Add native desktop themes and platform fidelity testing

.github/actionlint.yaml

@@ -0,0 +1,11 @@
+# actionlint configuration. See scripts/check-workflows.sh.
+
+self-hosted-runner:
+  # windows-11-arm is a REAL GitHub-hosted label -- parparvm-tests-windows.yml runs on it
+  # and has done for months. actionlint ships a static list of known labels and that list
+  # lags GitHub's, so the label is reported as unknown.
+  #
+  # Declared here rather than by muting the runner-label rule, so a genuine typo in a
+  # runs-on is still caught.
+  labels:
+    - windows-11-arm

.github/workflows/_build-mac-port.yml

@@ -33,6 +33,9 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Verify native macOS font aliases with AppKit
+        run: python3 scripts/test_mac_native_font.py
+
       - name: Cache CocoaPods and user gems
         uses: actions/cache@v5
         with:
@@ -204,7 +207,7 @@ jobs:
 
       - name: Build macOS port
         if: steps.cn1_built.outputs.cache-hit != 'true'
-        run: ./scripts/build-mac-port.sh -q -DskipTests
+        run: ./scripts/build-mac-port.sh -q -Dtest=MacNativeFontModeTest -Dsurefire.failIfNoSpecifiedTests=false
         timeout-minutes: 40
 
       - name: Report cache outcome

.github/workflows/check-workflows.yml

@@ -0,0 +1,59 @@
+name: Check workflows
+
+# A workflow file GitHub rejects is not a broken job, it is a broken BRANCH: an invalid
+# file produces a failed check run on every push to every branch that contains it,
+# regardless of that workflow's own triggers and regardless of what the push touched. The
+# only symptom is "This run likely failed because of a workflow file issue" with no log,
+# which reads like infrastructure noise rather than a file someone has to fix.
+#
+# That happened here. A job-level `if:` referencing the `matrix` context took two unrelated
+# pull requests red for hours. Nothing local objected, because the file is valid YAML --
+# yaml.safe_load parses it, an editor shows nothing, and the error exists only in GitHub's
+# own expression parser. actionlint reimplements that parser.
+#
+# Runs on pull_request as well as push, because the point is to catch the file BEFORE it
+# reaches a branch other people build on. It is cheap: one ubuntu minute, no build.
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+jobs:
+  check-workflows:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      # Deliberately NOT filtered by paths. A workflow file is only one of the ways this
+      # check goes stale: actionlint's own rules move, and a run over an unchanged tree
+      # that starts failing is information rather than noise.
+      - name: Validate every workflow file
+        run: scripts/check-workflows.sh
+
+      # This workflow is unfiltered, so changes to the spec, its validator, or any
+      # native reference table are checked before they reach master.
+      - name: Validate fidelity spec and native reference tables
+        run: |
+          python3 scripts/test_check_fidelity_spec.py
+          python3 scripts/check-fidelity-spec.py
+
+      - name: Check desktop hover queues under saturation
+        run: python3 scripts/test_native_hover_queue.py
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Check fidelity baseline coverage enforcement
+        run: |
+          python3 scripts/test_fidelity_gate.py
+          python3 scripts/test_fidelity_geometry.py

.github/workflows/fidelity-desktop-native-ref.yml

@@ -0,0 +1,151 @@
+---
+name: Desktop native reference capture
+
+# Captures REAL native desktop widget screenshots -- Windows 11 Fluent (WinUI 3),
+# macOS (AppKit) and GNOME (GTK4 + libadwaita) -- on hosted runners, and uploads
+# them for human review. It commits nothing and gates nothing.
+#
+# MANUAL DISPATCH ONLY, on purpose. There is deliberately no schedule and no path
+# filter. A native reference *defines* the design generation the themes are
+# authored against; a job that re-captured it on its own would quietly re-anchor
+# that definition, turning a real OS-level design change into a green build. This
+# is the same doctrine scripts/build-ios-native-ref.sh and
+# scripts/build-android-native-ref.sh already state for the mobile references,
+# which CI is likewise forbidden from generating.
+#
+# Why the maintainer's own machine cannot do this: a working developer's Mac has a
+# chosen accent colour, a chosen appearance and custom fonts, and there is no
+# pristine Windows 11 or GNOME box to hand. The hosted runner IS the pristine
+# machine -- which is the whole reason this workflow exists.
+#
+# Promotion of an artifact into a committed golden set is a human act with a
+# written protocol: scripts/fidelity-app/goldens/README.md.
+
+'on':
+  workflow_dispatch:
+    inputs:
+      targets:
+        description: 'Which reference toolkits to run'
+        required: true
+        default: all
+        type: choice
+        options: [all, windows, macos, gnome]
+      mode:
+        description: 'probe = answer the environment go/no-go questions only; capture = produce reference tiles'
+        required: true
+        default: probe
+        type: choice
+        options: [probe, capture]
+      windows_runner:
+        description: 'windows-11-arm is a real Windows 11 client; windows-latest is Windows SERVER (Mica falls back silently)'
+        required: false
+        default: windows-11-arm
+        type: choice
+        options: [windows-11-arm, windows-latest]
+
+# No concurrency group at all, which took two tries to get right.
+#
+# Cancelling in progress -- copied from the PR-gating workflows, where a superseded commit's
+# result is genuinely worthless -- is wrong here: a capture run exists to produce evidence,
+# and a second dispatch to iterate on one platform would destroy the answer the first was
+# dispatched for.
+#
+# But merely turning cancellation off is not enough, because the group still serialises.
+# Measured: a Windows-only dispatch sat in `pending` behind an unrelated run whose macOS leg
+# had been waiting an hour for a runner, so the cheap 3-minute leg could not iterate at all.
+# The legs are independent and a human dispatches this a few times a day; there is no
+# pile-up to protect against, and any grouping only couples platforms that share nothing.
+
+permissions:
+  contents: read
+
+jobs:
+  gnome-ref:
+    if: ${{ inputs.targets == 'all' || inputs.targets == 'gnome' }}
+    name: GNOME (GTK4 + libadwaita)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CN1SS_FIDELITY_GOLDEN_SET: gnome-adwaita
+      NATIVEREF_MODE: ${{ inputs.mode }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install the GTK4 / libadwaita stack
+        run: |
+          scripts/ci/apt-get-install.sh \
+            libgtk-4-dev libadwaita-1-dev adwaita-icon-theme fonts-cantarell \
+            xvfb openbox dbus-x11 libgl1-mesa-dri
+      - name: Capture
+        run: scripts/build-gnome-native-ref.sh
+      - name: Report the environment this run saw
+        if: always()
+        run: |
+          echo '--- capture-manifest.json ---'
+          cat artifacts/desktop-native-ref/gnome/capture-manifest.json || true
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: desktop-native-ref-gnome
+          path: artifacts/desktop-native-ref/gnome/**
+          if-no-files-found: error
+          retention-days: 14
+
+  windows-ref:
+    if: ${{ inputs.targets == 'all' || inputs.targets == 'windows' }}
+    name: Windows (WinUI 3 / Fluent)
+    runs-on: ${{ inputs.windows_runner }}
+    timeout-minutes: 30
+    env:
+      CN1SS_FIDELITY_GOLDEN_SET: windows-11-fluent
+      NATIVEREF_MODE: ${{ inputs.mode }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '9.0.x'
+      # The WindowsAppSDK packaging targets resolve eight MSBuild tasks out of Visual
+      # Studio's AppxPackage assembly, which the .NET SDK has never carried. `dotnet build`
+      # therefore cannot build a WinUI 3 app at all, whichever SDK version is selected.
+      - name: Put Visual Studio's MSBuild on PATH
+        uses: microsoft/setup-msbuild@v2
+      - name: Capture
+        shell: pwsh
+        run: ./scripts/build-windows-native-ref.ps1
+      - name: Report the environment this run saw
+        if: always()
+        shell: pwsh
+        run: |
+          Write-Host '--- capture-manifest.json ---'
+          Get-Content artifacts/desktop-native-ref/windows/capture-manifest.json -ErrorAction SilentlyContinue
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: desktop-native-ref-windows
+          path: artifacts/desktop-native-ref/windows/**
+          if-no-files-found: error
+          retention-days: 14
+
+  macos-ref:
+    if: ${{ inputs.targets == 'all' || inputs.targets == 'macos' }}
+    name: macOS (AppKit)
+    runs-on: macos-15
+    timeout-minutes: 30
+    env:
+      CN1SS_FIDELITY_GOLDEN_SET: macos-aqua
+      NATIVEREF_MODE: ${{ inputs.mode }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Capture
+        run: scripts/build-macos-native-ref.sh
+      - name: Report the environment this run saw
+        if: always()
+        run: |
+          echo '--- capture-manifest.json ---'
+          cat artifacts/desktop-native-ref/macos/capture-manifest.json || true
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: desktop-native-ref-macos
+          path: artifacts/desktop-native-ref/macos/**
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/native-themes-sync.yml

@@ -66,6 +66,10 @@ jobs:
           bash $GITHUB_WORKSPACE/scripts/ci/retry.sh mvn -B -pl css-compiler -am install -DskipTests -Dmaven.javadoc.skip=true -Plocal-dev-javase
 
       - name: Rebuild native themes
+        env:
+          # Makes the script record every file it wrote, so the commit step below stages
+          # what this run actually produced instead of a list kept by hand.
+          NATIVE_THEMES_MANIFEST: ${{ runner.temp }}/native-themes-written.txt
         run: ./scripts/build-native-themes.sh
 
       - name: Commit and push regenerated .res files
@@ -80,11 +84,32 @@ jobs:
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          # Themes/ holds the single source of truth. Each downstream consumer
-          # (nativeios.jar, the Android port jar, the simulator fat-jar, the
-          # BuildDaemon's sibling cn1 checkout) copies from Themes/ at its own
-          # build time, so this workflow only commits these two files.
-          git add Themes/iOSModernTheme.res Themes/AndroidMaterialTheme.res
+          # Stage what THIS RUN wrote, from the manifest the script emits, rather than
+          # from a list kept here. The list used to be the two mobile themes and stayed
+          # that way when three desktop themes and two committed port mirrors joined the
+          # script: a desktop-only CSS change regenerated three .res files, staged none,
+          # reported "nothing to commit" and left every downstream build on the previous
+          # binary -- silently, because "nothing to commit" is what a no-op run says too.
+          #
+          # Untracked outputs are skipped deliberately. The script also mirrors into the
+          # JavaScript port's asset directory, which does not commit these themes, and
+          # staging blind there would start committing binaries nobody asked for.
+          staged="${RUNNER_TEMP}/native-themes-staged.txt"
+          : > "$staged"
+          while IFS= read -r f; do
+            [ -n "$f" ] || continue
+            if git ls-files --error-unmatch -- "$f" >/dev/null 2>&1; then
+              printf '%s\n' "$f" >> "$staged"
+            else
+              echo "not tracked, not staging: $f"
+            fi
+          done < "${RUNNER_TEMP}/native-themes-written.txt"
+          if [ ! -s "$staged" ]; then
+            echo "The theme build recorded no tracked outputs; refusing to report success." >&2
+            exit 1
+          fi
+          echo "Staging:"; cat "$staged"
+          git add --pathspec-from-file="$staged"
           if git diff --staged --quiet; then
             echo "No .res changes; nothing to commit."
             exit 0