## 1. Remove PaperLight (dead code)

- [ ] 1.1 Delete `ColorScheme`, the `COLOR_SCHEME` const, and the dead
  window-linked `bg` vector-art block in `src/app/schema/mod.rs`; collapse
  the `if COLOR_SCHEME == ...` background branch to the unconditional
  video path. Verify `make compile-dev` in `bin/app`.
- [ ] 1.2 Collapse every `match COLOR_SCHEME` / `if COLOR_SCHEME ==`
  two-arm branch in `chat.rs`, `menu/{mod,channel,contact}.rs`,
  `settings.rs`, and `wallet/*.rs` to the DarkMode values inlined, and
  drop the now-unused `ColorScheme`/`COLOR_SCHEME` imports (14 files
  total). Verify `make compile-dev` and that the app renders as before.

## 2. Property default APIs and permissions

- [ ] 2.1 Add post-creation default installation on `PropertyPtr` in
  `src/prop/mod.rs` (`set_default_*` for bool, u32, f32, str, enum, node
  id, shape, null) mutating `defaults[i]` with no modify event, enforcing
  the same length/type checks as the builder variants. Add unit tests:
  install-on-live-node changes effective read; explicit value wins;
  unset falls back to installed default.
- [ ] 2.2 Add expression defaults: builder `set_defaults_expr` plus
  post-creation `set_default_expr`, and make `is_expr`/`get_expr` resolve
  the effective expression source (`vals` expression, else `defaults`
  expression). Update `get_value` so it never returns an unresolved
  expression (resolution order per the `prop-defaults` spec; unevaluated
  expression reads yield the type default). Unit tests: override+unset
  returns to default expression; value-slot expression wins over default
  expression; concrete-type read before first evaluation succeeds.
  Verify `cargo test prop::` in `bin/app` (crate `darkfi-app`) and
  `make compile-dev`.
- [ ] 2.3 Make `Role` a hand-rolled u8 bitflag set (User, App, Internal,
  Ignored, Theme — no new dependency) and add `PropertyPermission`
  {read, write} taken by `Property::new` (transitional default = all
  roles, so all current call sites keep behavior) plus `can_read`/
  `can_write` and `Error::PropertyPermissionDenied` (design D13).
  Enforce write masks centrally in every mutating API (role is already
  a parameter) before any mutation or journaling; enforce read masks in
  the wrap layer (`wrap()` validates upfront, `get()` checks), in
  `eval_f32_multi` dependency reads, and at the `net.rs` RPC boundary;
  exempt `set_default_*` and `set_cache_*`. Unit tests: denied write
  leaves value unchanged; denied wrapped read errors; theme role denied
  on a mask without Theme. Verify `cargo test prop::` and `make
  compile-dev`.

## 3. f32-array expression evaluation beyond rect

- [ ] 3.1 Generalize the `PropertyRect::eval_with` pattern in
  `src/prop/wrap.rs` into a shared bounded f32-array evaluator and expose
  `PropertyColor::eval` (globals-only, no extras) plus a single-f32
  variant for `font_size`/spacing. Unit tests: per-index exprs recompute
  from dependency globals; plain indices untouched; evaluated results
  land in the cache and are returned by `get_f32` (note: cache writes
  bypass `set_f32` range validation by design). Verify `cargo test
  prop::`.
- [ ] 3.2 Add draw-path re-evaluation call sites in color/font-consuming
  widgets (`Text`, `Edit`, `ChatView`, `Menu`, `TextScramble`): at the
  top of `draw()`, alongside the existing rect evaluation, re-evaluate
  expr-bound styled props (`PropertyColor::eval`, f32 eval) so every
  pass computes from current dependency values; keep `when_change`
  handlers invalidation-only (clear draw cache + trigger), with cache
  writes as `Role::Internal` so `when_change_external` echo-skips them
  (same pattern as rect evals today). Verify with a scratch wiring
  (expr-bound `text_color` reacting to a test property) under `make
  compile-dev`.

## 4. `/theme` token node and class-wiring helpers

- [ ] 4.1 Create the `/theme` node (linked at scene root beside
  `/setting`) with an initial token vocabulary: `text_color`,
  `text_dim_color`, `accent_color`, `bg_color`, `edit.*` colors,
  `menu.*` colors, `chatview.*` colors, font/spacing f32s — defaults
  form the neutral minimal palette; write mask = Theme only (D13).
  Node is created in the app setup path before `schema::make`. Verify
  node exists at `/theme` with defaults via a startup log or debug
  lookup; `make compile-dev`.
- [ ] 4.2 Add wiring helpers (`wire_color`, `wire_f32`) that install
  default-exprs + `add_depend` edges from a node property onto token
  components in one call, replacing 4×`set_f32` styling blocks. All
  wiring happens at creation (design D5); theme-time rewiring goes
  through `ctx.depend_journaled`. Verify a helper-wired `text_color`
  tracks a token change at runtime under `make compile-dev`.

## 5. Minimal baseline: schema split and factory scrub

- [ ] 5.1 Scrub theme leaks in `src/app/node.rs` factories back to
  neutral Tier-0 defaults: `action_fg_color`/`action_bg_color`,
  `url_copy_*` colors, `scramble_color`, menu `role1/role2` colors,
  `tokentable` colors; enable `allow_exprs()` on every themeable prop
  (colors, `font_size`, `padding`, `lineheight`, spacing) — it is
  builder-only, so without this the wiring helpers' `set_default_expr`
  calls fail with `PropertySExprNotAllowed`; and assign real
  `PropertyPermission` masks per the D13 table (themeable style =
  write App|Theme; widget-computed/runtime = write Internal without
  Theme, enforcing D4; behavior toggles = write App; content/data =
  write App) — replacing the transitional allow-all default. Verify
  `make compile-dev` and note any visual deltas are restored later via
  tokens/scifi.
- [ ] 5.2 Convert `src/app/schema/mod.rs` (root, netstatus icons and
  overlay) to minimal defaults + token wiring: inline styling blocks
  become `set_default_*` or helper wirings; geometry exprs move to
  default-exprs; the first-run splash block is removed from the schema
  (re-implemented by scifi in 7.1 per design D12). Verify both a
  token-flip recolors the overlay and that with untouched tokens the UI
  looks minimal-but-correct; `make compile-dev`.
- [ ] 5.3 Convert `menu/` (mod, channel, contact, edit helpers) to
  minimal defaults + tokens. Verify menu, channel/contact lists, and
  edit mode render correctly under the baseline; `make compile-dev`.
- [ ] 5.4 Convert `chat.rs` per-channel screens (chatview styling, edit
  composer, selection overlay) to minimal defaults + tokens, including
  journaled handling for `nick_colors` (unbounded list, no exprs).
  Verify a freshly joined channel's screen renders themed-if-tokens-set;
  `make compile-dev`.
- [ ] 5.5 Convert `wallet/` screens (main, send steps 1-4, receive,
  tx_status, data, util helpers) and `settings.rs` to minimal defaults +
  tokens. Verify full wallet flow walkthrough under baseline; `make
  compile-dev`.

## 6. Theme engine

- [ ] 6.1 Create `src/theme/` with the `Theme` trait (`name()`, async
  `apply(ctx)`), compile-time registry (`minimal`, `scifi`), and
  `ThemeCtx` using nodes-as-storage (design D8): tracked node roots
  (incl. theme-defined token children under `/theme/<name>`, built
  pre-Arc with builder `add_property`), theme tasks pushed onto
  theme-owned nodes (`push_task` → cancelled by `clear_tasks()` on
  unload), and a journal of `Touched` (prop, i — unset on unload),
  `List` (unbounded-list priors, e.g. nick_colors — unbounded props
  have no defaults tier), and `Depend` (theme-added edges — removed on
  unload). All ctx setters stamp `Role::Theme` on the modify events
  (attribution lives on the event stream since `vals` has none); verify
  `when_change_impl`'s equality filters pass `Theme` through like `App`
  (only Internal/Ignored are skipped) and audit other Role consumers
  (`net.rs`, `setting.rs` produce roles; any external Role mapping
  needs a `Theme` arm); optional dev-mode leak audit warns on
  `Role::Theme` events for (prop, i) pairs not in the touched-set. The
  touched-set is required for correctness (`vals` has no authorship; a
  deep-walk reset would destroy runtime state) — the ctx is the only
  sanctioned path for themes to modify properties they don't own (and
  D13 masks deny off-path writes outright). Unload order:
  `clear_tasks()` on tracked nodes FIRST (cancel actors — an in-flight
  watcher writing after its unset would leave stale vals) → unset
  Touched → restore Lists → remove Depend edges → unset shared tokens →
  `unlink()` per tracked node. Verify a synthetic theme that touches
  one token, defines one private token wired to a widget, overrides a
  bounded prop and an unbounded list, inserts one node, and pushes one
  watcher task unloads cleanly (second apply leaves no residue, no
  dangling edges, watcher cancelled) via a temporary schema-test hook
  or unit test; `make compile-dev`.
- [ ] 6.2 Implement the atomic switch flow per design D9: single
  `redraw.make_guard` batch (unload + apply), explicit `trigger()` after
  the drop for structural-only changes (unlinks notify nothing); wire it
  to the `/setting/theme` property — `apply_startup()` in `App::setup`
  after `schema::make`, plus an engine-owned watcher task (not
  theme-tracked) for live switches. Verify startup applies the persisted
  theme before the first frame (pubsub queues buffer events until widget
  tasks start; the first pass evaluates draw-side) and a live setting
  change switches atomically; `make compile-dev`.

## 7. scifi theme

- [ ] 7.1 Extract the scifi look into `src/theme/scifi.rs`: cyan token
  values, at least one theme-defined private token (proves the D6
  private-token path, e.g. the netlogo accent), the king video
  background as a tracked structural node (reserved low z band under
  `/window/content`), the first-run scramble splash as a tracked node +
  hide task gated on `is_first_time` (design D12), and the netstatus
  overlay fade as a tracked watcher on `is_visible` writing `alpha` via
  `ctx.set_touched` (remove the in-handler fade from the reconnect
  click handler in `src/app/schema/mod.rs`). Verify: with `theme=scifi`
  the app is pixel-comparable to today's look (video bg, splash on
  first run, cyan accents, fade on overlay open); `make compile-dev`
  and `make compile-apk`.

## 8. Theme setting and settings UI

- [ ] 8.1 Add the `theme` enum property to `create_setting` in
  `src/setting.rs` (items `minimal`, `scifi`; default `scifi`); fix
  `Setting::new` to skip-and-log persisted keys that no longer exist as
  node properties instead of unwrapping; guard reads so an unknown
  persisted theme falls back to the default. Verify persistence across
  restart and the fallback path (hand-edit the persisted value);
  `make compile-dev`.
- [ ] 8.2 Add enum rendering to the settings screen (`settings.rs`):
  cycle-on-tap row for enum values (starts with `theme`; also fixes
  `net.transport` showing "unknown"). Verify both enums display and
  modify correctly, and switching `theme` there drives the live switch;
  `make compile-dev`.

## 9. End-to-end verification

- [ ] 9.1 Full walkthrough under both themes (chat, menus, wallet send
  flow, receive, settings, netstatus overlay, emoji picker): minimal is
  complete and usable per the `app-theme` spec; scifi matches the
  current shipped look; live switch mid-session leaves no mixed state,
  no orphaned visuals, no running animations from the old theme; theme
  writes outside permitted masks are denied (spot-check a widget-owned
  prop via a debug theme write). Verify `make compile-dev` clean,
  `cargo test` in `bin/app` green, and `make compile-apk` for Android.