CB-WP-0016: the drop target that was never there

Provenance (tier S, one paragraph in lieu of survey and ADR): the human
check that kept INTENT stage 1 open was run and the drag was broken.
Root cause, worth more than the instance: drop targets were ids, and an
id must be unique, so exactly one element could ever be seat-0. The
relationship-graph circle took it and the seat card that every action
card's own text points at -- 'drag Attack onto a seat' -- silently had
none. A seat is drawn twice and both drawings are the seat; the document
model could not express that.

Drop keys are now data-drop. Any number of elements may carry the same
key, so a seat is droppable on its card and on its graph node. Measured
on a live server: seat-0/1/2 each appear twice, id survives only on
cb-status which is the one element the script looks up, and
down=action-attack&up=seat-1 returns ok.

Second defect: a drop on nothing returned without posting and without
touching the status line, so a broken target was indistinguishable from
a working page. resolve already refuses rather than defaulting, which is
right; refusing SILENTLY is not. The page now reports the raw fact --
'took action-attack, let go over nothing droppable' -- which names
elements, not moves, so ADR-0007 control 5 holds.

And the honest part: the general check added here -- every offered
affordance names a key that exists, driven through Policy::choose over
four real bot games -- does NOT catch the reported defect. seat-0 did
exist, on the graph circle. It is kept because a wholly absent target is
a real class, and paired with a targeted regression test that does catch
it. Three mutations, each red for its stated reason, including the
reported defect reintroduced; only the targeted test fires on that one.

A cb-play assertion matched id="action-ground" as a substring while
describing itself as checking the page; rewritten through drop_keys.

make all exits 0. Stage 1 stays open: verified by tests, mutation and a
live server, not by a human dragging.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

INTENT.md

@@ -64,11 +64,14 @@ game.
    and scenario tests, simple bots. No rendering, no physics.
 1. **Inspectable 2D table** — card/token/hand/relationship-graph
    visualization, drag-to-propose, debug inspector, hot-seat play.
-   *Open on one human verification (CB-EV-0012 §4): the inspector,
-   drag-to-propose and hot-seat play are evidenced by executing code;
-   the visualization is evidenced only as correctly emitted, because no
-   browser is available to the loop. Run `cb-play --serve 0`, open the
-   printed URL, and confirm the table reads and a drag works.*
+   *Open on one human verification. The first run of it (2026-08-02)
+   found the table legible and the drag **broken**: drop targets were
+   `id`s, an `id` must be unique, so the relationship-graph circle held
+   `seat-0` and the seat card the page points at had none. Fixed in
+   CB-WP-0016 — drop keys are `data-drop` — and verified by tests, by
+   mutation, and against a live server, but **not** by a human dragging,
+   which is the standard that found it. Run `cb-play --serve 0`, open the
+   printed URL, and drag an action onto a seat card.*
 2. **Physical 3D tabletop** — wgpu renderer, Rapier-backed physics, camera
    and pointer controls, snap zones, asset importer.
 3. **Networked sessions** — authoritative host, private projections,