CB-WP-0014-T01/T02: execute the JavaScript — and find AM-4b blind

ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:

  boa_engine   896,410
  rquickjs      69,985
  quick-js      11,434
  node               0   <- and that zero is the problem

ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.

The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.

Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.

A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.

AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.

Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/status.py

@@ -214,14 +214,21 @@ def report():
     print(f"  branch     {branch}"
           + (f"  ({len(dirty)} uncommitted)" if dirty else "  (clean)"))
 
+    # The list grows by one line per pass forever, and this report has a
+    # length limit it is meant to keep. Collapse the fully-closed ones to
+    # a single line rather than raising the limit — the precedent is
+    # LOOP-LINT's four loadability breaches, each fixed structurally.
     print("\n  workplans")
+    closed = []
     for wid, title, status, tasks, _kind in plans:
         done = sum(1 for _, s, _ in tasks if s == "done")
         if status == "done" and done == len(tasks):
-            print(f"    {wid}  {status:<12} {done}/{len(tasks)}")
+            closed.append(wid.replace("CB-WP-", ""))
             continue
         short = (title or "")[:44]
         print(f"    {wid}  {status:<12} {done}/{len(tasks)} done   {short}")
+    if closed:
+        print(f"    {len(closed)} closed and complete: " + " ".join(closed))
 
     nxt = next_task(plans)
     if nxt: