phase: 02_simulate_fetch_commands

All green. Final report:

**Phase 02 — final verification pass** (both tasks already in `.agents/phases/complete/02_simulate_fetch_commands/`)
- Verified: no `fetch(` remains in `src/` (grep exit 1) or in built `dist/*.js`
- Verified: `simulatedCurlOutput()` / `simulatedWgetOutput()` in `src/terminal-commands.js` (lines 63/73), wired into `src/terminal.js` curl/wget branches
- Verified: regression test `curl/wget are simulated — no real network request leaves the origin` in `tests/e2e/02-terminal.spec.js` — asserts simulated bodies, `web_navigator` toast + localStorage persistence, and zero non-`baseURL` requests
- Tests: `./build.sh` → OK; `npm test` → **46 passed, 0 failed** (≥46 required); `bash .agents/validate.sh` → **exit 0** (E2E + repo-hygiene gates)
- No linter configured beyond validate.sh (vanilla JS, LOCKED no-toolchain)
- Completion criteria: ①no `fetch(` ✅ ②simulators present ✅ ③regression tests present & passing ✅ ④build+test 46 green ✅ ⑤no behavior change (page/terminal/vim/achievements/menu suites all green) ✅
- Documentation: full README/AGENTS.md review — both already updated in working tree and consistent with the project (simulated curl/wget, validate.sh gate, Podman build flow vs Dockerfile, Node ≥20 matches `@playwright/test` engines, M-4 header gap correctly documented as pending Phase 03) — **verified consistent, no changes needed**
- Note: `PLAN.md` still says "44 tests" (now 46) but PLAN is locked — flagged for the harness/user, not edited
- Next pending phase: `03_nginx_security_headers`

README.md

@@ -95,6 +95,16 @@ npm install        # installs the pinned @playwright/test dev dependency
 npm test           # Playwright E2E suite against dist/ on 127.0.0.1:8123
 ```
 
+The fake terminal performs **no real network I/O**. `curl` and `wget` render
+deterministic simulated output built by `simulatedCurlOutput()` /
+`simulatedWgetOutput()` in `src/terminal-commands.js`, which echo the requested
+URL and say they are simulated (audit finding M-2, Phase 02) — add new command
+output the same canned way. The E2E suite guards this: one test records every
+request outside the test origin while running `curl` and `wget`, so a real
+network call reintroduced into `src/` fails the suite. That test derives the
+allowed origin from `baseURL` in `playwright.config.js`, so changing the port
+there needs no test edit.
+
 Always build before testing: the suite exercises the built artifact in `dist/`,
 never `src/`. `npm test` starts (or reuses) its own static server, so no manual
 server is needed. Rebuild the image (`podman build`) after changing `src/`.