@celestia-island/hikari 0.55.283 → 0.55.284

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celestia-island/hikari",
-  "version": "0.55.283",
+  "version": "0.55.284",
   "private": false,
   "type": "module",
   "description": "Hikari UI library, Vue 3 runtime — one design system for Vue 3 and Rust/WASM applications",

package/src/components/HkAmbientLayer.styles.test.ts

@@ -35,6 +35,25 @@ describe("HkAmbientLayer pointer contract", () => {
     const blockStart = declarations.lastIndexOf('[data-pointer-events="auto"]', autoAt);
     expect(blockStart).toBeGreaterThan(-1);
     expect(declarations.slice(blockStart, autoAt)).toContain("> *");
+    // EVERY ruleset is checked by SCOPE, not proximity: any block that
+    // states pointer-events:auto must be the child-scoped opt-in, and any
+    // other block stating pointer-events at all must say none (an earlier
+    // round flagged both the first-only and the proximity-based shapes).
+    const rulesets = [...declarations.matchAll(/([^{}]+)\{([^{}]*)\}/g)].map(
+      ([, selector, body]) => ({ selector: selector.trim(), body }),
+    );
+    expect(rulesets.length).toBeGreaterThan(0);
+    for (const { selector, body } of rulesets) {
+      if (!/pointer-events/.test(body)) continue;
+      if (/pointer-events:\s*auto/.test(body)) {
+        expect(selector).toContain('[data-pointer-events="auto"]');
+        expect(selector).toContain("> *");
+      } else {
+        expect(body).toMatch(/pointer-events:\s*none/);
+      }
+    }
+    // The wrapper's own block states the ghost rule exactly once.
+    expect(declarations.match(/pointer-events:\s*none/g)).toHaveLength(1);
   });
 
   it("sits on the HUD ordinal band, below its root's document elevation", () => {

package/src/components/HkCalendarHeatmap.scss

@@ -42,12 +42,20 @@
   }
 
   // Weekday rail: the first (Monday) and last (Sunday) rows carry the
-  // labels (the wowsp convention); sticky so it survives horizontal
-  // scroll on narrow screens.
+  // labels (the wowsp convention). `align-self: flex-end` rows-aligns
+  // the rail with the GRID, not with the -cells box: -cells is one
+  // marker strip taller than the grid (the month labels ride above
+  // it), so a stretched rail started its seven rows on the markers and
+  // every label sat one strip too high (2026-11-05 user report from
+  // the chest quota card). The rail's natural height (7 cells + 6
+  // gaps) equals the grid's exactly, so end-alignment is row-exact.
+  // No sticky mask on purpose: a hard-coded surface can't match every
+  // host card (it painted a visible stripe behind the labels), and
+  // sticky without a mask lets cells slide beneath the labels during
+  // horizontal scroll — the rail scrolls with the calendar instead
+  // (the GitHub convention).
   &-rail {
-    position: sticky;
-    left: 0;
-    z-index: 1;
+    align-self: flex-end;
     display: flex;
     flex-direction: column;
     flex-shrink: 0;
@@ -55,7 +63,6 @@
     font-size: 10px;
     line-height: 14px;
     color: var(--hi-color-muted);
-    background: var(--hi-color-surface);
 
     > span {
       white-space: nowrap;

package/src/components/HkScreenIdentifyCard.styles.test.ts

@@ -54,12 +54,35 @@ describe("HkScreenIdentifyCard layout contract", () => {
   });
 
   it("parks the card in every corner through placement attributes", () => {
-    for (const placement of ["bottom-right", "top-left", "top-right"]) {
-      expect(scss).toContain(`&[data-placement="${placement}"]`);
+    // Each non-default corner must OVERRIDE the exact edges that move it
+    // there — an earlier round flagged this guard as presence-only, so a
+    // placement block that forgot its edge rule stayed green.
+    const corners: Array<[string, RegExp[]]> = [
+      // End-side corners must ALSO release the logical start edge — an
+      // over-constrained inset would resolve to the start edge and leave
+      // the card bottom-left no matter the placement (R1 V-3 probe).
+      ["bottom-right", [/inset-inline-end:\s*var\(--space-16/, /inset-inline-start:\s*auto/]],
+      ["top-left", [/top:\s*var\(--space-16/, /bottom:\s*auto/]],
+      [
+        "top-right",
+        [
+          /inset-inline-end:\s*var\(--space-16/,
+          /inset-inline-start:\s*auto/,
+          /top:\s*var\(--space-16[\s\S]*bottom:\s*auto/,
+        ],
+      ],
+    ];
+    for (const [placement, edges] of corners) {
+      const block = ruleBlock(`&[data-placement="${placement}"]`);
+      for (const edge of edges) {
+        expect(block).toMatch(edge);
+      }
     }
-    // Left/right use logical properties so RTL mirrors the pair while
-    // the card stays at the same corner of the glass.
-    expect(ruleBlock(".hk-screen-identify")).toMatch(/inset-inline-start:/);
+    // The default corner's own block must not have been turned into a
+    // catch-all: it keeps the bottom-left seat via the logical edge only.
+    const card = ruleBlock(".hk-screen-identify");
+    expect(card).toMatch(/inset-inline-start:\s*var\(--space-16/);
+    expect(card).toMatch(/bottom:\s*var\(--space-16/);
   });
 
   it("rides hikari text tokens for every font size except the numeral", () => {

package/src/components/calendarHeatmapRail.contract.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Source contract for the HkCalendarHeatmap weekday rail geometry
+ * (2026-11-05 user report from the chest quota card: the Monday/Sunday
+ * labels sat one marker strip too high, and a hard-coded surface fill
+ * painted a visible stripe behind them).
+ *
+ * jsdom does no layout, so the row alignment itself cannot be asserted
+ * here; these pins hold the two sheet decisions the fix rests on:
+ *
+ * 1. `align-self: flex-end` — the -cells box is one marker strip taller
+ *    than the grid (the month labels ride above it); a stretched rail
+ *    starts its seven rows on the markers. The rail's natural height
+ *    (7 cells + 6 gaps) equals the grid's exactly, so end-alignment is
+ *    row-exact. This also assumes the grid stays the LAST child of
+ *    -cells with no trailing padding — the third pin below.
+ * 2. no sticky mask — a hard-coded surface can't match every host
+ *    card, and sticky without a mask lets cells slide beneath the
+ *    labels during horizontal scroll. The rail scrolls with the
+ *    calendar (the GitHub convention).
+ */
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const sheet = readFileSync(join(here, "HkCalendarHeatmap.scss"), "utf-8");
+
+// The `&-rail` rule up to its closing brace (two-space indent inside
+// the `.hk-calendar-heatmap` block) — keeps the assertions scoped to
+// the rail (a background elsewhere in the sheet is legitimate).
+const rail = sheet.match(/&-rail \{[\s\S]*?\n  \}/)?.[0] ?? "";
+// Same for `-cells`, whose last-child geometry the alignment relies on.
+const cells = sheet.match(/&-cells \{[\s\S]*?\n  \}/)?.[0] ?? "";
+
+describe("HkCalendarHeatmap weekday rail contract", () => {
+  it("extracts the rail rule from the sheet", () => {
+    expect(rail, "the &-rail rule must exist").toContain("&-rail {");
+  });
+
+  it("bottom-aligns the rail with the grid, not the markers row", () => {
+    expect(rail, "rail must carry align-self: flex-end").toContain(
+      "align-self: flex-end",
+    );
+  });
+
+  it("carries no sticky mask (no hard-coded surface fill)", () => {
+    expect(rail, "rail must not paint a hard-coded surface").not.toContain(
+      "background:",
+    );
+    expect(rail, "rail must not go sticky").not.toContain("position: sticky");
+    expect(rail, "sticky's scroll pin has no business left behind").not.toContain(
+      "z-index",
+    );
+  });
+
+  it("keeps the grid the flush last child of -cells", () => {
+    expect(cells, "the &-cells rule must exist").toContain("&-cells {");
+    expect(cells, "trailing padding would break the end-alignment").not.toContain(
+      "padding",
+    );
+  });
+});

package/src/theme/useSolarTime.test.ts

@@ -514,6 +514,20 @@ describe("solar IP insight (the strategy dialog's readout)", () => {
     expect(mod.solarIpInsightFresh(insight.fetchedAt + 11 * 60 * 1000)).toBe(false);
   });
 
+  it("a probe and the ip cascade's geo resolution racing share one lookup GET", async () => {
+    mod.setSolarLocationStrategy("ip");
+    mod.setGeolocationProvider(async () => null);
+    const fetchMock = lookupFetch();
+    vi.stubGlobal("fetch", fetchMock);
+    // The dialog probe and the theme clock's resolution race the same
+    // lookup — the body fetch dedupes them into one network request and
+    // both consumers converge on the same insight.
+    await Promise.all([mod.probeSolarIpInsight(), mod.getGeolocation()]);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(mod.solarIpInsight.value?.ip).toBe("203.0.113.7");
+    expect(mod.solarIpProbeState.value).toBe("ok");
+  });
+
   it("the ip strategy's own geo resolution records the insight from the same body", async () => {
     mod.setSolarLocationStrategy("ip");
     mod.setGeolocationProvider(async () => null);

package/src/theme/useSolarTime.ts

@@ -330,16 +330,30 @@ const GEO_API_TIMEOUT_MS = 4000;
 /** One fetch of the lookup body with the shared timeout — the single
  *  network path for both consumers (the "ip" strategy's geo resolution
  *  and the strategy dialog's insight readout), so narrowing, abort
- *  handling and the no-store contract live in exactly one place. */
+ *  handling and the no-store contract live in exactly one place.
+ *  Concurrent callers SHARE the in-flight GET (a probe and an apply's
+ *  geo resolution racing each other used to issue two identical
+ *  requests); failures propagate to every joiner. */
+let ipBodyInflight: Promise<unknown> | null = null;
+
 async function fetchIpLookupBody(): Promise<unknown> {
-  const controller = new AbortController();
-  const timer = scheduleCronAfter(() => controller.abort(), GEO_API_TIMEOUT_MS);
-  return fetch(GEO_API_URL, {
-    signal: controller.signal,
-    cache: "no-store",
-  })
-    .then((r) => (r.ok ? r.json() : null))
-    .finally(() => timer.disconnect());
+  if (ipBodyInflight) return ipBodyInflight;
+  const inflight = (async () => {
+    const controller = new AbortController();
+    const timer = scheduleCronAfter(() => controller.abort(), GEO_API_TIMEOUT_MS);
+    return fetch(GEO_API_URL, {
+      signal: controller.signal,
+      cache: "no-store",
+    })
+      .then((r) => (r.ok ? r.json() : null))
+      .finally(() => timer.disconnect());
+  })();
+  ipBodyInflight = inflight;
+  try {
+    return await inflight;
+  } finally {
+    ipBodyInflight = null;
+  }
 }
 
 /** The trimmed-string guard for the untrusted lookup body: only a