fix(orders): narrow the return-reason escape so a plain arrow survives

`sed 's/--*>/-->/g; s/-->/ /g'` rewrote `->` (ONE dash) into `-->` and then
blanked it, so a reason written the way this repo writes prose - "premise ->
dead" - silently lost its arrow. The intent was only to stop a literal `-->`
from closing the trailer's HTML comment early. Replaced with a single
expression matching two-or-more dashes, `s/---*>/ /g`.

Same over-broad-escaping class as the `$`-pattern bug in
pre-state-line-guard.mjs, and invisible for the same reason: the fixture
reason had no arrow. Two checks added - a plain arrow must survive, a literal
`-->` must still be neutralised - so the escape now has both a known-positive
and a known-negative. orders 97 -> 99.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0134iB7ipXGgEpv9imYoVmr2

CLAUDE.md

@@ -82,7 +82,7 @@ marketplace plugin. Three components, one boundary:
   mailbox, `~/.claude/coord/<repo>/orders/`, with four one-verb scripts —
   `coord-order-send.sh` (write), `coord-order-inbox.sh` (read for injection),
   `coord-order-claim.sh` (claim), `coord-order-done.sh` (terminal state).
-  Pinned by `orders-selftest.sh` (97 checks).
+  Pinned by `orders-selftest.sh` (99 checks).
 
   **It is a separate CHANNEL, not more mail, and the axis is authorization.**
   Inbox content is untrusted cross-repo data that may never instruct a session
@@ -688,7 +688,7 @@ obligations in another repo.
   `bash scripts/coord-selftest.sh` must exit 0 (220/220),
   `bash scripts/board-selftest.sh` must exit 0 (237/237),
   `bash scripts/route-selftest.sh` must exit 0 (69/69),
-  `bash scripts/orders-selftest.sh` must exit 0 (97/97) and
+  `bash scripts/orders-selftest.sh` must exit 0 (99/99) and
   `bash scripts/state-line-guard-selftest.sh` must exit 0 (40/40).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.

README.md

@@ -180,7 +180,7 @@ Note that raising the inbox's priority (Rule 7) deliberately does **not** widen
     bash scripts/coord-selftest.sh              # 220 checks against a throwaway mailbox
     bash scripts/board-selftest.sh              # 237 checks against a throwaway repo tree
     bash scripts/route-selftest.sh              # 69 checks, incl. the route->board round trip
-    bash scripts/orders-selftest.sh             # 97 checks, incl. the 20-way barriered claim race
+    bash scripts/orders-selftest.sh             # 99 checks, incl. the 20-way barriered claim race
     bash scripts/state-line-guard-selftest.sh   # 40 checks, incl. the Edit replace_all projection and the ratchet
     npm test                                    # all five selftests plus the hook tests, via node --test
 

scripts/coord-order-done.sh

@@ -82,8 +82,15 @@ sanitize_field() { printf '%s' "$1" | tr '\r\n' '  ' | tr -d '\000-\037'; }
 COMMIT="$(sanitize_field "$COMMIT")"
 REASON="$(sanitize_field "$REASON")"
 # The trailer is an HTML comment, so a '-->' inside a reason would close it
-# early and leave the rest as body prose.
-REASON="$(printf '%s' "$REASON" | sed 's/--*>/-->/g; s/-->/ /g')"
+# early and leave the rest as body prose. ONE expression, not a round trip
+# through '-->': a `s/--*>/-->/g; s/-->/ /g` pair also rewrites a plain `->`
+# into `-->` and then blanks it, so a reason written the way this repo writes
+# prose ("premise -> dead") would silently lose its arrow. Same over-broad
+# escaping class as the `$`-pattern bug the state-line guard already paid for.
+# `---*>` is TWO-or-more dashes then '>', not `--*>` which is ONE-or-more and
+# therefore eats a plain `->` as well - the same over-broad match, one character
+# narrower, and the selftest carries an arrow fixture that catches it.
+REASON="$(printf '%s' "$REASON" | sed 's/---*>/ /g')"
 
 ORDERS="$COORD/$REPO/orders"
 CLAIMED="$ORDERS/claimed"

scripts/orders-selftest.sh

@@ -225,7 +225,10 @@ oid7="$(printf '%s\n' "$("$SEND" --to ret-repo --from dispatcher --subject "stal
 "$CLAIM" --repo ret-repo "$oid7" >/dev/null 2>&1
 "$ODONE" --repo ret-repo "$oid7" --return >/dev/null 2>&1; [ $? -eq 2 ]
 check "--return without --reason is refused" $?
-"$ODONE" --repo ret-repo "$oid7" --return --reason "forutsetningen er dod" >/dev/null 2>&1; [ $? -eq 0 ]
+# The reason carries a plain arrow on purpose: this repo writes prose that way
+# ("premise -> dead"), and an escape aimed at '-->' that also eats '->' would
+# silently mangle the one field whose whole value is being readable.
+"$ODONE" --repo ret-repo "$oid7" --return --reason "forutsetningen er dod -> ikke kjorbar" >/dev/null 2>&1; [ $? -eq 0 ]
 check "--return with a reason exits 0" $?
 [ -f "$CLAUDE_COORD_DIR/ret-repo/orders/$oid7.md" ]; check "returned order is pending again" $?
 [ ! -e "$CLAUDE_COORD_DIR/ret-repo/orders/claimed/$oid7.md" ]; check "returned order left orders/claimed" $?
@@ -234,6 +237,15 @@ check "returned order records the return" $?
 r7="$("$READ" --repo ret-repo)"
 printf '%s' "$r7" | grep -q "forutsetningen er dod"
 check "the return reason reaches the next session's injection" $?
+printf '%s' "$r7" | grep -q "dod -> ikke kjorbar"
+check "a plain arrow in the reason survives the comment escaping" $?
+# The escaping still has to do its actual job.
+oid7b="$(printf '%s\n' "$("$SEND" --to ret2-repo --from dispatcher --subject "s" --message "m" 2>&1)" | sed -n 's/^order-id=//p')"
+"$CLAIM" --repo ret2-repo "$oid7b" >/dev/null 2>&1
+"$ODONE" --repo ret2-repo "$oid7b" --return --reason "closes here --> and then prose" >/dev/null 2>&1
+[ "$(grep -c '^<!-- order-returned:' "$CLAUDE_COORD_DIR/ret2-repo/orders/$oid7b.md" 2>/dev/null)" -eq 1 ] &&
+  [ "$(tail -1 "$CLAUDE_COORD_DIR/ret2-repo/orders/$oid7b.md" | grep -c 'and then prose -->')" -eq 1 ]
+check "a literal --> in the reason cannot close the trailer early" $?
 "$CLAIM" --repo ret-repo "$oid7" >/dev/null 2>&1; [ $? -eq 0 ]
 check "a returned order can be claimed again" $?