[aenawi]

Target

• This is going into develop: the normal case for a fix, a chapter, a
  lab change, a typo
• This is a release: develop → main, shipping to the published guide
• This is a hotfix: straight into main, because published advice is
  currently locking readers out or leaving them exposed

What this changes

The page's furniture was in index.html, so adding a readout meant editing the
markup, the stylesheet and app.js — three files, and a fork for anyone who
wants a different instrument on the same lab. Now there are four docks around
the board (top, left, right, bottom), a card in one of them is a widget
folder under ui/hud/widgets/, and which card goes where is declared in a
theme's theme.json. The feed made the lab's data shareable; this makes the
layout data too.

Third of the four HUD branches. #77 gave the board a palette, #78 put the lab on
one wire, and this docks cards that read that wire. Record-and-replay is next and
is not in here.

Closes #

Kind

• Prose: clarity, typo, dead link
• The advice was wrong, unsafe, or out of date
• Lab or sandbox: code, checks, a new scenario
• A divergence between the lab and the sandbox, closed or newly documented
• Tests
• Something else

Checks

• make -C lab check passes
• gofmt is clean (make check fails on any output at all)
• New source files carry an SPDX-License-Identifier header

If this touches the lab or sandbox engine

• Nothing is drawn that was not measured
• A failed attack does not render as a green tick
• danger still outranks ok
• Time is not faked
• The engine still returns the rung that decided the outcome, not a bare pass/fail
• If a score moved, the comparison table in lab/README.md moved with it (a
  test asserts these against a fixture, so a mismatch will fail loudly)

The engine is untouched — no scores moved. The boxes above are about the new
tally widget, which is the one thing here that draws a judgement. It counts
allowed and denied apart rather than merging them, because "rung 3 allowed eleven
and denied none" is a finding and "rung 3 answered eleven times" is not. A rung
nothing reached shows a zero and no bar, not an empty bar that reads as a
measurement. Driven against the lab: the attacker to lab-vps:22 was denied at
rung 4 and the card read 0 / 1.

What a widget is handed

export function create({ el, feed, options }) {
  const off = feed.on("verdict", (data) => { /* draw into el */ });
  return { destroy: off };
}

A div, the feed, and the options its placement carried. No board object, no page
elements, no controller. hud/scene.js is twenty-five coupled methods over 1300
lines of three.js and publishing it as a plugin API would freeze it the day
somebody wrote against it.

The board is therefore not a widget in this change, and that is deliberate
rather than unfinished: app.js still creates and drives it, and the docks' part
is reporting what they cover so the camera frames the diagram in the gap the
cards leave. Making it a real widget under the contract above means the board
reading the feed instead of being called — next branch's work. A privileged
contract handing one widget the board object would be the plugin API this change
exists to avoid.

The trap this hit

--pad-* is measured against the canvas and consumed against the window, and
those differ by the height of the rung ladder, which sits below the viewport
rather than over it. A card measured one way and positioned the other is short by
exactly one ladder, which put the verdict 40px inside the bottom card. Fixed by
measuring the docks against both rectangles, and by splitting --rail-* out of
--pad-*: the docks are positioned from the furniture alone, because a dock
positioned from a number that includes its own size is a layout that never
settles.

Measured, not expected

Against the running lab on 2026-09-12, Chromium at 1600x1000, control rebuilt
with docker compose up -d --build --no-deps control:

chapter   no .slots element in the DOM, no cards; --rail-* and --pad-* equal
warroom   wire@top tape@right tally@bottom, three widget.css loaded
          --rail-r=346px  --pad-r=616px  --rail-b=50px  --pad-b=163px
probe     lab-ubuntu -> lab-vps:22  reached at rung 5   tally 1 / 0
probe     evil-box   -> lab-vps:22  denied  at rung 4   tally 0 / 1
fold ]    tape card 984..1244 -> 1276..1536, board re-framed
820px     cards stack at the foot of the page, no horizontal scroll
overlap   verdict / view controls / board gauges vs every card: none
console   one error, the favicon 404 the page already had

Two things changed because of what driving it showed, not because of what the
type list said. The tape hid only stat at first; with the three-second polls
in, one probe put nineteen lines on the tape and two of them were the probe, so
status and netcheck are hidden by default too and hide: [] puts them back.
And an empty tape card read as a broken one, so it says what it is waiting for
until there is a frame to replace the line with.

evil-box was already running when I started and I did not stop or start
anything. Only the control container was rebuilt; the lab's machines were not
touched.

Tests

Ten new Go tests. The two that matter:

• every placement in every embedded theme.json resolves against the registry —
  the failure it catches is silent in a browser, because a theme naming a widget
  that is not there gets a layout with that card quietly missing
• every selector in every widget.css is anchored to .card[data-widget="<id>"]
  — the same test, and the same reason, as the one holding a theme to the nine
  --board-* properties

The JavaScript parse check now finds the widget folders rather than carrying a
list of them. A list there would have been the third place to edit when adding a
widget, and the one nobody remembers — and an unparsed widget is a card that says
"did not load" with the reason only in the console.

Licence

• I have the right to submit this, and I am fine with it going out under
  CC BY-SA 4.0 (guide) or GPL-3.0-or-later (code), per the file I touched