fix(kb): the dj1l cases discriminate, and a replaced rule cannot silently become an add

Five findings from the second review round, and the first is this PR's own
standard applied to its own P1.

**The two fixes improvise-dj1l names had no discriminating test.** Reverting
`has_key` to unification, or dropping `canon_key` from the duplicate gate, left
kb-test at 27 passed. Case 11 was carried by `check_total` refusing with a
DIFFERENT message, and case 10 by the other half of the fix. Both now assert
which refusal fired (`said()`), plus two cases aimed at each half: a rm key with
a variable in a non-final position must be refused as ABSENT rather than
matching everything, and a keyed FACT whose key holds a variable must ADD
without excluding the siblings it would unify with. Each proved by reverting
exactly one fix and watching exactly that case fail.

**Keying a rule on its whole clause made `replace` on an edited rule silently
become `add`** -- both arms live, the stale one still firing, and `check_total`
cannot see it because `NO + NF` is correct arithmetic for an add. Reachable on
the 15 `kb_error/1` arms and the `kb_text/2` rules, so editing the check
improvise-2f97 adds is the first thing to hit it. `check_rule_replace` refuses
and names the route (rm, then add); the negative arm -- replace of a rule
present verbatim -- is tested, or the refusal would just be "replace never
works on rules".

**The `decision(` arm was dead code.** `cited_name` took the first field, and
the repo spells `decision(<ticket>, <name>)`, whose ticket id fails
`name_shaped/1` on the hyphen -- so that marker could never fire for a real
citation. A second `cited_name` clause takes the second field. All three
markers are now exercised.

Minor, from the same round: `_JS_TEST` no longer accepts `test.only`, which
disables every other test in its file, with a case asserting a heading cannot
be satisfied by one; and `node-test-test.sh`'s last case no longer duplicates
an earlier one.

Filed rather than fixed: improvise-w8ih, extracting `web/assemble.sh`'s gate so
its own absence is visible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

scripts/node-test-test.sh

@@ -101,11 +101,19 @@ run_case "an empty suite is refused" 1 "$work/suite/*.test.js"
 run_case "a describe holding a real test is not called barren" 0 \
   "$work/shapes/*.test.js"
 
-# A barren file hiding among real ones is the shape a refactor leaves: the run
-# passes, the count is healthy, and one file asserts nothing.
+# A degenerate file hiding among real ones is the shape a refactor leaves: the
+# run passes, the count is healthy, and one file asserts nothing. node's TAP
+# does not attribute a passing test to its file, so a whole-run count cannot
+# see either of these -- which is why the guard runs one file at a time.
 run_case "a barren file among passing ones is still named" 1 \
   "$work/tests/green.test.js" "$work/empty/nothing.test.js"
 
+run_case "a skip-only file among passing ones is still named" 1 \
+  "$work/tests/green.test.js" "$work/skipped/skipped.test.js"
+
+run_case "a todo-only file among passing ones is still named" 1 \
+  "$work/tests/green.test.js" "$work/todo/todo.test.js"
+
 # Two globs where the SECOND dies is the shape a directory move makes: the
 # first still matches, so a check over the union would pass.
 run_case "one dead pattern among several is refused" 1 \
@@ -114,9 +122,10 @@ run_case "one dead pattern among several is refused" 1 \
 run_case "no argument at all is a usage error, not a pass" 2
 
 # The literal the caller would pass if they forgot to quote AND the glob
-# matched: ordinary filenames, which expand to themselves.
+# matched: ordinary filenames, which expand to themselves -- several of them,
+# since one is what the accepted case above already passes.
 run_case "already-expanded filenames still run" 0 \
-  "$work/tests/green.test.js"
+  "$work/tests/green.test.js" "$work/shapes/shapes.test.js"
 
 printf '\nnode-test-test: %d passed, %d failed\n' "$pass" "$fail"
 [ "$fail" -eq 0 ]