From 55ffcf8dd5697a00adb50f43962ad689f6e801a3 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Sun, 6 Sep 2026 18:06:46 +0700
Subject: [PATCH 1/5] build(qa-inspect-host): take the ps-blitz 0.4 engine

The host is what gives ps-qa its renderer, so every check any project runs is
judged by whatever engine is pinned here. On 0.3 that engine dispatches a
checkbox's click before the checkbox takes its new value, never dispatches a
click at a control its label was pressed for, and treats a written
`checked="false"` as checked. A controlled toggle therefore reports the wrong
state from first paint and cannot be driven, which is invisible to a check that
asserts the renderer's own toggle rather than the application's reaction.

Pinned at 0.4.3 rather than 0.4: 0.4.2 is a newer engine without those fixes,
and a host on it would keep passing the checks this is meant to make honest.

Verified against that engine built from source: `@pathscale/ui`'s component gate
is 17/17 across switch, checkbox, radio and connection-settings, and 73/74 over
the whole library, the one failure being a Select paint check that fails
identically on the published host.
---
 crates/qa-inspect-host/Cargo.toml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/qa-inspect-host/Cargo.toml b/crates/qa-inspect-host/Cargo.toml
index 8dce26d..559bc19 100644
--- a/crates/qa-inspect-host/Cargo.toml
+++ b/crates/qa-inspect-host/Cargo.toml
@@ -18,11 +18,11 @@ publish = true
 # precisely so that driving a control does not build a browser engine. Keeping
 # the host in its own crate is what lets both stay true.
 [dependencies]
-blitz-dom = { package = "ps-blitz-dom", version = "^0.3", features = ["system-fonts"] }
-blitz-script = { package = "ps-blitz-script", version = "^0.3", features = ["system-fonts"] }
-blitz-traits = { package = "ps-blitz-traits", version = "^0.3" }
+blitz-dom = { package = "ps-blitz-dom", version = "^0.4.3", features = ["system-fonts"] }
+blitz-script = { package = "ps-blitz-script", version = "^0.4.3", features = ["system-fonts"] }
+blitz-traits = { package = "ps-blitz-traits", version = "^0.4.3" }
 brotli = { version = "^8.0.4", default-features = false, features = ["std"] }
-tauri-runtime-blitz = { version = "^0.3", features = ["agent-control"] }
+tauri-runtime-blitz = { version = "^0.3.2", features = ["agent-control"] }
 # Only the channel: `ControlBridge` hands its answer back on a
 # `tokio::sync::oneshot`, so the type has to match. No runtime, no reactor.
 tokio = { version = "^1", default-features = false, features = ["sync"] }

From 11e93e1e38d5e215e6dd71f28460f41959614676 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Sun, 6 Sep 2026 19:06:35 +0700
Subject: [PATCH 2/5] build(qa-inspect-host): release 0.1.9 with the new engine

0.1.8 is on crates.io and the publish workflow returns early for a version it
finds there, so the engine bump lands and every `cargo install` keeps handing
out the old host and the old renderer. That is worse than not bumping at all:
the checks would look updated and judge nothing new.
---
 crates/qa-inspect-host/Cargo.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/qa-inspect-host/Cargo.toml b/crates/qa-inspect-host/Cargo.toml
index 559bc19..c145d2a 100644
--- a/crates/qa-inspect-host/Cargo.toml
+++ b/crates/qa-inspect-host/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "qa-inspect-host"
 description = "Host a Blitz document and serve it over the inspection socket"
-version = "0.1.8"
+version = "0.1.9"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
@@ -22,7 +22,7 @@ blitz-dom = { package = "ps-blitz-dom", version = "^0.4.3", features = ["system-
 blitz-script = { package = "ps-blitz-script", version = "^0.4.3", features = ["system-fonts"] }
 blitz-traits = { package = "ps-blitz-traits", version = "^0.4.3" }
 brotli = { version = "^8.0.4", default-features = false, features = ["std"] }
-tauri-runtime-blitz = { version = "^0.3.2", features = ["agent-control"] }
+tauri-runtime-blitz = { version = "^0.3.3", features = ["agent-control"] }
 # Only the channel: `ControlBridge` hands its answer back on a
 # `tokio::sync::oneshot`, so the type has to match. No runtime, no reactor.
 tokio = { version = "^1", default-features = false, features = ["sync"] }

From b6e6110dd12e9ff6a5d949d118cfdd8f1a3ceb53 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Sun, 6 Sep 2026 19:57:47 +0700
Subject: [PATCH 3/5] feat(qa): open a plain page, and address any node by id

Two limits that between them stopped a repository from testing its own renderer
with the harness everybody else uses.

`qa-inspect-host` was not a page loader. It read an rsbuild `dist`, pulled the
one external stylesheet and the one external script out of it, and synthesised a
shell with the `<div id="root">` a component harness mounts into. That is the
right shape for a component library and the only shape it accepted: a page
carrying its own markup failed with "the page has no src asset". So a project
testing the engine, or reducing a bug, had to stand up a JavaScript toolchain
before it could assert that a checkbox toggles -- and wrote its own driver
instead, which is how a renderer ends up with two testing stories and one of
them untested. A page with no external script is now served as written.

And `#id` was documented as a selector but could not reach most of what carries
one. The role gate ran first, so only interactive nodes survived to be matched,
and a `<label>` -- generic, with an id, painted and enabled -- could not be
pressed by any spelling. That is not a niche shape: it is how every switch and
styled checkbox on the web is built, the visible thing a person actually hits.
`#id` and `@slot` now skip the gate, because they already name one exact node,
which is the reason `dom_id` is carried at all. A name or `role:name` still goes
through it: those are descriptions rather than identities.
---
 crates/ps-qa/src/target.rs        | 22 +++++++++++++++++++++-
 crates/qa-inspect-host/src/lib.rs | 30 +++++++++++++++++++++++++++++-
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/crates/ps-qa/src/target.rs b/crates/ps-qa/src/target.rs
index 310bf51..18c3644 100644
--- a/crates/ps-qa/src/target.rs
+++ b/crates/ps-qa/src/target.rs
@@ -160,8 +160,28 @@ pub(crate) async fn locate_control(
         let mut candidates: Vec<_> = snapshot
             .nodes
             .iter()
+            /*
+             * The role gate is skipped for a selector that already names one
+             * exact node.
+             *
+             * `#id` and `@slot` identify a single element by what the author
+             * wrote, which is the reason `dom_id` is carried at all. Deciding
+             * first that only interactive roles are addressable threw those
+             * away before the selector was ever consulted, so a `<label>` --
+             * `generic`, with an id, painted and enabled -- could not be
+             * pressed by any spelling. That is not a niche shape: it is how
+             * every switch and styled checkbox on the web is built, the visible
+             * thing a person actually hits, and the only way to press a control
+             * the way its own markup intends.
+             *
+             * A name or `role:name` still goes through the gate. Those are
+             * descriptions rather than identities, and matching them against
+             * every generic node in a document would make one ambiguous.
+             */
             .filter(|n| {
-                roles.contains(&"*")
+                selector_dom_id(want).is_some()
+                    || selector_slot(want).is_some()
+                    || roles.contains(&"*")
                     || roles.is_empty() && reach::interactive(n)
                     || roles.contains(&n.role.as_str())
             })
diff --git a/crates/qa-inspect-host/src/lib.rs b/crates/qa-inspect-host/src/lib.rs
index 96dec12..5d66b7e 100644
--- a/crates/qa-inspect-host/src/lib.rs
+++ b/crates/qa-inspect-host/src/lib.rs
@@ -169,7 +169,35 @@ fn create_dist_document(dist: &std::path::Path, url: &str) -> Result<ScriptDocum
     trace(&format!("loading page: {}", page_path.display()));
     let index = fs::read_to_string(&page_path)
         .map_err(|error| format!("could not read {}: {error}", page_path.display()))?;
-    let javascript_url = asset_url(&index, "src")?;
+    /*
+     * A page that carries its own markup is served as it stands.
+     *
+     * Everything below rebuilds the document: it pulls the one external
+     * stylesheet and the one external script out of a bundler's `index.html`
+     * and synthesises a shell around them, because that is the shape a
+     * component harness emits and the `<div id="root">` it mounts into is not
+     * in the file.
+     *
+     * That shape is not the only useful one. A repository testing the engine
+     * itself, or a reduction of a bug, writes the markup by hand: a control, a
+     * listener, and a heading naming what the listener saw. Demanding a bundle
+     * from those meant standing up a JavaScript toolchain to assert that a
+     * checkbox toggles, so they went and wrote their own driver instead, which
+     * is how a renderer ends up with two testing stories and one of them
+     * untested.
+     *
+     * Detection is the absence of an external script, not a flag: a hand-written
+     * page has inline script or none, and a built one always has `src=`.
+     */
+    let Ok(javascript_url) = asset_url(&index, "src") else {
+        trace("no external bundle; serving the page as written");
+        let config = DocumentConfig {
+            base_url: Some(url.into()),
+            ..DocumentConfig::default()
+        };
+        return Ok(ScriptDocument::from_html(&index, config));
+    };
+
     let stylesheet_url = asset_url(&index, "href")?;
     let css = read_brotli_asset(dist, stylesheet_url, "external CSS")?;
     let javascript = read_brotli_asset(dist, javascript_url, "external JavaScript")?;

From 4f16f38d0597d572a6d6f7022931d890445448bd Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Sun, 6 Sep 2026 19:58:01 +0700
Subject: [PATCH 4/5] build(ps-qa): release 0.5.12

0.5.11 is on crates.io and the publish workflow skips a version it finds there,
so the id selector reaching non-interactive nodes would land and no installed
harness would gain it. Same reason the host is going out as 0.1.9.
---
 crates/ps-qa/Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/ps-qa/Cargo.toml b/crates/ps-qa/Cargo.toml
index 07cfd28..d684584 100644
--- a/crates/ps-qa/Cargo.toml
+++ b/crates/ps-qa/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "ps-qa"
 description = "Drive a running Blitz app through its MCP control socket and assert what the renderer did"
-version = "0.5.11"
+version = "0.5.12"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"

From 2db539ff2a8789e299548d577d7018e47e9dd135 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Sun, 6 Sep 2026 20:11:03 +0700
Subject: [PATCH 5/5] build(qa-inspect-host): pin the engine at the minor, not
 the patch

`^0.4.3` is a version bump wearing a caret: it forces every consumer to a
version that does not exist yet, and it is not how anything else here is
pinned. `^0.4` resolves what is available and the lockfile decides the rest.

The reason I reached for the patch floor was that 0.4.2 is published and still
has the bugs this is meant to catch, so a host resolving it would keep passing
the checks. That is a lockfile's job, not a manifest's.
---
 crates/qa-inspect-host/Cargo.toml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/qa-inspect-host/Cargo.toml b/crates/qa-inspect-host/Cargo.toml
index c145d2a..8e3713c 100644
--- a/crates/qa-inspect-host/Cargo.toml
+++ b/crates/qa-inspect-host/Cargo.toml
@@ -18,11 +18,11 @@ publish = true
 # precisely so that driving a control does not build a browser engine. Keeping
 # the host in its own crate is what lets both stay true.
 [dependencies]
-blitz-dom = { package = "ps-blitz-dom", version = "^0.4.3", features = ["system-fonts"] }
-blitz-script = { package = "ps-blitz-script", version = "^0.4.3", features = ["system-fonts"] }
-blitz-traits = { package = "ps-blitz-traits", version = "^0.4.3" }
+blitz-dom = { package = "ps-blitz-dom", version = "^0.4", features = ["system-fonts"] }
+blitz-script = { package = "ps-blitz-script", version = "^0.4", features = ["system-fonts"] }
+blitz-traits = { package = "ps-blitz-traits", version = "^0.4" }
 brotli = { version = "^8.0.4", default-features = false, features = ["std"] }
-tauri-runtime-blitz = { version = "^0.3.3", features = ["agent-control"] }
+tauri-runtime-blitz = { version = "^0.3", features = ["agent-control"] }
 # Only the channel: `ControlBridge` hands its answer back on a
 # `tokio::sync::oneshot`, so the type has to match. No runtime, no reactor.
 tokio = { version = "^1", default-features = false, features = ["sync"] }