phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report:

**Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)**

- Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired.
- No defects found; zero changes made — working tree left exactly as the task executors left it.
- Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation.
- Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings.
- Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules.
- Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted.
- Next pending phase: **none** — 91 is the last phase in `todo/`.

README.md

@@ -403,7 +403,6 @@ asset references of the known pages in flight.
 | `BOR_APP_NAME` | `Brain of Reese` | Display name everywhere (page titles, header brand, status labels) |
 | `BOR_INPUT_PLACEHOLDER` | `Ask me anything…` | Chat composer placeholder |
 | `BOR_FOOTER_TEXT` | `Powered by self-hosted models` | Footer line on every page |
-| `BOR_THEME` | *(empty)* | Filename under `frontend/assets/themes/` (e.g. `indigo.css`) — a `:root` palette override |
 | `BOR_DATABASE_URL` | local compose URL | SQLAlchemy URL (psycopg) |
 | `BOR_LLM_BASE_URL` | `https://aipi.reeseapps.com/v1` | OpenAI-compatible endpoint |
 | `BOR_LLM_API_KEY` | — (falls back to `$AIPI_KEY`) | aipi API key |
@@ -440,11 +439,14 @@ Every identity string is an env var: `BOR_APP_NAME` (display name),
 `BOR_FOOTER_TEXT` (footer line) — all served by `GET /api/config` and
 applied by `assets/brand.js` at boot.
 
-Color themes are plain CSS variable overrides: write a `:root` block in
-`frontend/assets/themes/` and point `BOR_THEME` at the filename. The server
-refuses a malformed `BOR_THEME` at startup; a missing file degrades to the
-built-in palette. Leave everything unset and the app renders the defaults
-byte-identically.
+The colors are set from the admin **Theme tab** (`/theme.html`,
+admin-only — phase 91): the 8 identity colors plus the three strings
+above are edited with text fields and color pickers, persisted in the
+`ui_settings` table, and injected into every served page as an inline
+`<style>` BEFORE first paint (no red flash, no pop-in). The old
+CSS-file theming is retired — a leftover `BOR_THEME` line in a
+deployment's `.env` is simply ignored. Leave everything unset and the
+app renders the built-in dark-tech palette byte-identically.
 
 ---