fix(newos4): pipe stage quoting, maintain ordering, help cost row, plan status (v4.6.131)

Four items closed in one batch; three ran as parallel subagents on disjoint files, the bundle was
rebuilt once by the parent (rebuild-bundles.py serialises the working tree, which carries other
sessions' work — see 161372f).

1. PIPE STAGES KEEP THEIR QUOTES. `js "a b".length | wc -c` reached eval as `a b.length` and printed
   a ReferenceError. terminal.js executePipeChain() now keeps `stages[i]` aligned 1:1 with
   `pipeParts[i]` (the `.filter(argv => argv.length > 0)` shifted the index; replaced by a lastStage
   scan + `if (argv.length === 0) continue`) and forwards the stage's own text to the dispatcher.
   The core path alone was dead code: ShellModule.init() replaces terminal.executePipeChain
   (shell.js:144), and that override is what runs in the browser (`executePipeChain.toString()`
   contained `cmdText.split`, not `lastStage`). Both now pass `cmdText`/`pipeParts[i]`.
   test-pipe-guard.js was rewritten for the new shape and now also asserts the shell override
   forwards raw text — the assertion that would have caught the shadowing. RED on HEAD: both flags
   false; GREEN now.

2. MAINTENANCE --fix CAN CLEAR ITS OWN WARN. check_index() ran before check_atlas(), which is what
   regenerates course/atlas.json, so --fix rebuilt modules-index.json from the stale atlas and the
   same WARN reappeared every run. check_atlas() now runs immediately before check_index().
   modules-index.json regenerated: cost/usage present, 349 commands, version 2026-10-29-atlas.

3. `cost` DOCUMENTED. modules/core/module-billing.js registers `cost [on|off]` (an alias of `usage`);
   help.html had no row. Added above the `usage` row. help coverage 362/363 -> 363/363.

4. SHIPPED PLANS STOP ASKING FOR A DECISION. The applier only flips review<->safe, so every executed
   review-gated plan kept counting as an open decision (5 of 5). newos4-feedback-collect.py now reads
   the body: a `## Status` / `## Implementation` heading followed by shipped|executed plus a version,
   commit or date is `status: done`; those stay in `plans` (visible as shipped) but leave
   plans_review and awaiting_decision. Counts: plans_review 5 -> 0, awaiting_decision 4 -> 1
   (the remaining one is a real open report, RPT-20261027-160751).
   admin/feedback.html read `it.status[0]`, which would render `d` for a string status; it now
   prefers `status_lines[0]`.

Also carried, authored by earlier uncommitted sessions and already live in the bundle (attributed,
not silently absorbed): modules/core/module-billing.js (new, BillingModule: cost/usage),
its CORE_FILES entry in scripts/rebuild-bundles.py, and the BillingModule registry entry in
terminal.js. The bundle was rebuilt from HEAD + this batch with ollama-manager.js taken from HEAD,
so another session's in-flight `_httpError` refactor is deliberately NOT in the shipped bundle
(grep -c _httpError core-bundle.js = 0).

Verification
  node modules/test/test-pipe-guard.js   -> {"empty":[],"blank":[],"classifyGuarded":true,"pipeGuarded":true,"shellForwardsRaw":true}
  node modules/test/test-parse-args.js   -> 28/28 pass
  maintained job                          -> node tests 21/21 pass
  scripts/newos4-maintain.py             -> maintenance result: OK (modules-index 349, help 363/363,
                                            changelog current v4.6.131)
  live v4.6.131 (real DOM, no print monkey-patch):
    js "a b".length | wc -c   -> 1        (js printed 3, one byte)
    js "a b".length           -> 3
    js "abc".toUpperCase()    -> ABC
    echo "two words"          -> two words
    node -e "import('fs')"    -> red error + Node-builtin hint
    js 6*7                    -> 42
    unhandledrejection        -> 0
  livePipeImpl: shell-override, livePipeForwardsRaw: true, costRegistered: true

1 files changed, 35 insertions, 3 deletions

diff --git a/scripts/newos4-feedback-collect.py b/scripts/newos4-feedback-collect.py
index c0711d9..5e173a1 100755
--- a/scripts/newos4-feedback-collect.py
+++ b/scripts/newos4-feedback-collect.py
@@ -19,6 +19,28 @@ APPLIED = os.path.join(ROOT, 'spaces/newos4/data/feedback/applied.json')   # led
 NETFAIL = os.path.join(ROOT, 'spaces/newos4/data/debug/network_failures.json')  # ingest-filter counter
 AUTOREVIEW = os.path.join(ROOT, 'spaces/newos4/data/feedback/autoreview-latest.json')
 
+# A finished plan keeps its '<!-- autonomy: review -->' marker (the applier only flips
+# review<->safe), so the marker alone overstates the queue. The body is the evidence: a Status /
+# Implementation heading followed by 'shipped'/'executed' plus a version, a commit ref or a dated
+# stamp. Order-free on purpose — "executed 2026-10-26" and "shipped v4.6.128 (75c5113)" both count.
+STAMP_WORD = re.compile(r'(?i)\b(?:shipped|executed)\b')
+STAMP_REF = re.compile(r'\b(?:[vV]\d+\.\d+(?:\.\d+)?|[0-9a-f]{7,40}|20\d\d-\d\d-\d\d)\b')
+
+
+def execution_stamp(lines):
+    """True when a Status/Implementation heading carries an execution stamp.
+
+    Looks at the heading plus the ~8 lines under it. Truncated or empty files simply fail the
+    test; this never raises.
+    """
+    for i, line in enumerate(lines):
+        if not (line.startswith('## Status') or line.startswith('## Implementation')):
+            continue
+        block = '\n'.join(lines[i:i + 9])
+        if STAMP_WORD.search(block) and STAMP_REF.search(block):
+            return True
+    return False
+
 
 def load(path, default):
     try:
@@ -74,12 +96,17 @@ def plans_needing_decision(dec):
         excerpt = '\n'.join(lines[:60])[:2400]
         tasks = [l.lstrip('#').strip() for l in lines if re.match(r'^#{2,3}\s+Task\b', l)][:20]
         status = [l.strip() for l in lines if l.startswith('## Status') or l.startswith('## Implementation')][:2]
+        done = execution_stamp(lines)
         d = dec.get('plan:' + name, {})
         items.append({
             'id': 'plan:' + name, 'kind': 'plan', 'title': title, 'path': p,
             'size': os.path.getsize(p), 'mtime': datetime.fromtimestamp(
                 os.path.getmtime(p), timezone.utc).isoformat(timespec='seconds'),
-            'excerpt': excerpt, 'tasks': tasks, 'status': status,
+            'excerpt': excerpt, 'tasks': tasks,
+            # 'done' when the body records the execution; otherwise the raw heading lines, as before.
+            # Done plans stay in this list so the page can show them as shipped, but they no longer
+            # count as a pending review — see the plans_review count in main().
+            'status': 'done' if done else status, 'status_lines': status,
             'decision': d.get('decision'), 'decided_at': d.get('decided_at') or d.get('ts'),
             'note': d.get('note', ''), 'actor': d.get('actor', ''),
         })
@@ -133,7 +160,9 @@ def main():
     triage = load(TRIAGE, {}) or {}
     plans = plans_needing_decision(dec)
     reports = reports_needing_decision(dec)
-    awaiting = [x for x in plans + reports if not x.get('decision')]
+    # A plan whose body records its execution is shipped, not pending: it stays in `plans` (so the
+    # page can show it) but must not sit in the operator's "awaiting a decision" queue.
+    awaiting = [x for x in plans + reports if not x.get('decision') and x.get('status') != 'done']
     net = load(NETFAIL, {}) or {}
     net_top = sorted(((net.get('by_source') or {}) if isinstance(net.get('by_source'), dict) else {}).items(),
                      key=lambda kv: -int(kv[1]))[:3]
@@ -142,7 +171,10 @@ def main():
                              'top': [[str(k), int(v)] for k, v in net_top]},
         'generated_at': datetime.now(timezone.utc).isoformat(timespec='seconds'),
         'counts': {
-            'plans_review': len(plans), 'reports_total': len(reports),
+            # Only plans still awaiting a decision: a review marker whose body already records the
+            # execution is a shipped plan, not an open question. It stays in 'plans' below.
+            'plans_review': sum(1 for p in plans if p.get('status') != 'done'),
+            'reports_total': len(reports),
             'awaiting_decision': len(awaiting),
             'steering_pending': len(steer) if steer_ok else -1,   # -1 = steering.json unreadable/wrong shape
             'triage_reports_new': (triage.get('counts') or {}).get('reports_new', 0),