@bongos/core 1.19.545 → 1.19.546

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.545",
-  "core_contract": "1.19.545",
-  "source_commit": "5c4f4e2a15f8c6f9861c15036d1c064fe8136a67",
+  "core_version": "1.19.546",
+  "core_contract": "1.19.546",
+  "source_commit": "979e1675fe919e685e74158c7420564adda4d461",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T17:49:07.724Z",
+  "built_at": "2026-09-04T18:10:33.995Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 441,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2477,
-  "tree_sha256": "9502351a44d0d93a8a696a9d0a399703688efc0805e47ca4dc3a0027eb37df04",
+  "tree_sha256": "b5685b70ee82098100e1443399d51bf40ee47c0f7dd5487af8f73d92d81f1f1c",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1797,12 +1797,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "6178d1bd3c18b85943d5d48a55b38b4663f1de01788e6c47603a41d017fbeb12"
+      "sha256": "f031d9706b2afc0f579684ec7d451d38b9c8ffd88f7fdb29e3b720a306f80c2f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f087ebec28680cbb56319e404bf06eb18957a606c08296641de4c88db72801cf"
+      "sha256": "aff8da11e90581e6ca7c9410d4524bf22d8bce6fe8f58bae9ebd6f1de744a2eb"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2647,7 +2647,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d2b0d54eaf8523656fba5441fd370608fcfcf3281ba41c2ec404305790850ffc"
+      "sha256": "f93c244f3ed83f67a8ccf326a784d9a9049d83d72c2d05f6b06f12b3377481fe"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4802,7 +4802,7 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "402344a4e8c5c8a9e983c5e341dc2ea8ab40cab4d5512715b62bd7736060ab74"
+      "sha256": "f153e550a362c0da63c307e93eb135966e0ca74f7bffbbfebd44af98b1a1ece3"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
@@ -5002,7 +5002,7 @@
     {
       "path": "modules/hall-ui/public/profile-charts.js",
       "mode": "0000644",
-      "sha256": "8a630558026a76af240eb4b10ad11086fca7005386015574574b6b754a89322c"
+      "sha256": "8ec23ddc97bca27b13c27d18e378476d639545c1c772bae7ae4b113d4b2fcdea"
     },
     {
       "path": "modules/hall-ui/public/profile-connections.js",
@@ -7182,47 +7182,47 @@
     {
       "path": "modules/ui-design/skills/brandkit/SKILL.md",
       "mode": "0000644",
-      "sha256": "7b5cd9e896dcdb79a4386c863a03c628b6187fe81a0380ac50ea5dabc91fa468"
+      "sha256": "b17be59c55cc536ed4dd4182564ca926ca886113ad8ce3ba5025f0caad689b28"
     },
     {
       "path": "modules/ui-design/skills/design-taste-frontend-v1/SKILL.md",
       "mode": "0000644",
-      "sha256": "5e461056c3e6fa4775cc6734b55bf6d5c050f01e0ee7a52378a9f4ab5501da28"
+      "sha256": "7f342307efb46a82fa29faa1708b8f67daef63a4992dc0edb0e80398cd95fb81"
     },
     {
       "path": "modules/ui-design/skills/design-taste-frontend/SKILL.md",
       "mode": "0000644",
-      "sha256": "ee07bdde8e388b2863431673390d4bff74ee1296920ebcb07b529060eb7f8959"
+      "sha256": "e1df9e0e7fa46b06147404cdf87673477cac42977da559064892c478bfb2ec37"
     },
     {
       "path": "modules/ui-design/skills/gpt-taste/SKILL.md",
       "mode": "0000644",
-      "sha256": "3e2e4802407df6763db372c27f3deaaf8f9b6233778668ddeaff65dec147ac7c"
+      "sha256": "7c22d993cf7e42114f1c234e1321299b340c0e7fabd09f19b408f771de211fb5"
     },
     {
       "path": "modules/ui-design/skills/high-end-visual-design/SKILL.md",
       "mode": "0000644",
-      "sha256": "eeb33e0a2d0a227d23b67c5e6d32c5757d8d5d7249a1a6d0fe3c67d8bd95fc91"
+      "sha256": "2bf36058d7db8c619b89b4e7fc97e303e99d2123cc2ea0f241174ab3c54b7d00"
     },
     {
       "path": "modules/ui-design/skills/image-to-code/SKILL.md",
       "mode": "0000644",
-      "sha256": "9c07a2328416874d69897bada333f955a93ef165eb128f073fb3bf40baef2d1e"
+      "sha256": "7a85f43a0455549a5434485f5803569693308bd713debbfe045f676d29dcdae0"
     },
     {
       "path": "modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md",
       "mode": "0000644",
-      "sha256": "664f64d1f16afb10d3027fcd7dc50031e0f090f75cf5ee72258adc78e2e2ff73"
+      "sha256": "5de59ad0e46c1efa1d52c8148ad39c26f797bc7fa888839236fa49e97a30d382"
     },
     {
       "path": "modules/ui-design/skills/imagegen-frontend-web/SKILL.md",
       "mode": "0000644",
-      "sha256": "75586cc997b927c7ca5ef7f3be574f4d81bd9238b01c9b66b1a5f8c587acaa14"
+      "sha256": "c096c4c7a74b5613c7012f4b0dc3b1baca5e59819dd2f2b218fbe57e2ecba8a5"
     },
     {
       "path": "modules/ui-design/skills/impeccable/SKILL.md",
       "mode": "0000644",
-      "sha256": "ec144ae6ee19f59743e42e035f0a0fefc342bfd292353be73d50419d9df98491"
+      "sha256": "285e595744c3d52b8a96e32f8986a82a08dd83fee172b852b5d8b14c808ae95e"
     },
     {
       "path": "modules/ui-design/skills/impeccable/reference/adapt.md",
@@ -7317,12 +7317,12 @@
     {
       "path": "modules/ui-design/skills/industrial-brutalist-ui/SKILL.md",
       "mode": "0000644",
-      "sha256": "4d781aa002138bdad572dfcae0dc6f1175fe070ee37fa8f3ef9a0f6af08e039b"
+      "sha256": "86e9497cbfe20def445fcf4a53429755f31517f19a0e07dc3a73f99d13ec9b4f"
     },
     {
       "path": "modules/ui-design/skills/minimalist-ui/SKILL.md",
       "mode": "0000644",
-      "sha256": "b7b22a1ab8aa148ac4fc8573d7088c6ff207beb53f628009e7cfc363c6bbd2c2"
+      "sha256": "fa1d7b7a801d6640bc49b4f762d48ff063f0cb01dc93d188a916a2b357c60542"
     },
     {
       "path": "modules/ui-design/skills/policy.json",
@@ -7332,17 +7332,17 @@
     {
       "path": "modules/ui-design/skills/redesign-existing-projects/SKILL.md",
       "mode": "0000644",
-      "sha256": "22e8f7ea0d206b3f4b2243b986a4dcd10df4ba0198aa063e76ef4d2788fec55d"
+      "sha256": "b58f23bda03283aea06430601dd73f654509d3404bdd31322c8214582fee7eb1"
     },
     {
       "path": "modules/ui-design/skills/stitch-design-taste/SKILL.md",
       "mode": "0000644",
-      "sha256": "f8c6c38ccb5fea529e86731005e8bbf231a9131c890010a29129c06195f48945"
+      "sha256": "6fbf6fa566e576e2d8b55aad5cfee97d75f316263669d0eefd1eb1b8e691ea0f"
     },
     {
       "path": "modules/ui-design/skills/style/SKILL.md",
       "mode": "0000644",
-      "sha256": "7853e7f17cd39caeae5107959905397dcc634aac0af2a7e017f357c8d36e45e5"
+      "sha256": "5383fe2edfc30bd17325797405b2e0809b3f76ae49b0cc94622557b2aac8a30d"
     },
     {
       "path": "modules/ui-design/styles/README.md",
@@ -7452,12 +7452,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c56d9508b46348664d7d32a7d213eeb6261e34879903149c73def19d545a9921"
+      "sha256": "d19f98e5a6379aae00b038e27ad4051484dfe060b053b67bef5577e892e623ec"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "07a22aa815528b99f6db3a1fb72caf6171e457c97efed837f1e4c5b0c796520f"
+      "sha256": "97a3bc18d404c2c95f273adcefacee1b34c6ed9445229622681f3a34a0bfbd72"
     },
     {
       "path": "public-docs/index.html",
@@ -7892,7 +7892,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "172f890f2a4297d287008f0ba11bc04fc801ea21a52728855967b178e2875373"
+      "sha256": "c825842ed0e4bf34fa9fa7bc7e711967d1aa0efdde4132253c51231c6ccbd22e"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8612,7 +8612,7 @@
     {
       "path": "scripts/gds/skill-lint.js",
       "mode": "0000644",
-      "sha256": "cacae521e5580e66c74128142772abe93d6742e8438417bd4e5a19d48d611c9f"
+      "sha256": "c68e39e195cf38a7ec09d601f616dd44f83e2ea698705f41e30a08eef4308fba"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -9142,7 +9142,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "54d926a5e17a476efbde6fe6786af692b26ea841a09c9c49c45e43654c13790b"
+      "sha256": "83cdf243b987aea59adf18f939bc808239053d6f2fa39339bd17001be9bcf501"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10582,7 +10582,7 @@
     {
       "path": "tests/hall_kit_charts.mjs",
       "mode": "0000644",
-      "sha256": "b3c95d32e4c2402699070c08fa4eaa9f460cd4d2b813f8b15e39d29fc5aa5b4d"
+      "sha256": "5654f4366ddcfcb61848a119a2dba3827f3fe19c0151005558a803c2e09db573"
     },
     {
       "path": "tests/hall_nav.mjs",
@@ -12067,7 +12067,7 @@
     {
       "path": "tests/skill_lint.mjs",
       "mode": "0000644",
-      "sha256": "da75748d8733b16c479686a350f4e648e85ccc171ce633b4561315bd6d7073bb"
+      "sha256": "bb11de1a32e4d3504d9b5b4f649a1117364f0d5368ca96cf2a720d6dbbfbd040"
     },
     {
       "path": "tests/skill_preflight.mjs",
@@ -12307,7 +12307,7 @@
     {
       "path": "tests/ui_design_skills.mjs",
       "mode": "0000644",
-      "sha256": "f12817db3dd3486446cfcbe1701a06e19b7d1c18e9a6046f7861a667268fd3d4"
+      "sha256": "e8ae559aa743e4ea3377f1bf57fd33cb5efdb96ba7c67ab57964915814e7e212"
     },
     {
       "path": "tests/ui_design_styles.mjs",

package/docs/copy-inventory.md

@@ -557,7 +557,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7a239a17afc8` | certain | Loading your preferences… | `modules/hall-ui/public/settings.html:32` |
 | `04df1bd30129` | certain | Loading your rank… | `modules/hall-ui/public/ranks.html:30` |
 | `c27711f9eb4d` | certain | Locked until you reach the end of the article above. | `modules/hall-ui/public/primer.html:103` |
-| `4017ee030bc2` | certain | Lookback window | `modules/hall-ui/public/profile-charts.js:425` |
+| `4017ee030bc2` | certain | Lookback window | `modules/hall-ui/public/profile-charts.js:431` |
 | `a93ca2841b96` | certain | Mac (Intel) | `modules/hall-ui/public/hall-render.js:750` |
 | `06b4ede3fb58` | certain | Machine principals | `modules/hall-ui/public/government.html:124` |
 | `6b3d660e0e31` | certain | Map view | `modules/hall-ui/public/atlas.html:46` |
@@ -1062,7 +1062,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b6dceaace783` | certain | Your profile page setting applies now — private already answers "not found" everywhere your profile is read. R | `modules/hall-ui/public/settings.html:119` |
 | `f39746e3d66b` | certain | Your rendering preference could not be loaded. Reload the page to try again. | `modules/hall-ui/public/settings.js:554` |
 | `b2dfd7120052` | certain | Your request is sent ✓ | `modules/hall-ui/public/hall-render.js:381` |
-| `b410b052f000` | certain | Your shipping year | `modules/hall-ui/public/profile-charts.js:279` |
+| `b410b052f000` | certain | Your shipping year | `modules/hall-ui/public/profile-charts.js:285` |
 | `c16addf957d0` | certain | Your track record across every project you build on, shown on your public profile. Hiding it takes effect imme | `modules/hall-ui/public/settings.html:96` |
 | `f6b12676169b` | certain | Your vote | `modules/hall-ui/public/hall-widgets.js:170` |
 | `fe94ff29a2cc` | certain | Your wandering level could not be loaded. Reload the page to try again. | `modules/hall-ui/public/settings.js:486` |
@@ -1072,7 +1072,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `137b07b42203` | certain | Zoom in | `modules/hall-ui/public/diagram-viewer.js:98` |
 | `0d0bfa651b36` | certain | Zoom out | `modules/hall-ui/public/diagram-viewer.js:96` |
 | `cc361cc7333a` | certain | \s?/.test(raw)) { const quoteLines = []; while (i | `modules/hall-ui/public/md-reader.js:189` |
-| `a02616e47d11` | certain | a year of qualifying ships, in your timezone \u00b7 only you see this one | `modules/hall-ui/public/profile-charts.js:279` |
+| `a02616e47d11` | certain | a year of qualifying ships, in your timezone \u00b7 only you see this one | `modules/hall-ui/public/profile-charts.js:285` |
 | `44e6e402db94` | certain | account, then open | `modules/hall-ui/public/hall-render.js:750` |
 | `ae43396446ed` | certain | account. | `modules/hall-ui/public/hall-render.js:750` |
 | `9612c983451f` | certain | achieved · | `modules/hall-ui/public/roadmap.js:275` |
@@ -1189,8 +1189,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9bec9eb4829e` | certain | scope: {…} | `modules/hall-ui/public/goals-render.js:785` |
 | `a6f55d7aa6f7` | certain | shipped (live) | `modules/hall-ui/public/roadmap.js:285` |
 | `026ba1289d4d` | certain | shipped · | `modules/hall-ui/public/goals-render.js:707` |
-| `ec6d8c900bc8` | certain | sign in | `modules/hall-ui/public/profile-charts.js:493` |
-| `ec6d8c900bc8` | certain | sign in | `modules/hall-ui/public/profile-charts.js:505` |
+| `ec6d8c900bc8` | certain | sign in | `modules/hall-ui/public/profile-charts.js:499` |
+| `ec6d8c900bc8` | certain | sign in | `modules/hall-ui/public/profile-charts.js:511` |
 | `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:132` |
 | `da30b952a60b` | certain | system / unattributed | `modules/hall-ui/public/goals-page.js:249` |
 | `da30b952a60b` | certain | system / unattributed | `modules/hall-ui/public/work.js:498` |

package/docs/copy-registry.json

@@ -1553,8 +1553,8 @@
       "text": "sign in",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile-charts.js:493",
-        "modules/hall-ui/public/profile-charts.js:505"
+        "modules/hall-ui/public/profile-charts.js:499",
+        "modules/hall-ui/public/profile-charts.js:511"
       ]
     },
     {
@@ -6009,7 +6009,7 @@
       "surface": "builders-hall",
       "text": "Lookback window",
       "file": "modules/hall-ui/public/profile-charts.js",
-      "line": 425,
+      "line": 431,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10554,7 +10554,7 @@
       "surface": "builders-hall",
       "text": "Your shipping year",
       "file": "modules/hall-ui/public/profile-charts.js",
-      "line": 279,
+      "line": 285,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10644,7 +10644,7 @@
       "surface": "builders-hall",
       "text": "a year of qualifying ships, in your timezone \\u00b7 only you see this one",
       "file": "modules/hall-ui/public/profile-charts.js",
-      "line": 279,
+      "line": 285,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11697,7 +11697,7 @@
       "surface": "builders-hall",
       "text": "sign in",
       "file": "modules/hall-ui/public/profile-charts.js",
-      "line": 493,
+      "line": 499,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11706,7 +11706,7 @@
       "surface": "builders-hall",
       "text": "sign in",
       "file": "modules/hall-ui/public/profile-charts.js",
-      "line": 505,
+      "line": 511,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1539,5 +1539,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.543 with no explicit bump. run 33899781074. (task 1002620)
   1.19.545 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.544 with no explicit bump. run 33902527608. (task 1002620)
+  1.19.546 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.545 with no explicit bump. run 33904396127. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/hall-kit.js

@@ -1033,69 +1033,100 @@
       + '</div>';
   }
 
-  // calendarGridHtml(days, opts) — a year of ship-days as a contribution calendar:
-  // one cell per calendar day, BANDED by count rather than scaled, its reading a
-  // per-cell title (plus an aria summary on the whole grid), not a crosshair. The
-  // hall's THIRD chart family (task 1003572, criterion legibility-series-are-drawn):
-  // OTBKit's other two shapes are a horizontal bar series and a plot on a time axis;
-  // a 2-D year grid is neither, so it earns its own primitive rather than a hand-roll
-  // at the page (modules/hall-ui/CLAUDE.md; tests/hall_audit.mjs section 6b).
+  // The calendar's date arithmetic, shared by the window and the grid.
   //
-  // THE READING, decided and written down (the task asked which): a NON-picture reader
-  // gets the exact figure two ways — each cell carries a `title` ("2026-09-03 · 3
-  // ships" / "… · no ships"), and the grid carries an aria-label summarising the
-  // window (active days + total ships). No table twin: unlike a line, a calendar's
-  // value IS its position, so a per-cell title reads the same fact the picture shows,
-  // and a 366-row table beneath would be longer than the thing it explains.
-  //
-  // `days`: [{ local_date:'YYYY-MM-DD', count }] — SPARSE (only days that had ships),
-  // already resolved in the BUILDER's timezone server-side (GET /me). Empty → '' so
-  // the caller renders its own empty state, never an empty grid.
+  // THE TIMEZONE TRAP: local_date is already the builder's own day, so the grid is built
+  // by ORDINAL arithmetic on the 'YYYY-MM-DD' parts (Date.UTC on the parsed integers,
+  // floored to an epoch day) — never `new Date('2026-09-03')`, which is UTC-midnight and
+  // would shift a cell a day west of Greenwich. Same epoch-day floor cumulateByDay uses,
+  // so no cell moves relative to the other charts. calDow is Sunday-indexed: epoch day 0
+  // (1970-01-01) is a Thursday, hence the +4.
+  const calYmdToOrd = (ymd) => {
+    const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd);
+    if (!m) return null;
+    return Math.floor(Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])) / 86400000);
+  };
+  const calOrdToYmd = (ord) => {
+    const dt = new Date(ord * 86400000);
+    return `${dt.getUTCFullYear()}-${String(dt.getUTCMonth() + 1).padStart(2, '0')}-${String(dt.getUTCDate()).padStart(2, '0')}`;
+  };
+  const calDow = (o) => (((o + 4) % 7) + 7) % 7;
+
+  // calendarWindow(days, opts) — the DRAWN window and what falls inside it, resolved
+  // once so the grid and whatever caption sits beside it can never disagree (task
+  // 1003583). Two bugs came from computing this twice: the aria summary tallied every
+  // row handed in rather than the cells drawn, and profile-charts.js counted
+  // `days.filter(d => d.count > 0)` over the whole bounded array — so "N days shipped
+  // this year" could name a day sitting outside the grid's first partial week.
   //
-  // THE TIMEZONE TRAP the task names: local_date is already the builder's own day, so
-  // the grid is built by ORDINAL arithmetic on the 'YYYY-MM-DD' parts (Date.UTC on the
-  // parsed integers, floored to an epoch day) — never `new Date('2026-09-03')`, which
-  // is UTC-midnight and would shift a cell a day west of Greenwich. Same epoch-day
-  // floor cumulateByDay uses, so no cell moves relative to the other charts.
-  function calendarGridHtml(days, opts = {}) {
+  // Returns null when there is nothing real to draw, so callers keep their own empty
+  // state rather than rendering an empty grid.
+  function calendarWindow(days, opts = {}) {
     const list = (days || []).filter((d) => d && typeof d.local_date === 'string');
-    const ymdToOrd = (ymd) => {
-      const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd);
-      if (!m) return null;
-      return Math.floor(Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])) / 86400000);
-    };
-    const ordToYmd = (ord) => {
-      const dt = new Date(ord * 86400000);
-      return `${dt.getUTCFullYear()}-${String(dt.getUTCMonth() + 1).padStart(2, '0')}-${String(dt.getUTCDate()).padStart(2, '0')}`;
-    };
     const counts = new Map();
     let maxOrd = null;
-    let activeDays = 0;
-    let totalShips = 0;
     for (const d of list) {
-      const o = ymdToOrd(d.local_date);
+      const o = calYmdToOrd(d.local_date);
       if (o == null) continue;
       const c = Math.max(0, Math.round(Number(d.count) || 0));
       if (c <= 0) continue;
       counts.set(o, (counts.get(o) || 0) + c);
       if (maxOrd == null || o > maxOrd) maxOrd = o;
     }
-    if (maxOrd == null) return ''; // nothing real to draw → caller's empty state
-    for (const [, c] of counts) { activeDays += 1; totalShips += c; }
+    if (maxOrd == null) return null;
 
     // The grid ENDS at `today` (the builder's, when given) so a quiet recent week still
     // reads as time that passed, not a truncated chart; falls back to the last ship day.
-    const todayOrd = (opts.today && ymdToOrd(opts.today)) || maxOrd;
+    const todayOrd = (opts.today && calYmdToOrd(opts.today)) || maxOrd;
     const endOrd = Math.max(todayOrd, maxOrd);
     const weeks = Math.max(1, Math.min(53, Math.round(Number(opts.weeks)) || 53));
 
     // Columns are weeks, rows Sun..Sat. Epoch day 0 (1970-01-01) is a Thursday, so the
     // Sunday-indexed weekday is (ord + 4) mod 7. The last column is the week holding
     // endOrd; walk back `weeks` Sundays to the first cell.
-    const dow = (o) => (((o + 4) % 7) + 7) % 7;
-    const endSun = endOrd - dow(endOrd);
+    const endSun = endOrd - calDow(endOrd);
     const startSun = endSun - (weeks - 1) * 7;
 
+    // Tallied over the DRAWN range only — [startSun, endOrd] — not over everything
+    // handed in. A day the caller supplied that falls before the first column is real
+    // history, but it is not on this picture, so it is not in this picture's summary.
+    let activeDays = 0;
+    let totalShips = 0;
+    for (const [o, c] of counts) {
+      if (o < startSun || o > endOrd) continue;
+      activeDays += 1;
+      totalShips += c;
+    }
+    return { counts, startSun, endOrd, weeks, activeDays, totalShips };
+  }
+
+  // calendarGridHtml(days, opts) — a year of ship-days as a contribution calendar:
+  // one cell per calendar day, BANDED by count rather than scaled, its reading a
+  // per-cell title (plus an aria summary on the whole grid), not a crosshair. The
+  // hall's THIRD chart family (task 1003572, criterion legibility-series-are-drawn):
+  // OTBKit's other two shapes are a horizontal bar series and a plot on a time axis;
+  // a 2-D year grid is neither, so it earns its own primitive rather than a hand-roll
+  // at the page (modules/hall-ui/CLAUDE.md; tests/hall_audit.mjs section 6b).
+  //
+  // THE READING, decided and written down (the task asked which): a NON-picture reader
+  // gets the exact figure two ways — each cell carries a `title` ("2026-09-03 · 3
+  // ships" / "… · no ships"), and the grid carries an aria-label summarising the
+  // window (active days + total ships). No table twin: unlike a line, a calendar's
+  // value IS its position, so a per-cell title reads the same fact the picture shows,
+  // and a 366-row table beneath would be longer than the thing it explains.
+  //
+  // `days`: [{ local_date:'YYYY-MM-DD', count }] — SPARSE (only days that had ships),
+  // already resolved in the BUILDER's timezone server-side (GET /me). Empty → '' so
+  // the caller renders its own empty state, never an empty grid.
+  //
+  // The window it draws, and the tallies its summary quotes, come from calendarWindow —
+  // see the timezone trap documented there.
+  function calendarGridHtml(days, opts = {}) {
+    const win = calendarWindow(days, opts);
+    if (!win) return ''; // nothing real to draw → caller's empty state
+    const { counts, startSun, endOrd, weeks, activeDays, totalShips } = win;
+    const ordToYmd = calOrdToYmd;
+
     // level 0 = empty; 1..5 map to the anti-gaming daily cap (streak.js caps a day at
     // 5), so the darkest band means "hit the day's max", not "over some threshold".
     const level = (c) => (c <= 0 ? 0 : Math.min(5, c));
@@ -1112,8 +1143,11 @@
       }
     }
 
+    // The window is DESCRIBED, not assumed: a caller passing weeks:6 used to be handed
+    // an aria label saying "over the last year" (task 1003583).
+    const span = weeks === 53 ? 'the last year' : `the last ${weeks} week${weeks === 1 ? '' : 's'}`;
     const summary = opts.ariaLabel
-      || `Ships per day over the last year: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
+      || `Ships per day over ${span}: ${totalShips} ship${totalShips === 1 ? '' : 's'} across ${activeDays} day${activeDays === 1 ? '' : 's'}.`;
     // The legend is aria-hidden: it decorates the bands, it carries no fact the cell
     // titles and the summary do not already state in words.
     const legend = '<div class="kit-cal__key" aria-hidden="true"><span class="kit-cal__key-label">less</span>'
@@ -1141,6 +1175,7 @@
     sparklineHtml, barSeriesHtml, chartCardHtml, linePoints, cumulate, cumulateByDay,
     // the year-grid contribution calendar (task 1003572) — the hall's third chart family
     calendarGridHtml,
+    calendarWindow,
     // plotted charts: the axis frame + the two series shapes that ride it
     plotSvgHtml, plotValueLabelHtml, timeStepSeriesHtml, timeStepGeometry, columnSeriesHtml,
     // plotBox is exported so a caller mapping pointer x back into viewBox

package/modules/hall-ui/public/profile-charts.js

@@ -267,9 +267,15 @@
   // module doc's honest-exit rule; DONE WHEN #4).
   function calendarChart({ id, streak }) {
     const days = (streak && Array.isArray(streak.ship_days)) ? streak.ship_days : [];
-    const grid = window.OTBKit.calendarGridHtml(days, { today: streak && streak.today });
+    const opts = { today: streak && streak.today };
+    const grid = window.OTBKit.calendarGridHtml(days, opts);
     if (!grid) return null;
-    const active = days.filter((d) => Number(d.count) > 0).length;
+    // The caption counts what the GRID draws, not what the server sent (task 1003583).
+    // `days` is bounded to 371 days server-side while the grid spans 53 weeks back to a
+    // Sunday, so filtering `days` here could name a day the picture does not contain —
+    // and the number sits directly under that picture. One window, read twice.
+    const win = window.OTBKit.calendarWindow(days, opts);
+    const active = win ? win.activeDays : 0;
     const cur = Number(streak && streak.current) || 0;
     const lng = Number(streak && streak.longest) || 0;
     // The scalars in words, in the .pchart__read slot the other figures use for their

package/modules/ui-design/skills/brandkit/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: brandkit
-description: The identity-system method for ANY Cloud Bongos instance, under the owner's hero-only rule: infers the brand strategy before anything is made (category, audience, function, promise, cultural position, the one symbolic metaphor, what to avoid), holds the logo standard and the five concept methods, and lands the system as the instance's own materials: the mark drawn as SVG in code, the colour system as the branding pack, the type specimen as the pack's faces, the applications as the platform's real surfaces rendered by the kit, and the image direction as a text-free hero-object family with a sidecar beside every plate. The nine-panel board becomes a contact sheet composed from those parts, never a generated image with text in it. Triggers on "brand kit", "identity system", "logo system", "brand guidelines board", "the visual world for a new instance", or when cloudbongos init asks what an instance's mark and material are. Never generates a logo, a wordmark, a board with text, or a mockup with UI. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The identity-system method for any instance, under the owner's hero-only rule. Infers the brand strategy
+  first, holds the logo standard and the five concept methods, and lands the system as the instance's own
+  materials — the mark as SVG, the colours as the pack, the type as its faces. Triggers on "brand kit",
+  "identity system", "logo system". Never generates a logo, wordmark or UI mockup.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/design-taste-frontend/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: design-taste-frontend
-description: The default taste skill for a landing page, a portfolio, a marketing surface or a redesign of one, on ANY Cloud Bongos instance. Reads the brief and says the design read in one line, sets three dials (variance, motion, density) from named presets, locks one world for the whole page, keeps the hero and the layout disciplined, rations decoration, and ends on a pre-flight the kit measures. Triggers on "design a landing page", "make this not look templated", "taste pass", "anti-slop", "this looks like every AI site", or when /design hands off a marketing surface. Not for dashboards, data tables, wizards, code editors, native mobile or realtime collaboration (those go to /design and the hall's archetypes). Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); the instance's world is the palette and images are hero plates only.
+description: >-
+  The default taste skill for a landing page, portfolio or marketing surface on any Cloud Bongos instance.
+  Says the design read in one line, sets three dials (variance, motion, density), locks one world for the
+  whole page, and ends on a pre-flight the kit measures. Triggers on "design a landing page", "make this not
+  look templated", "taste pass", "anti-slop". Not for dashboards or native mobile.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/design-taste-frontend-v1/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: design-taste-frontend-v1
-description: The earlier generation of the taste skill, preserved under its own name so a task or a builder that names it gets exactly this behaviour while the default (design-taste-frontend) evolves separately. A fixed baseline triple of dials adapted in conversation, stack conventions for a served surface, typography and colour rules read against the instance's pack, the layout bans, full interaction cycles, motion rules inside the Kill Switch, performance guardrails, a named vocabulary of premium patterns and a tile-grid archetype set. Triggers on "design-taste-frontend-v1", "use the v1 taste skill", "the fixed dials", or "the pattern vocabulary". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); nothing here auto-updates from v2.
+description: >-
+  The earlier generation of the taste skill, kept under its own name so a task or builder that asks for it
+  gets exactly this behaviour while the default (design-taste-frontend) evolves separately. A fixed triple of
+  dials, the layout bans, full interaction cycles, and a named vocabulary of premium patterns. Triggers on
+  "design-taste-frontend-v1", "the fixed dials", "the pattern vocabulary".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/gpt-taste/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: gpt-taste
-description: Anti-default enforcement for a persuasive scrolling surface when the last attempt came out looking like every other one. A written plan block before any markup whose selection is derived deterministically from the route (a hero architecture, three component architectures, two CSS motion paradigms, checked against what sibling surfaces already used), the four-stage attention-interest-desire-action structure, an ultra-wide hero container that holds the headline to two or three lines, a dense tile grid with zero empty cells, real scroll-driven motion inside the Kill Switch, and a measured contrast sweep. Triggers on "it looks generic", "award-tier", "stop making the same page", "anti-default". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Anti-default enforcement for a persuasive scrolling surface when the last attempt came out looking like
+  every other one. A written plan block before any markup, derived deterministically from the route; the
+  four-stage attention-interest-desire-action structure; an ultra-wide hero; a dense tile grid with zero empty
+  cells. Triggers on "it looks generic", "award-tier", "anti-default".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/high-end-visual-design/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: high-end-visual-design
-description: Makes an interface read as an expensive agency build, inside the instance's world. One texture archetype and one layout archetype per project (never the same pair twice), the container anatomy (a shell and a core with a hairline ring and concentric radii, where the world allows a container at all), the pill button with its nested arrow disc, the spatial rhythm, the motion choreography inside the Kill Switch, the hover physics, the scroll entry, the mobile collapse per archetype and the performance rules, then a pre-output checklist. Triggers on "make it feel premium", "agency-grade", "this looks cheap", "expensive", "high-end", "the polish pass". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); the fonts are the pack's, the palette is the world's, images are hero plates only.
+description: >-
+  Makes an interface read as an expensive agency build, inside the instance's world. One texture archetype and
+  one layout archetype per project, the container anatomy, the pill button, the spatial rhythm, the motion
+  choreography inside the Kill Switch, the mobile collapse, then a pre-output checklist. Triggers on "make it
+  feel premium", "agency-grade", "this looks cheap", "the polish pass".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/image-to-code/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: image-to-code
-description: The analyse-then-implement loop for visually important web work on ANY Cloud Bongos instance, under the owner's hero-only rule: the design source of truth for the UI is the owner's reference images and the instance's world, read with a structured per-image analysis and extracted into a full spec before a line is written; the only image this skill generates is the hero plate the composition has a slot for, and the sections are built from the world's templates. Implements as a faithful translation rather than an interpretation, names design drift as the failure mode, holds the hero and clutter rules, and ends on a clarity checklist the kit measures. Triggers on "build this from the reference", "recreate these images in code", "implement the mock faithfully", "the owner sent screenshots to build from", or when a claimed ui task carries reference images. Never generates a section, a comp or a screen. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The analyse-then-implement loop for visually important web work, under the owner's hero-only rule. The
+  design source of truth is the owner's reference images and the instance's world, read per image and
+  extracted into a full spec before a line is written. Triggers on "build this from the reference", "implement
+  the mock faithfully". Never generates a section, comp or screen.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-mobile
-description: The plate-making skill for the narrow end of a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free portrait plates and hero objects for the 390 and 320 compositions the kit renders, the masthead above the words and the field behind them, sized for the fold and clear of the regions a phone reserves. Never a screen, never a phone mockup, never a flow of screens as images, and never code: a screen concept is the surface's states file rendered by the kit at 390, and a native app target declines to /design. Locks one material, light and camera across the family from the world's DESIGN.md, keeps the first view to one focal point, puts a scrim under any text that sits over a plate, and lands the pair convention with a sidecar beside every file. Triggers on "a plate for the mobile hero", "the masthead at 390", "the hero object for the phone collapse", "a portrait plate", or when adapt or design-taste-frontend names a narrow-width slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for the narrow end of a web surface, under the owner's hero-only rule. Text-free
+  portrait plates and hero objects for the 390 and 320 compositions the kit renders, sized for the fold and
+  clear of what a phone reserves, with a sidecar beside every file. Triggers on "a plate for the mobile hero",
+  "the masthead at 390". Never a screen, a phone mockup or code.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/imagegen-frontend-web/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-web
-description: The plate-making skill for a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free hero plates, hero objects and atmosphere backdrops for the slots a composition already has, never one image per section, never a screen, never a UI comp, and it writes no page code. Commits to the plate list out loud, chooses a composition anchor per plate that is not the text-left image-right default, locks one material, one light and one camera across the family, matches every plate tonally to the instance's pack, runs the generation through the instance's art pipeline key, and lands each plate as the pair convention (a black-ground plate for dark, an alpha cutout for light) with a provenance sidecar beside every file. Triggers on "make a hero plate", "we need a hero object for", "an atmosphere backdrop for the landing", "the project orbs need a new material", or when design-taste-frontend or /design names a plate slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for a web surface, under the owner's hero-only rule. Text-free hero plates, hero
+  objects and atmosphere backdrops for the slots a composition already has — never one per section, never a
+  screen, never a UI comp, and no page code. One material, light and camera across the family, landed with a
+  provenance sidecar. Triggers on "make a hero plate", "an atmosphere backdrop".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: impeccable
-description: The design-craft method for ANY surface on ANY Cloud Bongos instance, invoked as one skill plus an optional sub-command and an optional target ("impeccable audit /projects", "impeccable polish the hall's ranks page", "impeccable harden the wizard"). Sixteen sub-command playbooks (shape, audit, critique, polish, harden, animate, typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract) plus the two directions (bolder, quieter), exactly one loaded per request; a bare description with no sub-command is ordinary design work routed to the closest playbook; no argument prints a menu built from live project signals and never auto-runs anything. Carries the craft floor (loaded right before UI is edited, never recited to the user) and the bounded finish (build fully, one render round through the kit, one batch of fixes, at most one confirming round, stop). Triggers on "impeccable", "critique this page", "audit the UI", "polish the whole path", "make it survive long text", "animate this", "tighten the copy", "document the design system", "extract the repeated pattern". Rebuilt in-house from the impeccable rebuild spec (task 1003326, ADR 0198) with no hooks, no bypass agent, no telemetry and no live server; the live loop is the playwright plugin and the headless loop is the module's kit. Web surfaces only; a native mobile target declines to /design.
+description: >-
+  The design-craft method for any surface, invoked as one skill plus an optional sub-command and target
+  ("impeccable audit /projects"). Sixteen playbooks — shape, audit, critique, polish, harden, animate,
+  typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract — one per request.
+  Triggers on "impeccable", "critique this page", "audit the UI". Web surfaces only.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/industrial-brutalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: industrial-brutalist-ui
-description: Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase clamped display against fixed tracked-out mono metadata, the pack's terracotta as the single hazard accent and its sea as one terminal green, strict grid anchoring with the hairline as a one-pixel grid gap, zero corner rounding, bracket and crosshair framing glyphs, and static halftone, scanline and noise degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "terminal", "make it raw", "like a technical document". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype
+  per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase display
+  against tracked-out mono metadata, strict grid anchoring, zero corner rounding, halftone and scanline
+  degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "make it raw".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/minimalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: minimalist-ui
-description: Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every border in the sheet, washed accents measured against their own ink, flat tile cards with no shadow, box-less accordions, keycap shortcuts, one depth treatment per band, entry motion inside the Kill Switch. Triggers on "make it minimal", "clean and editorial", "quiet", "document-like", "this feels busy". Declines dense surfaces like dashboards and ledgers. Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198); the palette is the pack and the nearest library look is expedition.
+description: >-
+  Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro
+  whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every
+  border, flat tile cards with no shadow, entry motion inside the Kill Switch. Triggers on "make it minimal",
+  "clean and editorial", "this feels busy". Declines dense surfaces.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/redesign-existing-projects/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: redesign-existing-projects
-description: Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without breaking it. A fixed three-step sequence (scan the stack, diagnose against a written audit, apply targeted fixes), the seven-group audit (typography, colour and surface, layout, interaction, content, code and omissions) with the instance's world as the answer key, a catalogue of upgrade techniques marked CSS-only or not available, and a fixed impact-per-risk fix order. Triggers on "redesign this", "upgrade the existing page", "make the current X premium", "audit this UI", "this page looks generic, fix it". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); keeps the stack, never migrates frameworks, images are hero plates only.
+description: >-
+  Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without
+  breaking it. Three fixed steps — scan the stack, diagnose against a written audit, apply targeted fixes —
+  with the instance's world as the answer key and a fixed impact-per-risk fix order. Triggers on "redesign
+  this", "upgrade the existing page", "audit this UI".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/stitch-design-taste/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: stitch-design-taste
-description: Writes a design contract document for an external screen-generating tool such as Google Stitch, in the platform's own frontmatter shape. Four dials (creativity, density, variance, motion intent) with named bands and stated defaults, then eight fixed sections (atmosphere, colour roles, typography, components, layout, responsive rules, motion intent, banned patterns) written as descriptive language paired with exact values. The thirteen colours are transcribed from the instance's pack and diffed, never invented; motion is an intent brief inside the Kill Switch; the screens that come back are a reference, not a source of truth. Triggers on "write a design brief for Stitch", "a design contract document", "a prompt-to-screen tool". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Writes a design contract document for an external screen-generating tool such as Google Stitch, in the
+  platform's own frontmatter shape. Four dials with named bands and stated defaults, then eight fixed sections
+  pairing descriptive language with exact values. The thirteen colours are transcribed from the instance's
+  pack, never invented. Triggers on "a design brief for Stitch".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/style/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: style
-description: Runs a bounded session in which an owner authors their OWN look for the instance, as a branding pack inside the fifteen-token contract, and proves it clean before it lands. Four steps and no more. SEARCH reads the instance's world and the style library, renders the nearest two entries so the owner looks rather than imagines, and asks two or three questions about feel. CREATE drafts modules/ui-design/styles/<name>/ in the library's contract shape (pack.json, DESIGN.md, mock.html), never a fork of a sheet and never a sixteenth token. PROVE retunes the thirteen against contrast.js, the styles suite, check-mock and the kit's renders until every named pair is green, showing the shots each round. ADOPT hands the owner the one-step switch and files the look into the catalogue. Triggers on "/style", "make a look", "author a style", "I want our own theme", "can we have a different look", "add a style to the library".
+description: >-
+  Runs a bounded session in which an owner authors their own look for the instance, as a branding pack inside
+  the fifteen-token contract, and proves it clean before it lands. Four steps and no more — SEARCH, CREATE,
+  PROVE, ADOPT. Triggers on "/style", "make a look", "author a style", "I want our own theme", "add a style to
+  the library".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.545",
+  "version": "1.19.546",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.545",
+      "version": "1.19.546",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.545",
+  "version": "1.19.546",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1311,7 +1311,11 @@ function checkErrorEnvelope() {
 // truncated EVERY field, the skill matched on its body text, and nothing in CI noticed. A parse
 // error is a hard fail; description length and the listing budget are advisory (the listing is
 // resident in every session, ~1% of context, and gets truncated past ~8k chars). The check reads
-// the instance's .claude/skills/ and is a quiet pass when a checkout carries none (published core).
+// every skill Claude Code can load — the instance's .claude/skills/ AND the module-owned
+// modules/*/skills/ that claude-materialize.js copies into it (task 1003587: scanning only the
+// tracked root meant 14 ui-design skills went unlinted until the untracked copy existed, so four
+// unparseable frontmatters shipped and fitness only went red on a checkout that had materialized).
+// A quiet pass when a checkout carries none (published core).
 function checkSkillFrontmatter() {
   const violations = [];
   const warnings = [];
@@ -1329,7 +1333,10 @@ function checkSkillFrontmatter() {
   }
   if (long.length) {
     long.sort((a, b) => b.n - a.n);
-    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${l.file.split('/')[2]} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
+    // The skill's own name is its PARENT dir — a fixed path index would read "skills"
+    // for a module-owned path (modules/<key>/skills/<name>/SKILL.md).
+    const skillName = (f) => f.split('/').slice(-2, -1)[0] || f;
+    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${skillName(l.file)} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
   }
   if (report.overBudget) warnings.push(`the skill listing is ${report.listingChars} chars (~${estTokens(report.listingChars)} tokens) against a ~${report.budgetChars}-char budget — Claude Code truncates entries past it and routing degrades.`);
   return {
@@ -1338,7 +1345,7 @@ function checkSkillFrontmatter() {
     hardFail: violations.length > 0,
     violations,
     warnings,
-    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
+    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ + modules/*/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
   };
 }
 

package/scripts/gds/skill-lint.js

@@ -23,7 +23,9 @@
 // verdict as authoritative over this one.
 //
 // Usage:
-//   node scripts/gds/skill-lint.js                 lint every .claude/skills/*/SKILL.md; exit 1 on any error
+//   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
+//                                                  plus the module-owned modules/*/skills/* that materialize
+//                                                  into it; exit 1 on any error
 //   node scripts/gds/skill-lint.js <file...>       lint specific files
 //   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
 //                                                  edited file if it is a SKILL.md, print findings, exit 0
@@ -108,14 +110,40 @@ function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   return res;
 }
 
-// Every SKILL.md under .claude/skills/ (one level deep).
-function listSkillFiles(root = REPO_ROOT) {
-  const dir = path.join(root, '.claude', 'skills');
+// Every SKILL.md in one skills root (one level deep, plus a `vendor/` tier).
+function skillsIn(dir) {
   if (!fs.existsSync(dir)) return [];
-  return fs.readdirSync(dir, { withFileTypes: true })
-    .filter((d) => d.isDirectory())
-    .map((d) => path.join(dir, d.name, 'SKILL.md'))
-    .filter((f) => fs.existsSync(f));
+  const out = [];
+  for (const d of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!d.isDirectory()) continue;
+    const own = path.join(dir, d.name, 'SKILL.md');
+    if (fs.existsSync(own)) { out.push(own); continue; }
+    if (d.name === 'vendor') out.push(...skillsIn(path.join(dir, d.name)));
+  }
+  return out;
+}
+
+// Every skill Claude Code can end up loading — the tracked `.claude/skills/` PLUS the
+// module-owned `modules/<key>/skills/`, because claude-materialize.js copies those into
+// `.claude/skills/` as untracked copies (task 1003330) and a defect in one only shows up
+// after materialization. Scanning only the tracked root left 14 ui-design skills unlinted
+// until the copy existed, which is exactly how four unparseable frontmatters shipped
+// (task 1003587). A name already present in `.claude/skills/` wins and its module copy is
+// skipped — the same precedence the materializer applies — so nothing is counted twice.
+function listSkillFiles(root = REPO_ROOT) {
+  const core = skillsIn(path.join(root, '.claude', 'skills'));
+  const seen = new Set(core.map((f) => path.basename(path.dirname(f))));
+  const modulesDir = path.join(root, 'modules');
+  const owned = [];
+  if (fs.existsSync(modulesDir)) {
+    for (const d of fs.readdirSync(modulesDir, { withFileTypes: true })) {
+      if (!d.isDirectory()) continue;
+      for (const f of skillsIn(path.join(modulesDir, d.name, 'skills'))) {
+        if (!seen.has(path.basename(path.dirname(f)))) owned.push(f);
+      }
+    }
+  }
+  return [...core, ...owned];
 }
 
 // Lint a set of files; returns per-file results plus the listing total vs budget.
@@ -125,7 +153,13 @@ function lintSkills(files) {
   return { results, listingChars, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
-function isSkillMd(p) { return /[\\/]\.claude[\\/]skills[\\/][^\\/]+[\\/]SKILL\.md$/.test(String(p || '')); }
+// The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
+// file a builder actually edits; the `.claude/skills/` copy is generated (task 1003587).
+function isSkillMd(p) {
+  const s = String(p || '');
+  return /[\\/]\.claude[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s)
+    || /[\\/]modules[\\/][^\\/]+[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s);
+}
 
 function format(report, { relTo = REPO_ROOT } = {}) {
   const out = [];

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.545'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.546'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_kit_charts.mjs

@@ -623,3 +623,62 @@ test('CAL: the grid gets its own horizontal strip — it never widens the docume
   const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03' });
   assert.match(html, /kit-cal__scroll/, 'the wide grid scrolls inside its own strip');
 });
+
+// --- task 1003583: the summary and the caption must describe the DRAWN window ------
+
+test('CAL: a narrowed window is described as weeks, not as "the last year"', () => {
+  // The bug: the default aria summary hardcoded "over the last year" whatever
+  // opts.weeks said, so a caller asking for six weeks was handed a label describing
+  // fifty-three.
+  const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 2 }], { today: '2026-09-03', weeks: 6 });
+  assert.match(html, /over the last 6 weeks/, 'the aria summary still claims a year');
+  assert.doesNotMatch(html, /over the last year/);
+});
+
+test('CAL: a one-week window says "week", and the full window still says "the last year"', () => {
+  const one = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 1 });
+  assert.match(one, /over the last 1 week:/, 'singular grammar');
+  const full = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 53 });
+  assert.match(full, /over the last year/, 'the 53-week window is a year and should read like one');
+});
+
+test('CAL: the summary counts only the days the grid actually draws', () => {
+  // 2026-09-03 is a Thursday, so a 2-week grid starts at Sunday 2026-08-23. A ship on
+  // 2026-08-01 is real history the caller supplied, but it is off this picture, and it
+  // used to be counted in this picture's summary anyway.
+  const days = [
+    { local_date: '2026-08-01', count: 4 },   // before the first column
+    { local_date: '2026-08-30', count: 2 },   // inside
+    { local_date: '2026-09-03', count: 1 },   // inside
+  ];
+  const html = kit.calendarGridHtml(days, { today: '2026-09-03', weeks: 2 });
+  assert.match(html, /3 ships across 2 days/, 'the out-of-window day leaked into the summary');
+});
+
+test('CAL: calendarWindow is the one source of truth the caller reads too', () => {
+  // profile-charts.js used to recompute "N days shipped" with its own filter over the
+  // whole array; it now reads activeDays from here, so the caption and the picture
+  // cannot disagree.
+  const days = [
+    { local_date: '2026-08-01', count: 4 },
+    { local_date: '2026-08-30', count: 2 },
+    { local_date: '2026-09-03', count: 1 },
+  ];
+  const opts = { today: '2026-09-03', weeks: 2 };
+  const win = kit.calendarWindow(days, opts);
+  assert.equal(win.activeDays, 2);
+  assert.equal(win.totalShips, 3);
+  assert.equal(win.weeks, 2);
+  // The window's own bounds are what the grid iterates, so the naive filter the caller
+  // used to run disagrees with it — which is exactly the bug.
+  assert.notEqual(days.filter((d) => d.count > 0).length, win.activeDays);
+  const html = kit.calendarGridHtml(days, opts);
+  assert.match(html, new RegExp(`across ${win.activeDays} days`), 'grid and window disagree');
+});
+
+test('CAL: calendarWindow returns null on nothing to draw, matching the grid empty state', () => {
+  assert.equal(kit.calendarWindow([], {}), null);
+  assert.equal(kit.calendarWindow(null, {}), null);
+  assert.equal(kit.calendarWindow([{ local_date: '2026-09-03', count: 0 }], {}), null,
+    'a zero-count day is not a ship day');
+});

package/tests/skill_lint.mjs

@@ -3,6 +3,8 @@
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -58,11 +60,58 @@ test('no frontmatter at all is an error', () => {
   assert.equal(run('# Title\n\nBody.\n').errors.length, 1);
 });
 
-test('the hook path filter matches only .claude/skills/<name>/SKILL.md', () => {
+test('the hook path filter matches a SKILL.md in either home — .claude/skills/ or a module (task 1003587)', () => {
   assert.ok(lint.isSkillMd('C:\\repo\\.claude\\skills\\dev\\SKILL.md'));
   assert.ok(lint.isSkillMd('/repo/.claude/skills/dev/SKILL.md'));
+  // The module copy is the file a builder EDITS; .claude/skills/ holds the generated
+  // copy, so a hook that only watched the tracked root never saw the real edit.
+  assert.ok(lint.isSkillMd('/repo/modules/ui-design/skills/dev/SKILL.md'));
+  assert.ok(lint.isSkillMd('C:\\repo\\modules\\ui-design\\skills\\vendor\\dev\\SKILL.md'));
   assert.ok(!lint.isSkillMd('/repo/.claude/skills/dev/notes.md'));
-  assert.ok(!lint.isSkillMd('/repo/modules/ui-design/skills/dev/SKILL.md'));
+  assert.ok(!lint.isSkillMd('/repo/modules/ui-design/skills/dev/notes.md'));
+  assert.ok(!lint.isSkillMd('/repo/docs/skills/dev/SKILL.md'));
+});
+
+// A fixture root, because a real dev checkout may or may not have materialized its
+// module skills into .claude/skills/ (claude-materialize.js, task 1003330) and the
+// lister's contract must hold either way.
+function fixtureRoot(files) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'skill-lint-'));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = path.join(root, rel);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, body);
+  }
+  return root;
+}
+
+test('the lister reaches module-owned skills, and a core copy of the same name wins (task 1003587)', () => {
+  const skill = fm('>-\n  A description long enough for the harness to route on, written as a block scalar.');
+  const root = fixtureRoot({
+    '.claude/skills/only-core/SKILL.md': skill,
+    '.claude/skills/both/SKILL.md': skill,
+    'modules/ui-design/skills/both/SKILL.md': skill,
+    'modules/ui-design/skills/only-module/SKILL.md': skill,
+    'modules/ui-design/skills/vendor/vendored/SKILL.md': skill,
+    'modules/ui-design/skills/README.md': '# not a skill\n',
+  });
+  const files = lint.listSkillFiles(root).map((f) => path.relative(root, f).replace(/\\/g, '/'));
+  assert.deepEqual(files.sort(), [
+    '.claude/skills/both/SKILL.md',
+    '.claude/skills/only-core/SKILL.md',
+    'modules/ui-design/skills/only-module/SKILL.md',
+    'modules/ui-design/skills/vendor/vendored/SKILL.md',
+  ], 'a module skill is linted at its source; a name already in .claude/skills/ is not counted twice');
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('every module-owned skill this repo ships parses too — the 14 that did not on 2026-09-04 (task 1003587)', () => {
+  const dir = path.join(ROOT, 'modules', 'ui-design', 'skills');
+  const files = lint.listSkillFiles(ROOT).filter((f) => f.startsWith(dir) || fs.existsSync(path.join(dir, path.basename(path.dirname(f)), 'SKILL.md')));
+  assert.ok(files.length >= 14, `the ui-design module ships 14+ skills; found ${files.length}`);
+  const report = lint.lintSkills(files);
+  const broken = report.results.filter((r) => r.errors.length).map((r) => path.relative(ROOT, r.file) + ': ' + r.errors.join('; '));
+  assert.deepEqual(broken, [], broken.join('\n'));
 });
 
 test('every committed skill parses (the ten that did not on 2026-09-03 must stay fixed)', () => {

package/tests/ui_design_skills.mjs

@@ -34,14 +34,24 @@ const policy = readJson(path.join(SKILLS, 'policy.json'));
 const manifest = readJson(path.join(MODULE, 'module.json'));
 const materialize = require(path.join(ROOT, 'scripts', 'gds', 'claude-materialize.js'));
 
-// Minimal YAML-frontmatter reader: `key: value` lines between the first two `---` fences.
+// Minimal YAML-frontmatter reader: `key: value` lines between the first two `---`
+// fences, plus folded block scalars (`key: >-` then the text indented), which is the
+// only safe way to write a description carrying a colon-space (task 1003587) — a plain
+// scalar with ": " in it makes Claude Code's YAML reader drop EVERY field silently.
 function frontmatter(text) {
   const m = text.match(/^---\n([\s\S]*?)\n---\n/);
   const out = {};
   if (!m) return out;
+  let block = null; // the key whose folded value the indented lines below belong to
   for (const line of m[1].split('\n')) {
     const kv = line.match(/^([A-Za-z][A-Za-z0-9_-]*):\s*(.*)$/);
-    if (kv) out[kv[1]] = kv[2].replace(/^["']|["']$/g, '').trim();
+    if (kv) {
+      const v = kv[2].trim();
+      block = /^[>|][+-]?\d*$/.test(v) ? kv[1] : null;
+      out[kv[1]] = block ? '' : v.replace(/^["']|["']$/g, '').trim();
+      continue;
+    }
+    if (block && /^\s+\S/.test(line)) out[block] = (out[block] ? out[block] + ' ' : '') + line.trim();
   }
   return out;
 }