[skbarber]

Stacked PR, step 2b of the panels arc. Base: feat/panels-viewer (#1132) ← #1131 ← #1130. The stack merges in order at the end of the arc (maintainer's call: evaluate the arc as a unit).

What

The IOC stores both crosshairs (OVER1:1/2) and the analysis ROI (ROI1): shared by every viewer and autosaved. The panel draws them over the colour-mapped image and edits them. This is the design note's §5 ruling: colour crosshairs drawn client-side, with the stream left plain greyscale.

• overlay.js, a layer on the viewer's new hooks (draw, grab, hover, snapshot via window.GeecsCameraView). It zooms and pans with the image.
  • Drag a crosshair's centre, or the ROI's edges and corners, with resize and move cursors on hover.
  • An edit stays on screen until the IOC's readback agrees, so it never jumps back mid-drag.
• Rail controls:
  • Per crosshair: on/off, colour, x/y, To centroid. An overlay that was never configured becomes a visible cross with a visible colour.
  • ROI: x/y/width/height and Full frame.
• Writes (the first in the panel):
  • POST /camera/{d}/put: allow-listed (camera.WRITABLE: OVER1:1/2 fields and ROI1 Min/Size only, nothing a scan saves), with values coerced to the PV's type.
  • /crosshair/{n}/colour: r/g/b, range-checked by the model.
  • /crosshair/{n}/to-centroid: the STAT centroid converted from ROI to image pixels on the server (coords.py, binning and reversal included).
  • --read-only refuses every write and disables the controls.
• Fit leaves a 16 px margin. Found in the live test: a full-frame ROI's corner sat exactly on the viewport's edge and couldn't be grabbed.

1013 added, 19 removed.

Tests

• GeecsPanels: 90 passed. New test_writes.py covers:
  • Nothing outside the allow-list is writable, including the driver and HDF1.
  • Value coercion and refusal.
  • Coordinates with binning and reversal.
  • Each route: success, a 422 refusal that puts nothing, read-only 403, an IOC failure as a 502, to-centroid's conversion, a stale centroid as a 409, and colour.
• GeecsWebTheme: 199 passed (overlay.js added to the guard).
• Lint OK.

Hardware verification (done on ADTEST_CAM1)

Through the panel's routes and real mouse events in Chrome over CDP:

• Crosshair 1 moved and recoloured.
• cam1:AcquireTime and HDF1:Capture refused; Capture_RBV stayed Done.
• An out-of-range colour refused.
• To-centroid on crosshair 2 put (696, 552).
• Crosshair 2 turned on from its checkbox: Shape → Cross, size 205.
• Dragging crosshair 1: the IOC stored exactly the image pixel under the drop point, (717, 553).
• Dragging the ROI corner: ROI1 became 822 × 719, and STAT's centroid recomputed inside it.
• The test camera was restored afterwards and checked by readback: crosshair 1 (640, 512) green, crosshair 2 off as a 1-px rectangle, ROI full frame.

🤖 Generated with Claude Code

[skbarber]

Adversarial review (fresh-context reviewer, two rounds)

The reviewer found no way around the allow-list or --read-only: every write route passes _Writer.device() (403/404) and check_write's exact-key match. Injection values (text for a number, true for a pixel, NaN or Infinity, an enum outside its choices) are refused. The ROI write order (both Mins, then both Sizes) is safe against NDROI's clamping.

#	Finding	Disposition
F1	Crosshairs were drawn and written on a pixel's corner, not its centre. That put them half a pixel off STAT and OVER1's convention: 20 screen px at maximum zoom. round() rounded half to even.	Fixed in d86bcd6a3: drawn and hit-tested at the pixel centre, a drag writes the pixel the cursor readout names, to-centroid rounds half up. Confirmed (a mutation reverting the rounding fails the test).
F2	A cleared number field wrote 0 (ROI1:SizeX 0 collapses the analysis ROI), and /put had no ranges.	Fixed: an empty field writes nothing. WRITABLE carries Whole(lo, hi) ranges: pixels 0..65535, ROI size ≥ 1, colour 0..255. Confirmed (removing the ranges fails 4 tests).
F3	Handles were grabbable before the first frame, which could collapse an invisible ROI. Related: positions computed in JPEG pixels.	Fixed (no hover or grab before a frame). Confirmed. The JPEG-size part was also found live: ffmpegServer scales a Rot90 1280×1024 frame to 960×1200, so drags would land about 6% off. The fix is in #1134 (2c): the JPEG is stretched to MJPG1:ArraySize0/1_RBV. ⚠️ Do not deploy this PR without #1134. The stack merges together at the end of the arc.
F4	A reversed ROI whose size isn't whole bins mapped one pixel wrong.	Fixed: NDROI's whole-bin span. A new non-divisible test fails on the old formula. Confirmed. ROI1:EnableX/Y isn't handled: noted, since the chain contract keeps ROI1 enabled.
F5	The write routes can be requested cross-site (a form POST to to-centroid, a no-CORS JSON put), though only within the allow-list.	Noted, not fixed here. An Origin/Sec-Fetch-Site check belongs in geecs_web_theme.web for every surface; none has one today.

Below the floor, fixed in #1134: the allow-list comment sat above the wrong definition.

[skbarber]

Reviewed this PR in the #1130–#1135 stack, including the existing review fixes. No additional actionable findings in this PR. Validation at stack head dc8ac07: panel suite plus Core EPICS bootstrap/light-import tests, 143 passed (including JavaScript syntax checks). Targeted offline probes reproduced the findings on #1134/#1135. No hardware writes or live camera testing performed. The documented dependency on #1134 for scaled-image coordinates still applies.