/** * Canvas run-state: live step lighting for the sandboxed iframe, plus the * reverse click channel (iframe → parent). * * HOW IT WORKS — the stringify-into-iframe pattern * ───────────────────────────────────────────────── * The canvas iframe is served with `sandbox="allow-scripts"` which makes it * an opaque origin. The parent page cannot reach its DOM via any API — the * ONLY communication channel is `window.postMessage`. * * To apply live run state to the SVG nodes, we need code that runs INSIDE the * iframe's document. We cannot bundle a separate script for it (no fetch * inside a sandboxed iframe, no src="" script). Instead, `canvas-template.ts` * stringifies the functions below with `.toString()` and injects them * directly into the `