[lagarcia38]

Summary

• Replace the cropped rack image with the complete facility-rack photo supplied for the tutorial and show it without cropping.
• Add an interactive false-level question after the 42-sample replay. It distinguishes the recorded PLC response from the independent process evidence that would be needed to evaluate a spoofing claim.
• State clearly that no attack was run in the October 10 capture and that the added question is hypothetical.

Verification

• npm run lint -- --quiet
• npx tsc --noEmit
• npm run build
• Browser check of the image, replay controls, and question feedback.

The downloadable teaching CSV and underlying 42-sample trace are unchanged.