ADR-0009: embed quick-js; node is refused. Measured marginal cost against
the dev-toolchain graph, under the positive control:
boa_engine 896,410
rquickjs 69,985
quick-js 11,434
node 0 <- and that zero is the problem
ADR-0007 D3's acquisition rule biting its author. CI runs on rust:1.97,
which has no node, so the test would make our build fetch a JS runtime of
tens of millions of unaudited lines while scoring zero on the only
instrument that governs dependencies. A browser is exempt because a
developer has one regardless of us; a CI-installed runtime is not.
The loop is now closed: the real server serves the real page, QuickJS
runs that page's own scripts, the gesture goes over a real socket, and
the seat's Choice comes back. Before this, every link was tested and the
chain was not — a page whose JavaScript sent something else entirely
would have passed everything.
Three controls, each red for its stated reason: the JS posting a command
name instead of ids, the gesture not being delivered (EXPECT-VACUOUS),
and the token stripped from the endpoint.
A wrong assertion worth keeping: the first draft required the body not to
contain "attack". It legitimately does — action-attack is the id of an
element a finger landed on. An element may name an action; that is not
the page deciding. The real test is the shape: exactly two fields, down
and up, carrying two ids and nothing derived from them.
AND the ADR's own cost argument was wrong. It claimed 35% of AM-4b's
headroom; after landing AM-4b did not move at all. It measures
games-ground --edges normal — one package, no dev edges. Measured, the
workspace including dev edges is 725,258 lines against AM-4b's 317,021:
408,237 uncounted, MORE THAN THE TARGET ITSELF (criterion, clap,
ciborium, quick-js). The decision stands on the acquisition rule; the
affordability argument is withdrawn. Third defect in the AM-4 family.
Also fixed structurally rather than by raising a limit: `make status` had
grown past its 40-line readability gate as workplans accumulated. Closed
workplans now collapse to one line, so the report is fixed-size.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Declaration 9 of 12. Structural tier M (adds an external dependency to
the toolchain); d4 = 2, no override.
CB-EV-0010 §4 recorded that the emitted JavaScript has never run, and
that sentence is the only thing keeping INTENT stage 1 open. It was
carried for a pass on the assumption that executing it was not possible
here. node v24.11.1 is on this machine. The assumption was never
checked — the same shape as every other finding of the last three
passes: a claim carried because nobody ran the command that settles it.
Executing it does not prove the table looks right; that needs a
rendering engine and a human eye. It proves the contract ADR-0007
control 5 rests on — that the page reports raw pointer facts and
nothing else — which is currently asserted by grepping the script for
game vocabulary. Grepping for absent words is a weak proxy for "this
code cannot construct a command".
T01 is a real dependency decision, priced under ADR-0007 D3's
acquisition rule so that "it's only a dev tool" is not an automatic
pass. CI runs on rust:1.97, which has no node, so the test either
forces an install or skips — and a test that skips silently is the
harness-does-nothing class this project has found five times.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
