An instance that can be somebody else's

A name, a tagline, a logo, a favicon and the launcher icons derived from it; the
Middle-earth strings as data; themes as token sets; and a stylesheet for what
none of that reaches. All four are on one page, in one settings group.

The snapshot is a Jinja global over a process-level cache, because render() has
no session and four render paths never reach it at all -- the sign-in page, the
error pages, the offline page and the SSE fragments. A context value would have
had to be threaded through every one and would still have missed those. It being
a global is also what lets mark() branch on an uploaded logo without any of its
six call sites learning about branding; the macro that renders the sidebar link
is called brandlink now, because a macro imported as `brand` shadows the global
for the whole template and took out every page at once.

Defaults in code and overrides in the database, as the prompt fragments do, with
one difference stated in the module: an empty fragment means off, an empty
flavour string means the shipped wording. And blanked rather than dropped --
settings_store.update merges, so an omitted key leaves what was stored last time
and "I typed the default back in" would store something different from "I changed
nothing".

A custom theme sets a handful of tokens and inherits the rest, and the
inheritance is a CSS fact: tokens.css matches [data-base="shire"] as well as
[data-theme="shire"], so a custom light theme lands on parchment rather than four
light colours on near-black. Values are validated on read rather than on save,
because a theme written straight into the settings table still has to produce a
stylesheet that parses -- a `}` in a value ends the rule and silently breaks
every rule after it. The soft variants are derived from the accent, or a changed
accent leaves focus rings in the old hue and reads as half-working.

/branding.css is a route, not an inline block: an external stylesheet has no HTML
context to escape from. The link carries a content hash, so a save is not left to
the browser's cache, and it is deliberately outside the service worker's precache
list, which is versioned by the release.

The instance name moved off /admin/general rather than being duplicated there.
An upgrade keeps it: the general row is read as a seed exactly while the branding
row has never mentioned the name, which is `key in row` and not `row[key] is
truthy` -- the two read alike would resurrect the old name underneath a cleared
one.

The theme list stops being a hard-coded pair in five places. Every failure mode
in that area is silent, so it is driven under a DOM stub as well as tested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -20,7 +20,7 @@ lembas info                         # paths + counts, useful when confused
 lembas secret-key                   # generate LEMBAS_SECRET_KEY
 lembas create-admin                 # create or promote an admin
 
-pytest                              # 1949 tests, ~2min
+pytest                              # 1979 tests, ~2min
                                     # PLAN.md tracks what is and is not built
 ruff check .                        # lint (line length 100)
 python scripts/build_artwork.py     # regenerate artwork (SVG + PWA icons;
@@ -87,6 +87,8 @@ src/lembas/
     admin_search.py  web search provider and credentials
     admin_images.py  the ComfyUI, and the workflow templates on it
     admin_prompts.py the prompt fragment editor and its preview
+    admin_branding.py  the name, the logo, the wording and the themes
+    branding.py      /branding.css and the assets behind it, both unauthenticated
     admin_suggestions.py  the cards offered on the new-chat screen
     admin_tools.py   custom HTTP tools and MCP servers
     admin_agents.py  whether agent chats exist, and what they may spend
@@ -155,6 +157,8 @@ src/lembas/
     reasoning.py     splits thinking from the answer
     subagent.py      a helper another model sent: a hidden chat, one turn,
                      and everything it may not do
+    branding.py      whose instance this is: the name, the artwork, the
+                     wording and the themes, cached once per process
     settings_store.py  runtime instance settings
     canvas.py        what is open in the canvas panel, and where it comes from
     scratch.py       a chat's own working document
@@ -190,6 +194,9 @@ touching the code it names -- these are the same notes, not a summary.
   schedule something wrote a note and said it had).
 - `docs/notes/image-generation.md` -- the ComfyUI workflow with holes in it, what
   substitution walks, the review-and-retry loop, and how a failure reports itself.
+- `docs/notes/branding.md` -- the branding snapshot and why it is a Jinja global,
+  where the instance name went and how an upgrade keeps it, how a custom theme
+  inherits through `data-base`, and why `/branding.css` is a route.
 - `docs/notes/subagents.md` -- the hidden chat a helper runs in, why `unattended`
   is a column and not a kind, the two halves that stop a helper stalling on a
   card nobody can see, what it may run and why Auto is never inherited, and where