From aaa148fb301e015a10630fe426319e2a851d7402 Mon Sep 17 00:00:00 2001
From: c4ch3c4d3 <bryce@zuccaro.me>
Date: Wed, 19 Aug 2026 07:24:09 -0500
Subject: [PATCH] =?UTF-8?q?docs:=20spec=20=E2=80=94=20correct=20encryption?=
 =?UTF-8?q?=20card=20bucket=20model=20(real=20families=20+=20legend=20id)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../2026-08-19-encryption-card-redesign.md    | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/docs/superpowers/specs/2026-08-19-encryption-card-redesign.md b/docs/superpowers/specs/2026-08-19-encryption-card-redesign.md
index 14e6255..00207b0 100644
--- a/docs/superpowers/specs/2026-08-19-encryption-card-redesign.md
+++ b/docs/superpowers/specs/2026-08-19-encryption-card-redesign.md
@@ -15,11 +15,18 @@ should be a proper ring graph with a readable key.
 - Remove the `encValue` / `encSub` text line (`WPA2-PSK` / `54 of 96 APs`)
   entirely. Title + ring + legend tell the whole story.
 - Ring: existing doughnut grows to fill the card body (canvas ~120px tall),
-  plain hole, all six buckets (Open / WEP / WPA / WPA2 / WPA3 / Enterprise) in
-  the current `RECON_ENC_COLORS`.
+  plain hole. Segments come from the **actual** `reconEncBucket` family keys
+  (Open / WEP / WPA / WPA2-PSK / WPA2-Enterprise / WPA3-Personal / WPA3-PSK /
+  WPA3-Enterprise / Unknown) — the nominal six-bucket list was a wrong
+  assumption: `reconEncBucket` never returns `WPA2`/`WPA3`/`Enterprise`
+  verbatim, so the ring drew an empty ring on WPA2-dominated data.
+  Families are ordered by `RECON_ENC_ORDER`; colors cycle `RECON_ENC_COLORS`.
 - Legend: move out of the canvas into real HTML below the ring. Flex-wrap so
   entries never clip at 190px. Each entry: colored dot + label + count
-  (`● WPA2  54`). Buckets with zero APs are hidden.
+  (`● WPA2-PSK  44`). Zero-count families are never produced (built from
+  non-zero `encCounts` keys). The legend div carries both the class and the
+  id `recon-enc-legend` — drawCharts looks it up with `getElementById`, and a
+  class-only element made the population block silently no-op.
 - Empty state unchanged: "No encryption data yet — run a scan."
 - Data source, per-scan bucketing (`reconEncBucket`), re-sync, and the 5-card
   layout are untouched. The other cards are untouched.
@@ -30,7 +37,10 @@ should be a proper ring graph with a readable key.
   callers (the recon landscape doughnut calls with `legend:false`; the enc
   card switches to `legend:false` since HTML legend replaces it).
 - `views.js`: drop `encValue`/`encSub`; build an HTML legend container
-  (`recon-enc-legend`) populated in `drawCharts` from the same `encCounts`;
-  ring drawn with `{ legend: false, height: ~120 }`.
+  (`#recon-enc-legend`) populated in `drawCharts` from the same `encCounts`;
+  ring drawn with `{ legend: false, height: ~120 }` from a shared `encSegs`
+  array (real family keys, `RECON_ENC_ORDER`-sorted, cycled colors).
 - `app.css`: `.recon-enc-legend` flex-wrap styles + dot/entry styles.
 - Ring hole stays plain (no center text).
+- On-device verification MUST assert the legend has non-empty entries
+  (class/id mismatch and the bucket-name mismatch both fail silently).