The order that carried plan steps 17-20 required this decision to be taken in
M2 rather than allowed to slide. Taken: the gate moves onto the guard, the
version floor stays as the second gate, selvsjekk keeps reporting.
Deciding argument: every skill degrades to manual paste without jobbsok-tools,
so failing closed costs a connector that does not appear, while failing open
costs untrusted text persisted through the one boundary this plugin exists to
hold.
Scoped deliberately: M2's first write (--oppdater) persists four derived
values and no untrusted byte, so it is not the trigger. Step 21 and Step 22
are, and the implementation is pinned there because it lives in files outside
this order's fence.
Co-Authored-By: Claude <claude-opus-5>