fix(route): close the record's drift surface and the confounded smoke test

Six follow-ups on 0d11838, three of which mattered.

The model-alias gate passed for the wrong reason: after the quoted-alias grep
it fell back to an unanchored grep for the bare word, which matches "opus"
anywhere in `claude --help` and would have reported success even if --model
stopped accepting the alias. A gate that cannot fail is worse than no gate.
Only the quoted form is matched now, and the failing aliases are named.

--last-model and --last-effort were unvalidated free text while the other two
record fields were gated. The next session READS the record back to decide
--opus-xhigh-failed, so a drifted spelling there rebuilds the exact
reader-versus-writer drift this script exists to remove, one field over. Both
are closed sets now: the row table's three model names and the verified effort
levels. That also makes the record's sanitizing dead code, so it is gone.

The skill told future sessions to write the record "every session" while
STATE documented that the effort level is not observable from inside a running
session. A session following both would have fabricated the value, and a
fabricated effort reads back later as a measurement. The skill now says: ask
the operator, and omit the record rather than guess -- explicitly including
that reading it off the previous board line measures what was PRESCRIBED, not
what was RUN.

Also: README said "seven bash scripts" (nine files, six user-facing) and its
skills badge still said 2; selftest counts updated to 50.

Verified, not assumed: the installed plugin cache at 0.9.0 contains only
board and coord-send, so route is not discoverable until a release bumps it --
the smoke test STATE had queued before release would have failed with 127 for
a reason unrelated to the skill. STATE reordered to release-then-test. The
manifest is auto_discover, so no skills array needs an entry.
check-versions.mjs is green (11 OK, 0 ERROR) with the new skill at 0.9.0.

Selftests: coord 136, board 30, route 50, node 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017peNgsxVt1BR4BTuMwiPoX

scripts/route.sh

@@ -73,7 +73,8 @@
 #   route.sh --path <v> --verification <v> --reversibility <v> --scope <v>
 #            --rationale <text> [--opus-xhigh-failed]
 #
-#   route.sh ... --last-model <name> --last-effort <level>
+#   route.sh ... --last-model <Sonnet 5|Opus 5|Fable 5>
+#                --last-effort <low|medium|high|xhigh|max>
 #                --last-completed <yes|no> --last-corrections <n>
 #
 # --opus-xhigh-failed is the ONLY way rows 5 and 6 can fire, and it means one
@@ -89,6 +90,13 @@
 # high counts on row 1 mean the cheap row is too easy to reach, systematically
 # zero on row 4 means escalation fires too readily.
 #
+# All four fields are closed sets or numbers, and required together, because the
+# NEXT session reads the record back to decide --opus-xhigh-failed. Note what
+# the caller must supply rather than infer: the effort a session ran with is not
+# observable from inside that session, and reading it back off the previous
+# board line would measure what was PRESCRIBED, not what was RUN. Omit the
+# record rather than guess - a guessed value reads back as a measurement.
+#
 # It is deliberately NOT wired to the Fable rows. Inferring "the model failed"
 # from "the session did not finish" would fire on context exhaustion and on
 # operator interrupts, which say nothing about the model. The record is
@@ -158,6 +166,18 @@ if [ "$L_SET" -eq 1 ]; then
   [ -n "$L_EFFORT" ] || die "--last-effort is required with a last-session record"
   [ -n "$L_DONE" ]   || die "--last-completed is required with a last-session record"
   [ -n "$L_CORR" ]   || die "--last-corrections is required with a last-session record"
+  # Model and effort are closed sets here, not free text. The next session READS
+  # this record back to decide --opus-xhigh-failed, so a drifted spelling
+  # ("opus 5" for "Opus 5") rebuilds the reader-versus-writer drift this whole
+  # script exists to remove, one field over.
+  case "$L_MODEL" in
+    "Sonnet 5"|"Opus 5"|"Fable 5") ;;
+    *) die "--last-model: '$L_MODEL' is not a row-table model (Sonnet 5|Opus 5|Fable 5)" ;;
+  esac
+  case "$L_EFFORT" in
+    low|medium|high|xhigh|max) ;;
+    *) die "--last-effort: '$L_EFFORT' is not a verified effort level (low|medium|high|xhigh|max)" ;;
+  esac
   case "$L_DONE" in
     yes|no) ;;
     *) die "--last-completed: unknown value '$L_DONE' (yes|no)" ;;
@@ -231,9 +251,9 @@ echo "command=$(row_cmd "$ROW")"
 echo "fallback=$(row_name "$FB")"
 echo "fallback-command=$(row_cmd "$FB")"
 echo "route-line=<!-- route: path=$PATH_T; verification=$VERIF; reversibility=$REVERS; scope=$SCOPE; rationale=$RAT_CLEAN -->"
+# No sanitizing needed on the record: all four fields are validated against
+# closed sets above, so none of them can carry a newline or a '-->'.
 if [ "$L_SET" -eq 1 ]; then
-  LM="$(printf '%s' "$L_MODEL" | tr '\r\n' '  ' | tr -d '\000-\037' | sed 's/-->/-- >/g')"
-  LE="$(printf '%s' "$L_EFFORT" | tr '\r\n' '  ' | tr -d '\000-\037' | sed 's/-->/-- >/g')"
-  echo "route-last=<!-- route-last: model=$LM; effort=$LE; completed=$L_DONE; corrections=$L_CORR -->"
+  echo "route-last=<!-- route-last: model=$L_MODEL; effort=$L_EFFORT; completed=$L_DONE; corrections=$L_CORR -->"
 fi
 exit 0