`system_dependencies` holds apt PACKAGE names; checking `which <name>` only coincides with "installed" when the name equals its command (pandoc, rsync). Names like poppler-utils / texlive-latex-base / docker-compose-plugin have no binary of that name, so the functional? predicate wrongly reported them unmet. Fall back to `dpkg -s` (the real "installed" check) after the PATH fast-path.