feat: the wordmark has its space, and logo and banner say so

closes #28

The owner supplied a redrawn lockup, docs/design/dist/splash.webp, which sets
the name as "Privacy: Period Tracker" — with the space after the colon.

NECESSARY AND NOT SUFFICIENT

The tempting move was to look at the new artwork and close the issue. #28's
Verify names the two DERIVED assets, not the lockup: the wordmark in
docs/data/img/logo.webp and banner.webp had to match app_full_name, and both
still carried the old spaceless form because they were generated from the
earlier source. Regenerated from the new lockup and checked by cropping the
colon out of each finished webp and reading it at 1350px wide.

THE BANNER IS COMPOSED, NEVER CROPPED

The lockup is square and the banner is 3:1, so a crop takes the ends off the
wordmark — the trap the first pass at these assets hit. A 660px square card
centred on 2176x725, matching how the existing asset did it. No flood-fill this
time either: splash.webp has real transparency where the earlier sources
rendered their rounded corners against black.

icon.webp is deliberately untouched. It carries no wordmark, it is the same
visual family, and #28 is about the name — regenerating it would be churn
dressed as consistency.

BRAND_GUIDE.md §10 carried a callout stating the drawn mark disagreed with the
written name. That is now false, so it records what happened instead and marks
lockup-light-source.png and lockup-dark-source.png as superseded rather than
deleting them; they are the owner's files.

Also corrects a path in the previous log entry, which named splash.png in
backticks — doc-claims reads that as a claim the file is present, and it is now
splash.webp. Named bare, per the convention DOC_TRUST_MAP.md documents for a
path that deliberately does not exist. Second time this session; the lesson is
that converting a file means grepping the docs for its old name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/DOC_TRUST_MAP.md

@@ -81,7 +81,7 @@ Where the two disagree, `PRODUCT_PLAN.md` is the specification and
 | `docs/planning/` | `PRODUCT_PLAN` — the V1 specification. `PROJECT_PLAN` — the vision. Neither is the schedule; that is the tracker. |
 | `docs/qa/` | `ClaudeQAPlan` (playbook, passes A–H), `ClaudeQACoverage` (what each pass reached), `ClaudeReport` (the verdict) |
 | `docs/architecture/` | modules, boundaries, data shapes, the migration table; `GUARDS.md`; `githooks/README.md` |
-| `docs/design/` | `README.md` — tone, the four rules that settle arguments, and which specification sections own each surface. `BRAND_GUIDE.md` — the owner-supplied visual identity, which outranks `PRODUCT_PLAN.md` §39 on colour. `brand/` — the source PNGs the marks were cut from. `dist/` — the onboarding concept cards, references rather than shipping assets |
+| `docs/design/` | `README.md` — tone, the four rules that settle arguments, and which specification sections own each surface. `BRAND_GUIDE.md` — the owner-supplied visual identity, which outranks `PRODUCT_PLAN.md` §39 on colour. `brand/` — the owner's source art, including the emblem the launcher icon is cut from. `dist/` — the onboarding illustration sources, and `splash.png`, the lockup `docs/data/img/logo.webp` and `banner.webp` are generated from |
 | `docs/security/` | `SECURITY` — threat model, the advertising boundary, logging rules. `SECURITY_CHECKLIST` — the pre-release list |
 | `docs/history/` | `DEVELOPMENT_LOG` (dated, append-only), `HISTORY` (decisions and their reasons), `BATCH_LEDGER` (archived) |
 | `docs/data/` | `README.md` — the rule, and why this folder cannot be exempted. `img/README.md` — the three required names, their dimensions and the 512 KB ceiling. `img/icon.webp`, `img/logo.webp`, `img/banner.webp` — the marks privacyllc.dev renders |

docs/design/BRAND_GUIDE.md

@@ -366,13 +366,17 @@ The brand name is:
 
 Keep the colon between Privacy and Period, with a single space after it.
 
-> **The drawn wordmark does not match this yet.** The supplied artwork sets the
+> **The drawn wordmark agrees with this now.** It did not for a while: the first
-> name as *Privacy:Period Tracker* — no space after the colon — and that is what
+> supplied lockup set the name as *Privacy:Period Tracker*, with no space after
-> `docs/data/img/logo.webp` and `docs/data/img/banner.webp` currently show. The
+> the colon, so `logo.webp` and `banner.webp` disagreed with every document and
-> written form above is canonical — it is what every document, the store listing
+> with `app_full_name`. It was filed as #28 rather than papered over, because
-> and the app itself use — so the lockup needs redrawing to agree with it. Filed
+> closing that gap needed an artist and not a rename.
-> as issue #28 (Batch 08, `P2`) rather than fixed here, because closing the gap
+>
-> needs an artist and not a rename.
+> The redrawn lockup is [`dist/splash.webp`](dist/splash.webp), and the two webp
+> assets are regenerated from it. `lockup-light-source.png` and
+> `lockup-dark-source.png` in [`brand/`](brand/) are the **superseded** originals
+> — kept because they are the owner's files, not because anything should be cut
+> from them again.
 
 Preferred presentation:
 

docs/design/dist/README.md

@@ -85,6 +85,31 @@ unclipped they showed as four notches against the app background: obvious on a
 device, invisible in code review. `Illustration` in `Illustrations.kt` clips just
 inside the painted curve, and what is left reads as a deliberate rounded card.
 
+## `splash.webp` — the redrawn lockup
+
+Not an onboarding illustration, and it sits here because it arrived with them.
+It is the full brand lockup — emblem, wordmark, divider, tagline — and it is the
+artwork that closed **#28**: the first lockup set the name as
+*Privacy:Period Tracker* with no space after the colon, disagreeing with
+`app_full_name` and with every document.
+
+`../../data/img/logo.webp` and `banner.webp` are generated from it:
+
+```bash
+magick splash.webp -trim +repage -resize 900x900 lockup.png
+magick -size 1024x1024 xc:'#F0E6F0' -fill '#FAF0F5' \
+  -draw 'roundrectangle 8,8,1015,1015,88,88' \
+  lockup.png -gravity center -composite -quality 86 logo.webp
+```
+
+The banner is the same recipe on a 2176×725 canvas with a 660px square card
+centred. **It is composed, never cropped** — the lockup is square and a 3:1 crop
+takes the wordmark's ends off, which is the trap the first pass at these assets
+hit.
+
+No flood-fill this time: `splash.webp` has real transparency, where the earlier
+sources rendered their rounded corners against black.
+
 ## Format
 
 WebP at the delivered resolution — 312 KB for all sixteen, against 6.8 MB as

docs/history/DEVELOPMENT_LOG.md

@@ -32,6 +32,44 @@ written and stay true. It is exempt from review for the same reason a receipt is
 
 ## Entries
 
+### 2026-08-18 — The wordmark got its space, and #28 closed
+
+The owner supplied a redrawn lockup, `docs/design/dist/splash.webp`. It sets the
+name as **Privacy: Period Tracker** — with the space after the colon — which is
+the whole of what #28 asked for.
+
+**It was necessary and not sufficient**, which is worth writing down because the
+tempting move was to look at the new artwork and close the issue. #28's `Verify`
+line names the two *derived* assets, not the lockup: the wordmark in
+`docs/data/img/logo.webp` and `banner.webp` had to match `app_full_name`. Both
+still carried the old spaceless form, because they were generated from the
+earlier source months of decisions ago. Regenerated from the new lockup, checked
+by cropping the colon out of each finished webp at 1350px wide and reading it.
+
+**The banner is composed, never cropped.** The lockup is square and the banner
+is 3:1, so a crop takes the ends off the wordmark — the exact trap the first pass
+at these assets hit. A 660px square card centred on a 2176×725 field, same as the
+existing asset did it. No flood-fill this time either: `splash.webp` has real
+transparency where the earlier sources rendered their rounded corners against
+black.
+
+**`icon.webp` was deliberately left alone.** It carries no wordmark, it is the
+same visual family, and #28 is about the name. Regenerating it would have been
+churn dressed as consistency.
+
+`BRAND_GUIDE.md` §10 carried a callout saying the drawn mark disagreed with the
+written name. That statement is now false, so it says what happened instead, and
+names the old lockup sources as superseded rather than deleting them — they are
+the owner's files.
+
+- **Closed:** #28.
+- **Next action:** Batch 06 has #34, #35 and #37 left, and Batch 08 has #31 and
+  #32. #37 is the smallest and is unblocked. #34 still carries the open product
+  question about a forgotten PIN.
+- **Blockers:** #9, the Command Center webhook, still needs a person. TalkBack
+  has still never been run and no real lock screen has been looked at — both
+  cheap, both never done.
+
 ### 2026-08-18 — A logging guard, and the leak it was not looking for
 
 #38 asked for a guard that stops health data reaching a log. Writing it found a
@@ -90,8 +128,10 @@ early, because "no logs" is trivially true of an app that did nothing.
   same screen.
 - **Blockers:** #9, the Command Center webhook, still needs a person. TalkBack
   has still never been run and no real lock screen has been looked at. A
-  `docs/design/dist/splash.png` appeared in the tree during this session and is
+  docs/design/dist/splash.png — named bare, because it no longer exists under
-  untracked — it belongs to nobody's issue yet.
+  that name — appeared in the tree during this session and was untracked at the
+  time. It turned out to be the redrawn lockup, and is now committed as
+  `splash.webp`.
 
 ### 2026-08-18 — Batch 06 starts, and two defects that only a device could show