fix: a click target wearing a drag affordance made the controls look dead

Tier S (a fix inside a boundary; chaos d8=7 from the previous roll stands
for this continuation). Two observations from play that are ONE defect.

`play again`, `end session`, `pass` and the move buttons carried `.pick`,
which is cursor:grab. The stylesheet has .btn{cursor:pointer} BEFORE
.pick{cursor:grab}, so grab won.

A GRAB CURSOR INVITES A DRAG. A drag released over nothing posts nothing,
so the player picked up the button, let go, and the page did nothing. It
looked dead because the affordance told them to do the one thing that does
not work. Reported as two separate things -- "the button shows a hand to
pick up that it probably shouldn't" and "I can't start another game or
stop the server" -- and the first causes the second.

The click path itself was never broken: driving again->again and
done->done through the JS harness posts correctly. The logic was fine and
the invitation was wrong.

Click targets now carry `.tap` -- pointer cursor, same press affordance.
This extends CB-WP-0017's rule (interactive and inert must not look
identical) to: click and drag must not look identical either. The test
asserts both directions, because checking only that buttons lost `.pick`
would pass for a page with no affordances at all.

Registered F20 (applied) and F21.

F21 IS THE ONE I COULD NOT REPRODUCE: dragging did not work until after
the first note was saved. Ruled out the plausible mechanisms -- the
gesture logic posts correctly against the served page, the drag ghost
carries pointer-events:none so it cannot intercept the drop, and the
markup is identical before and after since the 303 re-renders the same
page from the same state. Remaining candidates are a <details> toggle
shifting layout mid-drag, a first-load timing difference, or browser-level
pointer capture. Reproducing it needs a browser, which no test here has --
the same gap F19 named. Recorded as unreproduced rather than given a
speculative fix.

And the fourth observation is confirmation, not a bug: "drawing my cards
from the deck is not implemented, I did not need to do that" is exactly
what CB-WP-0028 T04 determined and deliberately did not build. It is the
first evidence that importing the card text closed the comprehension gap
that produced the earlier click-the-deck request.

make all: exit 0. 62 render tests, 26 cb-play.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

specs/FindingRegister.md

@@ -47,6 +47,8 @@ kinds, states and metrics: [`GameDesign.md`](GameDesign.md). Reported by
 | F17 | degenerate | note | — | — | 2026-08-06 | ground-game |
 | F18 | inert | raised | — | — | 2026-08-06 | clay-borg |
 | F19 | degenerate | applied | crates/cb-render-html/src/lib.rs::overhead_table | counterexample | 2026-08-06 | clay-borg |
+| F20 | inert | applied | crates/cb-render-html/src/lib.rs::ending_page | counterexample | 2026-08-06 | clay-borg |
+| F21 | degenerate | note | — | — | 2026-08-06 | clay-borg |
 
 <!-- design-register:end -->
 
@@ -76,6 +78,28 @@ kinds, states and metrics: [`GameDesign.md`](GameDesign.md). Reported by
   since GROUND-WP-0005 is blocked on exactly this number. The withdrawal
   was reported (ADR-0012 D5). Its reproduction is `difficulty.rs`, whose
   policy panel is plural *because of this finding*.
+- **F21 — dragging did not work until after the first note was saved.**
+  Reported 2026-08-06: *"I could not drag and drop at the beginning but
+  after I added the first comment it worked."* **`note`, and I could not
+  reproduce it.** The gesture logic is correct against the served page
+  (the JS harness posts properly), the ghost carries `pointer-events:none`
+  so it cannot intercept the drop, and the markup is identical before and
+  after the note — the 303 re-renders the same page from the same state.
+  **Candidates, none confirmed:** a `<details>` toggle inside an action
+  card shifting the layout mid-drag; a first-load timing difference; or a
+  browser-level pointer capture. **Reproducing it needs a browser, which
+  no test here has** — the same gap F19 named. Recorded rather than
+  guessed at.
+- **F20 — a click target wearing a drag affordance made the ending
+  controls look dead.** `play again`, `end session`, `pass` and the move
+  buttons carried `.pick`, which is `cursor:grab`. A grab cursor invites a
+  **drag**, and a drag released over nothing posts nothing — so the button
+  did nothing and appeared broken. Reported as two separate observations
+  (*"the button shows a hand to pick up that it probably shouldn't"* and
+  *"I can't start another game or stop the server"*) which are one defect.
+  **`applied`**: click targets now carry `.tap`. **This extends CB-WP-0017's
+  rule** — interactive and inert must not look identical — to *click and
+  drag must not look identical either*.
 - **F19 — the engine shipped a table nobody could play on, and every gate
   was green.** CB-WP-0028's overhead view was 620px tall, so the action
   cards sat a screen below the Problems; dragging between them was