feat(web): the Cost & Risk view, Day 1 on a Pareto detent ladder (#44)

[bgent19]

Closes #44.

Day 1's opening thesis on screen: serve each destination by its own cheapest path, watch the plan fail, then flip to the feasible optimum — walked along the Pareto frontier.

The detents

The coarse unit is a distinct Pareto point, not a λ value. The eight default λs collapse to four distinct plans on the theater (blocks 0,1,2,5 / 10 / 25 / 50,100), so walking λ positions would have made the first four presses of Day 1 change nothing on screen — the dead-key failure the beat model exists to prevent, sitting in the default sweep at the worst possible moment.

Dedup is on the pair. A block collapses only if neither the naive plan nor the optimum moved. Deduping on the optimum alone would be the same bug one step later: the theater has a λ where the naive plan moves and the optimum does not, and collapsing it would hide the ticket's own punchline — that the naive plan fails at every λ and gets worse.

The panel keeps all eight rows with the duplicates marked as duplicates. paretoRows is one pure function called by both the spine and the table, so the block the panel marks and the beat the keyboard reaches cannot disagree.

The panel

The Pareto table is promoted to be this view's timeline and the beat timeline is empty here — a four-row detent list beside eight λ rows would be the same beat state in two components that can disagree. The two slots swap: they are never both filled. views.js carries the standing note not to "fix" the empty list.

Two structurally different violations

An over-capacity lane is a mark on the lane; an over-stock hub is a mark on the node. Two shapes, not two shades of one, so the room reads an assignment error rather than merely a too-small pipe. Every supply node renders with its dispatched-against-stock readout, idle healthy ones included — on the theater the overdrawn hub's identity changes from HUB-BRAVO to HUB-ALPHA as λ rises, which kills the "you just picked bad weights" objection on screen.

A base nothing reaches wears the removed vocabulary (grey, struck) where a base served illegally wears the violation hue: unreachability and infeasibility are different lessons. No shipped dataset exercises found: false, so that branch is the guard reporting idle.

Beat a switches capacity on and cost/risk off — the two share the anchor's lower row, and the sentence there is "this lane is asked for 90 and holds 60". The flip switches them back for the frontier's trade-off.

The violation hue

Day 1 authors --violation, which the token block had been carrying as a provisional panel tick with no canvas hue behind it, and re-derives that tick from it. Reddish purple rather than red: red against --node-demand is ΔE 3 under deuteranopia — confusable exactly where it matters, since an overloaded lane is by construction the lane running into a demand node.

The degenerate combination

Labelled, not struck. On the textbook set every cost is 1 and no lane carries risk, so λ multiplies zero and all eight λs return one plan. The headline states no risk data; frontier is a single point rather than the view being made unreachable — view-aware behaviour is the hidden modality the key assignments exist to avoid.

Verification

• 378 tests pass; 13 new source-inspection tests in tests/test_web_assets.py (the repo verifies the frontend from Python or not at all).
• Behaviour checked against real /sweep + /naive payloads on all three datasets: 4 detents on the theater, the 1080 → 1250 delta at λ0, the hub identity flip, and the degenerate note on textbook and greedy_trap.
• Both /code-review axes run and addressed. Notably it caught a real bug: a Pareto row click drove whatever spine was active, so clicking a λ row in Flow & Cut silently jumped the augmentation ladder — a pointer reaching a state no key can. Row clicks now go through jumpToUnit and are gated on the view owning the table.