fix(infra): a failed measurement must never render as a reassuring value

Tier 3, all five the same defect class (Verifiseringsloven ansikt 4): a
broken or uninstrumented query returning a positive-looking null, consumed
as a fact about the world.

F5  coord-count.sh: a mailbox root that does not exist was byte-identical
    to one where nobody has pending mail - zero lines, exit 0, silent
    stderr. Now exit 3 + a named stderr line; an existing-but-empty root
    stays a silent, clean 0. 3 rather than 2 because 2 already means "you
    called me wrong" and this means "the world you named is not there".
F14 coord-count.sh: the header promised exit 0 unconditionally while
    --exclude with no value already exited 2. Contract restated as
    0/2/3 and pinned as a check on the help TEXT.
F6  board.sh: `git status | wc -l` yields 0 lines whether the tree is
    clean or git refused to answer, so a failure printed DRT=0. Now "?",
    and BOTH awk consumers handle it - --plan's free-capacity test
    compares the field as a string against "0" (a "?" coerces to 0 in
    arithmetic and would certify an unmeasured tree as free), and the SUM
    roll-up names what it could not add.
F10 board.sh: a scan root that does not exist was skipped in silence and
    the empty scan exited 0. Bad roots are now named on stderr; exit 3
    only when NO root was scanned. A mix still exits 0 and prints the
    board. Replaces an assertion that encoded this defect as a pass.
F13 pre-state-line-guard.mjs: MAX_LINES is overridable via
    CLAUDE_STATE_MAX_LINES so the boundary is testable without hardcoding
    120 twice. An unusable value denies by name rather than falling back
    to the default - a limit that silently did not take effect is the
    same defect one layer up.

Every design choice mutation-tested; every negative check carries a
known-positive control. Section 11's first cut was vacuously green (wrong
basename + unexported fixture path) - recorded in CLAUDE.md rather than
quietly fixed, and the section now asserts its own ground truth.

Denominator measured, not estimated: coord-inbox.sh:57 and
coord-order-inbox.sh:60/64 carry the same `|| exit 0` shape and are
deliberately left alone (injection path, prose output, must never fail a
SessionStart) - stated in CLAUDE.md as a bounded gap.

Suites: coord 230->242, board 281->300, guard 40->54, route 69, orders
110, npm 11/11. Verified under system bash 3.2, not just Homebrew 5.3.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/coord-count.sh

@@ -35,7 +35,20 @@
 #   --exclude <mailbox>  omit one mailbox (the caller's own, whose inbox is
 #                        already injected in full).
 # Env: CLAUDE_COORD_DIR overrides the mailbox root.
-# Exit: always 0 - this runs at session start and must never fail one.
+# Exit: 0 = counted (zero or more mailboxes have pending mail)
+#       2 = usage error, nothing counted
+#       3 = mailbox root does not exist, nothing counted
+#
+# The header used to promise exit 0 unconditionally, on the grounds that this
+# runs at session start and must never fail one - and that was false in both
+# directions (F14). It exited 2 on a usage error already, and - worse - it exited 0 with zero lines when the mailbox root
+# was ABSENT, which is byte-identical to "no mailbox has pending mail" on every
+# channel a consumer can read (F5). board.sh consumes this TSV. That is
+# Verifiseringsloven ansikt 4: a broken query returning a positive-looking null.
+# What the old claim was protecting is kept and made precise: no state OF THE
+# MAILBOX can ever produce a nonzero exit - not an empty root, not a malformed
+# message, not an unreadable date. Only the caller (2) or a missing root (3)
+# can, and both print nothing on stdout, so neither can be mistaken for a count.
 # ASCII only, bash 3.2 safe.
 set -u
 export LC_ALL=C
@@ -56,7 +69,15 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-[ -d "$COORD" ] || exit 0
+# Not `|| exit 0`: see the F5 paragraph in the header. Status 3 rather than 2
+# because 2 is already "you called me wrong" and this is "the world you named
+# is not there" - two different repairs, and a consumer that only ever sees one
+# integer cannot tell them apart. stdout stays empty on purpose: 3 is not a
+# count of zero, it is the absence of a count.
+if [ ! -d "$COORD" ]; then
+  echo "coord-count: mailbox root does not exist: $COORD (not counted, not zero)" >&2
+  exit 3
+fi
 
 # GNU/BSD date flavor, detected once per run (not per mailbox): BSD date
 # rejects --version outright (exit nonzero, "illegal option" - measured on