feat(orders): order queue channel with atomic claim, board ORDRE column

ORDRE 59. A dispatched order used to live only in a scratch prompt file
passed through argv, so it died with the pane it was typed into. Measured
2026-08-17: one order was dispatched three times over 90 minutes before it
was worked, because the first two tabs ran something else and the order
left no trace in the receiving repo at all.

New channel `~/.claude/coord/<repo>/orders/`, beside `inbox/` and never
merged with it. The axis is authorization: inbox content is untrusted
cross-repo data that may never instruct a session (Rule 6), a dispatch
order is operator-authorized work by construction. One channel carrying
both classes would mean either mail that can instruct or orders that
cannot, so the infrastructure is reused and the channel is not.

Four one-verb engines: coord-order-send.sh (write), coord-order-inbox.sh
(read, writes nothing at all), coord-order-claim.sh (atomic claim),
coord-order-done.sh (executed with a commit pointer / --no-commit with a
reason / --return with a reason).

The claim is a rename with no check-then-act step, so of N racing sessions
exactly one finds the source and the rest get ENOENT. The test that proves
it spawns 20 claimers BARRIERED on a start flag - unbarriered children do
not race at all - and runs the identical harness against a deliberately
racy `[ -e src ] && cp && rm` as a known-negative control, which must
produce many winners. Without that control, "exactly one winner" is
indistinguishable from "the race never happened".

Channel separation is pinned structurally, not only behaviourally: no mail
script may contain the string `orders`, with a known-positive control
proving the grep can find. coord-done cannot archive an order and
coord-order-claim cannot claim a message.

board gains an ORDRE column beside INN, counted with the identical idiom
and never summed with it: INN is "others are waiting on YOU", ORDRE is
"work is waiting on this REPO". Claimed orders are excluded - the column
answers what a session can pick up. board.sh --dispatch --order-id emits a
thin starter carrying only the id and the four steps, so the order text has
exactly one home; the id is validated shell-clean and must be pending in
the target's queue.

SessionStart injects the queue as its own block below the mailbox block.
Two channels, two blocks, mail first: it carries Rule 7, and the queue
order is mail -> orders -> STATE's NESTE.

Also folds in dde392d (board prefix-match fix), which landed after the
0.26.0 bump and before any tag. v0.26.0 was never tagged, so 0.27.0 is the
release that carries all of it.

Suites: coord 220, board 237, route 69, orders 97, guard 40; npm test 11/11.
Antakelse 4 (atomic claim) and antakelse 6 (morning --plan-file --dry-run
reports 1 of 1 for the thin starter) both measured, not assumed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0134iB7ipXGgEpv9imYoVmr2

CLAUDE.md

@@ -78,10 +78,72 @@ marketplace plugin. Three components, one boundary:
   `coord-count.sh` exists for every "what is pending" question and writes
   nothing at all. Any future read-shaped feature belongs there, not in the
   read path.
+- **Order queue (`scripts/coord-order-*.sh`):** a SECOND channel beside the
+  mailbox, `~/.claude/coord/<repo>/orders/`, with four one-verb scripts —
+  `coord-order-send.sh` (write), `coord-order-inbox.sh` (read for injection),
+  `coord-order-claim.sh` (claim), `coord-order-done.sh` (terminal state).
+  Pinned by `orders-selftest.sh` (97 checks).
+
+  **It is a separate CHANNEL, not more mail, and the axis is authorization.**
+  Inbox content is untrusted cross-repo data that may never instruct a session
+  (Rule 6); a dispatch order is operator-authorized work by construction —
+  dispatch IS the operator's authorization. One channel carrying both classes
+  would mean either mail that can instruct or orders that cannot, so the
+  infrastructure is reused and the channel is not. The separation is pinned
+  STRUCTURALLY, not only behaviourally: no mail script may contain the string
+  `orders` at all (with a known-positive control proving the grep can find),
+  `coord-done` cannot archive an order, `coord-order-claim` cannot claim a
+  message. A behavioural test alone samples one case; the claim is that no
+  write path exists.
+
+  **What the queue does NOT claim is that dispatch is its only writer.**
+  `--from` redefines identity here exactly as it does in `coord-send.sh`, so
+  any session can write an order into any repo's queue. The authority rests on
+  a CONVENTION about who writes, not on enforcement, and the injected text says
+  so in those words. Asserting the guarantee instead would be this repo's
+  oldest defect class (`--reply-to` claiming "marked handled" against the call
+  rather than the world).
+
+  **The claim is a `mv` with NO check-then-act step, and the test that proves
+  it is built to be able to fail.** `rename(2)` is atomic, so of N racing
+  processes exactly one finds the source and the rest get ENOENT — the source
+  is the contended resource, not any lock. The selftest spawns 20 claimers
+  BARRIERED on a start flag, because unbarriered children do not race at all
+  (the first finishes before the second starts) and the test would go green
+  having proven nothing. It then runs the identical harness against a
+  deliberately racy `[ -e src ] && cp && rm`, which must produce MANY winners.
+  Deleting that known-negative control turns the whole section back into an
+  unmeasured assumption wearing a passing test — this is the assumption the
+  design document marked RISIKO, and the control is what closes it.
+
+  **Claimed orders stay visible in the read path.** A session that claims an
+  order and dies is the only remaining way an order can evaporate, so the
+  injection keeps showing claimed orders with their in-flight age and the
+  command that returns them. Visible-again, NOT a lease timer: nothing here
+  expires anything, and building expiry would make the engine decide that a
+  session is dead, which it cannot know.
+
+  **`--return` costs a stated reason, and so does `--no-commit`.** A return
+  with no reason is a silent drop with extra steps; a `--no-commit` with no
+  reason is "trust me" and would quietly become the cheapest way to close any
+  order. The reason is written INTO the order, so the next session that picks
+  it up sees why the last one put it down.
 - **Hook (`hooks/scripts/session-start.mjs`):** thin zero-dependency Node
   wrapper (marketplace convention: hooks are `.mjs`) that calls
-  `coord-inbox.sh` and emits the `hookSpecificOutput.additionalContext`
-  envelope. No mailbox logic lives here. Always exits 0.
+  `coord-inbox.sh` AND `coord-order-inbox.sh` and emits the
+  `hookSpecificOutput.additionalContext` envelope. No mailbox logic lives here.
+  Always exits 0.
+
+  **Two channels, two blocks, never merged, mail first.** Each engine owns the
+  words its own block is read under; concatenating them, or letting the wrapper
+  write a shared header, would put both authorization classes under one framing
+  — the exact thing the channel split exists to prevent. Mail goes above the
+  queue because the mail block carries Rule 7 and because the convention's
+  queue order is mail -> orders -> STATE's NESTE, so printing the queue first
+  would invert on the page the order the two are to be worked in. Each engine
+  is run in its own try: an order queue that stayed invisible because the
+  mailbox threw would be precisely the silent evaporation the queue exists to
+  stop.
 - **Hook (`hooks/scripts/pre-state-line-guard.mjs`):** a `PreToolUse` hook on
   `Write|Edit` that enforces the STATE.md convention's `maks ~120 linjer`
   (global CLAUDE.md; raised from `~60` by operator decision 2026-08-14 —
@@ -567,6 +629,15 @@ marketplace plugin. Three components, one boundary:
   startup command. Corollary pinned by section 13: `skills/route/SKILL.md` must
   never declare an `effort:` frontmatter field, because frontmatter overrides the
   session effort and the reading would then measure the skill, not the session.
+- **Board's ORDRE column** counts PENDING orders per repo with the identical
+  idiom as INN, and the two are never summed: INN is "others are waiting on
+  YOU" (outgoing obligation), ORDRE is "authorized work is waiting on this
+  REPO" (incoming). Claimed orders are excluded — the column answers what a
+  session can pick up, and one in flight cannot be. Bounded gap, stated rather
+  than closed: an order addressed to a mailbox with no matching directory in
+  the scanned roots is invisible here, exactly as mail to such a name is
+  invisible in INN. There is deliberately no join built for it; `coord-count.sh`
+  is the cross-check for the mail half only.
 - **Skills (`skills/coord-send/`, `skills/board/`, `skills/route/`, `skills/dispatch/`):** natural-language front
   doors mapping user intent to engine invocations. No mailbox logic lives here
   either. `board` additionally owns the *ranking* — which repo wins and why —
@@ -615,8 +686,9 @@ obligations in another repo.
   builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
   `bash scripts/coord-selftest.sh` must exit 0 (220/220),
-  `bash scripts/board-selftest.sh` must exit 0 (217/217),
-  `bash scripts/route-selftest.sh` must exit 0 (69/69) and
+  `bash scripts/board-selftest.sh` must exit 0 (237/237),
+  `bash scripts/route-selftest.sh` must exit 0 (69/69),
+  `bash scripts/orders-selftest.sh` must exit 0 (97/97) and
   `bash scripts/state-line-guard-selftest.sh` must exit 0 (40/40).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.
@@ -625,8 +697,14 @@ obligations in another repo.
 ## Commands
 
 - Test: `bash scripts/coord-selftest.sh`, `bash scripts/board-selftest.sh`,
-  `bash scripts/route-selftest.sh` and `bash scripts/state-line-guard-selftest.sh`
-  (or `npm test`, the Node wrapper around all four)
+  `bash scripts/route-selftest.sh`, `bash scripts/orders-selftest.sh` and
+  `bash scripts/state-line-guard-selftest.sh` (or `npm test`, the Node wrapper
+  around all five plus the hook tests)
+- Order queue smoke test: `CLAUDE_COORD_DIR=$(mktemp -d) bash
+  scripts/coord-order-send.sh --to smoke --from tester --subject s --message m`
+  then `CLAUDE_COORD_DIR=<same> bash scripts/coord-order-inbox.sh --repo smoke`
+  (the read path writes nothing; never run the send path against the real
+  mailbox without meaning to deliver an order)
 - Hook smoke test: `node hooks/scripts/session-start.mjs` (expects JSON on stdout)
 - State-line-guard smoke test: `echo '{"tool_name":"Write","tool_input":{"file_path":"/tmp/STATE.md","content":"x\n"}}' | node hooks/scripts/pre-state-line-guard.mjs; echo $?`
   (expects exit 0, no output — a one-line STATE.md is under the limit)