# Vision review — synthesis of three lenses

Three parallel read-only reviews of the completed settings redesign (honesty audit,
completeness vs GNOME/macOS/KDE, product coherence), 2026-08-24, HEAD `be0e552`. Full
agent reports live in the session transcript; this file is the ranked synthesis. Companion
to the /code-review ultra run of the same day.

## The one-sentence verdicts

- **Honesty**: clears the bar on breadth and intent; thinnest at the last mile — the honesty
  is computed in the services and then dropped by one line of glue at the surface.
- **Completeness**: "has thoroughly won the argument that it is a complete settings app; has
  not yet made the argument that it is a *Hyprland* settings app."
- **Coherence**: 8/10 as one product; the deficit is component adoption, not design
  disagreement — the phases wrote down every shared abstraction and then copy-pasted it.

## Tier 0 — bugs to fix now (shipped-broken behavior)

1. **DND exceptions are dead** — `Toasts.qml:15` re-gates on `!Notifs.doNotDisturb`,
   overriding the service's three-way decision. Allowed apps chime + flash and never show.
   Fix: `visible: Notifs.popups.length > 0`.
2. **Restore-defaults safety snapshot races the wipe** — `takeSafetySnapshot()` returns at
   launch; the reset rewrites settings.json before the async helper reads it. The "undoable"
   promise records the post-reset defaults. Fix: completion signal, reset inside it, abort on
   snapshot failure.
3. **Reset confirm lies about dock pins** — "Pinned applications … are not changed" while
   `resetDesktopDefaults` restores the shipped 16-app dock. Fix the sentence.
4. **Manual proxy deadlock** — host and port each refuse to commit until the other is set;
   neither can ever be first, and manual mode is already engaged. Fix: page-local drafts,
   commit when both present.
5. **"Close the range" closes one of two protocols** — the mutation loop discards every
   iteration after the first; Fedora's zone has tcp AND udp ranges. Fix: multi-spec verb or
   pending-mutation queue.
6. **Reassurance without measurement** ×3 on Privacy — device-security "everything
   recommended" over a parse failure; "No app has asked" over an unread portal; live tiles
   "Idle" with pw-dump absent. The `scanned`/`available`/`initialized` flags exist unread.
   Same class: failed update check renders "Up to date" (`panama-updates` exit-code
   swallow); health sidebar footer green beside a red unavailable hero (flag precedence).
7. **User-deletion consent names a guessed path** — `"/home/" + userName` in the armed
   confirm; the helper reports the real HomeDirectory unread.
8. **VRR picker snaps back mid-confirmation** — reads the persisted store instead of
   `pendingRequestedLayout` during the keep-or-revert window.
9. **Quicksettings scan killed by the settings service** — `Connectivity.active` false
   re-syncs `scannerEnabled` off under an open panel stuck at "Searching…". Refcount the
   hold.
10. **Dictation try-it can type someone else's recording** — "Listening…" set even on
    `already-recording`; mic test has no error surface at all.

## Tier 1 — the safety layer (one pass, one file first)

- `SettingsButton` carries the two-press contract in a comment and enforces nothing: add
  keyboard focus/keys/ring + make the seven one-press destructive buttons two-stage
  (BluetoothPanel Forget, FocusModeRow Delete, ThemeSaveRow Delete, HomeFavoriteCard Remove,
  UsersPage avatar Remove, SshKeysPage agent Remove, DisplayPanelHeader Forget) — then the
  nine more from the honesty audit's finding 11 (theme cards, override reset, history clear,
  RDP creds, BT quicksettings trash glyph, print-job cancel, display Forget, default-zone
  change; snapshot-delete and powermenu name their consequence).
- Promote three patterns to components so they can't be forgotten: **ConfirmAction**
  (two-stage, one-armed-at-a-time, Keep/Verb…/Verb it), **ErrorRow** (in-card placement,
  "<Subject> needs attention"), **"not measured, because—"** state for status surfaces.
  Add the idiom contract the coherence review specifies so drift fails the build.

## Tier 2 — identity features (the "Hyprland settings app" argument)

1. **Custom keyboard shortcuts** (schema `customBinds` → keybinds.lua, ShortcutCapture
   reused) — build the user-config-through-schema mechanism properly;
2. **Window rules editor** rides the same mechanism (float/workspace/size/opacity scope
   first; match captured from the live window);
3. **Gesture bindings** complete the trio.
4. **Search tokenization** + the named holes (log out, wired, metered, gestures…) + route
   through `openSettingsSection` so results land on the right tab (mechanism exists, one
   caller).
5. **Kill the last dead doors**: GNOME "system" umbrella button on Health (contract can't
   see it — add `[system]=about` to OWNED), the Wellbeing handoff (inert without
   gnome-shell) → replace with native screen time/break reminders; the phantom "per-device
   input stays with GNOME" comment.
6. **Network round-out**: static IP/DNS/metered/saved networks/hidden SSID (new
   panama-network verbs).
7. Smaller: DND quick-settings tile, color filters via `decoration:screen_shader`,
   Bluetooth device management depth (trust/rename/adapter, D-Bus already exposes it),
   keyboard layout list (evdev.lst already parsed), first-run offering import + theme,
   Displays rescan row, removable-drive mount, launcher toggle verbs (dark mode first),
   per-app hub drill-in, uncapped lists (known_hosts worst; MyHome entities double-render;
   quicksettings Wi-Fi/BT lists whose settings twins carry the bounding comments).

## Tier 3 — coherence convergence (four passes, first two ≈ a day)

Pass 1 the safety layer (above). Pass 2 adopt existing components (SectionLabel ×9,
StatusBadge rename + 6 hand-rolls, SettingsChip ×4, chip height 26, guard the 12 unguarded
refresh-on-open). Pass 3 the two extractions + idiom contract. Pass 4 copy & docs: search
section-routing, 12 README errors, 5 manual errors + 14 unmentioned categories, one spelling
each of colour/app, detail-punctuation rule, 29 essay-details into SettingsNote.

## Recorded honest state (not findings)

Tier-2 deferrals all verified recorded in-tree (mono audio, sticky keys, rollback, PPDs,
Samba, hibernate, etc.). All 190 schema keys have genuine readers. Zero dead components,
complete qmldir, uniform disclosure/lede/button conventions. The manual's structure is
contract-pinned; its content is not (that gap is Tier 3 Pass 4).