CB-WP-0014-T03: hot-seat evidenced; stage 1 open on one human check

CB-EV-0012. Stage 1, deliverable by deliverable:

  relationship-graph visualization   emitted and gated, NEVER SEEN
  drag-to-propose                    evidenced end to end
  debug inspector                    evidenced (CB-WP-0011)
  hot-seat play                      evidenced here

Hot-seat was the one closest to being claimed on the strength of the code
path existing. SeatPolicy hands every human seat a handle on one shared
Server, so turn-taking "obviously" worked — and nothing drove more than
one seat until now. The property that matters is not that two turns
happen but that the same tab, asked twice, shows two different hands.
Mutating the projection to serve P1's view to every seat turns it red.

The stage stays open on ONE named blocker rather than a vague
reservation: no browser is available to this loop, so the visualization
is evidenced only as correctly emitted. Everything testable from here has
been tested. What remains is `cb-play --serve 0`, open the URL, confirm
the table reads and a drag works. INTENT carries that note now.

The self-quoting rule from CB-EV-0011 §4 is ADOPTED: an evidence file
quotes the previous pass's final cost and never its own. CB-WP-0013
reported itself at $5.78/34 mid-flight; final is $8.26/47, under by 43%.
Four for four, always low.

Meta budget 29% [OVER] soft 25%, driven by CB-WP-0013 in a trailing three
with two cheap product passes; it was an instrument repair, which
ADR-0006 D2 exempts.

SH-1 at 347,720 [HARD] against a 300,000 ceiling. Compaction is the
remedy and this session cannot do it for itself. CB-EV-0009's standing
prediction is now live and testable for the first time in three passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/cb-play/src/hotseat.rs

@@ -426,4 +426,70 @@ mod tests {
         assert!(reply.contains("200 OK"), "{reply}");
         assert!(server.refusals().is_empty(), "{:?}", server.refusals());
     }
+
+    /// **Hot-seat**: two seats, one browser, one listener — and each seat
+    /// is shown its own hand and nobody else's.
+    ///
+    /// This is the deliverable that was closest to being claimed on the
+    /// strength of the code path existing. `SeatPolicy` gives every human
+    /// seat a handle on one shared `Server`, so turn-taking "obviously"
+    /// works; nothing drove more than one seat until this test.
+    ///
+    /// The property that matters is not that two turns happen. It is that
+    /// the *projection follows the seat* — the same tab, asked twice,
+    /// must show two different hands.
+    #[test]
+    fn two_seats_take_turns_through_one_listener_and_see_different_hands() {
+        let server = Server::bind(0).expect("bind");
+        let port = server.listener.local_addr().unwrap().port();
+        let token = server.url().rsplit("t=").next().unwrap().to_string();
+
+        let tok = token.clone();
+        let client = std::thread::spawn(move || {
+            let mut pages = Vec::new();
+            for _ in 0..2 {
+                let mut s = TcpStream::connect(("127.0.0.1", port)).expect("connect");
+                s.write_all(get(&tok).as_bytes()).expect("write");
+                let mut page = String::new();
+                let _ = s.read_to_string(&mut page);
+                pages.push(page);
+
+                let mut s = TcpStream::connect(("127.0.0.1", port)).expect("connect");
+                s.write_all(post(&tok, "down=action-ground&up=table").as_bytes())
+                    .expect("write");
+                let mut reply = String::new();
+                let _ = s.read_to_string(&mut reply);
+            }
+            pages
+        });
+
+        let state = state();
+        for seat in [0u8, 1] {
+            let choice = server
+                .next_choice(&state, PlayerId(seat), &ground_only(), false)
+                .expect("a choice");
+            assert_eq!(choice, Choice::Command(0), "seat P{}", seat + 1);
+        }
+
+        let pages = client.join().expect("client thread");
+        assert_eq!(pages.len(), 2);
+        for (i, page) in pages.iter().enumerate() {
+            let text = cb_render_html::text_of(page);
+            assert!(
+                text.contains(&format!("viewing as P{}", i + 1)),
+                "turn {i} was not served to P{}",
+                i + 1
+            );
+            // K13: exactly one open hand per page, and it is this seat's.
+            assert_eq!(
+                text.matches("cards)").count(),
+                1,
+                "turn {i} showed {} open hands",
+                text.matches("cards)").count()
+            );
+        }
+        // And the two turns were genuinely different views, not the same
+        // page served twice — which is how this test would pass vacuously.
+        assert_ne!(pages[0], pages[1], "both turns served an identical page");
+    }
 }