diff --git a/.github/workflows/build-artifacts.yml b/.github/workflows/build-artifacts.yml
index 5123df6..4ddf880 100644
--- a/.github/workflows/build-artifacts.yml
+++ b/.github/workflows/build-artifacts.yml
@@ -103,14 +103,36 @@ jobs:
           name: frontend-dist
           path: frontend/dist
 
+      # The icon, version strings, and DPI manifest reach a Windows binary only
+      # through a .syso the linker finds inside the package being built. This
+      # workflow calls `go build` directly rather than going through
+      # build/windows/Taskfile.yml, so the step has to be repeated here -- doing
+      # it only in the Taskfile would leave every released .exe on the default
+      # executable icon while local builds looked correct.
+      - name: Compile Windows resources
+        if: matrix.target.platform == 'windows'
+        shell: bash
+        working-directory: build
+        run: |
+          go run github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.4 generate syso \
+            -icon windows/icon.ico \
+            -manifest windows/wails.exe.manifest \
+            -info windows/info.json \
+            -arch "$GOARCH" \
+            -out "../cmd/oneagent-desktop/rsrc_windows_${GOARCH}.syso"
+
       - name: Build binaries
         shell: bash
         run: |
           mkdir -p bin
           version_ldflag="-X github.com/MaimoryLab/OneAgent/internal/version.Version=$RELEASE_VERSION"
           if [ "${{ matrix.target.platform }}" = windows ]; then
-            GOARCH=amd64 go run github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.4 generate icons -input build/appicon.png -macfilename "" -windowsfilename build/windows/icon.ico
-            GOARCH=amd64 go run github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.4 generate syso -arch "${GOARCH}" -icon build/windows/icon.ico -manifest build/windows/wails.exe.manifest -out "cmd/oneagent-desktop/wails_windows_${GOARCH}.syso"
+            # No `generate icons` step: build/windows/icon.ico is tracked. That
+            # generator scales every entry from appicon.png, and its 16x16 -- the
+            # size Explorer and the taskbar use -- collapses into a solid block,
+            # so the tracked file carries a hand-drawn entry there. Regenerating
+            # would have replaced it on every release build.
+            GOARCH=amd64 go run github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.4 generate syso -arch "${GOARCH}" -icon build/windows/icon.ico -manifest build/windows/wails.exe.manifest -info build/windows/info.json -out "cmd/oneagent-desktop/wails_windows_${GOARCH}.syso"
           fi
           go build -tags wails,production -trimpath -buildvcs=false -ldflags="${{ matrix.target.desktop_ldflags }} $version_ldflag" -o "bin/oneagent-desktop${{ matrix.target.suffix }}" ./cmd/oneagent-desktop
           rm -f "cmd/oneagent-desktop/wails_windows_${GOARCH}.syso"
diff --git a/.gitignore b/.gitignore
index e1cd1c4..03b3637 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,7 @@ site/
 
 # 对竞品的定向调研笔记：含内部评价措辞，保留本机参考但不随开源仓库分发。
 docs/internal/cc-switch-reference-notes.md
+
+# Windows 资源产物：图标、版本号和 DPI manifest 由 build/windows/ 下的源文件
+# 在构建时编译进 .syso。它必须落在被构建的包目录里链接器才认，构建完即删除。
+cmd/oneagent-desktop/*.syso
diff --git a/NOTICE b/NOTICE
index 7d83f8e..ba75b12 100644
--- a/NOTICE
+++ b/NOTICE
@@ -63,6 +63,17 @@ Every mark is distributed as a single-colour glyph painted with
 fill="currentColor", so it takes the surrounding text colour rather than
 carrying a brand colour.
 
+OneAgent's own mark is not part of that inventory and is not third-party
+material. It is MaimoryLab's work, distributed under this repository's Apache-2.0
+license, and appears at frontend/src/components/icons/assets/oneagent-mark.svg
+in the interface and at build/appicon.png, build/darwin/icons.icns, and
+build/windows/icon.ico as the application icon. It is recorded under
+`firstPartyAssets` in frontend/src/components/icons/asset-rights.json, kept
+separate from the `assets` inventory above because it has no third-party source,
+licence text or copyright owner to record -- listing it there would assert a
+provenance it does not have. It is named here so the inventory above is not read
+as covering every image in the release.
+
 Sponsor marks are a separate case and are not nominative use. The PPIO and
 Novita logos under docs/assets/sponsors/ are reproduced with each owner's
 permission to identify a sponsor of this project, and they do carry their brand
diff --git a/build/Taskfile.yml b/build/Taskfile.yml
index 8f8cc13..abe0747 100644
--- a/build/Taskfile.yml
+++ b/build/Taskfile.yml
@@ -70,19 +70,14 @@ tasks:
     cmds:
       - '{{.WAILS3}} generate icons -input appicon.png -macfilename darwin/icons.icns -windowsfilename ""'
 
-  generate:windows:icon:
-    summary: Generate the Windows application icon
-    run: once
-    dir: build
-    sources:
-      - appicon.png
-    generates:
-      - windows/icon.ico
-    env:
-      # The generator runs on the host; GOARCH may be the cross-compile target.
-      GOARCH: amd64
-    cmds:
-      - '{{.WAILS3}} generate icons -input appicon.png -macfilename "" -windowsfilename windows/icon.ico'
+  # windows/icon.ico is tracked rather than generated, so there is deliberately no
+  # generate:windows:icon task. `wails3 generate icons` scales every entry from
+  # appicon.png, and at 16x16 -- the size Explorer and the taskbar use -- the ring
+  # stroke, its counter, and the inner form each land on under 2.4px and blend
+  # into a solid block, losing the break in the ring. That entry is hand-drawn.
+  # A task that regenerated the file would discard it on every `task package`,
+  # silently and without failing. Re-run `wails3 generate icons` by hand only if
+  # the mark itself changes, then restore the 16x16 entry.
 
   dev:frontend:
     summary: Runs the Vite dev server (used by `task dev`)
diff --git a/build/appicon.png b/build/appicon.png
index c0247b1..393e465 100644
Binary files a/build/appicon.png and b/build/appicon.png differ
diff --git a/build/darwin/icons.icns b/build/darwin/icons.icns
index 5b9aaa2..ee65379 100644
Binary files a/build/darwin/icons.icns and b/build/darwin/icons.icns differ
diff --git a/build/windows/Taskfile.yml b/build/windows/Taskfile.yml
index 4e68a9e..ec7bc0b 100644
--- a/build/windows/Taskfile.yml
+++ b/build/windows/Taskfile.yml
@@ -17,6 +17,9 @@ tasks:
           ARCH: '{{.ARCH | default ARCH}}'
     cmds:
       - go build {{.BUILD_FLAGS}} -o "{{.OUTPUT}}" ./cmd/oneagent-desktop
+      # The .syso is a build input for GOOS=windows only. Left in place it would
+      # be picked up by a native Windows build of any other target in this repo,
+      # and its arch suffix makes it wrong for the other architecture.
       - cmd: powershell Remove-item "cmd/oneagent-desktop/wails_windows_{{.ARCH | default ARCH}}.syso"
         platforms: [windows]
       - cmd: rm -f "cmd/oneagent-desktop/wails_windows_{{.ARCH | default ARCH}}.syso"
@@ -32,10 +35,12 @@ tasks:
   generate:syso:
     summary: Generates Windows resources with the application icon
     dir: '{{.ROOT_DIR}}'
-    deps:
-      - task: common:generate:windows:icon
+    # No common:generate:windows:icon dep: build/windows/icon.ico is tracked, and
+    # regenerating it from appicon.png would replace its hand-drawn 16x16 entry --
+    # the size Explorer and the taskbar use, where a scaled copy of the mark
+    # collapses into a solid block.
     cmds:
-      - '{{.WAILS3}} generate syso -arch {{.ARCH | default ARCH}} -icon build/windows/icon.ico -manifest build/windows/wails.exe.manifest -out cmd/oneagent-desktop/wails_windows_{{.ARCH | default ARCH}}.syso'
+      - '{{.WAILS3}} generate syso -arch {{.ARCH | default ARCH}} -icon build/windows/icon.ico -manifest build/windows/wails.exe.manifest -info build/windows/info.json -out cmd/oneagent-desktop/wails_windows_{{.ARCH | default ARCH}}.syso'
     env:
       # The generator runs on the host; GOARCH may be the cross-compile target.
       GOARCH: amd64
@@ -48,7 +53,8 @@ tasks:
         vars:
           ARCH: '{{.ARCH}}'
           VERSION: '{{.VERSION}}'
-      - task: common:generate:windows:icon
+      # nsis/project.nsi reads the tracked ../icon.ico directly through MUI_ICON,
+      # so the installer needs no icon-generation step of its own.
     preconditions:
       - sh: command -v makensis >/dev/null 2>&1
         msg: "makensis not found. Install NSIS first."
diff --git a/build/windows/icon.ico b/build/windows/icon.ico
index 34da089..ff77df9 100644
Binary files a/build/windows/icon.ico and b/build/windows/icon.ico differ
diff --git a/build/windows/info.json b/build/windows/info.json
new file mode 100644
index 0000000..168f1b6
--- /dev/null
+++ b/build/windows/info.json
@@ -0,0 +1,14 @@
+{
+  "fixed": {
+    "file_version": "0.3.0"
+  },
+  "info": {
+    "0000": {
+      "ProductVersion": "0.3.0",
+      "CompanyName": "MaimoryLab",
+      "FileDescription": "Local AI development environment activator",
+      "LegalCopyright": "(c) 2026 MaimoryLab",
+      "ProductName": "OneAgent"
+    }
+  }
+}
diff --git a/frontend/src/components/NavigationSidebar.tsx b/frontend/src/components/NavigationSidebar.tsx
index 3dc3f35..91cd28e 100644
--- a/frontend/src/components/NavigationSidebar.tsx
+++ b/frontend/src/components/NavigationSidebar.tsx
@@ -1,7 +1,8 @@
-import { Boxes, FolderCog, Gauge, Layers3, Settings } from "lucide-react";
+import { FolderCog, Gauge, Layers3, Settings } from "lucide-react";
 import { NavLink } from "react-router-dom";
 
 import { type TranslationKey, useI18n } from "../i18n";
+import { BrandMark } from "./icons/BrandMark";
 import { TaskCenter } from "./TaskCenter";
 
 // Only real destinations belong here. /setup/* are wizard steps behind
@@ -18,8 +19,11 @@ export function NavigationSidebar() {
   return (
     <aside className="navigation-sidebar">
       <div className="brand-lockup">
+        {/* The product's own mark. This was lucide's generic <Boxes> glyph --
+            a stock icon from the icon library standing in for a brand that did
+            not exist yet. */}
         <span className="brand-mark" aria-hidden="true">
-          <Boxes size={21} strokeWidth={1.8} />
+          <BrandMark size={22} />
         </span>
         <div>
           <strong>OneAgent</strong>
diff --git a/frontend/src/components/icons/BrandMark.test.tsx b/frontend/src/components/icons/BrandMark.test.tsx
new file mode 100644
index 0000000..62535e7
--- /dev/null
+++ b/frontend/src/components/icons/BrandMark.test.tsx
@@ -0,0 +1,47 @@
+import { render } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { AGENT_ICON_IDS, agentMarkKind } from "./agents";
+import { BrandMark } from "./BrandMark";
+
+describe("BrandMark", () => {
+  it("renders an inline svg so currentColor resolves against this document", () => {
+    const { container } = render(<BrandMark />);
+    const svg = container.querySelector("svg");
+    expect(svg).toBeTruthy();
+    // An <img src> would make the SVG a separate document where currentColor
+    // falls back to black; the Agent marks are inlined for the same reason.
+    expect(container.querySelector("img")).toBeNull();
+    expect(svg?.getAttribute("fill")).toBe("currentColor");
+    expect(svg?.querySelectorAll("path").length).toBeGreaterThan(0);
+  });
+
+  it("does not hardcode the brand blue, so it follows the theme", () => {
+    const { container } = render(<BrandMark />);
+    const markup = container.innerHTML.toLowerCase();
+    // #007AFF equals --blue on the light theme but not the dark one (#0a84ff),
+    // so a literal here would be visibly wrong in dark mode.
+    expect(markup).not.toContain("007aff");
+    expect(markup).not.toContain("0a84ff");
+  });
+
+  it("is hidden from assistive technology, since the wordmark carries the name", () => {
+    const { container } = render(<BrandMark />);
+    expect(container.firstElementChild?.getAttribute("aria-hidden")).toBe("true");
+  });
+
+  it("honours the requested size", () => {
+    const { container } = render(<BrandMark size={40} />);
+    const host = container.firstElementChild as HTMLElement;
+    expect(host.style.width).toBe("40px");
+    expect(host.style.height).toBe("40px");
+  });
+
+  it("stays out of the third-party Agent mark inventory", () => {
+    // The MARKS table exists to track vendor artwork with a recorded licence and
+    // SHA-256. This mark is first-party, so registering it there would assert a
+    // third-party provenance it does not have.
+    expect(AGENT_ICON_IDS).not.toContain("oneagent");
+    expect(agentMarkKind("oneagent")).toBe("fallback");
+  });
+});
diff --git a/frontend/src/components/icons/BrandMark.tsx b/frontend/src/components/icons/BrandMark.tsx
new file mode 100644
index 0000000..a2db265
--- /dev/null
+++ b/frontend/src/components/icons/BrandMark.tsx
@@ -0,0 +1,34 @@
+/**
+ * OneAgent's own mark.
+ *
+ * Deliberately not part of the MARKS table in agents.tsx. That table exists to
+ * track third-party vendor artwork -- every entry carries a source, licence, and
+ * SHA-256 in asset-rights.json, and agents.test.tsx asserts each one has a
+ * recorded basis. This mark is first-party work under the repository's own
+ * licence, so recording it there would claim a third-party provenance it does
+ * not have.
+ *
+ * The path is traced from the master raster in the site repository
+ * (public/images/brand/oneagent-logo.png) rather than redrawn, so the geometry
+ * stays the designer's. It paints with fill="currentColor" instead of the
+ * brand's #007AFF: that value matches --blue on the light theme exactly, but the
+ * dark theme sets --blue to #0a84ff, so a hardcoded fill would be visibly off
+ * against every other blue in the window. Inheriting the colour keeps it in step
+ * with both themes.
+ */
+import brandMark from "./assets/oneagent-mark.svg?raw";
+
+export function BrandMark({ size = 22 }: { size?: number }) {
+  // Inlined rather than <img src>, for the same reason the Agent marks are: an
+  // SVG fetched by <img> is an isolated document where currentColor resolves to
+  // black instead of the surrounding text colour.
+  return (
+    <span
+      className="brand-mark-glyph"
+      style={{ width: size, height: size }}
+      aria-hidden="true"
+      data-mark-kind="brand"
+      dangerouslySetInnerHTML={{ __html: brandMark }}
+    />
+  );
+}
diff --git a/frontend/src/components/icons/asset-rights.json b/frontend/src/components/icons/asset-rights.json
index d0041c8..7d3fbff 100644
--- a/frontend/src/components/icons/asset-rights.json
+++ b/frontend/src/components/icons/asset-rights.json
@@ -43,5 +43,11 @@
       "modified": true,
       "modificationNote": "Recoloured to a single currentColor glyph for theme adaptation: the linearGradient (#ff4d4d to #991b1b), the antenna stroke colour and the cyan eye highlights were removed, and the eyes became a mask cut-out. Geometry is unchanged. Not an official OpenClaw mark; drawn by the cc-switch project."
     }
+  },
+  "firstPartyAssets": {
+    "oneagent-mark": {
+      "file": "assets/oneagent-mark.svg",
+      "note": "OneAgent's own mark, traced from the master raster in MaimoryLab/OneAgent-site (public/images/brand/oneagent-logo.png). MaimoryLab's work under this repository's Apache-2.0 license, so it carries no third-party source, licence text or copyright owner and is deliberately absent from `assets` above -- registering it there would assert a provenance it does not have. Listed here so the compliance gate can tell a first-party asset apart from one nobody attributed."
+    }
   }
 }
diff --git a/frontend/src/components/icons/assets/oneagent-mark.svg b/frontend/src/components/icons/assets/oneagent-mark.svg
new file mode 100644
index 0000000..d6a1634
--- /dev/null
+++ b/frontend/src/components/icons/assets/oneagent-mark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" fill="currentColor" fill-rule="evenodd" aria-hidden="true"><path d="M23.67 3.38L25.22 3.42L25.27 3.47L25.78 3.47L25.83 3.52L26.25 3.52L26.30 3.56L26.72 3.56L26.77 3.61L27.28 3.66L29.02 4.03L30.80 4.59L32.86 5.48L34.31 6.28L35.53 7.08L36.70 7.97L37.45 8.62L38.81 9.98L39.70 11.02L41.16 13.08L42.09 14.72L43.03 16.88L43.73 19.17L44.06 20.91L44.16 22.12L44.20 22.17L44.20 22.69L44.25 22.73L44.25 25.22L44.20 25.27L44.11 26.77L43.78 28.36L43.78 28.59L43.50 29.48L43.41 30.00L43.12 30.70L43.12 30.84L42.70 31.92L41.72 33.94L40.64 35.67L39.19 37.55L37.69 39.09L36.56 40.08L34.73 41.39L33.28 42.23L31.59 43.03L29.81 43.69L29.48 43.73L28.45 44.06L27.98 44.11L27.28 44.30L26.34 44.39L26.30 44.44L25.88 44.44L25.83 44.48L25.31 44.48L25.27 44.53L22.59 44.53L22.55 44.48L21.19 44.39L19.45 44.06L18.56 43.78L18.23 43.73L17.81 43.55L17.25 43.41L16.55 43.08L16.41 43.08L15.98 42.84L15.66 42.75L14.44 42.09L14.34 42.09L13.83 41.77L14.95 41.72L16.22 41.39L16.45 41.25L16.92 41.11L17.48 40.78L17.58 40.78L19.22 39.80L24.66 36.09L25.27 35.62L25.55 35.48L25.88 35.20L26.62 34.73L28.12 33.66L29.25 32.67L29.77 32.02L30.09 31.36L30.33 30.38L30.28 29.39L30.09 28.69L28.78 26.25L28.55 25.92L28.41 25.59L27.19 23.53L26.77 22.69L26.53 22.36L24.52 18.75L24.19 18.52L23.77 18.47L23.58 18.56L23.30 18.84L22.36 20.58L21.94 21.23L21.70 21.75L21.52 21.98L21.33 22.41L21.14 22.64L20.95 23.06L20.77 23.30L19.97 24.80L19.73 25.12L18.00 28.27L17.77 28.59L16.27 31.36L15.66 32.11L15.23 32.44L15.14 32.44L14.81 32.62L14.30 32.77L13.64 32.77L12.98 32.58L12.80 32.44L12.23 31.69L11.81 31.03L11.30 30.05L12.33 28.27L12.52 27.84L12.75 27.52L13.17 26.67L13.83 25.59L14.48 24.33L14.67 24.09L15.84 21.94L16.41 21.05L17.20 19.55L17.39 19.31L18.47 17.30L19.03 16.41L19.73 15.09L20.44 14.02L21.23 13.22L21.61 12.94L22.41 12.52L22.97 12.33L23.44 12.23L24.42 12.23L25.08 12.38L25.22 12.47L25.59 12.56L26.58 13.17L27.14 13.69L27.70 14.39L34.36 26.06L34.78 26.91L34.78 27.05L34.97 27.42L35.25 28.41L35.39 29.11L35.39 29.48L35.44 29.53L35.44 30.66L35.39 30.70L35.39 30.98L35.25 31.69L34.88 32.81L34.50 33.56L34.08 34.22L33.23 35.25L31.78 36.66L30.42 37.78L28.27 39.42L25.08 41.67L25.22 41.72L25.45 41.58L25.92 41.44L26.34 41.20L26.67 41.11L27.38 40.73L27.47 40.73L27.56 40.64L28.55 40.17L30.80 38.81L32.25 37.78L33.33 36.89L34.50 35.77L35.86 34.12L36.84 32.62L37.78 30.75L38.48 28.78L38.95 26.91L38.95 26.67L39.09 26.06L39.09 25.73L39.14 25.69L39.14 25.12L39.19 25.08L39.19 22.88L39.14 22.83L39.14 22.31L39.09 22.27L39.05 21.61L38.77 20.20L38.11 18.19L37.36 16.59L36.38 15.00L35.20 13.55L34.08 12.42L32.81 11.39L31.45 10.50L30.19 9.84L28.36 9.14L28.17 9.14L27.33 8.86L26.81 8.81L26.58 8.72L25.73 8.62L25.69 8.58L25.31 8.58L25.27 8.53L23.53 8.48L23.48 8.53L22.22 8.58L22.17 8.62L21.89 8.62L21.84 8.67L20.58 8.86L19.12 9.28L17.72 9.84L15.98 10.78L14.95 11.48L13.88 12.38L12.28 14.02L11.11 15.61L10.17 17.30L9.75 18.28L9.14 20.16L8.86 21.52L8.81 22.12L8.77 22.17L8.77 22.64L8.72 22.69L8.67 24.56L8.72 24.61L8.77 25.92L9.09 27.66L9.70 29.53L10.78 31.64L11.48 32.67L12.19 33.52L13.36 34.69L14.62 35.72L16.17 36.70L17.62 37.41L18.28 37.59L18.70 37.78L19.73 38.02L19.41 38.30L18.61 38.77L18.33 39.00L16.45 40.03L15.42 40.41L14.44 40.59L13.36 40.59L12.42 40.41L11.44 39.98L10.59 39.42L9.98 38.86L9.09 37.88L7.69 35.95L7.12 35.30L6.19 33.94L5.20 31.97L5.06 31.50L4.78 30.89L4.64 30.33L4.55 30.19L4.12 28.64L3.80 26.91L3.70 25.55L3.66 25.50L3.66 24.61L3.61 24.56L3.61 23.30L3.66 23.25L3.66 22.45L3.70 22.41L3.70 21.98L3.80 21.52L3.80 21.05L3.89 20.77L3.89 20.48L4.17 19.08L4.41 18.42L4.55 17.77L4.78 17.20L4.78 17.06L5.44 15.47L6.47 13.50L7.45 12.00L8.48 10.64L8.95 10.12L10.97 8.16L12.42 7.03L13.73 6.19L14.77 5.62L15.42 5.34L15.52 5.25L15.84 5.16L16.27 4.92L17.20 4.55L17.34 4.55L18.19 4.22L18.70 4.12L19.41 3.89L19.64 3.89L21.14 3.56L22.55 3.47L22.59 3.42L23.62 3.42Z"/></svg>
diff --git a/frontend/src/styles/app.css b/frontend/src/styles/app.css
index 69200f0..6a50ec3 100644
--- a/frontend/src/styles/app.css
+++ b/frontend/src/styles/app.css
@@ -52,7 +52,12 @@
   font-size: 16px;
 }
 
-.brand-lockup span:last-child {
+/* Scoped to the tagline beside the wordmark. Written as `.brand-lockup
+   span:last-child` this matched any last-child span anywhere in the lockup,
+   including the one wrapping the product mark, and painted it --text-secondary
+   instead of the brand colour. It only stayed hidden while the mark was a Lucide
+   <svg> rather than a <span>. */
+.brand-lockup > div > span:last-child {
   color: var(--text-secondary);
   font-size: 11px;
 }
@@ -493,6 +498,21 @@
   height: 100%;
 }
 
+/* The product mark, painted in the theme's blue rather than the text colour the
+   Agent marks inherit. Those identify a row and should read as neutral UI; this
+   one is the brand and carries its colour. */
+.brand-mark-glyph {
+  display: inline-grid;
+  place-items: center;
+  flex: 0 0 auto;
+  color: var(--blue);
+}
+
+.brand-mark-glyph > svg {
+  width: 100%;
+  height: 100%;
+}
+
 .agent-copy,
 .choice-copy,
 .progress-copy {
diff --git a/frontend/src/styles/brand-mark.test.ts b/frontend/src/styles/brand-mark.test.ts
new file mode 100644
index 0000000..709bdd1
--- /dev/null
+++ b/frontend/src/styles/brand-mark.test.ts
@@ -0,0 +1,64 @@
+/**
+ * Guards the product mark in the sidebar lockup.
+ *
+ * Two things here are load-bearing and neither is visible to jsdom, which does
+ * not resolve var():
+ *
+ *   - The mark paints var(--blue), not a literal. #007AFF matches --blue exactly
+ *     on the light theme, which is why a hardcoded fill looks correct until you
+ *     switch to dark, where --blue becomes #0a84ff.
+ *   - The tagline rule stays scoped to the tagline. It was written as
+ *     `.brand-lockup span:last-child`, which matched any last-child span in the
+ *     lockup -- including the one wrapping the mark -- and painted it
+ *     --text-secondary. That stayed hidden only while the mark was a Lucide
+ *     <svg> rather than a <span>, so the next markup change would reintroduce it.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+function sheet(name: string): string {
+  const css = readFileSync(fileURLToPath(new URL(name, import.meta.url)), "utf8");
+  return css.replace(/\/\*[\s\S]*?\*\//g, " ");
+}
+
+function declarations(css: string, selector: string): Map<string, string> {
+  const want = selector.replace(/\s+/g, " ").trim();
+  const found = new Map<string, string>();
+  let seen = false;
+  for (const block of css.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+    if (block[1].replace(/\s+/g, " ").trim() !== want) continue;
+    seen = true;
+    found.clear();
+    for (const part of block[2].split(";")) {
+      const split = part.indexOf(":");
+      if (split < 0) continue;
+      found.set(part.slice(0, split).trim(), part.slice(split + 1).trim().replace(/\s+/g, " "));
+    }
+  }
+  expect(seen, `${selector} should exist`).toBe(true);
+  return found;
+}
+
+describe("sidebar product mark", () => {
+  it("takes its colour from the theme token rather than a literal", () => {
+    const rules = declarations(sheet("app.css"), ".brand-mark-glyph");
+    expect(rules.get("color")).toBe("var(--blue)");
+  });
+
+  it("scopes the tagline colour so it cannot reach the mark", () => {
+    const app = sheet("app.css");
+    // The child combinator is the whole point: the mark's span is a direct child
+    // of .brand-lockup, the tagline is nested one level deeper.
+    const scoped = declarations(app, ".brand-lockup > div > span:last-child");
+    expect(scoped.get("color")).toBe("var(--text-secondary)");
+    expect(app).not.toMatch(/\.brand-lockup\s+span:last-child\s*\{/);
+  });
+
+  it("sizes the glyph from the element box so the svg cannot overflow the plate", () => {
+    const rules = declarations(sheet("app.css"), ".brand-mark-glyph > svg");
+    expect(rules.get("width")).toBe("100%");
+    expect(rules.get("height")).toBe("100%");
+  });
+});
diff --git a/scripts/test_generate_third_party_licenses.py b/scripts/test_generate_third_party_licenses.py
index 237387e..3afee07 100644
--- a/scripts/test_generate_third_party_licenses.py
+++ b/scripts/test_generate_third_party_licenses.py
@@ -58,16 +58,25 @@ def test_collects_every_rights_manifest_asset_and_copies_license_text(self) -> N
                 for license_file in dependency.license_files:
                     self.assertTrue((Path(output_dir) / license_file).is_file())
 
-    def test_every_shipped_image_asset_is_registered(self) -> None:
+    def test_every_shipped_image_asset_is_accounted_for(self) -> None:
         # The generator walks the manifest, never the directory, so an asset file
         # that nobody registered is redistributed with no source, licence or hash
         # recorded -- and --check still passes. That is the failure this guards:
         # docs/distribution-compliance-policy.md makes the rights inventory a
         # release precondition.
+        #
+        # `firstPartyAssets` is a separate list because the two cases need
+        # different evidence. A third-party file needs a source, licence text,
+        # owner and hash. Our own artwork has none of those to give -- it is
+        # covered by the repository's own licence -- and putting it in `assets`
+        # to satisfy the gate would assert a vendor provenance that does not
+        # exist. What still matters is that no file is in neither list, which is
+        # what this checks.
         manifest = json.loads(ASSET_RIGHTS_MANIFEST.read_text(encoding="utf-8"))
-        registered = {
-            (ICON_ROOT / str(rights["file"])).resolve()
-            for rights in manifest["assets"].values()
+        accounted = {
+            (ICON_ROOT / str(entry["file"])).resolve()
+            for group in ("assets", "firstPartyAssets")
+            for entry in manifest.get(group, {}).values()
         }
         on_disk = {
             path.resolve()
@@ -75,15 +84,36 @@ def test_every_shipped_image_asset_is_registered(self) -> None:
             if path.is_file() and path.suffix.lower() in {".svg", ".png", ".jpg", ".jpeg", ".webp"}
         }
 
-        unregistered = sorted(path.name for path in on_disk - registered)
+        unaccounted = sorted(path.name for path in on_disk - accounted)
         self.assertEqual(
-            unregistered,
+            unaccounted,
             [],
             "image assets present but absent from asset-rights.json: "
-            f"{unregistered}. Register each with its source, licence, copyright "
-            "owner and SHA-256, or delete it.",
+            f"{unaccounted}. Register a third-party asset under `assets` with its "
+            "source, licence, copyright owner and SHA-256; record our own artwork "
+            "under `firstPartyAssets`; or delete it.",
         )
 
+    def test_first_party_assets_claim_no_third_party_rights(self) -> None:
+        # The two groups must not blur together. A first-party entry carrying a
+        # licence or owner field would read as an attribution, and a file listed
+        # in both would make it ambiguous which basis applies.
+        manifest = json.loads(ASSET_RIGHTS_MANIFEST.read_text(encoding="utf-8"))
+        third_party_files = {str(entry["file"]) for entry in manifest["assets"].values()}
+        for name, entry in manifest.get("firstPartyAssets", {}).items():
+            self.assertNotIn(
+                str(entry["file"]),
+                third_party_files,
+                f"{name} is listed as both first-party and third-party",
+            )
+            self.assertTrue(str(entry.get("note", "")).strip(), f"{name} records no note")
+            for field in ("source", "license", "licenseSource", "copyrightOwner", "sha256"):
+                self.assertNotIn(
+                    field,
+                    entry,
+                    f"{name} is first-party but carries the third-party field {field!r}",
+                )
+
 
 class NoticeRenderingTests(unittest.TestCase):
     def test_renders_target_platforms_and_license_paths_deterministically(self) -> None: