[TMHSDigital]

Stacked on #69, which is stacked on #68. Its base is site/phase-6-search, so the diff shows only this phase. Two commits: the first moves the explainer's inline <style> and <script> into explainer.css and explainer.js with no change in behaviour, so the second reads as a diff of real changes.

Fixes #25. Fixes #53. Fixes #55. Fixes #57.
(These close when the stack lands on main.)

The explainer's opening

• The page now opens with a card showing the example report's result: the measured ECE against the floor's 95th percentile on one gauge, and the verdict.
• build_site.py writes the card from the report's own ECE line, into a <!-- site:example-card --> slot. So it says exactly what the report says, it reads the same with scripts off, and it flips wording if the example ever becomes distinguishable.
• Two calls to action follow: "Check your numbers" and "Read the methodology".
• From 64rem the "On this page" list becomes a sticky rail beside the text, with the same section highlighting as the doc pages.

A Content-Security-Policy on every page

• The policy is default-src 'self', with script-src, style-src, connect-src and worker-src all 'self', img-src 'self' data: (for the inline favicon), object-src, frame-src, base-uri and form-action set to 'none', and no 'unsafe-inline'.
• The build refuses an explainer without the tag.
• check_site_links.mjs now fails any page that lacks the tag or carries an inline <script>, a <style> block, or a style= attribute. I confirmed it catches an injected style= on a doc page.

Calculator and planner

• Every validation error on the calculator reads "[object Object]" #25: validation messages said [object Object]. They now say what is wrong.
• Calculator accessibility: contrast, error association, and live regions #53:
  • An invalid field gets aria-invalid and an aria-describedby pointing at the status line, and takes focus.
  • The result blocks are no longer aria-live; the status line announces one summary line instead.
  • The control and bar contrast fixes landed in feat(site): a header on every page, and navigation for the docs (phase 5) #68.
• Site: cancel long runs, share inputs in the URL, add a CSP #57:
  • The calculator and planner each have their own worker, so the planner's long search never queues the calculator.
  • Each tool has a Cancel button that ends its worker and starts a fresh one on the next run. It is hidden where the page falls back to running on the main thread.
  • Inputs are kept in the query string (n, bins, accuracy, measured, and target, plan_bins, plan_accuracy), and a link that carries them runs the tool on load.
  • Each result has "Copy link" and "Copy result". The result is the verdict in the report's wording.
• Small site bugs: misreported example errors, nBins of 0, parity precision #55:
  • The worked example now says whether its rows were missing or failed to draw, and logs the error.
  • floor.js refuses a bin count of 0, as the Python does, instead of turning it into 10.
  • example-run.json now carries the Python's unrounded calibration_floor, and the parity check holds the page's floor to 1e-9 against it, not just to the four decimals of the report line.
• Found in feat(site): search the explainer and the docs (phase 6) #69: a link to /#planner stopped short, because the worked example grows the page after it loads. It now lands on its target once the example is drawn, unless the reader has already moved.

Checked

• ruff, mypy --strict, and pytest pass. The new tests cover:
  • explainer slots and CSP refusal;
  • the committed page having both slots and the tag;
  • the card saying what the report says, in both verdict branches.
• floor_golden --check, check_floor_parity (now including the 1e-9 floor), check_site_links (with CSP), check_search, and render_docs --self-test all pass.
• In the browser (Playwright, 1440 and 375 px), with no console messages and no CSP violations:
  • rows 0 shows the real message, marks the field aria-invalid with aria-describedby="calc-status", and focuses it;
  • a run writes ?n=300&bins=10&accuracy=0.8&measured=0.09#calculator, and opening that link reproduces the result;
  • a planner search can be cancelled and reports "Cancelled.";
  • #planner lands 68 px from the top, just under the header, with its rail entry highlighted.

Still open in #54: a browser smoke test in CI. It needs a package install in a workflow that has none today.

🤖 Generated with Claude Code