Themes
Repainting the instance in your own colours, what the editor can honestly show you, and why the preview cannot disagree with what is saved.
A theme repaints ServiceNow. While one is active it takes precedence over both dark mode and light mode. Themes live on your account rather than on a profile, so switching profile does not change the colours.
They are edited in settings, under Themes.
Ten sections, four slots each
The instance's design tokens are grouped into ten sections, derived from the platform's own naming: the navbar, menus, lists, forms, buttons, containers, messages, steps, charts, and a base that collects everything the others do not claim. The grouping is total by construction: all 5,731 tokens land somewhere, and the base takes the 1,195 with no home of their own.
Each section has four slots: background, hover, text and border. They come from the role, not from the state. A slot called "active item" would put a background, a text colour and a border under one swatch, which is three decisions pretending to be one. Hover is the exception, because there the state really is the colour.
Charts are a section of their own, and the one to think twice about: colour there carries meaning.
The factory presets are not rows
The only thing you can do to a preset is duplicate it. They are the same for everyone, and a copy per account would start ageing the first time one of them was corrected.
What the editor shows you
The editor does not compile 5,731 tokens on every keystroke. Each derived slot shows its anchor's colour, and says that is what it is doing: an honest approximation rather than a claim about the exact compiled result.
The page is bundled with the same engine the worker compiles with, so the preview cannot disagree with what is saved. Contrast is measured live against the target for that anchor and flagged when it falls below.
Free CSS goes through a checker, and a refusal is reported on the line of your own text rather than on a line number in a re-serialised copy you have never seen.
The two layers
The generic dark stylesheet is the anti-flash layer, not the theme. A custom theme's CSS cannot be applied before first paint, because pre-paint registration wants a file on disk. So for a dark theme the generic dark sits underneath and the theme paints over it; for a light theme nothing is registered at all, because ServiceNow is already light and registering dark would flash the wrong way.
The compiled theme is cached in a single write. An extension worker can be killed mid-compilation, and two writes would leave behind a cache that claims to be current and never gets noticed again.
The live preview from the editor expires after thirty seconds: past that, the tab has moved on.
The settings page has its own theme
It follows what you chose there, then the mode of the active theme, then your system preference. It follows the mode and nothing else, because a theme's tokens are written against ServiceNow's own markup and would paint nothing on this page.