phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report:

**Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)**

- Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired.
- No defects found; zero changes made — working tree left exactly as the task executors left it.
- Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation.
- Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings.
- Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules.
- Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted.
- Next pending phase: **none** — 91 is the last phase in `todo/`.

tests/unit/test_models.py

@@ -18,6 +18,33 @@ def test_all_tables_registered() -> None:
     assert "documents" in tables
     assert "chunks" in tables
     assert "query_log" in tables
+    assert "ui_settings" in tables  # phase 91: the single-row UI settings
+
+
+def test_ui_settings_single_row_nullable_contract() -> None:
+    """Phase 91: the single-row UI settings table — Integer PK ``id``
+    with the Python-side ``default=1`` (the row is always id 1), the 3
+    strings VARCHAR(300) and the 8 identity colors VARCHAR(7), ALL
+    nullable (NULL = default — B1: env value for the strings, the
+    built-in palette for the colors)."""
+    settings_table = Base.metadata.tables["ui_settings"]
+    assert set(settings_table.c.keys()) == {
+        "id", "app_name", "input_placeholder", "footer_text",
+        "bg", "surface", "ink", "ink_soft", "line",
+        "brand", "brand_soft", "brand_ink",
+    }
+    pk = settings_table.c["id"]
+    assert pk.primary_key is True, "ui_settings.id must be the PK"
+    assert pk.default is not None, "id needs the Python-side default=1"
+    for name in ("app_name", "input_placeholder", "footer_text"):
+        col = settings_table.c[name]
+        assert col.nullable is True, f"{name} must be NULL (env default)"
+        assert getattr(col.type, "length", None) == 300, f"{name} must be String(300)"
+    for name in ("bg", "surface", "ink", "ink_soft", "line",
+                 "brand", "brand_soft", "brand_ink"):
+        col = settings_table.c[name]
+        assert col.nullable is True, f"{name} must be NULL (the built-in)"
+        assert getattr(col.type, "length", None) == 7, f"{name} must be String(7) — #rrggbb"
 
 
 def test_chunks_embedding_is_vector_768() -> None: