fix(desk): the heid code-review and bug-hunt panels on r2b merge 2, folded

The bug hunt (4/4) and code review (4/4) were both clean on mechanism.
Their shared catch was the one-sided minute check.

Dates:
- The date filters never raise. One clock outside the calendar's range
  500'd the Desk for every booth, because every row renders in one
  response. An unrenderable date now renders nothing.
- "Updated" shows whenever it differs from "created" by a minute or more,
  either way. Copied content is often older than its folder.
- A clock ahead of now shows its date, never "just now".
- A day is 24h ("1d ago" never appeared).
The row:
- The controls are last in the markup, so the booth's name comes first in
  tab order and wipe last. The cluster is placed over the strip from the
  row's box.
The theme:
- A choice made in one tab moves the Booth's other open tabs.
- The theme mark goes only on ask fragments the embed mounted.
Tests, strengthened after the code review:
- the pill is visible at rest;
- keyboard focus reveals the controls;
- the controls act with scripts off;
- Reveal all reaches the doc page;
- the high-contrast check reads tokens that actually differ;
- the art-light extras are written from SVOS, not derived from the
  copies;
- two overstated mutation rows are replaced (one was a runtime no-op, one
  went red through a syntax error).
Contract amended.

r2b.toml 55/55 proved. 799 passed.

booth/app.py

@@ -261,29 +261,50 @@ def human_dur(seconds: float) -> str:
 _MONTHS = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec")
 
 
+# NEVER RAISE: the Desk renders every row in ONE response, and a clock a fleet
+# session can set (content mtimes) or a filesystem can report (birth time) may
+# lie outside the calendar's range — which raised through the template and
+# 500'd the index for every booth (heid bug-hunt, 4/4). A date that cannot be
+# rendered is "" and the macro renders nothing, as for an unknown birth time.
+_BAD_DATE = (OverflowError, OSError, ValueError)
+
+
 def date_iso(epoch: float) -> str:
-    return datetime.fromtimestamp(epoch, tz=timezone.utc).isoformat(timespec="seconds")
+    try:
+        return datetime.fromtimestamp(epoch, tz=timezone.utc).isoformat(timespec="seconds")
+    except _BAD_DATE:
+        return ""
 
 
 def date_stamp(epoch: float) -> str:
-    return time.strftime("%Y-%m-%d %H:%M", time.localtime(epoch))
+    try:
+        return time.strftime("%Y-%m-%d %H:%M", time.localtime(epoch))
+    except _BAD_DATE:
+        return ""
 
 
 def date_day(epoch: float, now: float | None = None) -> str:
-    """'12 Sep', with the year only when it is not this year's."""
-    t, n = time.localtime(epoch), time.localtime(time.time() if now is None else now)
+    """'12 Sep', with the year only when it is not this year's; '' when the
+    calendar cannot hold it."""
+    try:
+        t, n = time.localtime(epoch), time.localtime(time.time() if now is None else now)
+    except _BAD_DATE:
+        return ""
     day = f"{t.tm_mday} {_MONTHS[t.tm_mon - 1]}"
     return day if t.tm_year == n.tm_year else f"{day} {t.tm_year}"
 
 
 def date_ago(seconds: float) -> str:
-    """An age in its largest whole unit: 'just now', '12m ago', '5h ago', '3d ago'."""
+    """An age in its largest whole unit: 'just now', '12m ago', '5h ago',
+    '1d ago'. A day is 24h (hours used to run on to 47h, so '1d ago' never
+    appeared). The caller never passes a clock AHEAD of now: that is said as a
+    date, not an age."""
     s = int(seconds)
     if s < 60:
         return "just now"
     if s < 3600:
         return f"{s // 60}m ago"
-    if s < 2 * 86400:
+    if s < 86400:
         return f"{s // 3600}h ago"
     return f"{s // 86400}d ago"