Give the desktop real themes, video wallpapers, and honest titlebars

Appearance now opens on Themes: light and dark side by side, each
remembering its own choice, over galleries of ten shipped themes —
Tokyo Moon and Day joined by Moon Rose, Catppuccin, Nord, Gruvbox and
Everforest in both modes. A theme is a complete palette: the catalog
lives in themes.json, Theme.qml reads every color token from the
active record, and one render pipeline carries it to kitty, tmux,
btop, GTK, Vicinae, Firefox's chrome, and the lock screen. The Theme
editor builds new ones from four wells — wheel, hex, or eyedropper —
with derived surfaces, a saturation slider, debounced fine-tune, and
effects that save with the theme. Custom edits finally keep GNOME's
accent, kitty's border, and hyprlock in sync.

Wallpapers can be video: mpvpaper per output, hardware-decoded, muted
and looped, supervised and respawned. Panama owns the pausing — games,
battery, and a bar pill for right now — because the compositor
rebuilds full-screen blur for every frame a video wallpaper draws.
The lock screen gets a still frame.

Titlebars stop lying. GNOME apps get close-only on your chosen side,
the maximize and double-click settings are gone, the Settings window
obeys the same rules, and its titlebar can be turned off entirely.
Typography becomes five labeled dropdowns instead of a wall of
samples.

Contracts updated and written throughout (165 now); per the redesign
workflow none were executed — the full sweep runs once at the end.

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/settings-ownership-contract

@@ -14,6 +14,7 @@ schema="$repo_dir/config/dot/quickshell/config/PreferenceSchema.qml"
 search="$repo_dir/config/dot/quickshell/services/SettingsSearch.qml"
 scheme="$repo_dir/config/dot/quickshell/services/ColorScheme.qml"
 looks="$repo_dir/config/dot/hypr/looks.lua"
+catalog="$repo_dir/config/dot/quickshell/config/themes.json"
 readme="$pages_dir/README.md"
 
 fail() {
@@ -109,32 +110,56 @@ for needle in \
     rg -Fq "$needle" "$readme" || fail "README is missing $needle"
 done
 
-python3 - "$scheme" "$looks" <<'PY' \
-    || fail 'scheme-relative border ownership drifted'
+python3 - "$scheme" "$looks" "$catalog" <<'PY' \
+    || fail 'window border ownership drifted'
+import json
 import re
 import sys
 
 scheme = open(sys.argv[1], encoding="utf-8").read()
 looks = open(sys.argv[2], encoding="utf-8").read()
+themes = {t["id"]: t for t in json.load(open(sys.argv[3], encoding="utf-8"))["themes"]}
 
-dark = re.search(r'property string inactiveBorderDark:\s*"([^"]+)"', scheme)
-light = re.search(r'property string inactiveBorderLight:\s*"([^"]+)"', scheme)
-effective = re.search(r'property string inactiveBorder:\s*root\.dark\s*\?\s*root\.inactiveBorderDark\s*:\s*root\.inactiveBorderLight', scheme)
-if not dark or not light or not effective:
-    raise SystemExit("ColorScheme does not expose the two inactive-border roles")
-if dark.group(1) not in looks or light.group(1) not in looks:
-    raise SystemExit("Hyprland startup values disagree with the live scheme roles")
+# Hyprland's own startup value has to stand alone with no settings file, so it
+# carries a literal pair -- but that pair is the two DEFAULT themes' gutters,
+# the same role ColorScheme restates the moment the shell is up. A drift here
+# is a visible flash of the wrong border on every login.
+for theme_id in ("moon", "day"):
+    expected = "rgba(" + themes[theme_id]["palette"]["gutter"].lstrip("#") + "99)"
+    if expected not in looks:
+        raise SystemExit(
+            f"Hyprland's startup inactive_border does not carry {theme_id}'s gutter ({expected})")
+
+# The inactive border is a neutral contrast role, and it is now drawn from the
+# ACTIVE THEME's gutter rather than from two Tokyo Night literals. Those
+# literals were right for two of the ten shipped themes and for no custom one,
+# so a hardcoded pair here is the regression worth catching.
+inactive = re.search(
+    r'property string inactiveBorder:\s*root\.hyprColor\(Theme\.gutter,', scheme)
+if not inactive:
+    raise SystemExit("the inactive border is no longer the active theme's neutral role")
+if re.search(r'property string inactiveBorder(Dark|Light):\s*"#', scheme):
+    raise SystemExit("ColorScheme has regrown a hardcoded inactive-border literal")
+if re.search(r'rgba\([0-9a-f]{8}\)', scheme):
+    raise SystemExit("ColorScheme has regrown a literal Hyprland border colour")
 
 without_comments = re.sub(r"//.*", "", scheme)
 
 # The focused border is the accent role, and ColorScheme.qml owns it too:
 # each named accent carries a separate pair per scheme, so a scheme change
 # must restate the focused border, not just the neutral one, or a chosen
-# accent goes stale the moment light/dark flips.
-start = re.search(r'property string accentBorderStart:\s*root\.hyprColor\(Theme\.accent\)', scheme)
-end = re.search(r'property string accentBorderEnd:\s*root\.hyprColor\(Theme\.accentSecondary\)', scheme)
+# accent goes stale the moment light/dark flips. Both roles are also restated
+# when the THEME changes, since both now follow the resolved palette.
+start = re.search(r'property string accentBorderStart:\s*root\.hyprColor\(Theme\.accent,', scheme)
+end = re.search(r'property string accentBorderEnd:\s*root\.hyprColor\(Theme\.accentSecondary,', scheme)
 if not start or not end:
     raise SystemExit("ColorScheme does not derive the focused border from the chosen accent")
+if 'themeChanged' not in without_comments:
+    raise SystemExit("ColorScheme does not restate its borders when the theme changes")
+if 'schemeChanged || themeChanged' not in without_comments:
+    raise SystemExit("the inactive border is not restated on a theme change")
+if 'schemeChanged || accentChanged || themeChanged' not in without_comments:
+    raise SystemExit("the focused border is not restated on a theme change")
 
 # Written as a Lua TABLE, not a string: the string form of a Hyprland gradient
 # carries only one stop, so writing it that way is accepted and silently