fix(theme): guard color first paint and flatten composer fill

.github/workflows/ci.yml

@@ -58,6 +58,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Check portable shell scripts
+        run: /bin/sh tests/shell-scripts.sh
+
       # The Tauri stack needs a webview toolchain to compile at all.
       - name: Install Tauri system dependencies
         run: |

.github/workflows/qa-panel.yml

@@ -9,10 +9,9 @@ name: QA panel
 # frontend and QA changes while making a UI dependency bump prove the exact
 # package it resolves before that pull request can merge.
 #
-# Pull requests run the input-component contract groups and tree integrity.
-# Manual runs can execute every declared outcome and optionally reconcile every
-# control instance, keeping historical whole-application debt separate from a
-# focused component regression gate.
+# Pull requests run every declared outcome plus tree integrity. Manual runs can
+# still select a focused group while authoring, or add inventory reconciliation
+# and lifecycle checks for the exhaustive release audit.
 on:
   pull_request:
     paths:
@@ -21,6 +20,7 @@ on:
       - 'apps/gui/frontend/src/**'
       - 'ps-qa.ron'
       - 'scripts/qa-profile-restore.sh'
+      - 'scripts/qa-memory-navigation.sh'
       - 'scripts/qa-run-groups.sh'
       - 'tests/ps-qa/**'
   workflow_dispatch:
@@ -53,6 +53,9 @@ jobs:
     # for a cold release build and cleanup, but never leave a stale QA process
     # occupying a runner for an hour.
     timeout-minutes: 30
+    defaults:
+      run:
+        shell: zsh {0}
     steps:
       - uses: actions/checkout@v4
 
@@ -71,8 +74,7 @@ jobs:
       # spending minutes building or launching an app with an incompatible
       # harness release.
       - name: Install ps-qa
-        # Compatible 0.4 releases preserve the reviewed QA profile contract.
-        run: cargo install ps-qa --version '^0.4.4'
+        run: cargo install ps-qa
 
       - name: Validate the QA profile and outcome manifest
         run: ps-qa --app ps-qa.ron list --checks tests/ps-qa
@@ -120,6 +122,7 @@ jobs:
         run: |
           launch_app() {
             HOME=/tmp/qa-home AZ_DATA_DIR=/tmp/qa-profile-db \
+              AZ_QA_WORKSPACE_ROOT=/tmp/qa-profile-db-workspace \
               ./target/release/az-gui --blitz-control > /tmp/az-qa.log 2>&1 &
             echo $! > /tmp/az-qa.pid
           }
@@ -169,7 +172,7 @@ jobs:
 
       - name: Run the focused input checks
         id: checks
-        if: ${{ github.event_name == 'pull_request' || inputs.group != '' || inputs.suite == 'focused' }}
+        if: ${{ github.event_name == 'workflow_dispatch' && (inputs.group != '' || inputs.suite == 'focused') }}
         continue-on-error: true
         timeout-minutes: 3
         env:
@@ -198,7 +201,7 @@ jobs:
       # a blank group, after the focused regression is green.
       - name: Run the complete behavior audit
         id: full
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.group == '' && inputs.suite != 'focused' }}
+        if: ${{ github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.group == '' && inputs.suite != 'focused') }}
         continue-on-error: true
         timeout-minutes: 3
         env:
@@ -217,7 +220,7 @@ jobs:
         timeout-minutes: 3
         run: |
           set -o pipefail
-          ps-qa inventory 2>&1 | tee /tmp/cover.txt
+          ps-qa inventory --require-outcomes 2>&1 | tee /tmp/cover.txt
           components="$(awk '/^components:/ { print $2; exit }' /tmp/cover.txt)"
           unverified="$(awk '/^unverified:/ { print $2; exit }' /tmp/cover.txt)"
           isolated="$(awk '/^isolated:/ { print $2; exit }' /tmp/cover.txt)"
@@ -238,19 +241,19 @@ jobs:
           ps-qa reconcile /tmp/cover.txt --checks tests/ps-qa \
             2>&1 | tee /tmp/sweep.txt
 
+      - name: Verify native navigation memory plateaus
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.group == '' && inputs.suite == 'exhaustive' && steps.full.outcome == 'success' }}
+        timeout-minutes: 2
+        run: scripts/qa-memory-navigation.sh
+
       - name: Verify the inspection toggle disconnects control
         id: isolated
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.group == '' && inputs.suite == 'exhaustive' && steps.full.outcome == 'success' }}
+        if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.group == '' && inputs.suite == 'exhaustive')) && steps.full.outcome == 'success' }}
         continue-on-error: true
         run: |
-          ps-qa click Settings
-          sleep 2
-          ps-qa click "Enable inspection and agent control" \
+          ps-qa click '#tabs-settings'
+          ps-qa click '#settings-inspection-control' \
             > /tmp/isolated.txt 2>&1 || true
-          if ps-qa nodes > /tmp/isolated-probe.txt 2>&1; then
-            ps-qa click "Enable inspection and agent control" \
-              >> /tmp/isolated.txt 2>&1 || true
-          fi
           disconnected=0
           for _ in $(seq 1 20); do
             if ! ps-qa nodes > /tmp/isolated-probe.txt 2>&1; then
@@ -268,22 +271,41 @@ jobs:
       # stopped at the first failure and silently hid later lifecycle failures.
       - name: Enforce complete QA outcome
         if: always()
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REQUESTED_GROUP: ${{ inputs.group }}
+          REQUESTED_SUITE: ${{ inputs.suite }}
+          INTEGRITY_OUTCOME: ${{ steps.integrity.outcome }}
+          FOCUSED_OUTCOME: ${{ steps.checks.outcome }}
+          FULL_OUTCOME: ${{ steps.full.outcome }}
+          INVENTORY_OUTCOME: ${{ steps.inventory.outcome }}
+          SWEEP_OUTCOME: ${{ steps.sweep.outcome }}
+          ISOLATED_OUTCOME: ${{ steps.isolated.outcome }}
         run: |
           failed=0
-          for gate in \
-            'tree integrity:${{ steps.integrity.outcome }}' \
-            'focused input checks:${{ steps.checks.outcome }}' \
-            'complete behavior audit:${{ steps.full.outcome }}' \
-            'reachability inventory:${{ steps.inventory.outcome }}' \
-            'semantic sweep:${{ steps.sweep.outcome }}' \
-            'inspection toggle:${{ steps.isolated.outcome }}'; do
-            name="${gate%%:*}"
-            outcome="${gate#*:}"
-            if [ "$outcome" = failure ]; then
+          require_gate() {
+            local name="$1"
+            local outcome="$2"
+            if [[ "$outcome" != success ]]; then
               echo "$name failed" >&2
               failed=1
             fi
-          done
+          }
+
+          require_gate 'tree integrity' "$INTEGRITY_OUTCOME"
+          if [[ "$EVENT_NAME" == pull_request ]]; then
+            require_gate 'complete behavior audit' "$FULL_OUTCOME"
+            require_gate 'inspection toggle' "$ISOLATED_OUTCOME"
+          elif [[ -n "$REQUESTED_GROUP" || "$REQUESTED_SUITE" == focused ]]; then
+            require_gate 'focused input checks' "$FOCUSED_OUTCOME"
+          else
+            require_gate 'complete behavior audit' "$FULL_OUTCOME"
+          fi
+          if [[ "$EVENT_NAME" == workflow_dispatch && -z "$REQUESTED_GROUP" && "$REQUESTED_SUITE" == exhaustive ]]; then
+            require_gate 'reachability inventory' "$INVENTORY_OUTCOME"
+            require_gate 'semantic sweep' "$SWEEP_OUTCOME"
+            require_gate 'inspection toggle' "$ISOLATED_OUTCOME"
+          fi
           exit "$failed"
 
       - name: Summary

.github/workflows/release-experimental.yml

@@ -88,7 +88,7 @@ jobs:
       # See the same step in release.yml: the crates.io build of the CLI the
       # npm package shims, so the release path never needs Node.
       - name: Install the Tauri CLI
-        run: cargo install tauri-cli --version "^2.11"
+        run: cargo install tauri-cli
 
       - name: Build the AgencyProxy sidecar
         run: scripts/stage-agency-proxy-sidecar.sh

.github/workflows/release.yml

@@ -147,7 +147,7 @@ jobs:
       # package is a thin Node shim around this binary, so taking it from
       # crates.io is what keeps Node out of the release path entirely.
       - name: Install the Tauri CLI
-        run: cargo install tauri-cli --version "^2.11"
+        run: cargo install tauri-cli
 
       - name: Build the AgencyProxy sidecar
         run: scripts/stage-agency-proxy-sidecar.sh

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.8.41"
+version = "0.8.48"
 edition = "2024"
 publish = false
 
@@ -21,8 +21,12 @@ az-core = { path = "crates/core" }
 # time rather than at build time. Both are declared here so the pair cannot
 # drift: the crates inherit these, and sidecar staging asks cargo for the
 # resolved version instead of re-parsing the manifest to check they match.
-agency-proxy-client = "0.1.7"
-agency-proxy-protocol = "0.1.7"
+agency-proxy-client = "^0.1.8"
+agency-proxy-protocol = "^0.1.8"
+# The GUI and both storage tools compile the same schema against one resolved
+# WorkTable package. A workspace dependency prevents their compatible ranges
+# from drifting into separate copies without freezing the selected patch.
+worktable = "1.0.0-beta.11"
 
 # Heavy deps are declared per-crate on purpose: only apps/gui pulls in the
 # Tauri stack, so agent/proxy builds never trigger a webview toolchain build.
@@ -45,6 +49,38 @@ agency-proxy-protocol = "0.1.7"
 debug = 0
 incremental = true
 
+# The frontend is JavaScript interpreted by Boa. Leaving the interpreter at
+# dev's default opt-level 0 made a small Solid reaction take ~300ms in the QA
+# build while the renderer itself took single-digit milliseconds. Keep AZ's own
+# crates quick to compile, but build the long-lived script runtime like runtime
+# code rather than like code under source-level debugging.
+[profile.dev.package.ps-boa-engine]
+opt-level = 2
+
+[profile.dev.package.ps-boa-gc]
+opt-level = 2
+
+[profile.dev.package.ps-boa-string]
+opt-level = 2
+
+[profile.dev.package.ps-blitz-script]
+opt-level = 2
+
+# Pixel QA uses the renderer's real CPU paint path. At opt-level 0 even a
+# 32x32 crop spends seconds repainting the window, so the inspector times out
+# before it can compare first paint with the post-hover frame.
+[profile.dev.package.ps-blitz-paint]
+opt-level = 2
+
+[profile.dev.package.ps-anyrender-vello-cpu]
+opt-level = 2
+
+[profile.dev.package.ps-vello-cpu]
+opt-level = 2
+
+[profile.dev.package.ps-glifo]
+opt-level = 2
+
 [profile.test]
 # Tests need assertions and line-bearing panic output, not debugger symbols.
 debug = 0

apps/blitz-preview/Cargo.toml

@@ -14,14 +14,14 @@ build = "build.rs"
 # with it the only genuinely headless path, from building at all.
 anyrender = { package = "ps-anyrender", version = "^0.13.0" }
 anyrender_vello_cpu = { package = "ps-anyrender-vello-cpu", version = "^0.16.0", optional = true }
-blitz-dom = { package = "ps-blitz-dom", version = "^0.3.0-beta.11", features = ["system-fonts"] }
-blitz-paint = { package = "ps-blitz-paint", version = "^0.3.0-beta.11", features = ["scrollbars"] }
-blitz-script = { package = "ps-blitz-script", version = "^0.3.0-beta.11", features = ["system-fonts"] }
-blitz-traits = { package = "ps-blitz-traits", version = "^0.3.0-beta.11" }
+blitz-dom = { package = "ps-blitz-dom", version = "^0.3", features = ["system-fonts"] }
+blitz-paint = { package = "ps-blitz-paint", version = "^0.3", features = ["scrollbars"] }
+blitz-script = { package = "ps-blitz-script", version = "^0.3", features = ["system-fonts"] }
+blitz-traits = { package = "ps-blitz-traits", version = "^0.3" }
 brotli = { version = "^8.0.4", default-features = false, features = ["std"] }
 png = { version = "^0.18.1", optional = true }
 tauri = { version = "^2.11.5", default-features = false, features = ["compression"] }
-tauri-runtime-blitz = "^0.1.0"
+tauri-runtime-blitz = "^0.3"
 url = "^2.5.8"
 
 # For `--offscreen`: the activation policy has to be set before any window
@@ -36,7 +36,9 @@ brotli = { version = "^8.0.4", default-features = false, features = ["std"] }
 tauri-build = { version = "^2.6.3", features = [] }
 
 [dev-dependencies]
-usvg = "^0.46.0"
+# Use the renderer's SVG fork so geometry assertions inspect the exact tree
+# type produced by Blitz instead of compiling a second, incompatible `usvg`.
+usvg = { package = "ps-usvg", version = "^0.48.1" }
 
 [features]
 capture = ["dep:anyrender_vello_cpu", "dep:png"]

apps/blitz-preview/build.rs

@@ -38,9 +38,6 @@ fn compress_asset(path: &Path, output: &Path, quality: u32) -> usize {
     input.len()
 }
 
-
-
-
 /// Drop framework load commands that nothing in this binary references.
 ///
 /// On macOS `tauri` and `tauri-runtime` depend on `objc2-web-kit`