except FileNotFoundError:
+            original = ""
+        except OSError as error:
+            raise ConfigError("read-failed") from error
+        atomic_write(path, render_updated(original, updates))
+    finally:
+        os.close(lock_fd)
+
+    result = public_state(read_values(path))
+    result["ok"] = True
+    result["error"] = ""
+    return result
+
+
+def compact_json(value: Mapping[str, object]) -> str:
+    return json.dumps(value, separators=(",", ":"))
+
+
+def main() -> None:
+    command = sys.argv[1] if len(sys.argv) > 1 else "status"
+    if len(sys.argv) > 2 or command not in {"status", "write"}:
+        raise ConfigError("usage")
+    path = env_path()
+    result = public_state(read_values(path)) if command == "status" else write_payload(path, read_payload())
+    print(compact_json(result))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except ConfigError as error:
+        print(compact_json({"ok": False, "error": str(error)}))
+        raise SystemExit(1) from error
+    except OSError:
+        print(compact_json({"ok": False, "error": "write-failed"}))
+        raise SystemExit(1)

config/dot/quickshell/scripts/panama-settings-backup

@@ -572,6 +572,28 @@ def command_restore(arguments: list[str]) -> None:
         home_present = False
         home_data = None
 
+    # Display geometry is never restored from a snapshot. Applying it requires
+    # the visible confirmation/recovery flow in Displays.qml; a settings-file
+    # restore followed by `hyprctl reload` must not bypass that safety boundary.
+    # Preserve the currently confirmed generation when it is readable, and
+    # otherwise remove the snapshot's geometry so startup uses shipped policy.
+    try:
+        current_desktop = read_json(SETTINGS, "The current settings file") \
+            if is_present(SETTINGS) else {}
+    except BackupError:
+        current_desktop = {}
+
+    if isinstance(current_desktop, dict) and "displays" in current_desktop:
+        # Even a Home-only snapshot must retain the confirmed monitor layout.
+        # In that case the restored desktop file contains only the protected
+        # geometry; every ordinary desktop preference remains absent/default.
+        desktop_present = True
+        desktop_data = dict(desktop_data) if desktop_data is not None else {}
+        desktop_data["displays"] = current_desktop["displays"]
+    elif desktop_present and desktop_data is not None:
+        desktop_data = dict(desktop_data)
+        desktop_data.pop("displays", None)
+
     # Restoring remains undoable, but a corrupt current file must not prevent a
     # known-good snapshot from recovering the desktop.
     save_snapshot(require_any=False, validate=False)

config/dot/quickshell/services/AudioDevices.qml

@@ -0,0 +1,43 @@
+pragma Singleton
+
+// Shared PipeWire device discovery and default selection. Quick Settings and
+// Panama Settings intentionally use this same boundary so they cannot disagree
+// about what counts as an input or which node should become the default.
+
+import Quickshell
+import Quickshell.Services.Pipewire
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property var outputs: Pipewire.nodes.values.filter(node =>
+        !node.isStream && node.isSink)
+
+    readonly property var inputs: Pipewire.nodes.values.filter(node =>
+        !node.isStream
+        && (node.type & PwNodeType.AudioSource) === PwNodeType.AudioSource)
+
+    function nodes(output: bool): var {
+        return output ? root.outputs : root.inputs;
+    }
+
+    function current(output: bool): var {
+        return output ? Pipewire.defaultAudioSink : Pipewire.defaultAudioSource;
+    }
+
+    function select(output: bool, node: var): void {
+        if (!node)
+            return;
+        if (output)
+            Pipewire.preferredDefaultAudioSink = node;
+        else
+            Pipewire.preferredDefaultAudioSource = node;
+    }
+
+    function label(node: var): string {
+        if (!node)
+            return "Unknown device";
+        return node.description || node.nickname || node.name || "Unknown device";
+    }
+}

config/dot/quickshell/services/Connectivity.qml

@@ -0,0 +1,144 @@
+pragma Singleton
+
+// Network and Bluetooth state for the settings page.
+//
+// The hard parts -- scanning, joining, pairing -- already work in the quick
+// settings panel through Quickshell.Networking and Quickshell.Bluetooth, which
+// speak to NetworkManager and BlueZ over DBus. Nothing here shells out to nmcli
+// or bluetoothctl, and nothing should: the founding requirement for this
+// desktop was never having to drop to a terminal to join a network.
+//
+// This exists so the page does not have to reach into those modules for the
+// same derived values the panel already computes, and so scanning is driven by
+// whether the page is actually on screen. Scanning while nobody is looking is
+// radio time and battery spent on a list that is not being read.
+
+import Quickshell
+import Quickshell.Networking
+import Quickshell.Bluetooth
+import QtQuick
+
+Singleton {
+    id: root
+
+    // Set by the page while it is visible; drives both scanners.
+    property bool active: false
+
+    readonly property var wifiDevice: {
+        for (const device of Networking.devices.values) {
+            if (device.type === DeviceType.Wifi)
+                return device;
+        }
+        return null;
+    }
+
+    readonly property var wiredDevice: {
+        for (const device of Networking.devices.values) {
+            if (device.type === DeviceType.Wired)
+                return device;
+        }
+        return null;
+    }
+
+    readonly property var adapter: Bluetooth.defaultAdapter
+
+    readonly property bool wifiEnabled: Networking.wifiEnabled
+    readonly property bool wifiAvailable: Networking.wifiHardwareEnabled
+
+    // Current network, then saved, then by signal -- the order GNOME uses,
+    // which is the order you actually look for things in.
+    readonly property var networks: {
+        if (!root.wifiDevice || !root.wifiDevice.networks)
+            return [];
+        const list = root.wifiDevice.networks.values.slice();
+        list.sort((a, b) => {
+            if (a.connected !== b.connected)
+                return a.connected ? -1 : 1;
+            if (a.known !== b.known)
+                return a.known ? -1 : 1;
+            return b.signalStrength - a.signalStrength;
+        });
+        return list;
+    }
+
+    readonly property var savedNetworks: root.networks.filter(network => network.known)
+
+    readonly property var bluetoothDevices: {
+        if (!Bluetooth.devices)
+            return [];
+        const list = Bluetooth.devices.values.slice();
+        list.sort((a, b) => {
+            if (a.connected !== b.connected)
+                return a.connected ? -1 : 1;
+            if (a.paired !== b.paired)
+                return a.paired ? -1 : 1;
+            return String(a.name || "").localeCompare(String(b.name || ""));
+        });
+        return list;
+    }
+
+    readonly property var activeNetwork: root.networks.find(network => network.connected) ?? null
+
+    function isSecured(network: var): bool {
+        return network.security !== WifiSecurityType.Open
+            && network.security !== WifiSecurityType.Owe
+            && network.security !== WifiSecurityType.Unknown;
+    }
+
+    function securityLabel(network: var): string {
+        if (!root.isSecured(network))
+            return "Open";
+        switch (network.security) {
+        case WifiSecurityType.Wep: return "WEP";
+        case WifiSecurityType.Wpa: return "WPA";
+        case WifiSecurityType.Wpa2: return "WPA2";
+        case WifiSecurityType.Wpa3: return "WPA3";
+        case WifiSecurityType.Enterprise: return "Enterprise";
+        }
+        return "Secured";
+    }
+
+    // Four bars is what people read signal as, so bucket rather than showing a
+    // percentage that changes every scan and means nothing to anyone.
+    //
+    // signalStrength is 0.0-1.0, NOT a percentage. Treating it as 0-100 puts
+    // every network including the connected one in the bottom bucket, which is
+    // exactly as useless as showing nothing. Thresholds match the icon buckets
+    // in modules/quicksettings/WifiList.qml so the two never disagree.
+    function signalLabel(strength: real): string {
+        if (strength >= 0.8) return "Excellent";
+        if (strength >= 0.55) return "Good";
+        if (strength >= 0.3) return "Fair";
+        if (strength > 0.05) return "Weak";
+        return "No signal";
+    }
+
+    function connectionFailureText(reason: var): string {
+        switch (reason) {
+        case ConnectionFailReason.WifiAuthTimeout:
+        case ConnectionFailReason.Authentication:
+            return "Wrong password";
+        case ConnectionFailReason.WifiNetworkLost:
+            return "Network out of range";
+        }
+        return "Could not connect";
+    }
+
+    // Scanning follows visibility. NetworkManager keeps scanning as long as it
+    // is asked to, and Bluetooth discovery is worse -- it holds the radio.
+    function syncScanners(): void {
+        if (root.wifiDevice)
+            root.wifiDevice.scannerEnabled = root.active && root.wifiEnabled;
+
+        if (root.adapter && root.adapter.enabled) {
+            const shouldDiscover = root.active;
+            if (root.adapter.discovering !== shouldDiscover)
+                root.adapter.discovering = shouldDiscover;
+        }
+    }
+
+    onActiveChanged: root.syncScanners()
+    onWifiDeviceChanged: root.syncScanners()
+    onWifiEnabledChanged: root.syncScanners()
+    onAdapterChanged: root.syncScanners()
+}

config/dot/quickshell/services/Displays.qml

@@ -0,0 +1,470 @@
+pragma Singleton
+
+// Display configuration: resolution, refresh rate, scale, and rotation.
+//
+// This is the only page in Panama Settings where a wrong value can leave you
+// unable to SEE the screen well enough to undo it. A mode the display cannot
+// show, or a scale that makes everything unreadable, is not recoverable through
+// the same UI that caused it.
+//
+// So a change is never applied irreversibly. It is applied, then reverted
+// automatically after a countdown unless confirmed -- the same contract every
+// desktop uses for this one setting, and for the same reason. Confirming is
+// what writes it to the settings store; letting the countdown run leaves
+// nothing behind.
+//
+// Applied with `hyprctl eval` and hl.monitor{}. As everywhere else in Panama,
+// success means the value was read back from the compositor and matched, never
+// that a command exited zero.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+import qs.config
+
+Singleton {
+    id: root
+
+    // [{ name, description, width, height, refreshRate, scale, transform,
+    //    modes: [{ label, mode, width, height, refresh }] }]
+    property var monitors: []
+    property string lastError: ""
+
+    // Set while a change is applied but not yet confirmed.
+    property string pendingOutput: ""
+    property var pendingPrevious: null
+    property var pendingRequested: null
+    property bool pendingVerified: false
+    property bool revertQueued: false
+    property var revertExpected: null
+    property string revertReason: ""
+    property bool revertVerificationActive: false
+    property int operationGeneration: 0
+    property int revertGeneration: -1
+    property bool externalChangeBlocked: false
+    property int secondsLeft: 0
+
+    readonly property bool awaitingConfirmation: root.pendingOutput !== ""
+    readonly property bool canConfirm: root.awaitingConfirmation
+        && root.pendingVerified
+        && !root.busy
+    readonly property bool busy: query.running || applyRun.running || revertRun.running
+        || root.revertExpected !== null
+
+    readonly property int confirmSeconds: 15
+
+    readonly property var transforms: [
+        { value: 0, label: "Landscape" },
+        { value: 1, label: "Portrait" },
+        { value: 2, label: "Landscape (flipped)" },
+        { value: 3, label: "Portrait (flipped)" }
+    ]
+
+    // Scales that divide this desktop's common resolutions into whole pixels.
+    // Hyprland rejects a fractional scale that does not, and the message it
+    // gives is not something to put in front of a user.
+    readonly property var scales: [1.0, 1.25, 1.5, 1.75, 2.0, 2.5, 3.0]
+
+    Process {
+        id: query
+        property int generation: 0
+        command: ["hyprctl", "-j", "monitors"]
+        stdout: StdioCollector {
+            onStreamFinished: root.parse(this.text, query.generation)
+        }
+        onExited: (exitCode, exitStatus) => {
+            if (exitCode !== 0)
+                root.lastError = "Could not read the connected displays.";
+            if (root.revertQueued && !applyRun.running && root.awaitingConfirmation)
+                root.performRevert();
+        }
+    }
+
+    Process {
+        id: applyRun
+        onExited: (exitCode, exitStatus) => {
+            if (!root.awaitingConfirmation)
+                return;
+            if (root.revertQueued) {
+                if (!query.running)
+                    root.performRevert();
+                return;
+            }
+            if (exitCode !== 0) {
+                root.revertWithMessage("The display rejected that change and Panama restored the previous setting.");
+                return;
+            }
+            verifyTimer.attempts = 0;
+            verifyTimer.ticks = 0;
+            verifyTimer.restart();
+        }
+    }
+
+    Process {
+        id: revertRun
+        onExited: (exitCode, exitStatus) => {
+            // Exit status is advisory only. Hyprland's Lua bridge can report
+            // success without applying a value, so exact readback decides.
+            root.revertVerificationActive = true;
+            revertVerifyTimer.attempts = 0;
+            revertVerifyTimer.ticks = 0;
+            revertVerifyTimer.restart();
+        }
+    }
+
+    Component.onCompleted: root.refresh()
+
+    function refresh(): bool {
+        if (!query.running) {
+            query.generation = root.operationGeneration;
+            query.running = true;
+            return true;
+        }
+        return false;
+    }
+
+    function parse(text: string, generation: int): void {
+        try {
+            const raw = JSON.parse(text);
+            root.monitors = raw.map(monitor => {
+                const modes = root.normaliseModes(monitor.availableModes ?? []);
+                const width = monitor.width ?? 0;
+                const height = monitor.height ?? 0;
+                const refreshRate = monitor.refreshRate ?? 0;
+                const current = modes
+                    .filter(mode => mode.width === width && mode.height === height)
+                    .sort((left, right) =>
+                        Math.abs(left.refresh - refreshRate) - Math.abs(right.refresh - refreshRate))[0];
+                return {
+                    name: monitor.name ?? "",
+                    description: monitor.description ?? monitor.model ?? "Display",
+                    width: width,
+                    height: height,
+                    refreshRate: refreshRate,
+                    mode: current?.mode ?? `${width}x${height}@${refreshRate}`,
+                    scale: monitor.scale ?? 1,
+                    transform: monitor.transform ?? 0,
+                    currentFormat: monitor.currentFormat ?? "",
+                    colorPreset: monitor.colorManagementPreset ?? "",
+                    vrr: monitor.vrr === true,
+                    modes: modes
+                };
+            });
+            if (root.awaitingConfirmation && root.pendingRequested
+                    && root.matchesRequest(root.monitorNamed(root.pendingOutput), root.pendingRequested)) {
+                root.pendingVerified = true;
+                verifyTimer.stop();
+                root.lastError = "";
+            } else if (root.revertVerificationActive
+                    && generation === root.revertGeneration
+                    && root.revertExpected
+                    && root.matchesRequest(root.monitorNamed(root.revertExpected.output), root.revertExpected)) {
+                revertVerifyTimer.stop();
+                root.revertVerificationActive = false;
+                root.revertGeneration = -1;
+                root.revertExpected = null;
+                if (root.revertReason === "")
+                    root.lastError = "";
+                else
+                    root.lastError = root.revertReason;
+                root.revertReason = "";
+            } else if (!root.awaitingConfirmation && !root.revertExpected && (
+                    root.lastError === "Could not read the connected displays."
+                    || root.lastError === "The display list could not be read.")) {
+                root.lastError = "";
+            }
+        } catch (error) {
+            root.lastError = "The display list could not be read.";
+        }
+    }
+
+    // "[email protected]" -> a sortable record. The compositor reports the same
+    // resolution at distinct rates such as 60.00 and 59.94. Those identities
+    // remain separate because confirmation and recovery must read back the
+    // exact mode the user chose, even when their rounded labels look similar.
+    function normaliseModes(raw: var): var {
+        const seen = {};
+        const out = [];
+        for (const entry of raw) {
+            const match = String(entry).match(/^(\d+)x(\d+)@([\d.]+)Hz$/);
+            if (!match)
+                continue;
+            const width = Number(match[1]);
+            const height = Number(match[2]);
+            const refreshText = match[3];
+            const refresh = Number(refreshText);
+            const roundedRefresh = Math.round(refresh);
+            const key = `${width}x${height}@${refreshText}`;
+            if (seen[key])
+                continue;
+            seen[key] = true;
+            out.push({
+                label: `${width} × ${height}`,
+                refreshLabel: Math.abs(refresh - roundedRefresh) < 0.005
+                    ? `${roundedRefresh} Hz`
+                    : `${refresh.toFixed(2)} Hz`,
+                mode: `${width}x${height}@${refreshText}`,
+                width: width,
+                height: height,
+                refresh: refresh
+            });
+        }
+        return out.sort((a, b) => (b.width * b.height) - (a.width * a.height) || b.refresh - a.refresh);
+    }
+
+    function monitorNamed(name: string): var {
+        return root.monitors.find(monitor => monitor.name === name) ?? null;
+    }
+
+    function modeParts(mode: string): var {
+        const match = String(mode).match(/^(\d+)x(\d+)@(\d+(?:\.\d+)?)$/);
+        if (!match)
+            return null;
+        return {
+            width: Number(match[1]),
+            height: Number(match[2]),
+            refresh: Number(match[3])
+        };
+    }
+
+    function isScaleClean(mode: string, scale: real): bool {
+        const parts = root.modeParts(mode);
+        if (!parts || root.scales.indexOf(scale) < 0 || !Number.isFinite(scale) || scale <= 0)
+            return false;
+        const logicalWidth = parts.width / scale;
+        const logicalHeight = parts.height / scale;
+        return Math.abs(logicalWidth - Math.round(logicalWidth)) < 0.0001
+            && Math.abs(logicalHeight - Math.round(logicalHeight)) < 0.0001;
+    }
+
+    function scalesForMode(mode: string): var {
+        return root.scales.filter(scale => root.isScaleClean(mode, scale));
+    }
+
+    function nearestCleanScale(mode: string, preferred: real): real {
+        const choices = root.scalesForMode(mode);
+        if (choices.length === 0)
+            return 1.0;
+        return choices.reduce((best, candidate) =>
+            Math.abs(candidate - preferred) < Math.abs(best - preferred) ? candidate : best,
+            choices[0]);
+    }
+
+    function matchesRequest(monitor: var, requested: var): bool {
+        if (!monitor || !requested || monitor.name !== requested.output)
+            return false;
+        const parts = root.modeParts(requested.mode);
+        return !!parts
+            && monitor.width === parts.width
+            && monitor.height === parts.height
+            && Math.abs(monitor.refreshRate - parts.refresh) < 0.01
+            && Math.abs(monitor.scale - requested.scale) < 0.001
+            && monitor.transform === requested.transform;
+    }
+
+    function modeIsCurrent(monitor: var, candidate: var): bool {
+        return !!monitor && !!candidate
+            && monitor.width === candidate.width
+            && monitor.height === candidate.height
+            && Math.abs(monitor.refreshRate - candidate.refresh) < 0.01;
+    }
+
+    // Applies immediately and starts the countdown. Nothing is stored yet: the
+    // settings file is only written by confirm().
+    function apply(output: string, mode: string, scale: real, transform: int): bool {
+        if (root.externalChangeBlocked) {
+            root.lastError = "Wait for Settings to finish restoring before changing a display.";
+            return false;
+        }
+        if (root.busy) {
+            root.lastError = "Wait for the current display operation to finish.";
+            return false;
+        }
+        if (root.awaitingConfirmation) {
+            root.lastError = "Finish the current display change first.";
+            return false;
+        }
+        const monitor = root.monitorNamed(output);
+        if (!monitor) {
+            root.lastError = "That display is not connected.";
+            return false;
+        }
+        if (!monitor.modes.some(candidate => candidate.mode === mode)) {
+            root.lastError = "That display does not offer that mode.";
+            return false;
+        }
+        if (!root.isScaleClean(mode, scale)) {
+            root.lastError = "That scale does not divide this resolution cleanly.";
+            return false;
+        }
+        if (!root.transforms.some(candidate => candidate.value === transform)) {
+            root.lastError = "That rotation is not one Panama offers.";
+            return false;
+        }
+
+        root.pendingPrevious = {
+            output: output,
+            mode: monitor.mode,
+            scale: monitor.scale,
+            transform: monitor.transform
+        };
+        root.operationGeneration++;
+        root.pendingRequested = {
+            output: output,
+            mode: mode,
+            scale: scale,
+            transform: transform
+        };
+        root.pendingOutput = output;
+        root.pendingVerified = false;
+        root.revertQueued = false;
+        root.secondsLeft = root.confirmSeconds;
+        root.lastError = "";
+        countdown.restart();
+
+        root.push(output, mode, scale, transform);
+        return true;
+    }
+
+    function push(output: string, mode: string, scale: real, transform: int): void {
+        // Values are validated above and the output name comes from the
+        // compositor's own list, so nothing user-authored reaches the payload.
+        applyRun.exec(["hyprctl", "eval",
+            `hl.monitor({ output = "${output}", mode = "${mode}", scale = ${scale}, transform = ${transform} })`]);
+    }
+
+    function confirm(): bool {
+        if (!root.canConfirm || !root.matchesRequest(
+                root.monitorNamed(root.pendingOutput), root.pendingRequested)) {
+            if (root.awaitingConfirmation)
+                root.lastError = "Wait for the display to finish applying before keeping it.";
+            return false;
+        }
+
+        const stored = DesktopPreferences.get("displays");
+        const next = Object.assign({}, (stored && typeof stored === "object") ? stored : {});
+        next[root.pendingOutput] = {
+            mode: root.pendingRequested.mode,
+            scale: root.pendingRequested.scale,
+            transform: root.pendingRequested.transform
+        };
+        if (!DesktopPreferences.set("displays", next)) {
+            root.lastError = "That display setting could not be saved. Revert it and try again.";
+            return false;
+        }
+
+        root.clearPending();
+        root.lastError = "";
+        return true;
+    }
+
+    function clearPending(): void {
+        countdown.stop();
+        verifyTimer.stop();
+        root.pendingOutput = "";
+        root.pendingPrevious = null;
+        root.pendingRequested = null;
+        root.pendingVerified = false;
+        root.revertQueued = false;
+        root.secondsLeft = 0;
+    }
+
+    function revert(): void {
+        root.revertWithMessage("");
+    }
+
+    function revertWithMessage(message: string): void {
+        if (!root.awaitingConfirmation)
+            return;
+        countdown.stop();
+        verifyTimer.stop();
+        root.pendingVerified = false;
+        root.revertReason = message;
+        if (message !== "")
+            root.lastError = message;
+        if (applyRun.running || query.running) {
+            root.revertQueued = true;
+            return;
+        }
+        root.performRevert();
+    }
+
+    function performRevert(): void {
+        const previous = root.pendingPrevious;
+        root.operationGeneration++;
+        root.revertGeneration = root.operationGeneration;
+        root.revertExpected = previous;
+        root.revertVerificationActive = false;
+        root.clearPending();
+        if (previous) {
+            revertRun.exec(["hyprctl", "eval",
+                `hl.monitor({ output = "${previous.output}", mode = "${previous.mode}", scale = ${previous.scale}, transform = ${previous.transform} })`]);
+        }
+    }
+
+    // Clears any stored override for an output so it returns to the value
+    // shipped in hypr/monitors.lua on the next start.
+    function forget(output: string): void {
+        const stored = DesktopPreferences.get("displays");
+        if (!stored || typeof stored !== "object" || stored[output] === undefined)
+            return;
+        const next = Object.assign({}, stored);
+        delete next[output];
+        DesktopPreferences.set("displays", next);
+    }
+
+    function isOverridden(output: string): bool {
+        const stored = DesktopPreferences.get("displays");
+        return !!(stored && typeof stored === "object" && stored[output] !== undefined);
+    }
+
+    Timer {
+        id: verifyTimer
+        property int attempts: 0
+        property int ticks: 0
+        interval: 120
+        repeat: true
+        onTriggered: {
+            ticks++;
+            if (ticks > 50) {
+                root.revertWithMessage("The display did not apply that setting, so Panama restored the previous one.");
+                return;
+            }
+            if (root.refresh())
+                attempts++;
+        }
+    }
+
+    Timer {
+        id: revertVerifyTimer
+        property int attempts: 0
+        property int ticks: 0
+        interval: 120
+        repeat: true
+        onTriggered: {
+            ticks++;
+            if (ticks > 50) {
+                stop();
+                root.revertVerificationActive = false;
+                root.revertGeneration = -1;
+                root.revertExpected = null;
+                root.revertReason = "";
+                root.lastError = "The previous display setting could not be verified. Open Displays and restore it manually.";
+                return;
+            }
+            if (root.refresh())
+                attempts++;
+        }
+    }
+
+    Timer {
+        id: countdown
+        interval: 1000
+        repeat: true
+        onTriggered: {
+            root.secondsLeft -= 1;
+            if (root.secondsLeft <= 0)
+                root.revert();
+        }
+    }
+}

config/dot/quickshell/services/HomeAssistantConfig.qml

@@ -0,0 +1,120 @@
+pragma Singleton
+
+// Redacted Home Assistant configuration state. The helper is the only object
+// that touches the private env file; QML never receives the stored token.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    readonly property string helperPath: Quickshell.shellDir + "/scripts/panama-home-assistant-config"
+
+    property string url: ""
+    property var entities: []
+    property bool tokenConfigured: false
+    property bool configured: false
+    property string lastError: ""
+    property string pendingPayload: ""
+    property var refreshHomeAssistant: function() { HomeAssistant.refresh(); }
+    readonly property bool busy: statusProc.running || writeProc.running
+
+    signal configurationSaved
+
+    function errorMessage(code: string): string {
+        switch (code) {
+        case "invalid-url": return "Enter an HTTP or HTTPS Home Assistant URL.";
+        case "invalid-token": return "The access token contains unsupported characters.";
+        case "invalid-entities": return "Entity IDs must look like light.living_room.";
+        case "read-failed": return "The private configuration file could not be read.";
+        case "write-failed": return "The private configuration file could not be saved.";
+        case "invalid-payload": return "The configuration could not be validated.";
+        default: return code ? "Home Assistant configuration is unavailable." : "";
+        }
+    }
+
+    function applyResult(text: string, saved: bool): void {
+        let result = null;
+        try {
+            result = JSON.parse(text);
+        } catch (error) {
+            result = { ok: false, error: "invalid-response" };
+        }
+        if (result.ok !== true) {
+            root.lastError = root.errorMessage(String(result.error || "invalid-response"));
+            return;
+        }
+        root.url = String(result.url || "");
+        root.entities = Array.isArray(result.entities) ? result.entities : [];
+        root.tokenConfigured = result.tokenConfigured === true;
+        root.configured = result.configured === true;
+        root.lastError = "";
+        if (saved) {
+            root.configurationSaved();
+            root.refreshHomeAssistant();
+        }
+    }
+
+    function refresh(): void {
+        if (!statusProc.running && !writeProc.running)
+            statusProc.running = true;
+    }
+
+    // An empty token means "keep the stored token". Clearing is an explicit
+    // separate action so editing the URL can never erase a secret by accident.
+    function save(url: string, entitiesText: string, token: string): bool {
+        if (root.busy)
+            return false;
+        const payload = { url: url, entities: entitiesText };
+        if (token.trim() !== "")
+            payload.token = token;
+        return root.startWrite(payload);
+    }
+
+    function clearToken(): bool {
+        if (root.busy || !root.tokenConfigured)
+            return false;
+        return root.startWrite({ token: "" });
+    }
+
+    function startWrite(payload: var): bool {
+        root.lastError = "";
+        root.pendingPayload = JSON.stringify(payload);
+        writeProc.running = true;
+        return true;
+    }
+
+    Process {
+        id: statusProc
+        command: [root.helperPath, "status"]
+        stdout: StdioCollector {
+            onStreamFinished: root.applyResult(this.text, false)
+        }
+        onExited: (code, status) => {
+            if (code !== 0 && root.lastError === "")
+                root.lastError = "Home Assistant configuration could not be loaded.";
+        }
+    }
+
+    Process {
+        id: writeProc
+        command: [root.helperPath, "write"]
+        stdinEnabled: true
+        stdout: StdioCollector {
+            onStreamFinished: root.applyResult(this.text, true)
+        }
+        onStarted: {
+            writeProc.write(root.pendingPayload + "\n");
+            root.pendingPayload = "";
+        }
+        onExited: (code, status) => {
+            root.pendingPayload = "";
+            if (code !== 0 && root.lastError === "")
+                root.lastError = "Home Assistant configuration could not be saved.";
+        }
+    }
+
+    Component.onCompleted: root.refresh()
+}

config/dot/quickshell/services/NightLight.qml

@@ -89,6 +89,34 @@ Singleton {
     onEnabledChanged: DesktopPreferences.set("nightLightEnabled", root.enabled)
     onAutomaticChanged: DesktopPreferences.set("nightLightAutomatic", root.automatic)
 
+    // `enabled`, `temperature`, and `automatic` are declared as bindings on the
+    // store, but a binding is destroyed the moment anything assigns to the
+    // property -- which toggle() does. Without this, the service would write to
+    // the store and never read from it again: Quick Settings would keep working
+    // while the same settings on the Displays page silently did nothing, which
+    // is worse than not offering them there at all.
+    //
+    // No loop: set() is a no-op when the value is unchanged, and assigning a
+    // property its current value emits nothing, so this converges immediately.
+    Connections {
+        target: DesktopPreferences
+        function onRevisionChanged(): void { root.syncFromStore(); }
+    }
+
+    function syncFromStore(): void {
+        const storedEnabled = DesktopPreferences.get("nightLightEnabled") === true;
+        if (root.enabled !== storedEnabled)
+            root.enabled = storedEnabled;
+
+        const storedAutomatic = DesktopPreferences.get("nightLightAutomatic") === true;
+        if (root.automatic !== storedAutomatic)
+            root.automatic = storedAutomatic;
+
+        const storedTemperature = DesktopPreferences.get("nightLightTemperature");
+        if (typeof storedTemperature === "number" && root.temperature !== storedTemperature)
+            root.temperature = storedTemperature;
+    }
+
     onActiveChanged: {
         if (!root.initialized)
             return;

config/dot/quickshell/services/Notifs.qml

@@ -37,6 +37,39 @@ Singleton {
     // Cleared when the notification centre is opened. The bar binds to this.
     property int unreadCount: 0
 
+    // Kept separate from the persisted map so this version can safely run
+    // before the matching schema entry lands. A later accepted write folds the
+    // complete map into DesktopPreferences and clears this fallback.
+    property var fallbackAppRules: ({})
+
+    // Display metadata is intentionally session-only. The durable shape stays
+    // just the per-application rule map, while a fresh notification gives the
+    // settings page a human-readable name straight away.
+    property var rememberedApplications: ({})
+
+    readonly property var persistedAppRules: {
+        const stored = DesktopPreferences.get("notificationAppRules");
+        return stored && typeof stored === "object" && !Array.isArray(stored) ? stored : {};
+    }
+
+    // The schema change is the persistence boundary. This branch keeps a
+    // session fallback only so it remains usable while that companion change
+    // is being integrated; it intentionally makes no restart guarantee then.
+    readonly property bool appRulesSchemaAvailable: PreferenceSchema.has("notificationAppRules")
+
+    readonly property var appRules: Object.assign({}, root.persistedAppRules, root.fallbackAppRules)
+
+    readonly property var applications: {
+        // byId()/heuristicLookup() do not make a binding by themselves. This
+        // read updates persisted app labels once DesktopEntries finishes scan.
+        const entries = DesktopEntries.applications.values;
+        const remembered = root.rememberedApplications;
+        return Object.keys(root.appRules).map(appId => ({
+            id: appId,
+            name: root.applicationLabel(appId, entries, remembered)
+        })).sort((a, b) => a.name.localeCompare(b.name));
+    }
+
     // Arrival times, keyed by notification id — the protocol carries no
     // timestamp. Deliberately formatted once at arrival rather than shown as
     // "5 minutes ago", which would need a clock ticking behind every card.
@@ -49,6 +82,79 @@ Singleton {
 
     readonly property bool hasNotifications: root.history.length > 0
 
+    function notificationAppId(notification: var): string {
+        const desktopEntry = String(notification.desktopEntry ?? "").trim();
+        return desktopEntry || String(notification.appName ?? "").trim() || "Notifications";
+    }
+
+    function applicationLabel(appId: string, entries: var, remembered: var): string {
+        const desktopId = appId.endsWith(".desktop") ? appId.slice(0, -8) : appId;
+        const entry = DesktopEntries.byId(appId)
+            || DesktopEntries.byId(desktopId)
+            || DesktopEntries.heuristicLookup(appId)
+            || DesktopEntries.heuristicLookup(desktopId);
+        return entry?.name || remembered[appId]?.name || appId;
+    }
+
+    function normalizedAppRule(rule: var): var {
+        const source = rule && typeof rule === "object" && !Array.isArray(rule) ? rule : {};
+        return {
+            enabled: source.enabled !== false,
+            showOnLockScreen: source.showOnLockScreen !== false,
+            showContentOnLockScreen: source.showContentOnLockScreen !== false
+        };
+    }
+
+    function appRule(appId: string): var {
+        return root.normalizedAppRule(root.appRules[appId]);
+    }
+
+    function setAppRule(appId: string, patch: var): bool {
+        if (!appId)
+            return false;
+
+        const current = root.appRule(appId);
+        const next = {};
+        for (const knownAppId of Object.keys(root.appRules))
+            next[knownAppId] = root.appRule(knownAppId);
+        next[appId] = {
+            enabled: patch.enabled === undefined ? current.enabled : patch.enabled === true,
+            showOnLockScreen: patch.showOnLockScreen === undefined ? current.showOnLockScreen : patch.showOnLockScreen === true,
+            showContentOnLockScreen: patch.showContentOnLockScreen === undefined ? current.showContentOnLockScreen : patch.showContentOnLockScreen === true
+        };
+
+        if (root.appRulesSchemaAvailable && DesktopPreferences.set("notificationAppRules", next))
+            root.fallbackAppRules = {};
+        else
+            root.fallbackAppRules = next;
+        return true;
+    }
+
+    function rememberApplication(notification: var): string {
+        const appId = root.notificationAppId(notification);
+        const next = Object.assign({}, root.rememberedApplications);
+        next[appId] = {
+            name: String(notification.appName ?? "").trim() || appId
+        };
+        root.rememberedApplications = next;
+
+        if (root.appRules[appId] === undefined)
+            root.setAppRule(appId, {});
+        return appId;
+    }
+
+    // These policy getters deliberately accept Notification objects, so a lock
+    // screen can use the same source of truth without duplicating app matching.
+    function shouldShowOnLockScreen(notification: var): bool {
+        const rule = root.appRule(root.notificationAppId(notification));
+        return rule.enabled && rule.showOnLockScreen;
+    }
+
+    function shouldShowContentOnLockScreen(notification: var): bool {
+        const rule = root.appRule(root.notificationAppId(notification));
+        return rule.enabled && rule.showOnLockScreen && rule.showContentOnLockScreen;
+    }
+
     // history grouped by app, in most-recent-app-first order — the shape
     // NotificationCenter.qml renders directly.
     readonly property var groups: {
@@ -85,13 +191,20 @@ Singleton {
         actionIconsSupported: true
         inlineReplySupported: true
 
-        onNotification: notification => {
+        onNotification: notification => root.handleNotification(notification)
+    }
+
+    function handleNotification(notification: var): void {
             // Replayed from before a shell reload. Letting these through would
             // re-toast and re-list everything on every edit, so they are left
             // untracked and allowed to die.
             if (notification.lastGeneration)
                 return;
 
+            const appId = root.rememberApplication(notification);
+            if (!root.appRule(appId).enabled)
+                return;
+
             // Without this the object is destroyed the instant this returns.
             notification.tracked = true;
             root.arrivals[notification.id] = new Date();
@@ -109,11 +222,10 @@ Singleton {
             if (!root.doNotDisturb)
                 root.popups = [notification].concat(root.popups);
     }
-    }
 
     // ── Mutation ────────────────────────────────────────────────────────────
 
-    function pushHistory(n: Notification): void {
+    function pushHistory(n: var): void {
         const next = [n].concat(root.history);
 
         // Anything past the cap is released, otherwise it stays tracked
@@ -166,7 +278,7 @@ Singleton {
 
     // Called from the `closed` signal — the object is on its way out, so this
     // only ever removes references, never touches the notification.
-    function forget(n: Notification): void {
+    function forget(n: var): void {
         delete root.arrivals[n.id];
         if (root.history.indexOf(n) !== -1)
             root.history = root.history.filter(x => x !== n);

config/dot/quickshell/services/SettingsBackup.qml

@@ -38,6 +38,10 @@ Singleton {
     property var initializeHome: function(ids) { HomePreferences.initialize(ids); }
     property var aliasHome: function(id, alias) { HomePreferences.setAlias(id, alias); }
     property var reloadDesktop: function() { DesktopPreferences.reload(); }
+    property var readDisplays: function() { return DesktopPreferences.get("displays"); }
+    property var protectDisplays: function(value) { return DesktopPreferences.set("displays", value); }
+    property var displayBusy: function() { return Displays.busy || Displays.awaitingConfirmation; }
+    property var setDisplayBlocked: function(blocked) { Displays.externalChangeBlocked = blocked; }
     property var applyCompositor: function() { SystemSettings.applyPersistedDisplayPolicy(); }
     property var reloadKeybinds: function() { Keybinds.applyReload(); }
     property var keybindsReloading: function() { return Keybinds.reloading; }
@@ -47,6 +51,7 @@ Singleton {
     }
     property var applyWallpaper: function(path) { Wallpaper.set(path); }
     property var reloadShell: function() { Quickshell.reload(false); }
+    property var protectedDisplays: ({})
 
     readonly property bool busy: listQuery.running || actionRun.running
         || applyRestoredState.running || settleReload.running
@@ -81,6 +86,10 @@ Singleton {
                 root.lastError = actionRun.restoring
                     ? "That snapshot could not be restored."
                     : "The settings could not be backed up.";
+                if (actionRun.restoring) {
+                    root.setDisplayBlocked(false);
+                    root.protectedDisplays = ({});
+                }
                 return;
             }
             root.lastAction = actionRun.restoring ? "restored" : "saved";
@@ -89,6 +98,10 @@ Singleton {
                 root.lastError = homeReloaded
                     ? ""
                     : "Desktop settings were restored, but Home favourites could not be reloaded.";
+                if (!homeReloaded) {
+                    root.setDisplayBlocked(false);
+                    root.protectedDisplays = ({});
+                }
             } else
                 root.lastError = "";
             root.refresh();
@@ -124,6 +137,8 @@ Singleton {
             // from leaving restored Home state stale indefinitely.
             if ((!root.keybindsReloading() && !root.systemBusy()) || attempts >= 30) {
                 stop();
+                root.setDisplayBlocked(false);
+                root.protectedDisplays = ({});
                 root.reloadShell();
             }
         }
@@ -162,6 +177,8 @@ Singleton {
         if (!root.reloadHomeState(text))
             return false;
         root.reloadDesktop();
+        if (!root.protectDisplays(root.protectedDisplays))
+            return false;
         applyRestoredState.restart();
         return true;
     }
@@ -222,10 +239,18 @@ Singleton {
     function restore(name: string): bool {
         if (actionRun.running)
             return false;
+        if (root.displayBusy()) {
+            root.lastError = "Finish the current display change before restoring settings.";
+            return false;
+        }
         if (!root.snapshots.some(snapshot => snapshot.name === name)) {
             root.lastError = "That snapshot is not in the list.";
             return false;
         }
+        const currentDisplays = root.readDisplays();
+        root.protectedDisplays = JSON.parse(JSON.stringify(
+            currentDisplays && typeof currentDisplays === "object" ? currentDisplays : {}));
+        root.setDisplayBlocked(true);
         actionRun.restoring = true;
         actionRun.exec([root.helperPath, "restore", name]);
         return true;

config/dot/quickshell/services/SettingsSearch.qml

@@ -29,6 +29,7 @@ Singleton {
         "dock": "desktop",
         "focus": "desktop",
         "display": "displays",
+        "nightLight": "displays",
         "idle": "power",
         "accessibility": "accessibility",
         "input": "shortcuts",

config/dot/quickshell/services/SoundFeedback.qml

@@ -0,0 +1,97 @@
+pragma Singleton
+
+// GNOME and GTK applications already honour these desktop sound preferences.
+// Panama controls the same durable keys so moving between sessions does not
+// create two competing notions of whether event feedback is enabled.
+
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+Singleton {
+    id: root
+
+    property bool eventSounds: true
+    property bool inputFeedback: false
+    property string lastError: ""
+    readonly property bool busy: eventRead.running || inputRead.running
+        || eventWrite.running || inputWrite.running
+
+    function parsedBoolean(text: string, fallback: bool): bool {
+        const value = text.trim();
+        if (value === "true")
+            return true;
+        if (value === "false")
+            return false;
+        return fallback;
+    }
+
+    function refresh(): void {
+        if (!eventRead.running)
+            eventRead.running = true;
+        if (!inputRead.running)
+            inputRead.running = true;
+    }
+
+    function setEventSounds(enabled: bool): void {
+        root.eventSounds = enabled;
+        eventWrite.command = ["gsettings", "set", "org.gnome.desktop.sound", "event-sounds", String(enabled)];
+        eventWrite.running = true;
+    }
+
+    function setInputFeedback(enabled: bool): void {
+        root.inputFeedback = enabled;
+        inputWrite.command = ["gsettings", "set", "org.gnome.desktop.sound", "input-feedback-sounds", String(enabled)];
+        inputWrite.running = true;
+    }
+
+    Process {
+        id: eventRead
+        command: ["gsettings", "get", "org.gnome.desktop.sound", "event-sounds"]
+        stdout: StdioCollector {
+            onStreamFinished: root.eventSounds = root.parsedBoolean(this.text, root.eventSounds)
+        }
+        onExited: (code, status) => {
+            if (code !== 0)
+                root.lastError = "Event sound preferences could not be read.";
+        }
+    }
+
+    Process {
+        id: inputRead
+        command: ["gsettings", "get", "org.gnome.desktop.sound", "input-feedback-sounds"]
+        stdout: StdioCollector {
+            onStreamFinished: root.inputFeedback = root.parsedBoolean(this.text, root.inputFeedback)
+        }
+        onExited: (code, status) => {
+            if (code !== 0)
+                root.lastError = "Input feedback preferences could not be read.";
+        }
+    }
+
+    Process {
+        id: eventWrite
+        onExited: (code, status) => {
+            if (code !== 0) {
+                root.lastError = "Event sound preferences could not be changed.";
+                root.refresh();
+            } else {
+                root.lastError = "";
+            }
+        }
+    }
+
+    Process {
+        id: inputWrite
+        onExited: (code, status) => {
+            if (code !== 0) {
+                root.lastError = "Input feedback preferences could not be changed.";
+                root.refresh();
+            } else {
+                root.lastError = "";
+            }
+        }
+    }
+
+    Component.onCompleted: root.refresh()
+}

config/dot/quickshell/services/SystemSettings.qml

@@ -33,6 +33,16 @@ Singleton {
     property string quickshellVersion: "0.3.0"
     property string lastError: ""
 
+    // Explicit seams keep reset sequencing testable without changing the live
+    // keymap, wallpaper, or display from an isolated contract harness.
+    property var displayBusy: function() { return Displays.busy || Displays.awaitingConfirmation; }
+    property var readDisplays: function() { return DesktopPreferences.get("displays"); }
+    property var protectDisplays: function(value) { return DesktopPreferences.set("displays", value); }
+    property var setDisplayBlocked: function(blocked) { Displays.externalChangeBlocked = blocked; }
+    property var reloadKeybinds: function() { Keybinds.applyReload(); }
+    property var keybindsReloading: function() { return Keybinds.reloading; }
+    property var applyWallpaper: function(path) { Wallpaper.set(path); }
+
     readonly property bool busy: monitorQuery.running || serviceQuery.running || versionQuery.running
         || configWrite.running || configVerify.running || bluebubblesQuery.running
 
@@ -196,6 +206,11 @@ Singleton {
     }
 
     // ── Applying options ────────────────────────────────────────────────────
+    // Test harnesses may replace the external compositor boundary while still
+    // exercising validation, commit routing, persistence, and reset replay.
+    // Production leaves this unset and always uses the verified Hyprland path.
+    property var compositorApplyOverride: null
+
     // `values` maps schema keys to values, e.g. { vrrPolicy: 3, gapsOut: 12 }.
     // The whole batch is validated before anything is sent, so one bad value
     // rejects the batch rather than half-applying it.
@@ -217,6 +232,9 @@ Singleton {
         if (Object.keys(requested).length === 0)
             return false;
 
+        if (root.compositorApplyOverride !== null)
+            return root.compositorApplyOverride(requested);
+
         // A write in flight is queued rather than refused. Options are applied
         // and verified one batch at a time, but the callers are a settings UI
         // and a startup replay of every compositor-backed preference -- they
@@ -389,8 +407,22 @@ Singleton {
     //
     // Compositor-backed values are re-applied afterwards, since resetting the
     // stored value does not by itself tell Hyprland anything.
-    function restoreDefaults(): void {
+    function restoreDefaults(): bool {
+        if (root.displayBusy()) {
+            root.lastError = "Finish the current display change before restoring defaults.";
+            return false;
+        }
+
+        const currentDisplays = root.readDisplays();
+        const protectedDisplays = JSON.parse(JSON.stringify(
+            currentDisplays && typeof currentDisplays === "object" ? currentDisplays : {}));
+        root.setDisplayBlocked(true);
         DesktopPreferences.resetDesktopDefaults();
+        if (!root.protectDisplays(protectedDisplays)) {
+            root.setDisplayBlocked(false);
+            root.lastError = "The current display setting could not be protected during reset.";
+            return false;
+        }
 
         // Home accessories keep their own store (panama-home.json), so a reset
         // that only cleared the schema store would silently leave a customised
@@ -401,12 +433,33 @@ Singleton {
         HomePreferences.resetHomeDefaults();
 
         resettleTimer.restart();
+        return true;
     }
 
     Timer {
         id: resettleTimer
         interval: 60
-        onTriggered: root.applyPersistedDisplayPolicy()
+        onTriggered: {
+            root.applyPersistedDisplayPolicy();
+            root.reloadKeybinds();
+            root.applyWallpaper(String(DesktopPreferences.get("wallpaperPath") ?? ""));
+            resetRelease.attempts = 0;
+            resetRelease.restart();
+        }
+    }
+
+    Timer {
+        id: resetRelease
+        property int attempts: 0
+        interval: 100
+        repeat: true
+        onTriggered: {
+            attempts++;
+            if ((!root.keybindsReloading() && !root.busy) || attempts >= 50) {
+                stop();
+                root.setDisplayBlocked(false);
+            }
+        }
     }
 
     function setAutoHdr(enabled: bool): void {

config/dot/quickshell/services/Wallpaper.qml

@@ -33,6 +33,7 @@ Singleton {
     property bool scanning: false
 
     readonly property string configured: DesktopPreferences.get("wallpaperPath")
+    readonly property string shippedPath: `${Quickshell.env("HOME")}/Pictures/Wallpapers/faroe_islands.jpg`
 
     // Directories searched for wallpapers, in order. Screenshots are
     // deliberately excluded: a folder of 300 screenshots is not a wallpaper
@@ -85,6 +86,7 @@ Singleton {
         id: apply
 
         property string requested: ""
+        property string storedValue: ""
         property var remaining: []
 
         onExited: (exitCode, exitStatus) => {
@@ -100,7 +102,7 @@ Singleton {
                 return;
             }
             root.lastError = "";
-            DesktopPreferences.set("wallpaperPath", apply.requested);
+            DesktopPreferences.set("wallpaperPath", apply.storedValue);
             root.refreshActive();
         }
     }
@@ -140,19 +142,16 @@ Singleton {
     // Applies to every connected output. Returns false when the path is not one
     // the schema will accept, so a caller can report the refusal.
     function set(path: string): bool {
-        if (PreferenceSchema.coerce("wallpaperPath", path) === undefined) {
+        const effectivePath = path === "" ? root.shippedPath : path;
+        if (PreferenceSchema.coerce("wallpaperPath", effectivePath) === undefined) {
             root.lastError = "That file path cannot be used as a wallpaper.";
             return false;
         }
         if (apply.running)
             return false;
 
-        apply.requested = path;
-        // "" clears the preference without touching what is on screen.
-        if (path === "") {
-            DesktopPreferences.set("wallpaperPath", "");
-            return true;
-        }
+        apply.requested = effectivePath;
+        apply.storedValue = path;
 
         const outputs = Quickshell.screens.map(screen => screen.name).filter(name => !!name);
         if (outputs.length === 0) {
@@ -161,7 +160,7 @@ Singleton {
         }
 
         apply.remaining = outputs.slice(1);
-        apply.exec(["hyprctl", "hyprpaper", "wallpaper", `${outputs[0]},${path}`]);
+        apply.exec(["hyprctl", "hyprpaper", "wallpaper", `${outputs[0]},${effectivePath}`]);
         return true;
     }
 

config/dot/quickshell/settings-backup-harness.qml

@@ -13,6 +13,9 @@ ShellRoot {
     property var calls: []
     property bool homeInitialized: false
     property var homeFavorites: []
+    property bool displayOperationBusy: false
+    property bool displayBlocked: false
+    property var displayGeneration: ({ "DP-2": { mode: "4500x3000@60", scale: 1.5, transform: 0 } })
 
     function record(name: string): void {
         const next = root.calls.slice();
@@ -43,6 +46,17 @@ ShellRoot {
                 favorite.id === id ? { id: id, alias: alias } : favorite);
         };
         SettingsBackup.reloadDesktop = function() { root.record("desktop.reload"); };
+        SettingsBackup.readDisplays = function() { return root.displayGeneration; };
+        SettingsBackup.protectDisplays = function(value) {
+            root.record("display.protect:" + JSON.stringify(value));
+            root.displayGeneration = value;
+            return true;
+        };
+        SettingsBackup.displayBusy = function() { return root.displayOperationBusy; };
+        SettingsBackup.setDisplayBlocked = function(blocked) {
+            root.record("display.block:" + blocked);
+            root.displayBlocked = blocked;
+        };
         SettingsBackup.applyCompositor = function() { root.record("system.apply"); };
         SettingsBackup.reloadKeybinds = function() { root.record("keybinds.reload"); };
         SettingsBackup.keybindsReloading = function() { return false; };
@@ -59,17 +73,29 @@ ShellRoot {
             root.calls = [];
             root.homeInitialized = false;
             root.homeFavorites = [];
+            root.displayOperationBusy = false;
+            root.displayBlocked = false;
+            SettingsBackup.protectedDisplays = root.displayGeneration;
         }
 
         function apply(output: string): bool {
             return SettingsBackup.handleRestoreOutput(output);
         }
 
+        function restoreWhileDisplayBusy(): bool {
+            root.displayOperationBusy = true;
+            SettingsBackup.snapshots = [{ name: "settings-20260818-010203004.json" }];
+            return SettingsBackup.restore("settings-20260818-010203004.json");
+        }
+
         function status(): string {
             return JSON.stringify({
                 calls: root.calls,
                 initialized: root.homeInitialized,
-                favorites: root.homeFavorites
+                favorites: root.homeFavorites,
+                displayBlocked: root.displayBlocked,
+                displays: root.displayGeneration,
+                lastError: SettingsBackup.lastError
             });
         }
     }

config/dot/quickshell/settings-system-harness.qml

@@ -6,6 +6,48 @@ import qs.config
 import qs.services
 
 ShellRoot {
+    id: root
+
+    property var resetCalls: []
+    property var appliedBatches: []
+    property bool displayBlocked: false
+
+    function recordReset(name: string): void {
+        const next = root.resetCalls.slice();
+        next.push(name);
+        root.resetCalls = next;
+    }
+
+    Component.onCompleted: {
+        // Keep compositor verification entirely inside the isolated harness.
+        // Production applyOptions is covered separately by the Hyprland write
+        // contract; this seam proves commit/reset routing without changing the
+        // desktop that is running the test.
+        if (Quickshell.env("PANAMA_SETTINGS_TEST_ISOLATE_COMPOSITOR") === "1") {
+            SystemSettings.compositorApplyOverride = function(requested) {
+                const batches = root.appliedBatches.slice();
+                batches.push(requested);
+                root.appliedBatches = batches;
+                for (const key in requested)
+                    DesktopPreferences.set(key, requested[key]);
+                return true;
+            };
+        }
+        SystemSettings.displayBusy = function() { return false; };
+        SystemSettings.readDisplays = function() { return DesktopPreferences.get("displays"); };
+        SystemSettings.protectDisplays = function(value) {
+            root.recordReset("display.protect");
+            return DesktopPreferences.set("displays", value);
+        };
+        SystemSettings.setDisplayBlocked = function(blocked) {
+            root.recordReset("display.block:" + blocked);
+            root.displayBlocked = blocked;
+        };
+        SystemSettings.reloadKeybinds = function() { root.recordReset("keybinds.reload"); };
+        SystemSettings.keybindsReloading = function() { return false; };
+        SystemSettings.applyWallpaper = function(path) { root.recordReset("wallpaper.set:" + path); };
+    }
+
     IpcHandler {
         target: "settings-system-test"
 
@@ -52,7 +94,22 @@ ShellRoot {
             });
         }
 
-        function restoreDefaults(): void { SystemSettings.restoreDefaults(); }
+        function restoreDefaults(): bool {
+            root.resetCalls = [];
+            return SystemSettings.restoreDefaults();
+        }
+
+        function resetState(): string {
+            return JSON.stringify({
+                calls: root.resetCalls,
+                displayBlocked: root.displayBlocked,
+                appliedBatches: root.appliedBatches
+            });
+        }
+
+        function applyState(): string {
+            return JSON.stringify(root.appliedBatches);
+        }
 
         function panelAllowed(panel: string): bool {
             return SystemSettings.isGnomePanelAllowed(panel);

config/dot/quickshell/sound-page-harness.qml

@@ -0,0 +1,34 @@
+// Read-only contract harness for the Sound page. It instantiates every device
+// row against the real PipeWire graph but exposes no mutating IPC methods.
+
+import Quickshell
+import Quickshell.Io
+import Quickshell.Services.Pipewire
+import QtQuick
+import qs.services
+import qs.modules.settings
+
+ShellRoot {
+    SoundPage {
+        width: 760
+        height: 900
+    }
+
+    PwObjectTracker {
+        objects: AudioDevices.outputs.concat(AudioDevices.inputs)
+    }
+
+    IpcHandler {
+        target: "sound-page-test"
+
+        function status(): string {
+            return JSON.stringify({
+                ready: Pipewire.ready,
+                outputs: AudioDevices.outputs.length,
+                inputs: AudioDevices.inputs.length,
+                defaultOutput: AudioDevices.label(AudioDevices.current(true)),
+                defaultInput: AudioDevices.label(AudioDevices.current(false))
+            });
+        }
+    }
+}

tests/quickshell/HomeAssistantConfigHarness.qml

@@ -0,0 +1,56 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.services
+
+ShellRoot {
+    id: root
+
+    property int refreshCalls: 0
+
+    FileView {
+        id: tokenFile
+        path: Quickshell.env("PANAMA_TEST_TOKEN_FILE")
+        blockLoading: true
+        printErrors: false
+    }
+
+    Component.onCompleted: {
+        HomeAssistant.fixtureMode = true;
+        HomeAssistantConfig.refreshHomeAssistant = function() { root.refreshCalls++; };
+    }
+
+    IpcHandler {
+        target: "home-assistant-config-test"
+
+        function save(url: string, entities: string): bool {
+            return HomeAssistantConfig.save(url, entities, "");
+        }
+
+        function saveWithToken(url: string, entities: string): bool {
+            return HomeAssistantConfig.save(url, entities, tokenFile.text());
+        }
+
+        function clearToken(): bool {
+            return HomeAssistantConfig.clearToken();
+        }
+
+        function refresh(): void {
+            HomeAssistantConfig.refresh();
+        }
+
+        function status(): string {
+            return JSON.stringify({
+                url: HomeAssistantConfig.url,
+                entities: HomeAssistantConfig.entities,
+                tokenConfigured: HomeAssistantConfig.tokenConfigured,
+                configured: HomeAssistantConfig.configured,
+                busy: HomeAssistantConfig.busy,
+                lastError: HomeAssistantConfig.lastError,
+                pendingPayloadEmpty: HomeAssistantConfig.pendingPayload === "",
+                refreshCalls: root.refreshCalls
+            });
+        }
+    }
+}

tests/quickshell/NotificationAppRulesHarness.qml

@@ -0,0 +1,126 @@
+import Quickshell
+import Quickshell.Io
+import QtQuick
+
+import qs.config
+import qs.services
+
+ShellRoot {
+    id: root
+
+    function notification(idValue: int, desktopEntryValue: string, appNameValue: string): var {
+        const closeHandlers = [];
+        return {
+            id: idValue,
+            desktopEntry: desktopEntryValue,
+            appName: appNameValue,
+            appIcon: "",
+            transient: false,
+            lastGeneration: false,
+            tracked: false,
+            dismissed: false,
+            closed: {
+                connect: callback => closeHandlers.push(callback)
+            },
+            dismiss: function() {
+                this.dismissed = true;
+                for (const callback of closeHandlers)
+                    callback();
+            }
+        };
+    }
+
+    function resetNotifications(): void {
+        Notifs.history = [];
+        Notifs.popups = [];
+        Notifs.unreadCount = 0;
+        Notifs.doNotDisturb = false;
+    }
+
+    function reset(): void {
+        root.resetNotifications();
+        Notifs.fallbackAppRules = {};
+        Notifs.rememberedApplications = {};
+        DesktopPreferences.set("notificationAppRules", {});
+    }
+
+    IpcHandler {
+        target: "notification-app-rules-test"
+
+        function exercise(): string {
+            root.reset();
+
+            const signal = root.notification(1, "org.signal.Signal.desktop", "Signal");
+            Notifs.handleNotification(signal);
+            const appId = Notifs.notificationAppId(signal);
+            const initialRules = DesktopPreferences.get("notificationAppRules");
+
+            const fallback = root.notification(6, "", "Fallback Terminal");
+            Notifs.handleNotification(fallback);
+            const fallbackId = Notifs.notificationAppId(fallback);
+            const fallbackApplication = Notifs.applications.find(app => app.id === fallbackId);
+
+            root.resetNotifications();
+            Notifs.setAppRule(appId, { enabled: false });
+            const muted = root.notification(2, "org.signal.Signal.desktop", "Signal");
+            Notifs.handleNotification(muted);
+            const mutedResult = {
+                tracked: muted.tracked,
+                history: Notifs.history.length,
+                popups: Notifs.popups.length,
+                unread: Notifs.unreadCount
+            };
+
+            root.reset();
+            Notifs.doNotDisturb = true;
+            const dnd = root.notification(3, "org.signal.Signal.desktop", "Signal");
+            Notifs.handleNotification(dnd);
+
+            Notifs.setAppRule("org.privacy.App.desktop", {
+                showOnLockScreen: false,
+                showContentOnLockScreen: false
+            });
+            const privateNotification = root.notification(4, "org.privacy.App.desktop", "Private");
+
+            return JSON.stringify({
+                appId: appId,
+                initialRules: initialRules,
+                fallback: {
+                    id: fallbackId,
+                    application: fallbackApplication
+                },
+                muted: mutedResult,
+                dnd: {
+                    tracked: dnd.tracked,
+                    history: Notifs.history.length,
+                    popups: Notifs.popups.length,
+                    unread: Notifs.unreadCount
+                },
+                privacy: {
+                    visible: Notifs.shouldShowOnLockScreen(privateNotification),
+                    content: Notifs.shouldShowContentOnLockScreen(privateNotification)
+                }
+            });
+        }
+
+        function persist(): string {
+            root.reset();
+            const notification = root.notification(5, "org.persist.App.desktop", "Persist");
+            Notifs.handleNotification(notification);
+            Notifs.setAppRule("org.persist.App.desktop", {
+                enabled: false,
+                showOnLockScreen: true,
+                showContentOnLockScreen: false
+            });
+            return JSON.stringify(DesktopPreferences.get("notificationAppRules"));
+        }
+
+        function restored(): string {
+            return JSON.stringify(DesktopPreferences.get("notificationAppRules"));
+        }
+
+        function applications(): string {
+            return JSON.stringify(Notifs.applications);
+        }
+    }
+}

tests/quickshell/connectivity-contract.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Network & Devices reads real NetworkManager and BlueZ state.
+#
+# Both of the bugs this contract exists to prevent were silent. Neither logged
+# anything; both produced a page that looked fine and told the user something
+# false:
+#
+#   * the device lookups used enum names that do not exist
+#     (NetworkDeviceType.Wifi rather than DeviceType.Wifi), so they returned
+#     null and the page reported "No Wi-Fi adapter" on a machine whose Wi-Fi was
+#     connected;
+#   * signalStrength is 0.0-1.0, not a percentage, so thresholds written for
+#     0-100 put every network including the connected one in the bottom bucket.
+#
+# So this compares what the service resolves against what NetworkManager itself
+# reports, rather than merely checking the service does not crash.
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+harness="$repo_dir/config/dot/quickshell/connectivity-harness.qml"
+
+fail() {
+    printf 'connectivity contract: %s\n' "$1" >&2
+    exit 1
+}
+
+command -v nmcli >/dev/null || fail 'nmcli is needed to check the service against reality'
+
+run() { qs -p "$harness" "$@"; }
+harness_pid=""
+
+cleanup() {
+    run ipc call connectivity-test setActive false >/dev/null 2>&1 || true
+    # By PID: never `pkill -f connectivity-harness`, which also matches the
+    # shell running this script.
+    [[ -n "$harness_pid" ]] && kill "$harness_pid" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+qs -p "$harness" --daemonize >/dev/null
+for _ in $(seq 1 40); do
+    run ipc show 2>/dev/null | rg -q '^target connectivity-test$' && break
+    sleep 0.1
+done
+run ipc show 2>/dev/null | rg -q '^target connectivity-test$' || fail 'test IPC target did not start'
+harness_pid="$(run list | awk '/Process ID:/ { print $3; exit }')"
+
+# Scanning only runs while the page says it is visible.
+run ipc call connectivity-test setActive true >/dev/null
+sleep 3
+
+state="$(run ipc call connectivity-test status)"
+
+# ── Devices the service finds must match the ones NetworkManager reports ─────
+nm_wifi="$(nmcli -t -f DEVICE,TYPE device | awk -F: '$2 == "wifi" { print $1; exit }')"
+nm_wired="$(nmcli -t -f DEVICE,TYPE,STATE device | awk -F: '$2 == "ethernet" && $3 == "connected" { print $1; exit }')"
+
+if [[ -n "$nm_wifi" ]]; then
+    [[ "$(jq -r .wifiDevice <<<"$state")" == "$nm_wifi" ]] \
+        || fail "NetworkManager reports Wi-Fi device '$nm_wifi' but the service found '$(jq -r .wifiDevice <<<"$state")'"
+fi
+if [[ -n "$nm_wired" ]]; then
+    [[ "$(jq -r .wiredConnected <<<"$state")" == "true" ]] \
+        || fail "NetworkManager reports '$nm_wired' connected but the service says it is not"
+fi
+
+# ── Signal strength is a ratio, and the labels must reflect that ─────────────
+while IFS='|' read -r value expect; do
+    got="$(run ipc call connectivity-test labelFor "$value")"
+    [[ "$got" == "$expect" ]] || fail "signal $value labelled '$got', expected '$expect'"
+done <<'CASES'
+1.0|Excellent
+0.85|Excellent
+0.6|Good
+0.4|Fair
+0.1|Weak
+0.0|No signal
+CASES
+
+# If a network is connected, it must not be described as the weakest possible
+# thing -- that was the visible symptom of reading the ratio as a percentage.
+active_ssid="$(jq -r .activeSsid <<<"$state")"
+if [[ -n "$active_ssid" ]]; then
+    strength="$(jq -r .activeStrength <<<"$state")"
+    awk -v s="$strength" 'BEGIN { exit !(s >= 0 && s <= 1) }' \
+        || fail "signalStrength $strength is outside 0.0-1.0; the label buckets assume a ratio"
+fi
+
+# ── Bluetooth ────────────────────────────────────────────────────────────────
+if [[ "$(bluetoothctl list 2>/dev/null | wc -l)" -gt 0 ]]; then
+    [[ "$(jq -r .adapter <<<"$state")" == "true" ]] \
+        || fail 'an adapter is present but the service did not find it'
+fi
+
+trap - EXIT
+cleanup
+printf 'connectivity contract: PASS\n'

tests/quickshell/displays-contract.sh

@@ -0,0 +1,300 @@
+#!/usr/bin/env bash
+
+# Display configuration.
+#
+# This is the only setting in Panama that can leave the user unable to SEE the
+# screen well enough to undo it: a mode the panel cannot show, or a scale that
+# makes everything unreadable, is not recoverable through the UI that caused it.
+#
+# So the property under test is not "can it change the resolution" but "does an
+# unconfirmed change always come back". A regression here is not a broken
+# feature, it is a user staring at a blank monitor.
+#
+#   * an unconfirmed change reverts on its own, and stores nothing
+#   * a confirmed change is what writes to the settings store
+#   * a mode, scale, rotation, or output the compositor did not offer is refused
+#     before anything is applied
+#
+# The compositor is the live one -- there is no way to test this otherwise --
+# but preferences are isolated, and every path restores the display it started
+# from.
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+harness="$repo_dir/config/dot/quickshell/displays-harness.qml"
+service="$repo_dir/config/dot/quickshell/services/Displays.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/DisplaysPage.qml"
+settings_page="$repo_dir/config/dot/quickshell/modules/settings/SettingsPage.qml"
+monitors_lua="$repo_dir/config/dot/hypr/monitors.lua"
+
+fail() {
+    printf 'displays contract: %s\n' "$1" >&2
+    exit 1
+}
+
+# Keep is unavailable until compositor readback exactly matches the request.
+for contract in \
+    'property var pendingRequested:' \
+    'property var revertExpected:' \
+    'property bool revertVerificationActive:' \
+    'property int revertGeneration:' \
+    'readonly property bool canConfirm:' \
+    'function matchesRequest(' \
+    'function scalesForMode(' \
+    'function isScaleClean('; do
+    rg -Fq "$contract" "$service" || fail "display service contract is missing: $contract"
+done
+rg -Fq 'enabled: Displays.canConfirm' "$page" \
+    || fail 'Keep is enabled before the display change is verified'
+rg -Fq 'options: Displays.scalesForMode(' "$page" \
+    || fail 'scale choices are not filtered for the active resolution'
+rg -Fq 'property string selectedOutput:' "$page" \
+    || fail 'connected outputs cannot be selected'
+rg -Fq 'options: Displays.monitors.map(' "$page" \
+    || fail 'the output selector is not populated from connected displays'
+rg -Fq 'id: revertVerifyTimer' "$service" \
+    || fail 'automatic restoration has no bounded readback verification'
+rg -Fq 'if (root.busy)' "$service" \
+    || fail 'the display service accepts a new apply while another operation is busy'
+
+# Stored JSON is untyped at field level, so the Lua startup consumer is the
+# final validation boundary and must support every named output it accepts.
+for contract in 'valid_mode' 'valid_scale' 'valid_transform' 'pairs(displays)'; do
+    rg -Fq "$contract" "$monitors_lua" || fail "monitor startup validation is missing: $contract"
+done
+
+# SettingsPage headers are genuinely pinned outside its scrolling surface.
+python3 - "$settings_page" <<'PY' || fail 'SettingsPage header is not pinned outside the Flickable'
+import sys
+text = open(sys.argv[1], encoding="utf-8").read()
+loader = text.find("id: pinnedHeader")
+flickable = text.find("id: pageScroll")
+if loader < 0 or flickable < 0 or loader > flickable:
+    raise SystemExit(1)
+PY
+
+MONITORS_LUA="$monitors_lua" lua - <<'LUA' || fail 'monitor startup accepted invalid persisted geometry or ignored a named output'
+package.preload["prefs"] = function()
+    return {
+        get = function()
+            return {
+                ["DP-2"] = { mode = "not-a-mode", scale = -1, transform = 99 },
+                ["HDMI-A-1"] = { mode = "1920x1080@60", scale = 1.5, transform = 1 },
+                ["BAD OUTPUT"] = { mode = "1920x1080@60", scale = 1, transform = 0 },
+            }
+        end,
+    }
+end
+
+local calls = {}
+hl = { monitor = function(value) table.insert(calls, value) end }
+assert(loadfile(os.getenv("MONITORS_LUA")))()
+
+local by_output = {}
+for _, value in ipairs(calls) do by_output[value.output] = value end
+assert(by_output["DP-2"].mode == "4500x3000@60")
+assert(by_output["DP-2"].scale == 1.5)
+assert(by_output["DP-2"].transform == 0)
+assert(by_output["HDMI-A-1"].mode == "1920x1080@60")
+assert(by_output["HDMI-A-1"].scale == 1.5)
+assert(by_output["HDMI-A-1"].transform == 1)
+assert(by_output["BAD OUTPUT"] == nil)
+assert(by_output[""] ~= nil)
+LUA
+
+if [[ "${PANAMA_DISPLAYS_STATIC_ONLY:-0}" == "1" ]]; then
+    printf 'displays contract: PASS (static)\n'
+    exit 0
+fi
+
+config_home="$(mktemp -d /tmp/panama-displays-config.XXXXXX)"
+
+run() { XDG_CONFIG_HOME="$config_home" qs -p "$harness" "$@"; }
+status() { run ipc call displays-test status; }
+
+original_mode=""
+original_scale=""
+original_transform=""
+original_width=""
+original_height=""
+original_refresh=""
+monitor_name=""
+
+monitor_state() {
+    hyprctl -j monitors | jq -c --arg output "$monitor_name" '.[] | select(.name == $output)'
+}
+
+display_is_restored() {
+    local current
+    current="$(monitor_state)"
+    [[ -n "$current" ]] || return 1
+    jq -e \
+        --argjson width "$original_width" \
+        --argjson height "$original_height" \
+        --argjson refresh "$original_refresh" \
+        --argjson scale "$original_scale" \
+        --argjson transform "$original_transform" \
+        '.width == $width and .height == $height
+            and ((.refreshRate - $refresh) | fabs) < 0.01
+            and ((.scale - $scale) | fabs) < 0.001
+            and .transform == $transform' <<<"$current" >/dev/null
+}
+
+restore_display() {
+    [[ -n "$original_mode" ]] || return 0
+    hyprctl eval "hl.monitor({ output = \"$monitor_name\", mode = \"$original_mode\", scale = $original_scale, transform = $original_transform })" >/dev/null \
+        || return 1
+    for _ in $(seq 1 50); do
+        display_is_restored && return 0
+        sleep 0.2
+    done
+    return 1
+}
+
+stop_harness() {
+    # Kill by PID, never `pkill -f displays-harness`: that pattern also matches
+    # any shell whose command line contains this script's text, which includes
+    # the invoking shell itself.
+    [[ -n "${harness_pid:-}" ]] && kill "$harness_pid" >/dev/null 2>&1 || true
+    rm -rf "$config_home"
+}
+
+cleanup() {
+    local status=$?
+    trap - EXIT
+    if ! restore_display; then
+        printf 'displays contract: FAILED to restore %s to %s scale %s transform %s\n' \
+            "$monitor_name" "$original_mode" "$original_scale" "$original_transform" >&2
+        status=1
+    fi
+    stop_harness
+    exit "$status"
+}
+trap cleanup EXIT
+
+XDG_CONFIG_HOME="$config_home" qs -p "$harness" --daemonize >/dev/null
+harness_pid=""
+for _ in $(seq 1 40); do
+    run ipc show 2>/dev/null | rg -q '^target displays-test$' && break
+    sleep 0.1
+done
+run ipc show 2>/dev/null | rg -q '^target displays-test$' || fail 'test IPC target did not start'
+harness_pid="$(run list | awk '/Process ID:/ { print $3; exit }')"
+
+refresh_fixture="$(run ipc call displays-test refreshIdentityFixture)"
+jq -e '
+    .count == 2
+    and .modes == ["[email protected]", "[email protected]"]
+    and .selected == ["[email protected]"]
+' <<<"$refresh_fixture" >/dev/null \
+    || fail "59.94 Hz and 60.00 Hz lost their distinct selection identity: $refresh_fixture"
+
+for _ in $(seq 1 50); do
+    [[ "$(status | jq -r .count)" != "0" ]] && break
+    sleep 0.1
+done
+
+state="$(status)"
+monitor_name="$(jq -r .name <<<"$state")"
+[[ -n "$monitor_name" ]] || fail "no display was detected: $state"
+original_mode="$(jq -r .mode <<<"$state")"
+original_width="$(jq -r .width <<<"$state")"
+original_height="$(jq -r .height <<<"$state")"
+original_refresh="$(jq -r .refresh <<<"$state")"
+original_scale="$(jq -r .scale <<<"$state")"
+original_transform="$(jq -r .transform <<<"$state")"
+
+[[ "$(jq -r .modes <<<"$state")" -gt 0 ]] || fail 'the display reported no usable modes'
+
+# ── Anything the compositor did not offer is refused before applying ─────────
+while IFS= read -r kind; do
+    [[ "$(run ipc call displays-test applyBad "$kind")" == "false" ]] \
+        || fail "an invalid $kind was accepted"
+    [[ "$(status | jq -r .awaiting)" == "false" ]] \
+        || fail "an invalid $kind left a change pending"
+done <<'KINDS'
+mode
+scale
+transform
+output
+dirtyScale
+KINDS
+
+# The display must not have moved for any of those.
+now="$(status)"
+[[ "$(jq -r .scale <<<"$now")" == "$original_scale" ]] || fail 'a refused change still altered the scale'
+
+# An immediate Revert may race both the apply process and its first readback.
+# It must queue until both are clear, then verify the original generation.
+target_scale=$(awk -v s="$original_scale" 'BEGIN { print (s == 1.25) ? 1.5 : 1.25 }')
+[[ "$(run ipc call displays-test applyScale "$target_scale")" == "true" ]] \
+    || fail 'the immediate-revert fixture could not apply'
+run ipc call displays-test revertChange >/dev/null
+immediate_reverted=false
+for _ in $(seq 1 60); do
+    if display_is_restored && [[ "$(status | jq -r .awaiting)" == "false" ]]; then
+        immediate_reverted=true
+        break
+    fi
+    sleep 0.2
+done
+[[ "$immediate_reverted" == true ]] \
+    || fail 'an immediate Revert raced the apply/readback and did not restore the display'
+
+# ── An unconfirmed change reverts on its own and stores nothing ──────────────
+[[ "$(run ipc call displays-test applyScale "$target_scale")" == "true" ]] \
+    || fail 'a valid scale change was refused'
+
+applied=false
+for _ in $(seq 1 30); do
+    [[ "$(monitor_state | jq -r '.scale')" == "$target_scale" ]] && { applied=true; break; }
+    sleep 0.2
+done
+[[ "$applied" == true ]] || fail 'the scale change never reached the compositor'
+[[ "$(status | jq -r .awaiting)" == "true" ]] || fail 'an applied change is not awaiting confirmation'
+[[ "$(status | jq -r .canConfirm)" == "true" ]] || fail 'an applied change was never verified by compositor readback'
+
+# Wait out the countdown. This is the whole point of the contract.
+reverted=false
+for _ in $(seq 1 120); do
+    if [[ "$(monitor_state | jq -r '.scale')" == "$original_scale" ]]; then
+        reverted=true
+        break
+    fi
+    sleep 0.5
+done
+[[ "$reverted" == true ]] || fail 'an unconfirmed change did NOT revert -- this would strand a user on an unreadable display'
+[[ "$(status | jq -r .awaiting)" == "false" ]] || fail 'the pending state survived the revert'
+[[ "$(status | jq -r .overridden)" == "false" ]] || fail 'an unconfirmed change was written to the settings store'
+
+# ── A confirmed change is what writes ────────────────────────────────────────
+run ipc call displays-test applyScale "$target_scale" >/dev/null
+[[ "$(run ipc call displays-test confirmChange)" == "false" ]] \
+    || fail 'Keep accepted a display change before compositor readback'
+verified=false
+for _ in $(seq 1 30); do
+    [[ "$(status | jq -r .canConfirm)" == "true" ]] && { verified=true; break; }
+    sleep 0.2
+done
+[[ "$verified" == true ]] || fail 'the confirmed change never became safe to keep'
+[[ "$(run ipc call displays-test confirmChange)" == "true" ]] \
+    || fail 'Keep refused a verified display change'
+sleep 0.6
+[[ "$(status | jq -r .awaiting)" == "false" ]] || fail 'confirming did not clear the pending state'
+[[ "$(status | jq -r .overridden)" == "true" ]] || fail 'confirming did not store the change'
+
+store="$config_home/panama/settings.json"
+jq -e --arg m "$monitor_name" '.displays[$m].scale != null' "$store" >/dev/null \
+    || fail 'the confirmed change is not in the settings store'
+
+# ── Forgetting clears it ─────────────────────────────────────────────────────
+run ipc call displays-test forget >/dev/null
+sleep 0.6
+[[ "$(status | jq -r .overridden)" == "false" ]] || fail 'forget did not clear the stored display setting'
+
+restore_display || fail 'the final cleanup could not restore and verify the original display'
+original_mode=""
+stop_harness
+trap - EXIT
+printf 'displays contract: PASS\n'

tests/quickshell/fixtures/org.persist.App.desktop

@@ -0,0 +1,5 @@
+[Desktop Entry]
+Type=Application
+Name=Persisted Fixture App
+Exec=/usr/bin/true
+Icon=applications-system

tests/quickshell/home-assistant-config-contract.sh

@@ -0,0 +1,217 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+helper="$repo_dir/config/dot/quickshell/scripts/panama-home-assistant-config"
+service="$repo_dir/config/dot/quickshell/services/HomeAssistantConfig.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/HomePhonePage.qml"
+password_field="$repo_dir/config/dot/quickshell/modules/settings/PasswordField.qml"
+harness_fixture="$repo_dir/tests/quickshell/HomeAssistantConfigHarness.qml"
+work="$(mktemp -d /tmp/panama-ha-config.XXXXXX)"
+env_file="$work/env"
+
+fail() {
+    printf 'Home Assistant config contract: %s\n' "$1" >&2
+    exit 1
+}
+
+cleanup() {
+    if declare -F qs_for_test >/dev/null; then
+        qs_for_test kill >/dev/null 2>&1 || true
+    fi
+    rm -rf "$work"
+}
+trap cleanup EXIT
+
+[[ -x "$helper" ]] || fail 'credential helper is missing or not executable'
+[[ -f "$service" ]] || fail 'credential service is missing'
+[[ -f "$harness_fixture" ]] || fail 'credential runtime harness is missing'
+
+rg -Fq 'stdinEnabled: true' "$service" || fail 'credential writes do not use process stdin'
+rg -Fq 'writeProc.write(root.pendingPayload + "\n")' "$service" || fail 'credential payload is not written over stdin'
+rg -Fq 'root.pendingPayload = ""' "$service" || fail 'credential payload remains in service memory after write'
+if rg -q 'command:.*(token|pendingPayload)' "$service"; then
+    fail 'credential data can reach a process command line'
+fi
+rg -Fq 'PasswordField {' "$page" || fail 'Home Assistant token is not entered through the masked field'
+rg -Fq 'activeFocusOnTab: true' "$password_field" || fail 'masked credential field is not keyboard reachable'
+rg -Fq 'HomeAssistantConfig.save(' "$page" || fail 'Home Assistant configuration cannot be saved from Settings'
+rg -Fq 'HomeAssistantConfig.clearToken()' "$page" || fail 'stored Home Assistant token cannot be cleared'
+rg -Fq 'id: clearTokenButton' "$page" || fail 'clear-token action has no keyboard control identity'
+rg -Fq 'id: saveHomeConfigButton' "$page" || fail 'save action has no keyboard control identity'
+rg -Fq 'activeFocusOnTab: enabled' "$page" || fail 'credential actions are not in tab order'
+rg -Fq 'Keys.onReturnPressed:' "$page" || fail 'credential actions have no keyboard activation'
+
+cat >"$env_file" <<'EOF'
+# Existing private shell settings must survive byte-for-byte.
+export KEEP_ME='untouched value'
+export JIRA_CREDENTIALS='unrelated-secret'
+export PANAMA_HOME_ASSISTANT_URL='https://old.example.test'
+export PANAMA_HOME_ASSISTANT_TOKEN='old-token'
+export PANAMA_HOME_ASSISTANT_ENTITIES='light.old'
+EOF
+chmod 0644 "$env_file"
+
+run_helper() {
+    PANAMA_HOME_ASSISTANT_ENV_FILE="$env_file" "$helper" "$@"
+}
+
+status="$(run_helper status)" || fail 'status failed for a valid private env file'
+jq -e '.configured == true and .tokenConfigured == true
+    and .url == "https://old.example.test"
+    and .entities == ["light.old"] and (has("token") | not)' \
+    <<<"$status" >/dev/null || fail "status exposed or misread credentials: $status"
+if rg -q 'old-token|unrelated-secret' <<<"$status"; then
+    fail 'status output leaked a secret'
+fi
+
+secret='ha-secret-must-never-appear-in-ps-or-output'
+payload="$work/payload.json"
+jq -cn --arg token "$secret" '{
+    url: "https://home.example.test/",
+    token: $token,
+    entities: ["light.kitchen", "light.desk", "light.kitchen"]
+}' >"$payload"
+
+# Keep stdin open long enough to prove the token is absent from the helper's
+# process arguments. The secret lives only in the private payload file/stdin.
+fifo="$work/input.fifo"
+mkfifo "$fifo"
+PANAMA_HOME_ASSISTANT_ENV_FILE="$env_file" "$helper" write <"$fifo" >"$work/write.out" 2>"$work/write.err" &
+helper_pid=$!
+for _ in $(seq 1 30); do
+    kill -0 "$helper_pid" 2>/dev/null && break
+    sleep 0.05
+done
+if ps -o args= -p "$helper_pid" | rg -Fq "$secret"; then
+    fail 'token appeared in the credential helper process arguments'
+fi
+cp "$payload" "$fifo"
+wait "$helper_pid" || fail 'stdin credential write failed'
+
+write_result="$(cat "$work/write.out")"
+jq -e '.ok == true and .configured == true and .tokenConfigured == true
+    and .url == "https://home.example.test"
+    and .entities == ["light.kitchen", "light.desk"] and (has("token") | not)' \
+    <<<"$write_result" >/dev/null || fail "write returned unsafe or incorrect state: $write_result"
+if rg -q "$secret|old-token|unrelated-secret" "$work/write.out" "$work/write.err"; then
+    fail 'credential helper output leaked a secret'
+fi
+
+[[ "$(stat -c '%a' "$env_file")" == "600" ]] || fail 'private env file is not mode 0600'
+rg -Fxq "export KEEP_ME='untouched value'" "$env_file" || fail 'unrelated env content changed'
+rg -Fxq "export JIRA_CREDENTIALS='unrelated-secret'" "$env_file" || fail 'unrelated secret changed'
+rg -Fq "$secret" "$env_file" || fail 'new token was not stored'
+
+# Omitting token preserves it; an explicit empty token clears it.
+printf '%s\n' '{"url":"https://new.example.test","entities":"light.office, light.hall"}' \
+    | run_helper write >/dev/null || fail 'non-secret update failed'
+rg -Fq "$secret" "$env_file" || fail 'blank token field unexpectedly erased the stored token'
+
+printf '%s\n' '{"token":""}' | run_helper write >/dev/null || fail 'token clear failed'
+cleared="$(run_helper status)"
+jq -e '.configured == false and .tokenConfigured == false
+    and .url == "https://new.example.test"
+    and .entities == ["light.office", "light.hall"]' \
+    <<<"$cleared" >/dev/null || fail "cleared state is wrong: $cleared"
+
+before_hash="$(sha256sum "$env_file" | cut -d' ' -f1)"
+printf '%s\n' '{"url":"file:///etc/passwd"}' | run_helper write >/dev/null 2>&1 \
+    && fail 'invalid URL was accepted'
+after_hash="$(sha256sum "$env_file" | cut -d' ' -f1)"
+[[ "$before_hash" == "$after_hash" ]] || fail 'rejected input still modified the private env file'
+
+# Exercise the actual QML Process.write() boundary with a pre-existing token.
+# The IPC carries only non-secret fields; the helper must preserve the token.
+config_path="$work/quickshell"
+harness="$config_path/home-assistant-config-harness.qml"
+cp -a "$repo_dir/config/dot/quickshell" "$config_path"
+cp "$harness_fixture" "$harness"
+printf '%s\n' \
+    "export PANAMA_HOME_ASSISTANT_URL='https://qml-old.example.test'" \
+    "export PANAMA_HOME_ASSISTANT_TOKEN=''" \
+    "export PANAMA_HOME_ASSISTANT_ENTITIES='light.old'" >"$env_file"
+chmod 0600 "$env_file"
+qml_token_file="$work/qml-token"
+printf '%s' 'qml-private-token' >"$qml_token_file"
+chmod 0600 "$qml_token_file"
+
+qs_for_test() {
+    PANAMA_HOME_ASSISTANT_ENV_FILE="$env_file" \
+        PANAMA_TEST_TOKEN_FILE="$qml_token_file" \
+        XDG_CONFIG_HOME="$work/config" XDG_STATE_HOME="$work/state" \
+        qs -p "$harness" "$@"
+}
+
+stop_harness() {
+    qs_for_test kill >/dev/null 2>&1 || true
+}
+
+qs_for_test --daemonize >/dev/null
+for _ in $(seq 1 60); do
+    qs_for_test ipc show 2>/dev/null | rg -q '^target home-assistant-config-test$' && break
+    sleep 0.1
+done
+qs_for_test ipc show 2>/dev/null | rg -q '^target home-assistant-config-test$' \
+    || fail 'credential QML harness did not start'
+
+for _ in $(seq 1 60); do
+    qml_status="$(qs_for_test ipc call home-assistant-config-test status)"
+    jq -e '.busy == false and .url == "https://qml-old.example.test"' <<<"$qml_status" >/dev/null && break
+    sleep 0.1
+done
+jq -e '.configured == false and .tokenConfigured == false and .pendingPayloadEmpty == true' \
+    <<<"$qml_status" >/dev/null || fail "QML service did not load redacted state: $qml_status"
+
+qs_for_test ipc call home-assistant-config-test saveWithToken \
+    https://qml-new.example.test 'light.office,light.hall' >/dev/null \
+    || fail 'QML service refused a private token-file update'
+for _ in $(seq 1 60); do
+    qml_status="$(qs_for_test ipc call home-assistant-config-test status)"
+    jq -e '.busy == false and .configured == true and .tokenConfigured == true
+        and .refreshCalls > 0' <<<"$qml_status" >/dev/null && break
+    sleep 0.1
+done
+jq -e '.configured == true and .tokenConfigured == true
+    and .url == "https://qml-new.example.test"
+    and .entities == ["light.office", "light.hall"]
+    and .pendingPayloadEmpty == true and .lastError == "" and .refreshCalls > 0' \
+    <<<"$qml_status" >/dev/null || fail "QML secret stdin save did not settle safely: $qml_status"
+rg -Fq 'qml-private-token' "$env_file" || fail 'QML secret stdin save did not store the token'
+if ps -o args= -p "$(qs_for_test list | awk '/Process ID:/ {print $3; exit}')" | rg -Fq 'qml-private-token'; then
+    fail 'QML token appeared in the shell process arguments'
+fi
+
+qs_for_test ipc call home-assistant-config-test save \
+    https://qml-final.example.test 'light.bedroom,light.hall' >/dev/null \
+    || fail 'QML service refused a non-secret update'
+for _ in $(seq 1 60); do
+    qml_status="$(qs_for_test ipc call home-assistant-config-test status)"
+    jq -e '.busy == false and .url == "https://qml-final.example.test"
+        and .entities == ["light.bedroom", "light.hall"]' <<<"$qml_status" >/dev/null && break
+    sleep 0.1
+done
+jq -e '.configured == true and .tokenConfigured == true
+    and .pendingPayloadEmpty == true and .lastError == ""' \
+    <<<"$qml_status" >/dev/null || fail "QML stdin save did not settle safely: $qml_status"
+rg -Fq 'qml-private-token' "$env_file" || fail 'QML non-secret save erased the stored token'
+
+qs_for_test ipc call home-assistant-config-test clearToken >/dev/null \
+    || fail 'QML service refused token clear'
+for _ in $(seq 1 60); do
+    qml_status="$(qs_for_test ipc call home-assistant-config-test status)"
+    jq -e '.busy == false and .tokenConfigured == false' <<<"$qml_status" >/dev/null && break
+    sleep 0.1
+done
+jq -e '.configured == false and .tokenConfigured == false
+    and .pendingPayloadEmpty == true and .lastError == ""' \
+    <<<"$qml_status" >/dev/null || fail "QML token clear did not settle safely: $qml_status"
+if rg -Fq 'qml-private-token' "$env_file"; then
+    fail 'QML token clear left the old token in the private env file'
+fi
+stop_harness
+
+trap - EXIT
+cleanup
+printf 'Home Assistant config contract: PASS\n'

tests/quickshell/home-assistant-helper-contract.sh

@@ -13,6 +13,20 @@ helper="$project_root/config/dot/quickshell/scripts/panama-home-assistant"
 [[ -x "$helper" ]] || fail 'helper is missing or not executable'
 
 catalog="$($helper catalog)"
+
+# This asserts a LIVE, authenticated Home Assistant. An absent credential is not
+# a defect in Panama, so it skips rather than fails -- otherwise the suite is red
+# on any machine that has not been given a token, and a red suite that is
+# expected to be red stops being read.
+#
+# A configured-but-broken bridge still fails, which is the case worth catching.
+if [[ "$(jq -r '.configured' <<<"$catalog")" != "true" ]]; then
+    printf 'Home Assistant helper contract: SKIP (no token configured)\n'
+    printf '  Set PANAMA_HOME_ASSISTANT_TOKEN in config/bash/env to exercise this.\n'
+    printf '  Reason reported by the helper: %s\n' "$(jq -r '.error // "unknown"' <<<"$catalog")"
+    exit 0
+fi
+
 jq -e '
   .ok == true and .configured == true and .error == "" and
   (.entities | type == "array" and length > 0) and

tests/quickshell/home-phone-settings-contract.sh

@@ -105,13 +105,21 @@ assert_contains 'Opens BlueBubbles' "$home_page"
 if rg -Fq 'index: model.index' "$home_page"; then
     fail 'HomePhonePage.qml reads an undefined model.index instead of the delegate index'
 fi
-if rg -qi 'token|bearer|api/states' "$home_page"; then
-    fail 'HomePhonePage.qml crosses the credential or REST privacy boundary'
+if rg -qi 'bearer|api/states' "$home_page"; then
+    fail 'HomePhonePage.qml crosses the Home Assistant REST boundary'
 fi
 assert_contains 'signal aliasCommitted(string id, string alias)' "$favorite_card"
 assert_contains 'signal removeRequested(string id)' "$favorite_card"
 assert_contains 'signal moveRequested(string id, int targetIndex)' "$favorite_card"
-assert_contains 'DragHandler {' "$favorite_card"
+assert_contains 'text: "↑"' "$favorite_card"
+assert_contains 'text: "↓"' "$favorite_card"
+assert_contains 'enabled: root.canMoveEarlier' "$favorite_card"
+assert_contains 'enabled: root.canMoveLater' "$favorite_card"
+if rg -Fq 'DragHandler {' "$favorite_card"; then
+    fail 'Home light cards still expose the broken drag affordance'
+fi
+assert_contains 'canMoveEarlier: index > 0' "$home_page"
+assert_contains 'canMoveLater: index < favoritesGrid.count - 1' "$home_page"
 assert_contains 'onEditingFinished:' "$favorite_card"
 assert_contains 'text: "Control Center"' "$favorite_card"
 assert_contains 'activeFocusOnTab: true' "$favorite_card"

tests/quickshell/home-preferences-contract.sh

@@ -96,6 +96,8 @@ assert_reset_persists_without_debounce() {
 initial_ids=' ["light.kitchen","light.hall","light.desk"]'
 expected='{"initialized":true,"favorites":[{"id":"light.desk","alias":""},{"id":"light.kitchen","alias":"Island"}],"saveError":""}'
 expected_file='{"initialized":true,"favorites":[{"id":"light.desk","alias":""},{"id":"light.kitchen","alias":"Island"}]}'
+reordered_expected='{"initialized":true,"favorites":[{"id":"light.desk","alias":""},{"id":"light.kitchen","alias":"Island"},{"id":"light.hall","alias":""}],"saveError":""}'
+reordered_file='{"initialized":true,"favorites":[{"id":"light.desk","alias":""},{"id":"light.kitchen","alias":"Island"},{"id":"light.hall","alias":""}]}'
 empty_expected='{"initialized":true,"favorites":[],"saveError":""}'
 empty_file='{"initialized":true,"favorites":[]}'
 reset_expected='{"initialized":false,"favorites":[],"saveError":""}'
@@ -106,6 +108,12 @@ start_harness
 qs_for_harness ipc call home-pref-test initialize "$initial_ids" >/dev/null
 qs_for_harness ipc call home-pref-test alias light.kitchen '  Island  ' >/dev/null
 qs_for_harness ipc call home-pref-test move light.desk 0 >/dev/null
+wait_for_status "$reordered_expected"
+wait_for_file_content "$reordered_file"
+stop_harness
+start_harness
+wait_for_status "$reordered_expected"
+
 qs_for_harness ipc call home-pref-test remove light.hall >/dev/null
 wait_for_status "$expected"
 wait_for_file_content "$expected_file"

tests/quickshell/notification-app-rules-contract.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+service="$repo_dir/config/dot/quickshell/services/Notifs.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/NotificationsPage.qml"
+harness_fixture="$repo_dir/tests/quickshell/NotificationAppRulesHarness.qml"
+desktop_entry_fixture="$repo_dir/tests/quickshell/fixtures/org.persist.App.desktop"
+
+fail() {
+    printf 'notification application rules contract: %s\n' "$1" >&2
+    exit 1
+}
+
+[[ -f "$service" ]] || fail 'notification service is missing'
+[[ -f "$page" ]] || fail 'notification settings page is missing'
+[[ -f "$harness_fixture" ]] || fail 'runtime harness fixture is missing'
+[[ -f "$desktop_entry_fixture" ]] || fail 'runtime desktop entry fixture is missing'
+
+SERVICE_PATH="$service" PAGE_PATH="$page" bun -e '
+const source = await Bun.file(process.env.SERVICE_PATH).text();
+const page = await Bun.file(process.env.PAGE_PATH).text();
+
+function fail(message) {
+    console.error(`notification application rules contract: ${message}`);
+    process.exit(1);
+}
+
+function functionBody(name) {
+    const start = source.indexOf(`function ${name}(`);
+    if (start === -1)
+        fail(`missing ${name}()`);
+    const open = source.indexOf("{", start);
+    let depth = 0;
+    for (let index = open; index < source.length; index++) {
+        if (source[index] === "{") depth++;
+        if (source[index] === "}" && --depth === 0)
+            return source.slice(open + 1, index);
+    }
+    fail(`${name}() is unterminated`);
+}
+
+const notificationAppId = Function("notification", functionBody("notificationAppId"));
+const normalizedAppRule = Function("rule", functionBody("normalizedAppRule"));
+
+const identityFixtures = [
+    { notification: { desktopEntry: "org.signal.Signal.desktop", appName: "Signal" }, expected: "org.signal.Signal.desktop" },
+    { notification: { desktopEntry: "", appName: "Terminal" }, expected: "Terminal" },
+    { notification: { desktopEntry: "", appName: "" }, expected: "Notifications" }
+];
+for (const fixture of identityFixtures) {
+    const actual = notificationAppId(fixture.notification);
+    if (actual !== fixture.expected)
+        fail(`stable app identity expected ${fixture.expected}, got ${actual}`);
+}
+
+const defaultRule = normalizedAppRule({});
+if (JSON.stringify(defaultRule) !== JSON.stringify({ enabled: true, showOnLockScreen: true, showContentOnLockScreen: true }))
+    fail(`missing rule fields did not default safely: ${JSON.stringify(defaultRule)}`);
+
+const explicitRule = normalizedAppRule({ enabled: false, showOnLockScreen: false, showContentOnLockScreen: false });
+if (JSON.stringify(explicitRule) !== JSON.stringify({ enabled: false, showOnLockScreen: false, showContentOnLockScreen: false }))
+    fail(`explicit rule was not preserved: ${JSON.stringify(explicitRule)}`);
+
+for (const required of ["rememberApplication", "appRule", "setAppRule", "handleNotification", "shouldShowOnLockScreen", "shouldShowContentOnLockScreen"]) {
+    functionBody(required);
+}
+
+const handler = source.indexOf("function handleNotification(notification: var)");
+const tracked = source.indexOf("notification.tracked = true", handler);
+const muted = source.indexOf("!root.appRule(appId).enabled", handler);
+if (handler === -1 || tracked === -1 || muted === -1 || muted > tracked)
+    fail("muted applications are not rejected before tracking/history/unread/toast work");
+if (!source.includes("root.handleNotification(notification)"))
+    fail("NotificationServer does not delegate delivery to the callable handler");
+if (!source.includes("PreferenceSchema.has(\"notificationAppRules\")"))
+    fail("the schema dependency is not explicit");
+if (!source.includes("DesktopPreferences.get(\"notificationAppRules\")"))
+    fail("rules are not read through DesktopPreferences");
+if (!source.includes("DesktopPreferences.set(\"notificationAppRules\", next)"))
+    fail("rules are not written through DesktopPreferences");
+if (!source.includes("next[knownAppId] = root.appRule(knownAppId)"))
+    fail("persisted rules are not normalized to the required three-field shape");
+if (!source.includes("root.fallbackAppRules = next"))
+    fail("missing-schema preference writes do not retain an in-memory fallback");
+if (!source.includes("if (!root.doNotDisturb)"))
+    fail("global DND popup override was removed");
+for (const required of [
+    "DesktopEntries.applications.values",
+    "DesktopEntries.byId(appId)",
+    "DesktopEntries.heuristicLookup(appId)"
+]) {
+    if (!source.includes(required))
+        fail(`persisted desktop entry ids are not reactively resolved through ${required}`);
+}
+
+for (const required of [
+    "Notifs.applications",
+    "Notifs.appRule(app.id).enabled",
+    "showOnLockScreen",
+    "showContentOnLockScreen",
+    "Notifs.setAppRule"
+]) {
+    if (!page.includes(required))
+        fail(`settings page is missing ${required}`);
+}
+
+console.log("notification application rules contract: PASS");
+'
+
+state_home="$(mktemp -d /tmp/panama-notification-rules-state.XXXXXX)"
+config_home="$(mktemp -d /tmp/panama-notification-rules-config.XXXXXX)"
+data_home="$(mktemp -d /tmp/panama-notification-rules-data.XXXXXX)"
+config_path="$state_home/quickshell"
+harness="$config_path/notification-app-rules-harness.qml"
+shell_log="$state_home/notification-app-rules.log"
+
+cleanup() {
+    if [[ -n "${bus_pid:-}" ]]; then
+        kill "$bus_pid" >/dev/null 2>&1 || true
+    fi
+    rm -rf "$state_home" "$config_home" "$data_home"
+}
+trap cleanup EXIT
+
+cp -a "$repo_dir/config/dot/quickshell" "$config_path"
+cp "$harness_fixture" "$harness"
+mkdir -p "$data_home/applications"
+cp "$desktop_entry_fixture" "$data_home/applications/org.persist.App.desktop"
+
+# This is intentionally a copy-local integration dependency. The production
+# schema is Claude's change; the runtime contract proves persistence only once
+# that key exists and never stages a schema edit from this branch.
+perl -0pi -e 's@(\n        // ── Capture)@\n        {\n            key: "notificationAppRules", type: "json", def: {}, group: "notifications", internal: true\n        },$1@' \
+    "$config_path/config/PreferenceSchema.qml"
+rg -q 'key: "notificationAppRules", type: "json"' "$config_path/config/PreferenceSchema.qml" \
+    || fail 'temporary schema integration key was not installed'
+
+mapfile -t dbus_info < <(dbus-daemon --session --fork --print-address=1 --print-pid=1)
+bus_address="${dbus_info[0]:-}"
+bus_pid="${dbus_info[1]:-}"
+[[ -n "$bus_address" && "$bus_pid" =~ ^[0-9]+$ ]] || fail 'private D-Bus session did not start'
+
+qs_for_test() {
+    DBUS_SESSION_BUS_ADDRESS="$bus_address" \
+        XDG_STATE_HOME="$state_home" XDG_CONFIG_HOME="$config_home" \
+        XDG_DATA_HOME="$data_home" XDG_DATA_DIRS="$data_home" \
+        qs -p "$harness" "$@"
+}
+
+stop_harness() {
+    qs_for_test kill >/dev/null 2>&1 || true
+    for _ in $(seq 1 40); do
+        ! qs_for_test ipc show >/dev/null 2>&1 && return
+        sleep 0.1
+    done
+    fail 'isolated notification harness did not stop cleanly'
+}
+
+start_harness() {
+    qs_for_test --daemonize >"$shell_log" 2>&1
+    for _ in $(seq 1 40); do
+        qs_for_test ipc show 2>/dev/null | rg -q '^target notification-app-rules-test$' && return
+        sleep 0.1
+    done
+    sed -n '1,240p' "$shell_log" >&2
+    fail 'isolated notification harness did not start'
+}
+
+start_harness
+exercise="$(qs_for_test ipc call notification-app-rules-test exercise)"
+jq -e '
+    .appId == "org.signal.Signal.desktop" and
+    .initialRules == {
+        "org.signal.Signal.desktop": {
+            enabled: true,
+            showOnLockScreen: true,
+            showContentOnLockScreen: true
+        }
+    } and
+    .muted == { tracked: false, history: 0, popups: 0, unread: 0 } and
+    .dnd == { tracked: true, history: 1, popups: 0, unread: 1 } and
+    .privacy == { visible: false, content: false } and
+    .fallback == {
+        id: "Fallback Terminal",
+        application: { id: "Fallback Terminal", name: "Fallback Terminal" }
+    }
+' <<<"$exercise" >/dev/null || fail "runtime notification policy fixture failed: $exercise"
+
+persisted="$(qs_for_test ipc call notification-app-rules-test persist)"
+jq -e '. == {
+    "org.persist.App.desktop": {
+        enabled: false,
+        showOnLockScreen: true,
+        showContentOnLockScreen: false
+    }
+}' <<<"$persisted" >/dev/null || fail "runtime persistence fixture wrote the wrong shape: $persisted"
+
+settings_file="$config_home/panama/settings.json"
+for _ in $(seq 1 40); do
+    [[ -f "$settings_file" ]] && jq -e '.notificationAppRules["org.persist.App.desktop"].enabled == false' "$settings_file" >/dev/null && break
+    sleep 0.1
+done
+[[ -f "$settings_file" ]] || fail 'runtime persistence fixture did not write settings.json'
+
+wait_for_persisted_application() {
+    local expected="$1"
+    local applications=""
+    for _ in $(seq 1 80); do
+        applications="$(qs_for_test ipc call notification-app-rules-test applications)"
+        if jq -e '.[] | select(.id == "org.persist.App.desktop" and .name == "Persisted Fixture App")' \
+            <<<"$applications" >/dev/null; then
+            [[ "$applications" == *"$expected"* ]] && printf '%s' "$applications" && return
+        fi
+        sleep 0.1
+    done
+    fail "persisted desktop entry did not resolve to a friendly name: $applications"
+}
+
+before_restart_applications="$(wait_for_persisted_application 'Persisted Fixture App')"
+
+stop_harness
+start_harness
+restored="$(qs_for_test ipc call notification-app-rules-test restored)"
+[[ "$restored" == "$persisted" ]] || fail "notification rules did not survive isolated restart: $restored"
+after_restart_applications="$(wait_for_persisted_application 'Persisted Fixture App')"
+[[ "$before_restart_applications" == *'"id":"org.persist.App.desktop","name":"Persisted Fixture App"'* ]] \
+    || fail "persisted application name was wrong before restart: $before_restart_applications"
+[[ "$after_restart_applications" == *'"id":"org.persist.App.desktop","name":"Persisted Fixture App"'* ]] \
+    || fail "persisted application name was wrong after restart: $after_restart_applications"
+stop_harness
+
+printf 'notification application rules runtime contract: PASS\n'

tests/quickshell/settings-backup-contract.sh

@@ -48,19 +48,21 @@ run save >/dev/null 2>&1 && fail 'backing up a missing settings file reported su
 [[ "$(run list)" == "[]" ]] || fail 'an empty backup directory did not list as empty'
 
 # ── A snapshot round-trips ───────────────────────────────────────────────────
-printf '{"gapsOut":24,"windowRounding":6}' >"$settings"
+printf '{"gapsOut":24,"windowRounding":6,"displays":{"DP-2":{"mode":"3840x2160@60","scale":2,"transform":0}}}' >"$settings"
 mkdir -p "$(dirname "$home")"
 printf '{"initialized":true,"favorites":[{"id":"light.desk","alias":"Desk"}]}' >"$home"
 run save >/dev/null || fail 'save failed on a valid settings file'
 name="$(run list | jq -r '.[0].name')"
 [[ "$name" =~ ^settings-[0-9]{8}-[0-9]{9}\.json$ ]] || fail "unexpected snapshot name: $name"
-[[ "$(run list | jq -r '.[0].keys')" == "2" ]] || fail 'snapshot key count is wrong'
+[[ "$(run list | jq -r '.[0].keys')" == "3" ]] || fail 'snapshot key count is wrong'
 
-printf '{"gapsOut":99}' >"$settings"
+printf '{"gapsOut":99,"displays":{"DP-2":{"mode":"4500x3000@60","scale":1.5,"transform":0}}}' >"$settings"
 printf '{"initialized":false,"favorites":[]}' >"$home"
 restore_result="$(run restore "$name")" || fail 'restore failed'
 [[ "$(jq -r .gapsOut "$settings")" == "24" ]] || fail 'restore did not bring back the snapshot contents'
 [[ "$(jq -r .windowRounding "$settings")" == "6" ]] || fail 'restore lost a key'
+[[ "$(jq -r '.displays["DP-2"].scale' "$settings")" == "1.5" ]] \
+    || fail 'restore bypassed display confirmation by applying snapshot geometry'
 [[ "$(jq -r '.favorites[0].id' "$home")" == "light.desk" ]] || fail 'restore did not bring back Home favourites'
 [[ "$(jq -r '.favorites[0].alias' "$home")" == "Desk" ]] || fail 'restore lost a Home alias'
 jq -e '.home.present == true and .home.data.favorites[0].id == "light.desk"' <<<"$restore_result" >/dev/null \
@@ -77,16 +79,20 @@ absent_result="$(run restore "$absent_name")" || fail 'restore failed for a snap
 jq -e '.home.present == false and (.home | has("data") | not)' <<<"$absent_result" >/dev/null \
     || fail 'restore did not return absent Home state for the live service to reload'
 
-# Desktop absence is symmetric: a Home-only snapshot removes a desktop file
-# created later and restores the Home store.
+# Desktop absence is symmetric for ordinary preferences, but confirmed display
+# geometry is protected state: it must survive even a Home-only snapshot.
 rm -f "$settings"
 printf '{"initialized":true,"favorites":[{"id":"light.porch","alias":"Porch"}]}' >"$home"
 run save >/dev/null || fail 'save failed when desktop settings were absent'
 desktop_absent_name="$(run list | jq -r '.[0].name')"
-printf '{"gapsOut":47}' >"$settings"
+printf '{"gapsOut":47,"windowRounding":9,"displays":{"DP-2":{"mode":"4500x3000@60","scale":1.5,"transform":0}}}' >"$settings"
 printf '{"initialized":false,"favorites":[]}' >"$home"
 run restore "$desktop_absent_name" >/dev/null || fail 'Home-only snapshot restore failed'
-[[ ! -e "$settings" ]] || fail 'restore did not preserve the snapshot’s absent desktop state'
+[[ -e "$settings" ]] || fail 'Home-only restore discarded confirmed display geometry'
+[[ "$(jq -r '.displays["DP-2"].scale' "$settings")" == "1.5" ]] \
+    || fail 'Home-only restore changed confirmed display geometry'
+[[ "$(jq 'keys == ["displays"]' "$settings")" == "true" ]] \
+    || fail 'Home-only restore retained ordinary desktop preferences'
 [[ "$(jq -r '.favorites[0].id' "$home")" == "light.porch" ]] \
     || fail 'Home-only snapshot did not restore Home state'
 assert_transaction_clean

tests/quickshell/settings-backup-live-contract.sh

@@ -43,6 +43,8 @@ for mapping in \
     'HomePreferences.initialize(ids);' \
     'HomePreferences.setAlias(id, alias);' \
     'DesktopPreferences.reload();' \
+    'DesktopPreferences.set("displays", value);' \
+    'Displays.externalChangeBlocked = blocked;' \
     'SystemSettings.applyPersistedDisplayPolicy();' \
     'Keybinds.applyReload();' \
     'Wallpaper.set(path);' \
@@ -82,9 +84,11 @@ jq -e '
         "home.alias:light.desk=Desk",
         "home.alias:light.office=Office",
         "desktop.reload",
+        "display.protect:{\"DP-2\":{\"mode\":\"4500x3000@60\",\"scale\":1.5,\"transform\":0}}",
         "system.apply",
         "keybinds.reload",
         "wallpaper.set:/tmp/restored-wallpaper.jpg",
+        "display.block:false",
         "shell.reload"
     ]
     and .initialized == true
@@ -118,15 +122,26 @@ jq -e '
     .calls == [
         "home.reset",
         "desktop.reload",
+        "display.protect:{\"DP-2\":{\"mode\":\"4500x3000@60\",\"scale\":1.5,\"transform\":0}}",
         "system.apply",
         "keybinds.reload",
         "wallpaper.set:/tmp/restored-wallpaper.jpg",
+        "display.block:false",
         "shell.reload"
     ]
     and .initialized == false
     and .favorites == []
 ' <<<"$status" >/dev/null || fail "absent Home handoff was wrong: $status"
 
+# Restore refuses before launching the helper while a display apply/recovery is
+# active, so no snapshot can race the confirmation boundary.
+qs_test ipc call settings-backup-behavior reset >/dev/null
+[[ "$(qs_test ipc call settings-backup-behavior restoreWhileDisplayBusy)" == "false" ]] \
+    || fail 'snapshot restore started during an active display operation'
+status="$(qs_test ipc call settings-backup-behavior status)"
+jq -e '.calls == [] and (.lastError | contains("display change"))' <<<"$status" >/dev/null \
+    || fail "display-busy restore refusal was not clean: $status"
+
 trap - EXIT
 cleanup
 printf 'settings backup live contract: PASS\n'

tests/quickshell/settings-commit-reset-contract.sh

@@ -20,10 +20,12 @@ set -euo pipefail
 repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 harness="$repo_dir/config/dot/quickshell/settings-system-harness.qml"
 system_settings="$repo_dir/config/dot/quickshell/services/SystemSettings.qml"
+wallpaper_service="$repo_dir/config/dot/quickshell/services/Wallpaper.qml"
 
 # Preferences are committed to $XDG_CONFIG_HOME, and the Home store lives under
 # $XDG_STATE_HOME. Both are isolated so this contract cannot touch the real
-# desktop's settings; the compositor is the live one and is restored below.
+# desktop's settings. The harness replaces the compositor write seam as well,
+# so interruption cannot leave the daily desktop modified.
 config_home="$(mktemp -d /tmp/panama-commit-config.XXXXXX)"
 state_home="$(mktemp -d /tmp/panama-commit-state.XXXXXX)"
 
@@ -37,22 +39,30 @@ rg -Fq 'HomePreferences.resetHomeDefaults();' "$system_settings" \
 if rg -q 'HomePreferences\.(favorites|initialized)\s*=' "$system_settings"; then
     fail 'restoreDefaults mutates Home aliases instead of using resetHomeDefaults'
 fi
+rg -Fq 'root.protectDisplays(protectedDisplays)' "$system_settings" \
+    || fail 'restoreDefaults can apply unconfirmed display geometry during reload'
+rg -Fq 'Keybinds.applyReload();' "$system_settings" \
+    || fail 'restoreDefaults does not replay shipped keybindings'
+rg -Fq 'root.applyWallpaper(String(DesktopPreferences.get("wallpaperPath") ?? ""));' "$system_settings" \
+    || fail 'restoreDefaults does not visibly reapply the shipped wallpaper'
+rg -Fq 'const effectivePath = path === "" ? root.shippedPath : path;' "$wallpaper_service" \
+    || fail 'clearing wallpaper preference leaves the old image visible'
+rg -Fq 'property string storedValue:' "$wallpaper_service" \
+    || fail 'the shipped wallpaper cannot remain represented by the default empty preference'
 
 qs_for_harness() {
-    XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" qs -p "$harness" "$@"
+    XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" \
+        PANAMA_SETTINGS_TEST_ISOLATE_COMPOSITOR=1 qs -p "$harness" "$@"
 }
 
-original_rounding="$(hyprctl -j getoption decoration:rounding | jq -r .int)"
-original_gaps="$(hyprctl -j getoption general:gaps_out | jq -r .css | awk '{print $1}')"
-
 restore() {
-    hyprctl eval "hl.config({ decoration = { rounding = $original_rounding }, general = { gaps_out = $original_gaps } })" >/dev/null 2>&1 || true
     qs_for_harness kill >/dev/null 2>&1 || true
     rm -rf "$config_home" "$state_home"
 }
 trap restore EXIT
 
-XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" qs -p "$harness" --daemonize >/dev/null
+XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" \
+    PANAMA_SETTINGS_TEST_ISOLATE_COMPOSITOR=1 qs -p "$harness" --daemonize >/dev/null
 for _ in $(seq 1 40); do
     qs_for_harness ipc show 2>/dev/null | rg -q '^target settings-system-test$' && break
     sleep 0.1
@@ -65,17 +75,13 @@ qs_for_harness ipc show 2>/dev/null | rg -q '^target settings-system-test$' || f
 [[ "$(qs_for_harness ipc call settings-system-test stored showSeconds)" == "false" ]] \
     || fail 'a local key was not stored'
 
-# ── A compositor key reaches Hyprland, then is stored ────────────────────────
-target_rounding=$(( original_rounding == 11 ? 13 : 11 ))
+# ── A compositor key reaches the verified apply boundary, then is stored ────
+target_rounding=11
 [[ "$(qs_for_harness ipc call settings-system-test commit windowRounding "$target_rounding")" == "true" ]] \
     || fail 'commitPreference refused a compositor key'
-
-for _ in $(seq 1 40); do
-    [[ "$(hyprctl -j getoption decoration:rounding | jq -r .int)" == "$target_rounding" ]] && break
-    sleep 0.1
-done
-[[ "$(hyprctl -j getoption decoration:rounding | jq -r .int)" == "$target_rounding" ]] \
-    || fail "a compositor-backed commit did not reach Hyprland (rounding=$(hyprctl -j getoption decoration:rounding | jq -r .int))"
+apply_state="$(qs_for_harness ipc call settings-system-test applyState)"
+jq -e '.[-1].windowRounding == 11' <<<"$apply_state" >/dev/null \
+    || fail "a compositor-backed commit did not reach the apply boundary: $apply_state"
 [[ "$(qs_for_harness ipc call settings-system-test stored windowRounding)" == "$target_rounding" ]] \
     || fail 'a verified compositor commit was not stored'
 
@@ -92,6 +98,9 @@ before="$(qs_for_harness ipc call settings-system-test stored windowRounding)"
 # ── Reset spans every store, not just the schema one ─────────────────────────
 qs_for_harness ipc call settings-system-test seedHome >/dev/null
 qs_for_harness ipc call settings-system-test commit dockHideDelayMs 900 >/dev/null
+display_fixture='{"DP-2":{"mode":"4500x3000@60","scale":1.5,"transform":0}}'
+[[ "$(qs_for_harness ipc call settings-system-test commit displays "$display_fixture")" == "true" ]] \
+    || fail 'the protected display fixture did not apply'
 sleep 0.4
 
 home_before="$(qs_for_harness ipc call settings-system-test homeState)"
@@ -100,24 +109,33 @@ jq -e '.count == 1 and .initialized == true' <<<"$home_before" >/dev/null \
 [[ "$(qs_for_harness ipc call settings-system-test stored dockHideDelayMs)" == "900" ]] \
     || fail 'the dock fixture did not apply'
 
-qs_for_harness ipc call settings-system-test restoreDefaults >/dev/null
+[[ "$(qs_for_harness ipc call settings-system-test restoreDefaults)" == "true" ]] \
+    || fail 'restoreDefaults refused a safe reset'
 sleep 0.6
 
+reset_state="$(qs_for_harness ipc call settings-system-test resetState)"
+jq -e '.calls == [
+    "display.block:true",
+    "display.protect",
+    "keybinds.reload",
+    "wallpaper.set:",
+    "display.block:false"
+] and .displayBlocked == false' <<<"$reset_state" >/dev/null \
+    || fail "reset did not safely replay non-reactive state: $reset_state"
+
 [[ "$(qs_for_harness ipc call settings-system-test stored dockHideDelayMs)" == "250" ]] \
     || fail 'reset did not restore a schema default'
+[[ "$(qs_for_harness ipc call settings-system-test stored displays | jq -cS .)" == "$(jq -cS . <<<"$display_fixture")" ]] \
+    || fail 'reset replaced confirmed display geometry without confirmation'
 
 home_after="$(qs_for_harness ipc call settings-system-test homeState)"
 jq -e '.count == 0 and .initialized == false' <<<"$home_after" >/dev/null \
     || fail "reset left the Home accessory store customised: $home_after"
 
-# Resetting a stored value does not by itself tell Hyprland anything, so the
-# reset must re-apply compositor-backed defaults too.
-for _ in $(seq 1 40); do
-    [[ "$(hyprctl -j getoption decoration:rounding | jq -r .int)" == "18" ]] && break
-    sleep 0.1
-done
-[[ "$(hyprctl -j getoption decoration:rounding | jq -r .int)" == "18" ]] \
-    || fail "reset did not re-apply the compositor default (rounding=$(hyprctl -j getoption decoration:rounding | jq -r .int))"
+# Resetting a stored value does not itself apply compositor policy, so the last
+# isolated batch must contain the shipped default.
+jq -e '.appliedBatches[-1].windowRounding == 18' <<<"$reset_state" >/dev/null \
+    || fail "reset did not re-apply the compositor default: $reset_state"
 
 trap - EXIT
 restore

tests/quickshell/sound-page-contract.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# The Sound page is a first-class PipeWire control surface, not a launcher for
+# another settings app. This contract keeps the real device plumbing shared
+# with Quick Settings and verifies the controls that must remain available.
+
+set -euo pipefail
+
+repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+sound_page="$repo_dir/config/dot/quickshell/modules/settings/SoundPage.qml"
+device_list="$repo_dir/config/dot/quickshell/modules/settings/SoundDeviceList.qml"
+device_row="$repo_dir/config/dot/quickshell/modules/settings/SoundDeviceRow.qml"
+balance="$repo_dir/config/dot/quickshell/modules/settings/AudioBalance.qml"
+audio_devices="$repo_dir/config/dot/quickshell/services/AudioDevices.qml"
+sound_feedback="$repo_dir/config/dot/quickshell/services/SoundFeedback.qml"
+quick_devices="$repo_dir/config/dot/quickshell/modules/quicksettings/AudioDeviceList.qml"
+harness="$repo_dir/config/dot/quickshell/sound-page-harness.qml"
+config_home="$(mktemp -d /tmp/panama-sound-config.XXXXXX)"
+state_home="$(mktemp -d /tmp/panama-sound-state.XXXXXX)"
+
+fail() {
+    printf 'sound page contract: %s\n' "$1" >&2
+    exit 1
+}
+
+qs_for_harness() {
+    XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" qs -p "$harness" "$@"
+}
+
+cleanup() {
+    qs_for_harness kill >/dev/null 2>&1 || true
+    rm -rf "$config_home" "$state_home"
+}
+trap cleanup EXIT
+
+for file in "$sound_page" "$device_list" "$device_row" "$balance" "$audio_devices" "$sound_feedback" "$quick_devices"; do
+    [[ -f "$file" ]] || fail "missing ${file#"$repo_dir/"}"
+done
+
+# One shared source of truth owns device discovery and default selection.
+rg -Fq 'pragma Singleton' "$audio_devices" || fail 'audio device service is not a singleton'
+rg -Fq 'Singleton {' "$audio_devices" || fail 'audio device service has no singleton root'
+rg -Fq 'PwNodeType.AudioSource' "$audio_devices" || fail 'audio sources are not filtered by PipeWire type'
+rg -Fq 'Pipewire.preferredDefaultAudioSink = node;' "$audio_devices" || fail 'output selection does not reach PipeWire'
+rg -Fq 'Pipewire.preferredDefaultAudioSource = node;' "$audio_devices" || fail 'input selection does not reach PipeWire'
+rg -Fq 'AudioDevices.outputs' "$quick_devices" || fail 'Quick Settings does not share output discovery'
+rg -Fq 'AudioDevices.inputs' "$quick_devices" || fail 'Quick Settings does not share input discovery'
+rg -Fq 'AudioDevices.select(root.output, node)' "$quick_devices" || fail 'Quick Settings does not share device selection'
+
+# Every hardware row binds its node before reading/writing audio state.
+rg -Fq 'PwObjectTracker {' "$device_row" || fail 'device rows do not bind PipeWire objects'
+rg -Fq 'root.node.audio.muted = !root.node.audio.muted;' "$device_row" || fail 'device mute is not writable'
+rg -Fq 'root.node.audio.volume = value;' "$device_row" || fail 'per-device volume is not writable'
+rg -Fq 'PwNodePeakMonitor {' "$device_row" || fail 'input rows have no level monitor'
+rg -Fq 'enabled: !root.output && root.selected' "$device_row" || fail 'input monitoring is not scoped to the selected source'
+
+# Stereo hardware gets a real channel balance control.
+rg -Fq 'PwAudioChannel.FrontLeft' "$balance" || fail 'balance does not identify the left channel'
+rg -Fq 'PwAudioChannel.FrontRight' "$balance" || fail 'balance does not identify the right channel'
+rg -Fq 'root.node.audio.volumes = next;' "$balance" || fail 'balance does not write per-channel volume'
+
+[[ "$(rg -c 'SoundDeviceList \{' "$sound_page")" -eq 2 ]] || fail 'Sound page does not expose output and input device lists'
+rg -Fq 'AudioBalance {' "$sound_page" || fail 'Sound page has no output balance control'
+rg -Fq 'SystemSettings.openGnomePanel("sound")' "$sound_page" || fail 'advanced GNOME Sound handoff was removed'
+rg -Fq 'SoundFeedback.setEventSounds(checked)' "$sound_page" || fail 'event sounds are not controllable'
+rg -Fq 'SoundFeedback.setInputFeedback(checked)' "$sound_page" || fail 'input feedback sounds are not controllable'
+rg -Fq 'org.gnome.desktop.sound' "$sound_feedback" || fail 'sound feedback does not use the desktop sound schema'
+
+# Native bindings are the supported path. Shelling out would race the service
+# that owns these same objects and regress Quick Settings coherence.
+if rg -q '\b(Process|pactl|wpctl)\b' "$audio_devices" "$device_list" "$device_row" "$balance"; then
+    fail 'Sound controls bypass the Quickshell PipeWire service'
+fi
+
+printf 'sound page static contract: PASS\n'
+
+# Instantiate the complete page against the real, read-only PipeWire graph.
+# Merely constructing these controls must never change a default or volume.
+qs_for_harness --daemonize >/dev/null
+for _ in $(seq 1 60); do
+    qs_for_harness ipc show 2>/dev/null | rg -q '^target sound-page-test$' && break
+    sleep 0.1
+done
+qs_for_harness ipc show 2>/dev/null | rg -q '^target sound-page-test$' \
+    || fail 'Sound page harness did not start'
+
+for _ in $(seq 1 60); do
+    status="$(qs_for_harness ipc call sound-page-test status)"
+    [[ "$(jq -r .ready <<<"$status")" == "true" ]] && break
+    sleep 0.1
+done
+jq -e '.ready == true and .outputs > 0 and .inputs > 0
+    and (.defaultOutput | length > 0) and (.defaultInput | length > 0)' \
+    <<<"$status" >/dev/null \
+    || fail "real PipeWire graph was not represented: $status"
+
+trap - EXIT
+cleanup
+printf 'sound page runtime: PASS (%s outputs, %s inputs)\n' \
+    "$(jq -r .outputs <<<"$status")" "$(jq -r .inputs <<<"$status")"