feat(theme): generate the compiled seed from the bundled JSON

[nigelfenton]

#3184 item 2 — "the high-leverage one; kills the drift class permanently."

⚠ Stacked on #4570 (6c599007), whose checker this repurposes into the freshness gate rather
than superseding. Review 7250974f alone, or merge #4570 first.

What was wrong

seedBuiltinDefaults() was a hand-maintained copy of default-dark.json. Both failure modes its
own comment warned about had already happened:

• 9 tokens had drifted — color.accent.dim and all eight color.slice.a..h. The seed said
  slice A was #ff4040 (red); both bundled themes say #00d4ff (cyan).
• 25 tokens were never seeded at all — slice.dim.a..h, highlight.*, button.*.disabled,
  and the six waterfall.colormap.* gradients. These resolved transparent (alpha 0) on any
  theme predating them, which is strictly worse than a stale value.

What this does

tools/gen_theme_seed.py emits src/core/ThemeSeedGenerated.cpp from the resource, resolving
{primitive} aliases to concrete values (the seed runs before any primitives palette exists).
209 hand-written lines become one call. All 128 tokens emitted, up from 104.

Per the design agreed on the issue: commit-time, not build-time. The generated file is checked
in and greppable — seedBuiltinDefaults() is code people demonstrably read, and its "Preliminary
values — a dedicated slice-colour audit may tune these" comment is how the drift was
diagnosed. tools/check_theme_seed.py becomes a staleness gate; its KNOWN_SEED_DRIFT list is
deleted because the class of bug is gone, not because the nine were individually patched.

One structural note: the generated TU can't see ThemeScope (private to ThemeManager.cpp), so
scoped tokens go through a new private seedScopedToken() helper.

On testing — the honest version

The seed is not observable through the public API. The constructor loads Default Dark
immediately after seeding, so by the time instance() returns the JSON has overwritten everything.
That is precisely the invisibility that let the drift go unnoticed.

I wrote C++ assertions for it, discovered they passed identically against the old hand-written
seed, and removed them rather than ship a test that proves nothing. theme_manager_test carries
a note explaining why, so the next person doesn't repeat the attempt.

Verification lives where the property is observable — --check now asserts completeness
(every JSON token reaches the emitted table) independently of byte-equality, because byte-equality
alone would happily pass a generator that silently dropped a family:

injected fault	result
drop the waterfall gradients	FAIL — "emitted 120 tokens but the theme defines 128"
edit the theme, don't regenerate	FAIL --strict, exit 1
neither	pass

ctest -R "theme\|s_meter\|colour\|color\|style\|applet" 5/5; full tree builds on Windows/MSVC.

Behaviour change worth calling out

A user whose theme predates the slice tokens currently renders slice A red from the seed and
will flip to cyan. That is the correct value — both bundled themes agree — and the blast radius
is limited to pre-v2 themes. Per the issue discussion this wants a CHANGELOG.md line under
whichever release carries it; happy to add that here if you'd prefer it in-PR.

Refs #3184.

[aethersdr-agent]

Strong PR, and the write-up is the kind I wish more contributors wrote — the "I deleted the test because it passed against the broken code" section in particular. I checked the claims rather than taking them: gen_theme_seed.py --check reproduces ThemeSeedGenerated.cpp byte-for-byte, no token from the old hand-written seed is lost (95 root+scoped keys all present, 128 emitted), and the only value changes are exactly the nine documented (color.accent.dim + slice.a..h) — the three applet/* scoped triples come through identical. The seedScopedToken() shape for keeping ThemeScope out of the generated TU is the right call, and it's declared under private: not private slots:, so moc stays out of it. All nine checks green, including the seed gate itself.

Two things I'd like sorted before merge; the rest is polish.

Would like fixed before merge

• theme-seed-check.yml paths: doesn't cover ThemeSeedGenerated.cpp or gen_theme_seed.py — the two files the gate now exists to protect. A hand-edit to the "DO NOT EDIT" file never runs the check.
• Stray duplicate ThemeSeedGenerated.cpp line in the ENABLE_ASR block, mis-indented. Harmless today (CI is green) but clearly an unintended paste.

Polish

• resolve() doesn't descend into lists, so a {primitive} alias in a gradient stop would emit QColor("{color.blue.500}") — invalid, i.e. transparent. No bundled theme does this today; it's the exact failure class this PR removes, re-entering through a side door.
• The --check completeness assertion is weaker than the description implies — worth a comment adjustment rather than a code change.

Non-blocking notes

• Yes, add the CHANGELOG line here rather than in a follow-up — the slice-colour flip is user-visible.
• One thought on the "seed is unobservable" conclusion, which is true for theme_manager_test but not universally.

CodeGuard's five CG-PATH-001 findings are all in src/gui/MainWindow.cpp, which this PR doesn't touch — dropped as out-of-diff.

---

_{🤖 aethersdr-agent · cost: $6.6833 · model: claude-opus-5}

[aethersdr-agent]

This paths: list predates the generator (it came in with #4570, when ThemeManager.cpp was the seed). After this PR the artifacts under the gate are ThemeSeedGenerated.cpp and gen_theme_seed.py, and neither triggers the job — so hand-editing the file whose banner says DO NOT EDIT, or changing the generator's emission logic, both land without the check ever running. ThemeManager.cpp can stay (cheap, and it's where seedBuiltinDefaults() lives), but the two new ones are the ones that matter.

The note added in theme_manager_test.cpp says the gate "runs it on every PR that touches either side" — this makes that true.

Suggested change

	- "src/core/ThemeManager.cpp"
	- "resources/themes/**"
	- "tools/check_theme_seed.py"
	- ".github/workflows/theme-seed-check.yml"
	- "src/core/ThemeManager.cpp"
	- "src/core/ThemeSeedGenerated.cpp"
	- "resources/themes/**"
	- "tools/gen_theme_seed.py"
	- "tools/check_theme_seed.py"
	- ".github/workflows/theme-seed-check.yml"

[aethersdr-agent]

Duplicated line, and the second copy carries the wrong indentation for this block (4 spaces vs 8). CI is green because CMake deduplicates identical sources within a target, so this compiles either way — but it reads as a paste slip, and ENABLE_ASR defaults ON so it's in the default build.

Suggested change

	src/core/ThemeSeedGenerated.cpp
	src/core/ThemeSeedGenerated.cpp
	src/core/ThemeSeedGenerated.cpp

[aethersdr-agent]

resolve() recurses into dicts and strings but passes lists through untouched — and gradient stops is a list of dicts. So a stop written as {"at": 0.5, "color": "{color.blue.500}"} would reach emit_gradient() unresolved and emit QColor("{color.blue.500}"), which QColor rejects → an invalid (transparent) stop, silently.

No bundled theme does this today (I checked — all 65 aliases in default-dark.json are scalar token values, none inside a list), so this is latent, not live. But it's the same silent-transparency failure this PR is removing, and the whole point of generation is that the next person can edit the JSON without thinking about the seed.

Suggested change

	if isinstance(value, dict):
	return {k: resolve(v, primitives, depth + 1) for k, v in value.items()}
	return value
	if isinstance(value, dict):
	return {k: resolve(v, primitives, depth + 1) for k, v in value.items()}
	if isinstance(value, list):
	return [resolve(v, primitives, depth + 1) for v in value]
	return value

[aethersdr-agent]

Two things this check doesn't do, worth reflecting in the comment above it since the PR description leans on it fairly hard:

1. expected and emitted both derive from collect(). It catches a drop in the emit loop (which is what you injected to verify it), but a bug in flatten()/is_compound() — e.g. a future compound shape misclassified so a whole namespace collapses to one key — shrinks both sides equally and passes clean. That's a plausible failure given is_compound() already has one documented near-miss (the font.family namespace).
2. < rather than != means over-emission passes silently.

No change needed to the logic for (1) — a genuinely independent count would mean a second parser, which you correctly argued against in check_theme_seed.py. But the comment currently reads as if it catches any dropped family, and it catches emit-side drops specifically. != for (2) is free.

[aethersdr-agent]

The reasoning is right for this target, but the conclusion is slightly stronger than the tree supports: the seed is observable in targets that don't link the theme resource — container_widget_test's own CMake comment says exactly that ("ThemeManager's compiled-in seedBuiltinDefaults() means we don't need the theme resource here"). With no :/themes/default-dark.json to load, the constructor's load fails and the seeded values survive to instance().

That's the one place a C++ assertion would have real teeth — and notably it would have caught the drift, since color.slice.a there resolves to the seed value, not the JSON's. Not asking you to add it in this PR; the Python gate is the higher-leverage check and you've argued that well. But I'd soften "you cannot, from here" to "you cannot from this target, because it links the theme resource" so the next person doesn't read it as impossible in principle.

[aethersdr-agent]

Cisco CodeGuard — static analysis of this PR (5 finding(s))

• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-4582/src/gui/MainWindow.cpp:7140
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-4582/src/gui/MainWindow.cpp:7174
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-4582/src/gui/MainWindow.cpp:7279
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-4582/src/gui/MainWindow.cpp:7280
• [MEDIUM] CG-PATH-001 — Potential path traversal in src/gui/MainWindow.cpp /tmp/aetherclaude/pr-4582/src/gui/MainWindow.cpp:7281

_{Automated static scan by Cisco DefenseClaw CodeGuard on the changed files. Advisory — some may be false positives; the review above verifies them.}

---

_{🤖 aethersdr-agent · cost: $7.1942 · model: claude-opus-5}