[markm39]

Dark mode now displays dark writing paper with readable ink, text, and tool swatches. Authored document colors and PDF exports stay unchanged. This uses the shared display-only renderer from mobile-ink PR #62, including the native diagram-mount fix.

Stacked on #40. Keep this draft and unmerged: overall smoothness remains unproven, and the shared engine needs independent review.

Validation:

• TypeScript and 122 existing tests pass; native Release build succeeds.
• Direct native interaction confirms dark paper and visible fixture ink. A one-page PDF exported from light and dark appearance renders pixel-identically, and the note body remains byte-identical.
• All three native 100-page audits pass functionally in dark appearance. Screenshot assertions now require ink contrasting with the paper; dark paper alone cannot pass.
• Writing/autosave: 1,149 frames, render p95 1.55 ms, render max 25.78 ms, main delay max 25.93 ms.
• Strict overall performance gate FAILS: pan render p95 24.62 ms and main delay max 163.76 ms; first keyboard main delay 1,864.42 ms; one startup 103.28 ms. Budgets remain 16.7 ms and 100 ms. These are simulator/native XCTest results, not physical Pencil latency or browser evidence.
• The cross-page asset history/export case passes locally on the final build (76.020 seconds), including unified ink/asset undo/redo, two resizes, save/reopen and native sharing. Earlier CI run39666815229 failed waiting for Copy: export stayed pending for the full30-second wait. New run39671122191 passes all six native functional cases, including that export, and persisted-body verification. No app export fix or timeout increase was made between those runs, so the earlier failure remains an unresolved intermittent failure.
• CI now profiles functional workload failures as well as budget failures. It preserves the original synthetic notebook bodies before reseeding for a separate diagnostic rerun. Timing gates still use the original unprofiled run. Run39671122191 still fails the unchanged timing gate and is collecting the separate profile evidence.
• A prior direct native comparison verified six pinches, but its 24 desktop drags did not move the simulator canvas. That report is pinch-only evidence, not a pan pass. The native touch-path follow-up now verifies page1 to page4 in three one-finger350ms swipes, then back to1. The longer six-pinch/24-pan sequence rendered89frames: main max95.32ms, zero100msstalls, renderp9525.4/max27.7ms. That still fails the16.7msrender target. No build or profiling overlapped either unprofiled window. A further unprofiled repeat starting/ending on page2 rendered63frames at p9514.4/max37.55ms with main max97.48ms and zero100msstalls. Earlier failed windows remain. Separate native-call-stack runs are diagnostic only. The local driver and owned simulator are now stopped; no browser/dev server or local replay sink remains.
• All 512 installed engine files match the vendored archive; source 8316b8c8931b933b01e6ee1e34141ae47264d9d3, SHA256 041f2c970c80e3ea074d424735530cb7d8de7765f3128dd3261da3f90137a5e6.

Simplify and security reviews completed with no outstanding findings. Existing source files above 500 lines are limited to the two-line note-screen theme binding and the toolbar/text-overlay color bindings. Splitting those existing stateful gesture components would broaden this display-only change and risk their lifecycle; new helpers stay below the limit. CI diagnostic changes also pass YAML/Python parsing, TypeScript and the 122-test suite; they only retain synthetic audit fixtures and sample the owned app process. No storage format, export colors, auth boundary, remote service, or dependency version changes.