CB-WP-0017: legible interaction, and the chaos window's verdict

Provenance (tier M, structural S, chaos d4=4 -> OVERRIDE drawn M):
the maintainer could drag after CB-WP-0016 but could not tell what was
pickable, held, or droppable. Underneath that, the page was WRONG about
which moves exist: 9 legal commands rendered as 5 cards each claiming
all three target kinds, from a const string in the emitter. Investigate
is legal on problems 2 and 3 but not 1; Solve on 1 but not 2 or 3. The
live page now says 'Solve onto problem 1'.

ADR-0010 restates control 5, which this work would otherwise have
outgrown in silence: every game fact the page acts on must arrive from
Rust as data; the script may read, match and render it, never compute,
infer, filter or default one. The survey's real finding is that the
permitted and forbidden designs are indistinguishable from outside, so
the vocabulary grep is demoted to a cheap first line and two behavioural
properties become the controls -- the highlighted set EQUALS the set
Rust emitted, and anything the page marks legal must resolve. Both
mutation-proven; the derive-legality mutation produces a plausible
highlight (seat-0,1,2 where only seat-1 is legal) and is caught.

Visible now: .pick resting shadow, .held on the grabbed element, .dropok
on every legal target including BOTH drawings of a seat, and a ghost
following the pointer. Nothing perceptual is verified and ADR-0010 D5
says so.

The DOM stub now models classList/querySelectorAll/createElement and
builds its node set from the real emitted page. Trap recorded: QuickJS
fixes its stack limit at Context creation relative to that frame, so a
helper returning a Context makes every later eval report
'SyntaxError: stack overflow'.

CHAOS WINDOW CLOSED, 12 declarations, 2 overrides, one each way. Both
changed the outcome, so the retirement condition is not met. Verdict:
keep, and recommend d4 -> d8 with a second window of 12 -- that is a
change to the loop's own constraints and is owed to the next declaration
as tier-M work, not made here.

CB-EV-0014 corrected: it quoted CB-WP-0015 at $15.14/136 and called it
the first settled figure quoted. Now $22.70/166. The number had been
read during CB-WP-0015 itself, so there are two defects -- the boundary,
and quoting from memory instead of re-running the instrument.

make all exits 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crates/cb-render-html/src/lib.rs

@@ -467,6 +467,69 @@ mod affordances {
         assert!(n >= 50, "checked only {n} decision point(s)");
     }
 
+    /// **ADR-0010 Decision 2, property 2.** A target the page marks legal
+    /// must resolve.
+    ///
+    /// If the page can advertise a drop that Rust then refuses, the two
+    /// have drifted and the highlighting is *worse* than none — it teaches
+    /// the player something false. This walks real games and checks the
+    /// emitted `data-targets` against `resolve` itself, so the page's
+    /// promise and the referee's answer cannot disagree.
+    #[test]
+    fn everything_the_page_advertises_actually_resolves() {
+        let checked = Rc::new(RefCell::new(0usize));
+        for seed in 0..4u64 {
+            let mut policies: Vec<Box<dyn Policy>> = (0..3)
+                .map(|i| {
+                    Box::new(AdvertisedPolicy {
+                        inner: RandomPolicy::new(seed * 7 + i),
+                        checked: checked.clone(),
+                    }) as Box<dyn Policy>
+                })
+                .collect();
+            play(fresh(seed), &mut policies).expect("a bot game completes");
+        }
+        let n = *checked.borrow();
+        assert!(n >= 50, "checked only {n} advertised target(s)");
+    }
+
+    struct AdvertisedPolicy {
+        inner: RandomPolicy,
+        checked: Rc<RefCell<usize>>,
+    }
+
+    impl Policy for AdvertisedPolicy {
+        fn name(&self) -> &'static str {
+            "advertised-target-checking"
+        }
+
+        fn choose(
+            &mut self,
+            state: &GroundState,
+            seat: PlayerId,
+            legal: &[GroundCommand],
+            may_pass: bool,
+        ) -> Choice {
+            let view = state.project(Viewer::Player(seat));
+            let html = doc::document(&view, legal, "/command?t=x", Some(seat), may_pass);
+
+            for (grab, targets) in crate::jsrun::droppables(&html) {
+                let Some(spec) = targets else { continue };
+                for drop in spec.split(' ').filter(|s| !s.is_empty()) {
+                    let fact = crate::PointerFact::new(&grab, drop);
+                    assert!(
+                        crate::resolve(&fact, legal, seat).is_ok(),
+                        "the page advertises {grab} -> {drop} but resolve refuses it \
+                         (seat {seat:?}, step {:?})",
+                        state.step
+                    );
+                    *self.checked.borrow_mut() += 1;
+                }
+            }
+            self.inner.choose(state, seat, legal, may_pass)
+        }
+    }
+
     /// **The regression test for the defect actually reported**, and the
     /// reason the check above is not sufficient on its own.
     ///