fix(desk): the heid code-review and bug-hunt panels on r2b merge 2, folded

The bug hunt (4/4) and code review (4/4) were both clean on mechanism.
Their shared catch was the one-sided minute check.

Dates:
- The date filters never raise. One clock outside the calendar's range
  500'd the Desk for every booth, because every row renders in one
  response. An unrenderable date now renders nothing.
- "Updated" shows whenever it differs from "created" by a minute or more,
  either way. Copied content is often older than its folder.
- A clock ahead of now shows its date, never "just now".
- A day is 24h ("1d ago" never appeared).
The row:
- The controls are last in the markup, so the booth's name comes first in
  tab order and wipe last. The cluster is placed over the strip from the
  row's box.
The theme:
- A choice made in one tab moves the Booth's other open tabs.
- The theme mark goes only on ask fragments the embed mounted.
Tests, strengthened after the code review:
- the pill is visible at rest;
- keyboard focus reveals the controls;
- the controls act with scripts off;
- Reveal all reaches the doc page;
- the high-contrast check reads tokens that actually differ;
- the art-light extras are written from SVOS, not derived from the
  copies;
- two overstated mutation rows are replaced (one was a runtime no-op, one
  went red through a syntax error).
Contract amended.

r2b.toml 55/55 proved. 799 passed.

tests/test_flow.py

@@ -1045,8 +1045,13 @@ def test_a_forced_theme_and_the_os_theme_are_the_same_declarations():
     assert "color-scheme: dark" in dark and len(dark) > 30   # the parser found the real dark block
     assert os_light == forced_light
     assert os_lhc == forced_lhc
-    assert props(forced_light) == props(dark) | (props(forced_light) & props(art))
-    assert props(dark) <= props(forced_light)
+    # Light overrides every dark property plus the art layer's four light-only
+    # values. That extra set is written here, from SVOS, NOT derived from the
+    # copies: deriving it from them let a transform that dropped an art-light
+    # value from BOTH copies pass (heid code-review, 2/4).
+    art_light = {"--shadow-sm", "--shadow-md", "--shadow-lg", "--glow-armed"}
+    assert art_light <= props(art)
+    assert props(forced_light) == props(dark) | art_light
     assert props(forced_lhc) == props(dhc)
 
 
@@ -1064,11 +1069,14 @@ def test_the_lifetime_pill_class_is_kept_held_or_counting(tmp_path):
     h = _booth(tmp_path, "held", {"a.png": PNG})
     declare_pick(h, "q", {"prompt": "Which?", "options": ["x", "y"]})
     _booth(tmp_path, "loose", {"a.png": PNG})
+    broken = _booth(tmp_path, "broken", {"a.png": PNG})
+    (broken / ".marks.json").write_text("{not json")
     body = _client(tmp_path).get("/").text
     pill = lambda n: re.search(r'<span class="life (life-\w+)"[^>]*>(.*?)</span>\s*</div>', _row(body, n), re.S)
     assert pill("kept1").group(1) == "life-kept" and "kept" in pill("kept1").group(2)
     assert pill("held").group(1) == "life-held" and "held until answered" in pill("held").group(2)
     assert pill("loose").group(1) == "life-count" and "expires in" in pill("loose").group(2)
+    assert pill("broken").group(1) == "life-held" and "marks unreadable" in pill("broken").group(2)
     # and the lifetime left the facts line, which is facts only
     assert "expires in" not in re.search(r'class="desk-facts".*?</div>', _row(body, "loose"), re.S).group(0)
 
@@ -1108,3 +1116,48 @@ def test_a_forced_theme_is_applied_before_first_paint(tmp_path):
         head = page[:page.index("</head>")]
         assert head.index("booth.theme") < head.index("<style>"), url
         assert re.search(r'<div class="theme"[^>]*hidden', page), url
+
+
+def test_a_date_no_calendar_can_hold_renders_nothing_and_never_500s(tmp_path, monkeypatch):
+    """heid bug-hunt (4/4): the date filters raised on a timestamp outside the
+    calendar's range, and the Desk renders every row in one response — one
+    poisoned clock 500'd the index for every booth. A date that cannot be
+    rendered renders nothing, like a birth time the disk cannot give."""
+    import booth.app as app_mod
+    _booth(tmp_path, "g", {"a.png": PNG})
+    _booth(tmp_path, "ok", {"a.png": PNG})
+    monkeypatch.setattr(app_mod, "birth_time", lambda p: 1e20 if p.name == "g" else None)
+    monkeypatch.setattr(app_mod, "_content_mtime", lambda p: -1e20 if p.name == "g" else time.time() - 3600)
+    c = _client(tmp_path)
+    r = c.get("/")
+    assert r.status_code == 200
+    assert "created" not in re.search(r'class="desk-facts".*?</div>', _row(r.text, "g"), re.S).group(0)
+    assert c.get("/b/g/").status_code == 200
+
+
+@pytest.mark.parametrize("age,words", [(30, "just now"), (59 * 60, "59m ago"), (23 * 3600, "23h ago"),
+                                       (30 * 3600, "1d ago"), (47 * 3600, "1d ago"), (5 * 86400, "5d ago")])
+def test_an_age_is_said_in_its_largest_whole_unit(age, words):
+    """heid bug-hunt (groa): hours ran on to 47h, so "1d ago" never appeared,
+    against the helper's own docstring."""
+    from booth.app import date_ago
+    assert date_ago(age) == words
+
+
+def test_updated_shows_whenever_it_differs_from_created_and_a_future_one_says_its_date(tmp_path, monkeypatch):
+    """heid bug-hunt (hulda, groa): "updated" was dropped for content OLDER than
+    the booth — copied files keep their mtimes while the folder is born now —
+    and a future content clock read "updated just now". Either direction of a
+    real gap shows; a clock ahead of now shows its date, never an age."""
+    import booth.app as app_mod
+    now = time.time()
+    _booth(tmp_path, "copied", {"a.png": PNG})
+    _booth(tmp_path, "ahead", {"a.png": PNG})
+    monkeypatch.setattr(app_mod, "birth_time", lambda p: now - 3600)
+    monkeypatch.setattr(app_mod, "_content_mtime",
+                        lambda p: now - 30 * 86400 if p.name == "copied" else now + 5 * 86400)
+    body = _client(tmp_path).get("/").text
+    facts = lambda n: re.search(r'class="desk-facts".*?</div>', _row(body, n), re.S).group(0)
+    assert re.search(r">updated 30d ago</time>", facts("copied"))
+    ahead = facts("ahead")
+    assert "just now" not in ahead and re.search(r">updated \d{1,2} [A-Z][a-z]{2}( \d{4})?</time>", ahead)