14 changed files with 297 additions and 1314 deletions
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.34.0",
+  "version": "0.33.0",
  "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
  "author": {
    "name": "Kjell Tore Guttormsen"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -5,142 +5,6 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 ## [0.34.0] - 2026-09-12
 ### Changed
 - **The advisor rule is struck from the rubric: `route.sh` and `board.sh
  --dispatch` no longer emit `--advisor` at all.** It fired on two needs -
  always on the Sonnet rows, and on the Opus rows at `costly|one-way` stakes -
  and it read well. What killed it was a measurement, not a change of taste:
  of 54 dispatches the PM issued 08.-12.09, **zero** carried the flag, because
  sessions are started by hand from the model and effort rather than from the
  whole emitted line. A rule nothing honours is not a policy, and an emitted
  value nobody acts on is decoration in a field whose only job is to be
  evidence. The advisor is now what it already was in practice: an operator
  decision per session, said in one sentence in `route.sh --help`. The
  direction is the safe one for the single thing the old rule protected - the
  quota fallback is still exactly one row cheaper, it just no longer implies a
  capability lift nobody was taking.
 - **The comments that rested on it were rewritten, not left standing.**
  `board.sh --dispatch` still refuses a `--model`/`--effort` pair, but the
  reason is no longer "the advisor is a property of the ROW": it is that the
  rubric has exactly one copy, and a dispatch taking the model directly would
  be a second, unscored way to reach the same decision - one recording no
  traits, no rationale and no `next-cost`, so nothing afterwards could say
  whether the routing or the scoring was wrong. A comment defending a
  mechanism that has been removed is how the next session restores it.
  `skills/route/SKILL.md` and `skills/dispatch/SKILL.md` carry the same
  correction.
 - Pinned as an ABSENCE over the whole trait space rather than on sampled rows -
  81 trait combinations, every line of output, with a known-positive control
  proving the sweep's grep can find a planted advisor - plus `--dispatch` at
  `reversibility=costly`, the exact input a reintroduced rule would fire on.
  Backward compatibility is pinned too: a route line carrying a legacy
  `advisor=` field still parses and still yields a command (measured the same
  day: 0 of 48 `<!-- route:` lines anywhere in `~/repos` carry one, so nothing
  in circulation depends on it - but a reader that broke on an unknown field
  would turn last month's STATE.md into "that repo has no route line").
 ### Added
 - **`board.sh --row <repo>`: the table's row for one repo, as `field=value`
  lines.** A seventh rendering of the same scan, never a second scan, and
  read-only like every other one. The motivation is a measured misreading: on
  11.09 the PM read the FLY column off the table **by eye** and got it wrong.
  Every other rendering a program consumes (`--plan`, `--inbox-plan`,
  `--dispatch`) is already `key=value`; the default view was the one left out,
  and a 34-character repo key already shifts a row two characters right, which
  makes counting spaces worse than it looks. `inn`, `ordre` and `fly` are three
  separate fields because they are three separate facts, and confusing them is
  what this exists to close. `status` is the bare token, never the table's
  `blocked>target` display, with `blocked-on` beside it; `neste` is last and
  uncut, for the same reason it is last in the record. An unknown repo exits
  **2** and writes nothing to stdout - an empty block would read as a repo whose
  every column is blank, which is a real and different state.
 - `upushet=` is the one field that is **not** a rendering of the scan, and it is
  named rather than blended in: nothing in the scan measures it, so it is read
  once, for the named repo only, and never enters the table, the plan or the
  briefing. It reads the remote-TRACKING ref, not the remote, so `upushet=N`
  honestly means "the local ref says N"; a repo with no upstream reports `?`,
  never `0`, because "nothing is waiting to be pushed" and "nobody looked" are
  exactly the pair this engine refuses to render alike.
 ### Fixed
 - **README's selftest numbers were re-measured, not re-derived.** The badge said
  `selftest_checks-868` and the five `## Development` comments said
  220/360/73/99/40 = 792 - two different wrong sums on the same public surface,
  neither matching the other. The five suites were run under `/bin/bash` (3.2)
  on `b57a1ea` and reported `coord 257`, `board 393`, `route 73`, `orders 116`,
  `state-line-guard 54` = **893**, 0 failed in every summary. 0.33.0's entry
  below records 257+368+73+116+54 = 868 and was true when written; 0.33.1 added
  25 board checks (368 -> 393) without re-summing, and the comment block had been
  stale far longer. No code, no version bump: the number furthest from the meter
  rots first, and only the number moved.
 ## [0.33.1] - 2026-09-04
 ### Added
 - **A git repo nested under a depth-1 repo now enters the board, on a STATE.md
  and nothing wider.** Discovery adds a depth-1 repo and stops, and the
  else-branch container scan - the only place children are ever looked at - is
  unreachable for an entry that is itself a repo. Measured before anything was
  written: **12 nested repos across the real tree, exactly 1 with a STATE.md**
  (`from-ai-to-chitta/content-sadhguru`, which had been running work and
  reporting to nobody). The other 11 are vendored or experimental checkouts and
  stay invisible on purpose - they do not even reach the `UTEN STATE.md` bucket.
  `add_nested_repos()` sits beside `add_dot_repos()` rather than widening the
  `*` loops, for the same reason ordre `20260818T124828Z` gave for dot repos:
  routing a depth-1 repo into the container branch would admit every nested
  checkout. One level only; depth 3 is pinned as NOT admitted. A dot-prefixed
  depth-1 repo gets the same nested scan, since nothing in the criterion
  distinguishes it.
  A nested repo carries **two names**, and conflating them would have put a
  fabricated 0 in three columns. The board KEY is `<parent>/<child>`; the
  MAILBOX name is `basename(git toplevel)`, so `$COORD/<parent>/<child>/inbox`
  finds no directory and INN/ORDRE/FLY would read 0 for a repo that may have
  mail. The record loop carries `mbox` beside `name`, and `--voyage`'s order
  lookup takes `basename($vy_dir)`. Which directories are nested is RECORDED by
  discovery (`NESTED_LIST`), never re-derived from "is my parent a repo?".
 - **The scan reports its own denominator.** `undersoekt: N katalog(er) depth 1,
  M polyrepo-container(e), K nestede repo (J med STATE.md tatt med).` The header
  count answered how many repos were found and nothing about how many were
  looked at, so a criterion excluding 11 of 12 nested repos was invisible on the
  surface built to show it. Real tree 2026-09-04: `43 / 5 / 12 (1 tatt med)`. A
  non-repo dot-directory counts in N and never in M - the line is a denominator,
  not a partition.
 ### Fixed
 - The denominator line's own wording broke an existing check: `polyrepo
  container itself is not listed as a repo` grepped the whole output for
  `polyrepo` and matched the new footer's `polyrepo-container(e)` - the same
  class as a grep reading a comment that EXPLAINS a pattern as an instance of
  it. Now anchored at column 1, which is what it always meant.
 ### Known gaps, stated rather than closed
 - The mailbox-keyed JOINs (`$OWED`, `brief_orphans`, `--inbox-plan`) still key
  on the board name, so a nested repo owing a reply gets no debt tab and is
  listed under `UTENFOR REPO-SKANNEN`. Neither created nor worsened here: before
  this change the repo was absent from `RECORDS` entirely, so both readings were
  already exactly as wrong.
 - A 34-character key overflows the table's `%-32s` REPO column, shifting that
  row two characters right. Same class as `Fable 5.1/xhigh` in KOST; parsing is
  unaffected, and widening the column moves three `cut -c89-` selftest helpers.
 - A dot-prefixed NESTED repo is not looked for. The combination was neither
  measured nor ordered.
 ### Testing
 - `board-selftest.sh` 368 -> 393 checks.
 ## [0.33.0] - 2026-09-04
 ### Added
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -467,7 +467,7 @@ marketplace plugin. Three components, one boundary:
 - **Board (`scripts/board.sh`):** cross-repo attention board. Reads STATE.md
  next-step blocks + board lines, `git status`, and mailbox pending counts, and
  prints one line per repo. Read-only by construction: it writes to no repo, no
-  STATE.md and no mailbox. Pinned by `board-selftest.sh` (427 checks).
+  STATE.md and no mailbox. Pinned by `board-selftest.sh` (368 checks).
  **It lives here because the mailbox is one of its three inputs, and it carries
  the same axis distinction the mailbox does.** A pending count means *others
@ -639,17 +639,13 @@ marketplace plugin. Three components, one boundary:
  `brief-nightly.sh` already carries for the briefing.
  **The cost comes from `route.sh`'s row table, and `--dispatch` deliberately
-  refuses a `--model`/`--effort` pair.** Until 2026-09-12 that rested on
+  refuses a `--model`/`--effort` pair.** `--advisor opus` is a property of the
-  `--advisor opus` being a property of the ROW; that rule is struck (see
+  ROW; two rows share a model/effort pair while differing on it, and the CLI
-  `route.sh` above) and the argument was REWRITTEN rather than left standing on
+  accepts a wrong advisor silently. A dispatch taking the model directly would
-  a premise the code no longer has — a comment defending a removed mechanism is
+  have no honest source for that flag, and both available guesses produce the
-  how the next session restores it. The reason now: the rubric is a policy with
+  same failure — a session that looks peer-reviewed without being. A Fable
-  exactly one copy, and a dispatch accepting the model directly would be a
+  dispatch is therefore not a `--dispatch` outcome at all, exactly as it is not
-  second, unscored way to reach the same decision — one recording no traits, no
+  a `route.sh` outcome; it is a hand-written override.
  rationale and no `next-cost`, so nothing afterwards could say whether the
  ROUTING was wrong or the SCORING was. A Fable dispatch is therefore not a
  `--dispatch` outcome at all, exactly as it is not a `route.sh` outcome; it is
  a hand-written override.
  **`--target-pane yes|no` is REQUIRED, with no default, and that is the same
  rule `--last-effort` carries.** It is a measurement of the world — does the
@ -906,101 +902,6 @@ marketplace plugin. Three components, one boundary:
  it was exactly the unmeasured side effect the order flagged, and nothing
  in `~/repos` currently needs it (`.claude` has no repo children today).
  **Ordre 20260903T190201Z-238406410 (2026-09-03, operator decision the same
  day): a git repo nested under a depth-1 REPO was invisible to the board, and
  the admission that closes it is criterion (a) - a STATE.md - never "all
  nested repos".** Discovery adds a depth-1 repo and stops; the else-branch
  container scan is the only place children are ever looked at, and it is
  unreachable for an entry that is itself a repo. Measured on the real tree
  before anything was written: **12 nested repos across the tree, exactly 1
  with a STATE.md** (`from-ai-to-chitta/content-sadhguru`, which had been
  running work and reporting to nobody). The other 11 are vendored or
  experimental checkouts under `claude-code-100x/`; the operator's decision is
  that they stay invisible ON PURPOSE - they do not even reach the `UTEN
  STATE.md` bucket, because that bucket is for repos someone opens. Verified
  after the fix with `board.sh`, not from memory:
  `from-ai-to-chitta/content-sadhguru in-progress ... Sonnet 5/high`, and
  `--plan` gives it a real tab with a `paste=` line.
  **`add_nested_repos()` beside `add_dot_repos()`, never a widening of the `*`
  loops - the same argument ordre 20260818T124828Z made for dot repos, and the
  order made it again before this repo wrote a line.** Routing a depth-1 repo
  into the container branch would admit every nested checkout, which is exactly
  what criterion (a) declines. One level only: a repo inside a nested repo is a
  checkout of a checkout, and the selftest pins that depth 3 is NOT admitted. A
  dot-prefixed depth-1 repo gets the same nested scan an ordinary one gets
  (`add_dot_repos` takes a `d1` flag for it) - the asymmetry would otherwise be
  arbitrary, and nothing in the criterion distinguishes them.
  **A nested repo now has TWO names, and conflating them would have put a
  fabricated 0 in three columns.** The board KEY is `<parent>/<child>` as the
  order specifies - a bare basename says nothing about where the checkout lives
  and would collide with a same-named depth-1 repo. The MAILBOX name is not
  that key: a mailbox is addressed by `basename(git toplevel)`, which is
  `coord-send.sh`'s own rule and the only name a session in that repo can hold,
  so `$COORD/<parent>/<child>/inbox` finds no directory and INN/ORDRE/FLY print
  0 for a repo that may have mail. That is the failed measurement wearing the
  reassuring value, in three columns at once. The record loop therefore carries
  `mbox` beside `name`, and `--voyage`'s order lookup takes `basename($vy_dir)`
  for the same reason. Mutation-verified: reverting the eight `$COORD/$mbox`
  reads to `$COORD/$name` turns exactly the three mailbox checks red with every
  other check in the section green.
  **Which nested dirs those are is RECORDED by discovery, not re-derived.** The
  obvious re-derivation ("is my parent directory a git repo?") answers a
  slightly different question and would prefix every depth-1 repo if a scan
  root ever happened to be a checkout; `NESTED_LIST` cannot drift from the
  criterion because discovery is what writes it.
  **The denominator line is independent of all of that and went in regardless,
  because the order said so and because it is ansikt 4 pointed at the board's
  own reading.** `undersoekt: N katalog(er) depth 1, M polyrepo-container(e),
  K nestede repo (J med STATE.md tatt med).` The header's repo count answers
  "how many were found"; nothing answered "how many were looked at", so a
  criterion excluding 11 of 12 nested repos was invisible at the surface built
  to show it. Real tree, 2026-09-04: `43 katalog(er) depth 1, 5
  polyrepo-container(e), 12 nestede repo (1 med STATE.md tatt med)`. A
  non-repo dot-dir counts in N (it WAS examined) and never in M (it is
  deliberately not a container - ordre 20260818's decision), so the line is a
  denominator, not a partition. Selftest section 32 pins each number against a
  fixture, then changes the tree and asserts the numbers move, so a hardcoded
  constant cannot pass.
  **The line's own wording broke an existing check, and that is the finding
  worth recording.** `check "polyrepo container itself is not listed as a
  repo"` grepped the WHOLE output for `polyrepo`, so the footer's
  `polyrepo-container(e)` matched and the check went red on a board that was
  behaving correctly - the same defect class as coord-selftest section 38's
  cache grep reading a comment that EXPLAINS a pattern as an instance of it,
  and as the done-guard's rule that prose saying `status=done` must not trigger
  it. The check is now anchored at column 1, which is what it always meant: a
  container has no ROW.
  **Bounded gap, stated rather than closed (1): the mailbox-keyed JOINS still
  key on the board name.** `--brief`/`--plan`'s `$OWED` join, `brief_orphans`
  and `--inbox-plan` match `coord-count.sh`'s mailbox names against RECORDS
  field 3, so a nested repo owing a reply would not get a debt tab and would be
  listed under `UTENFOR REPO-SKANNEN`. This change neither creates nor worsens
  that: before it, the repo was not in RECORDS at all, so both readings were
  already exactly as wrong. Closing it means threading a mailbox key through
  six awk programs, which was not ordered and is not a discovery change.
  Reported to `.claude` for its own order.
  **Bounded gap, stated rather than closed (2): a 34-character key overflows
  the table's `%-32s` REPO column**, shifting `from-ai-to-chitta/content-sadhguru`'s
  row two characters right. Same class as `Fable 5.1/xhigh` overflowing the
  `%-14s` KOST column, and handled the same way: parsing is unaffected (every
  rendering that a driver reads is `key=value`), widening the column moves every
  fixed offset including three `cut -c89-` selftest helpers, and it is a
  rendering change nobody ordered. Truncating instead would be worse - it would
  destroy the very identity the compound key exists to carry, and break
  copy-paste into `--dispatch --repo`.
  **Bounded gap, stated rather than closed (3):** a DOT-prefixed *nested* repo
  is not looked for. The `*` glob in `add_nested_repos()` has no dotglob, the
  combination was neither measured nor ordered, and `add_dot_repos` exists for
  the depth-1 and container cases only because those were.
  **Ordre 20260820T204409Z (2026-08-20): `route_cmd_for()`'s four trait
  extractions searched the WHOLE route line, and `.*trait=` is greedy, so a
  rationale that names a trait won the match over the field itself.**
@ -1070,38 +971,23 @@ marketplace plugin. Three components, one boundary:
  and belongs to the skill; turning scores into a row is a lookup and takes zero
  model calls.
-  **NO `--advisor` is emitted, by this calculator or by `board.sh --dispatch`
+  **`--advisor opus` is emitted per ROW, on a need, never unconditionally.**
-  (operator decision 2026-09-12, `~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md`
+  Rows 1-2 always carry it (Sonnet main model, so opus is a capability lift —
-  § 4, cut row 3).** The struck rule fired per ROW on a need — always on the
+  and since every fallback is one row cheaper and the cheap rows are Sonnet,
-  Sonnet rows (a capability lift, which is what made the quota fallback safe to
+  this is what makes the quota fallback safe to take); rows 3-4 only at
-  take), and on the Opus rows at `reversibility=costly|one-way` (peer review
+  `reversibility=costly|one-way` (Opus main model, so it buys peer review where
-  where a mistake is not cheap to undo). It read well and it was killed by a
+  a mistake is not cheap to undo); rows 5-6 never, because the CLI rejects every
-  MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.–12.09, **zero**
+  advisor for a Fable main model. The alternative — the global `advisorModel`
-  carried the flag, because sessions are started by hand from the model and
+  setting written by `/advisor` — is what this replaces: it applies to every
-  effort rather than from the whole emitted line. A rule nothing honours is not
+  session in every repo, which is how it burned quota before. The two triggers
-  a policy, and an emitted value nobody acts on is decoration in a field whose
+  are almost disjoint by construction, since `costly` forces row 3 and `one-way`
-  only job is to be evidence. The advisor is now what it already was in
+  forces row 4, so a Sonnet row always has `reversibility=cheap`.
-  practice: **an operator decision per session**, said in one sentence in
+  `verification=none` is deliberately NOT a third trigger: beyond the stakes
-  `route.sh --help`.
+  rule it would only add mistakes that are cheap to reverse, docs sessions
-  The absence is pinned over the WHOLE trait space — 81 combinations, every
+  (`known/none/cheap/local`) among them. Section 14 pins the rule and gates the
-  line of output, with a known-positive control proving the sweep's grep can
+  three CLI facts it rests on against the installed `claude` without spending a
-  find a planted advisor — rather than on four sampled rows, because the claim
+  token — advisor validation runs before the empty-prompt check, so `-p ""`
-  is that no path emits it. `--dispatch` at `reversibility=costly` is pinned
+  reaches the validator and stops there.
  separately: that is the exact input a reintroduced rule would fire on.
  The three CLI gates section 14 used to carry (does `claude` accept
  `--advisor`, does it accept opus advising sonnet, does it still reject opus
  advising fable) went with the rule — they existed to gate facts the rule
  rested on, and the suite no longer depends on the installed `claude` at all.
  **The literal string `--advisor opus` is absent from `route.sh` ENTIRELY,
  including the paragraph recording what was struck** (it says "an opus advisor
  flag" in words): a blunt grep cannot tell a description from a specification,
  the same reason coord-selftest's cache assertion runs on an extracted path
  rather than the whole file. Do not restore the quote.
  Backward compatibility is pinned rather than assumed: a route line carrying a
  legacy `advisor=` field still parses and still yields a command. Measured the
  same day — **0 of 48** `<!-- route:` lines anywhere in `~/repos` carry one, so
  nothing in circulation depends on it, but a reader that broke on an unknown
  field would turn last month's STATE.md into "that repo has no route line".
  **Rows 5-6 are never a `route.sh` outcome.** Until 2026-08-06 they fired
  only from an explicit `--opus-xhigh-failed` flag, mirroring a global
@ -1417,43 +1303,6 @@ marketplace plugin. Three components, one boundary:
  phase and age and leaves the judgement to the reader, which is why 51
  projects are listed rather than some filtered subset.
 - **`--row <repo>` is the SEVENTH rendering: the table's row for ONE repo, as
  `field=value` lines** (order 20260912T202210Z-7588027378, operator decision
  2026-09-12). Same scan, never a second one, read-only like every other
  rendering. **The order calls it the sixth; by this file's own numbering
  `--inbox-plan` is the fourth and `--dispatch` the fifth, so it is the
  seventh** — corrected here rather than carried wrong.
  **It exists because the columns WERE misread.** On 2026-09-11 the PM read the
  FLY column off the table by eye and got it wrong. Every other rendering a
  program consumes (`--plan`, `--inbox-plan`, `--dispatch`) is already
  `key=value`; the default view was the one left out, and the 34-character
  nested-repo key already shifts a row two characters right (a stated, unclosed
  gap), which makes counting spaces worse than it looks. `inn`, `ordre` and
  `fly` are three separate fields because they are three separate facts, and
  confusing them is the whole reason this exists. `status` is the bare token,
  never the table's `blocked>target` display, with `blocked-on` beside it;
  `neste` is last and uncut, for the same reason it is last in the record. An
  unknown repo exits **2** and writes NOTHING to stdout — an empty block would
  read as a repo whose every column is blank, which is a real and different
  state (`?`).
  **`upushet` is the one field that is NOT a rendering of the scan, and it is
  named rather than blended in.** Nothing in the scan measures it, so it is
  read once, for the named repo only, and never enters the table, the plan or
  the briefing. It reads the remote-TRACKING ref, not the remote: `upushet=N`
  honestly means "the local ref says N", and `git ls-remote` is still what a
  claim ABOUT THE WORLD costs. A repo with no upstream reports `?`, never `0` —
  "nothing is waiting to be pushed" and "nobody looked" are exactly the pair
  this engine refuses to render alike.
  **The fixture's three counts are three DIFFERENT integers (3/2/1), and that
  is the finding worth recording.** Built first with 2/1/1, it was
  mutation-tested by making `fly` read the ORDRE field — the exact 11.09
  misreading — and the check stayed GREEN, because the two fields held the same
  digit. A fixture that cannot tell two columns apart is the defect wearing a
  passing test, inside the section written to prevent it.
 - **Skills (`skills/coord-send/`, `skills/board/`, `skills/route/`, `skills/dispatch/`):** natural-language front
  doors mapping user intent to engine invocations. No mailbox logic lives here
  either. `board` additionally owns the *ranking* — which repo wins and why —
@ -1502,7 +1351,7 @@ obligations in another repo.
  builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
  `bash scripts/coord-selftest.sh` must exit 0 (257/257),
-  `bash scripts/board-selftest.sh` must exit 0 (427/427),
+  `bash scripts/board-selftest.sh` must exit 0 (368/368),
  `bash scripts/route-selftest.sh` must exit 0 (73/73),
  `bash scripts/orders-selftest.sh` must exit 0 (116/116) and
  `bash scripts/state-line-guard-selftest.sh` must exit 0 (54/54).
@ -1520,36 +1369,6 @@ obligations in another repo.
  and re-measured after: 11 of 11 now match. Only the Install block was
  converted; converting the other 39 indented blocks was not ordered and
  would bury a two-line fix in a whole-file diff.
 - **README's selftest numbers are pinned by `tests/selftest.test.mjs`, and the
  check lives there rather than in one of the five bash suites for a measured
  reason.** The badge and the five `## Development` comments rotted twice in a
  row - 529 carried from 0.25.0, then a badge saying 868 beside comments summing
  to 792, two different wrong sums of the same fact on the same screen - because
  nothing compared them to anything. The order behind the fix
  (`20260905T053602Z-6743615726`) suggested hosting it in whichever suite
  already pins README/catalog invariants; measured before choosing, **no such
  suite exists** (`grep -ln README scripts/*selftest*.sh` returns
  `board-selftest.sh` alone, on two incidental hits - a prose comment and a
  `research/README.md` fixture). This wrapper is the only place where all five
  numbers exist at once in a run that already happens: `runSuite()` captures
  each suite's own summary line, so the truth source is the line the suite
  prints, never a re-count. A check inside one suite could see its own total but
  would have to RE-RUN the other four (**212s sequentially**, measured
  2026-09-05 under `/bin/bash` 3.2) to see theirs, and grepping `check` calls out
  of the scripts is both the second copy of the counting and a wrong one, since
  those calls sit inside loops. The badge is compared against the MEASURED sum,
  not against the five README comments - a badge agreeing with five stale
  comments is the 868-beside-792 shape one layer down - and a suite that stops
  printing a summary FAILS the check rather than being skipped, because an
  absent measurement must not read as a matching one. It adds no bash check, so
  the five counts and the 893 badge are unchanged by its arrival.
  Mutation-verified in both directions: `73 -> 74` on the route comment gives
  "README says route-selftest has 74 checks; it reported 73", `893 -> 894` on
  the badge gives "README's badge says 894 selftest checks; the five suites
  reported 893", and the restored file is 12/12 green. **Bounded gap, stated
  rather than closed:** `CLAUDE.md`'s own copies of the five counts (in this
  section, above) are NOT checked - a second surface carrying the same numbers,
  measured and left alone because widening the check to it was not ordered.
 - Conventional Commits: `type(scope): description`.
 ## Commands
@ -1557,7 +1376,7 @@ obligations in another repo.
 - Test: `bash scripts/coord-selftest.sh`, `bash scripts/board-selftest.sh`,
  `bash scripts/route-selftest.sh`, `bash scripts/orders-selftest.sh` and
  `bash scripts/state-line-guard-selftest.sh` (or `npm test`, the Node wrapper
-  around all five plus the hook tests and the README-number check)
+  around all five plus the hook tests)
 - Order queue smoke test: `CLAUDE_COORD_DIR=$(mktemp -d) bash
  scripts/coord-order-send.sh --to smoke --from tester --subject s --message m`
  then `CLAUDE_COORD_DIR=<same> bash scripts/coord-order-inbox.sh --repo smoke`
--- a/README.md
+++ b/README.md
@ -10,11 +10,11 @@ Session A in repo X leaves a message for repo Y; the next session in repo Y gets
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
-![Version](https://img.shields.io/badge/version-0.34.0-blue)
+![Version](https://img.shields.io/badge/version-0.33.0-blue)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-4-orange)
 ![CLI scripts](https://img.shields.io/badge/CLI_scripts-8-blue)
-![Selftest checks](https://img.shields.io/badge/selftest_checks-927-blue)
+![Selftest checks](https://img.shields.io/badge/selftest_checks-868-blue)
 ---
@ -86,7 +86,7 @@ The plugin ships empty: your mailbox is created lazily on first send, on your ma
 Since v0.8.0 it closes with one aggregate line about mail pending in *other* mailboxes, so an empty inbox no longer reads as "all clear" while messages sit unanswered elsewhere. Two integers, never a roster: naming the other mailboxes would put their situation inside your repo's injection, and the line explicitly disclaims the obligation it sits beneath — those counts are not yours to handle, and counting them delivered nothing.
-**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked. Discovery takes git repos at depth 1, the children of a polyrepo container, and — since 0.33.1 — a repo nested under a depth-1 repo **only when it carries a `STATE.md`**: measured on the real tree, 12 such checkouts existed and exactly 1 had one, so admitting all of them would have buried the board in vendored clones. Every run prints its own denominator (`undersoekt: N katalog(er) depth 1, M polyrepo-container(e), K nestede repo (J med STATE.md tatt med)`), because a repo count alone says how many were found and nothing about how many were looked at.
+**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked.
 The mailbox is one of its three inputs, which is why the board lives here. Note the axis: a repo's pending count means *others are waiting on it*, an obligation it owes outward. Who a repo waits *on* comes only from its own board line, because the message format has no reply-to field.
@ -115,7 +115,6 @@ Ownership is explicit rather than implied. An order is pending until a session *
    coord-sweep.sh [--write] [--days <n>] [--log <path>]                   # close aged notices machine-wide (dry-run by default)
    board.sh [--roots <dir>[,<dir>...]] [--brief|--plan] [--focus "<prose>"]  # cross-repo attention board (read-only)
    board.sh --voyage                                                        # Voyage briefs in flight (read-only)
    board.sh --row <repo>                                                    # one repo's row as field=value lines (read-only)
    board.sh --dispatch --repo <name> --order-id <id> \
             --target-pane <yes|no> --path <v> ... --rationale "<why>"     # startup command for a session in <name>
    coord-order-send.sh --to <repo> --subject "<s>" --prompt-file <abs path>  # deliver a work order into <repo>'s queue
@ -144,15 +143,13 @@ launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 **`launchctl list` proves an agent is *loaded*, never that it is *right*.** A plist naming a script that does not exist loads cleanly and then silently never runs — there is no output to be wrong and no exit status to read, so the failure looks exactly like a quiet machine. Two separate things close that: `launchctl start <label>` followed by a line appearing in `~/Library/Logs/repo-mailbox-sweep.log` is the only runtime proof the program path resolves, and `coord-selftest.sh` section 38 asserts statically, for *every* plist in `launchd/`, that the path it names is a file that exists in this repo, that the `Label` matches the filename, that the placeholders survive, and that no agent points into the version-pinned plugin cache. Note that the launchd log is not the closure log: `$CLAUDE_COORD_DIR/_sweep.log` is where the record of each closed notice lives.
-**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` names the row rather than spelling the command and there must be exactly one spelling in circulation. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
+**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` alone cannot produce the advisor flag. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
 It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly at 06:00; like the sweep agent above it points at a checkout, never at the version-pinned plugin cache, and it is pinned by the same section 38 checks.
 **`board.sh --voyage` reports the Voyage briefs in flight**, a sixth rendering of the same scan. `board` reads STATE lines, which say nothing about a brief, so a programme running Voyage across several repos had no shared surface: nobody could answer which briefs were running, in what phase, and who was waiting on whom. Detection is by **property, never by directory name** — a directory holding `brief.md` or `brief.md.draft` under any of the three planning locations the convention recognises (`.claude/projects/`, `docs/`, `features/<n>-<name>/`) — and it walks the **filesystem, never the git index**: a repo that gitignores `.claude/projects/` would otherwise report zero briefs while actually running one. The phase ladder measures *artifacts*, not sessions: a plan executed in a single session leaves no file behind, so `plan` is the last thing the filesystem can prove, and nothing here claims a session is alive. `brief_quality` is read out of the brief's frontmatter and an absent field reads `-`, never `complete`; a research directory that exists and holds nothing reads `0`, distinct from the `-` that means no research step was ever started. The table carries a matching `VOY` column beside `ORDRE` and `FLY` — the same class of durable filesystem fact, and never summed with them.
-**`board.sh --row <repo>` renders one repo's row as `field=value` lines**, a seventh rendering of the same scan and the only one that answers about a single repo. It exists because the table's columns *were* misread: the fixed-width view is for a human, and reading a column off it by eye is how `FLY` was read as `ORDRE` on 2026-09-11 — while every other rendering a program consumes is already `key=value`. `inn`, `ordre` and `fly` are three separate fields because they are three separate facts; `status` is the bare token rather than the table's `blocked>target` display, with `blocked-on` beside it; `neste` is last and uncut. An unknown repo exits **2** and writes nothing, because an empty block would read as a repo whose every column is blank — a real and different state. One field is deliberately *not* a rendering of the scan and is named as such: `upushet` is measured once, for that repo only, from the remote-**tracking** ref rather than the remote, so a repo with no upstream reports `?` and never `0`.
+**`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and one deterministic score decides it: `40 ×` repos released transitively, `15 ×` unhandled inbox messages, plus small bonuses for live work and for a cheap `next-cost` row. Four hard buckets preceded it and could not express "this repo owes one message and releases two others" — which is how a blocked chain's root ended up ranked *below* the repos waiting on it. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the dominant term, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
 **`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and **five ordered groups** decide it, each a lookup over a field the scan already read rather than a weighted score: (1) **chain-root credit**, most repos released first; (2) **debt**, most-owed-first, whatever the status; (3) `planned`; (4) `in-progress`; (5) `?`/`MALFORMED` — undeclared, last and labelled. Within a group, ties break on a cheap Sonnet `next-cost` row, then oldest plan first. A 0.19.0 weighted score (`40 ×` repos released, `15 ×` unhandled inbox messages) briefly stood in this spot and *could* express "this repo owes one message and releases two others" as a single number — but re-tuning those two coefficients would have silently reordered a parser living in another repo, with no test here able to hold a ranking stable for a consumer it can't see; the operator replaced it with the group order in 0.20.0 for that reason. Groups 3 and 4 are `planned` above `in-progress`, inverted from every earlier version by the same decision: turning a decision into motion is the slow step, live work is already moving. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the group that placed the repo, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
 **`--focus "<prose>"` narrows that plan to one subject, and reports what it held back.** It is the only cutoff this format has, which is why the report is a condition of the feature rather than a refinement of it: `--plan` documents that it hides nothing and labels what it cannot rank, so a silent filter would break a property already written down. The same run prints the subjects the prose resolved to, how many blocks were removed, how many `STATE.md` were searched, and — named, not counted — the repos that *mention* a resolved subject without declaring a marker line. That last class is enumerated because it is where the misses live: a repo can be a heavy participant and never have written a marker, and no string measurement finds it until the held-back population is listed. Each surviving block carries the declaration it survived on. Prose matching nothing prints the *full* plan and says so, since the phrase arrives verbatim from a person and a typo must not empty the day. The subject vocabulary is read from the scanned `STATE.md` themselves, so the "reads `STATE.md` and no other file" invariant is untouched.
@ -198,12 +195,12 @@ Note that raising the inbox's priority (Rule 7) deliberately does **not** widen
 ## Development
-    bash scripts/coord-selftest.sh              # 257 checks against a throwaway mailbox
+    bash scripts/coord-selftest.sh              # 220 checks against a throwaway mailbox
-    bash scripts/board-selftest.sh              # 427 checks against a throwaway repo tree
+    bash scripts/board-selftest.sh              # 360 checks against a throwaway repo tree
    bash scripts/route-selftest.sh              # 73 checks, incl. the route->board round trip
-    bash scripts/orders-selftest.sh             # 116 checks, incl. the 20-way barriered claim race
+    bash scripts/orders-selftest.sh             # 99 checks, incl. the 20-way barriered claim race
-    bash scripts/state-line-guard-selftest.sh   # 54 checks, incl. the Edit replace_all projection and the ratchet
+    bash scripts/state-line-guard-selftest.sh   # 40 checks, incl. the Edit replace_all projection and the ratchet
-    npm test                                    # all five selftests, the hook tests, and the README-number check
+    npm test                                    # all five selftests plus the hook tests, via node --test
 TDD is the house rule: every behavior change lands with a failing selftest check first.
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.34.0",
+  "version": "0.33.0",
  "private": true,
  "type": "module",
  "engines": {
--- a/scripts/board-selftest.sh
+++ b/scripts/board-selftest.sh
@ -244,8 +244,8 @@ for n in 1 2 3; do echo "msg" > "$CLAUDE_COORD_DIR/repo-a/inbox/2026-msg$n-from-
 echo "old" > "$CLAUDE_COORD_DIR/repo-a/archive/2026-old-from-x.md"
 # repo-owes: unhandled inbox AND a route line, so the briefing can derive the
-# EXACT startup command from the repo's own four traits instead of guessing
+# EXACT startup command - advisor flag included - from the repo's own four
-# from next-cost alone. Its NESTE runs deliberately
+# traits instead of guessing from next-cost alone. Its NESTE runs deliberately
 # past the table's 38-character column: carrying that line whole is the reason
 # the briefing exists at all.
 mkrepo "$ROOT/repo-owes"
@ -355,13 +355,7 @@ printf '%s' "$OUT" | grep -q 'repo-a'; check "discovers top-level git repo" $?
 printf '%s' "$OUT" | grep -q 'plug-x'; check "discovers nested polyrepo git repo (depth 2)" $?
 printf '%s' "$OUT" | grep -q 'repo-c'; check "lists git repo without STATE.md" $?
 printf '%s' "$OUT" | grep -q 'plain-dir'; [ $? -ne 0 ]; check "ignores non-git directory tree" $?
-# Anchored at column 1, and the anchor is load-bearing: the claim is "the
+printf '%s' "$OUT" | grep -q 'polyrepo'; [ $? -ne 0 ]; check "polyrepo container itself is not listed as a repo" $?
 # container has no ROW", and a row starts with the repo name. Unanchored, this
 # check now matches the denominator line's own word "polyrepo-container(e)" -
 # the same defect class as a file-wide grep reading a comment that EXPLAINS a
 # pattern as an instance of it (coord-selftest section 38's cache assertion,
 # and the done-guard's rule that prose saying status=done must not trigger it).
 printf '%s' "$OUT" | grep -q '^polyrepo'; [ $? -ne 0 ]; check "polyrepo container itself is not listed as a repo" $?
 # Guard the fixture itself: if git ever stops writing a .git FILE for
 # worktrees, the next two checks would pass for the wrong reason.
 [ -f "$ROOT/wt-feature/.git" ]; check "fixture: worktree .git is a FILE, not a dir" $?
@ -581,15 +575,10 @@ printf '%s' "$BRIEF" | grep -q 'check-versions'
 check "brief prints the full NESTE line, not the 38-char table excerpt" $?
 # Derived by CALLING route.sh with the repo's own four traits - deliberately
-# not spelled out in board.sh - so the rubric keeps exactly one copy.
+# not spelled out in board.sh - so the rubric keeps exactly one copy. Row 1
-printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high'
+# carries the advisor, which is what makes the quota fallback safe to take.
 printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high --advisor opus'
 check "brief derives the exact startup command from the repo's route line" $?
 # Anchored to end-of-line, because the loose grep above would pass just as
 # happily on a command that grew a flag back. The rubric emits no advisor
 # since 2026-09-12 and the briefing is a rendering of the rubric, not a
 # second policy.
 printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high$'
 check "brief's startup command ends at the effort - no advisor is appended" $?
 # The command must start its OWN line. `fold` copies its input's missing
 # trailing newline, which ran the command onto the tail of the NESTE prose and
@ -905,8 +894,8 @@ n_b="$(printf '%s\n' "$PLAN" | grep -n '^repo=repo-b$' | cut -d: -f1)"
 check "uavklart repos rank below every repo that declared a status" $?
 # The command comes from route.sh, same single copy of the rubric the briefing
-# uses.
+# uses - advisor flag included, since that is a property of the ROW.
-printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high$'
+printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
 check "plan derives the exact startup command from the repo's route line" $?
 # Both no-command causes must degrade to a marker. A bare `command=` would be
@ -937,7 +926,7 @@ check "plan prints the full NESTE line, not the 38-char table excerpt" $?
 # because they answer different questions: a driver cd's the pane itself and
 # would choke on a compound line, while the operator needs ONE thing to copy.
 # Assembling it by hand from two fields is where a tab lands in the wrong repo.
-printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high\$"
+printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high --advisor opus\$"
 check "paste= is the whole line: cd into the repo, then the startup command" $?
 printf '%s\n' "$PLAN" | grep -A7 '^repo=repo-typo$' | grep -q '^paste='; [ $? -ne 0 ]
@ -1535,7 +1524,7 @@ check "ip-repo-no-state reports 1 owed (no reply-expected: no declared)" $?
 # class=repo still derives the exact startup command from the repo's own
 # route line - same single copy of the rubric every other rendering uses.
 printf '%s\n' "$IPLAN" | grep -A8 '^repo=ip-repo-done-fyi$' \
-  | grep -q '^command=claude --model sonnet --effort high$'
+  | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
 check "class=repo block derives its command from the repo's own route line" $?
 # class=no-state and class=orphan-mailbox can never fabricate a command - ask
@ -1771,8 +1760,8 @@ d6="$("$BOARD" --roots "$ROOT" --dispatch --repo no-such-repo --prompt-file "$DS
 [ "$rc" -eq 2 ]; check "dispatch: refuses a repo the scan does not know" $?
 # Invalid traits must refuse, never degrade to a command without them: a
-# command built on three scored traits and one silently dropped one reads
+# command missing --advisor reads exactly like a row that legitimately has no
-# exactly like a fully scored decision.
+# advisor.
 d7="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path bogus --verification strong --reversibility cheap --scope local --rationale t 2>&1)"; rc=$?
 [ "$rc" -eq 2 ]; check "dispatch: refuses trait values route.sh rejects, rather than emitting a partial command" $?
@ -1794,27 +1783,18 @@ printf '%s\n' "$d8" | grep -q '^paste=cd '; check "dispatch: plan block carries
 printf '%s\n' "$d8" | grep -q "command=.*\"\$(cat $DSP)\""; check "dispatch: the command carries the prompt in argv, never bare model+effort" $?
 printf '%s\n' "$d8" | grep -q "^paste=cd $ROOT/repo-a && claude .*\"\$(cat $DSP)\""; check "dispatch: paste= is the complete one-string form, prompt included" $?
-# The cost comes from route.sh's row table and nowhere else. These two differ
+# The cost comes from route.sh's row table and nowhere else, so --advisor is a
-# ONLY in reversibility, and both land on row 3 (Opus 5/high) - so since the
+# property of the ROW. These two differ ONLY in reversibility: both land on
-# advisor rule was struck (2026-09-12) they must produce the IDENTICAL command.
+# row 3 (Opus 5/high), and only the costly one carries the advisor. A dispatch
-# costly is the case that used to add --advisor opus, which makes it the exact
+# that took --model/--effort directly would have no source for that flag at
-# input a reintroduced rule would fire on: this is the order's named red test,
+# all, and forwarding it blindly is how a session ends up looking peer-reviewed
-# not a sampled one.
+# without being.
 d9="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path known --verification strong --reversibility cheap --scope multi-file --rationale t 2>/dev/null)"
-printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3)" $?
+printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3, no advisor at cheap)" $?
 d10="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path known --verification strong --reversibility costly --scope local --rationale t 2>/dev/null)"
-printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: reversibility=costly emits NO advisor (rule struck 2026-09-12)" $?
+printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high --advisor opus "'; check "dispatch: the advisor flag follows the ROW (costly -> row 3 with advisor)" $?
 if printf '%s\n' "$d10" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "dispatch: no advisor anywhere in the costly dispatch block" "$rc"
 if printf '%s\n' "$d10 claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
 check "control: that grep does find a planted advisor" "$rc"
 # The paste line is assembled separately from command=, so it is pinned
 # separately: a flag reintroduced in only one of the two is the shape that
 # sends the operator and the driver down different paths.
 if printf '%s\n' "$d10" | grep '^paste=' | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "dispatch: the paste line carries no advisor either" "$rc"
 printf '%s\n' "$d8" | grep -q '^next-cost=Sonnet 5/high$'; check "dispatch: the row's next-cost is reported alongside the command" $?
 # --no-go stops the Go MESSAGE, not the work: the startup command - prompt in
@ -2147,7 +2127,7 @@ mkrepo "$RG_ROOT/repo-rationale-overrides"
 } > "$RG_ROOT/repo-rationale-overrides/STATE.md"
 RG_PLAN="$("$BOARD" --roots "$RG_ROOT" --plan 2>/dev/null)"
-RG_CMD='^command=claude --model sonnet --effort high$'
+RG_CMD='^command=claude --model sonnet --effort high --advisor opus$'
 printf '%s\n' "$RG_PLAN" | grep -A6 '^repo=repo-greedy-rationale$' | grep -q "$RG_CMD"
 check "route line whose rationale names all four traits still yields a command" $?
@ -3064,389 +3044,6 @@ PAOUT2="$(CLAUDE_COORD_DIR="$PACOORD" "$BOARD" --roots "$PAROOT" 2>/dev/null)"
 check "pendingage: an unparseable filename reads ?, never a fabricated 0" $?
 /bin/rm -rf "$PAROOT" "$PACOORD" 2>/dev/null
 # --- 31. Nested git repos with a STATE.md (admission a) ---------------------
 # Operator decision 2026-09-03, order 20260903T190201Z-238406410-from-.claude:
 # a git repo nested at depth 2 UNDER a directory that is itself a git repo
 # (claude-code-100x/*, from-ai-to-chitta/*) was invisible to the board - the
 # discovery loop adds a depth-1 repo and never looks inside it, and the
 # else-branch container scan is reached only when the depth-1 entry is NOT a
 # repo. Admission is criterion (a) and nothing wider: such a repo enters the
 # board ONLY when it carries a STATE.md. A nested repo without one stays
 # invisible ON PURPOSE - it does not even reach the UTEN STATE.md bucket,
 # because that bucket is for repos the operator opens, and these are vendored
 # or experimental checkouts nobody has declared a next step for. Measured on
 # the real tree the day the order was written: 12 nested repos, exactly 1 with
 # a STATE.md (from-ai-to-chitta/content-sadhguru).
 #
 # A dedicated add_nested_repos() beside add_dot_repos(), never a widening of
 # the `*` loops: the same argument ordre 20260818T124828Z made for dot repos.
 # Turning the depth-1 repo branch into a container scan would admit every
 # nested checkout, which is precisely what criterion (a) declines.
 NEST_ROOT="$(mktemp -d)"
 NEST_COORD="$(mktemp -d)"
 mk_nest_state() {
  {
    echo "# STATE - $2"
    printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
    echo "<!-- board: status=$3; blocked-on=-; next-cost=Sonnet 5/high -->"
    echo "Next step for $2."
  } > "$1/STATE.md"
 }
 # A depth-1 repo holding THREE nested repos, exactly one with a STATE.md.
 mkrepo "$NEST_ROOT/parent-repo"
 mk_nest_state "$NEST_ROOT/parent-repo" parent-repo in-progress
 mkrepo "$NEST_ROOT/parent-repo/nest-with-state"
 mk_nest_state "$NEST_ROOT/parent-repo/nest-with-state" nest-with-state planned
 mkrepo "$NEST_ROOT/parent-repo/nest-no-state-1"
 mkrepo "$NEST_ROOT/parent-repo/nest-no-state-2"
 # Known-positive control: an ordinary depth-1 repo must still be found, so a
 # green section cannot come from a fix that broke the case that already worked.
 mkrepo "$NEST_ROOT/plain-repo"
 mk_nest_state "$NEST_ROOT/plain-repo" plain-repo planned
 # Known-negative control: a depth-1 repo whose nested repos carry NO STATE.md
 # must contribute exactly zero extra rows.
 mkrepo "$NEST_ROOT/barren-parent"
 mk_nest_state "$NEST_ROOT/barren-parent" barren-parent done
 mkrepo "$NEST_ROOT/barren-parent/nest-barren"
 NEST_OUT="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 # Ground truth for the fixture itself, before anything depends on it: the
 # nested checkout really is a git repo and really does carry a STATE.md.
 [ -e "$NEST_ROOT/parent-repo/nest-with-state/.git" ] && \
  [ -f "$NEST_ROOT/parent-repo/nest-with-state/STATE.md" ]
 check "nested: ground truth - the fixture nested repo has .git AND STATE.md" $?
 [ -e "$NEST_ROOT/parent-repo/nest-no-state-1/.git" ] && \
  [ ! -f "$NEST_ROOT/parent-repo/nest-no-state-1/STATE.md" ]
 check "nested: ground truth - the excluded fixture has .git and NO STATE.md" $?
 printf '%s' "$NEST_OUT" | grep -q 'parent-repo/nest-with-state'
 check "nested: a nested repo with STATE.md is on the board, keyed <parent>/<child>" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-no-state-1'; [ $? -ne 0 ]
 check "nested: a nested repo WITHOUT STATE.md stays invisible (criterion a)" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-no-state-2'; [ $? -ne 0 ]
 check "nested: the second STATE-less nested repo is invisible too" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-barren'; [ $? -ne 0 ]
 check "nested: known-negative - a parent with no STATE-carrying child adds 0 rows" $?
 printf '%s' "$NEST_OUT" | grep -q '^plain-repo '
 check "nested: known-positive - the ordinary depth-1 repo is still found" $?
 printf '%s' "$NEST_OUT" | grep -q '(4 repo'
 check "nested: exactly one row is added (4 = parent + plain + barren + nested)" $?
 # The nested row is a repo like any other: its status comes from its OWN
 # STATE.md, not the parent's.
 printf '%s' "$NEST_OUT" | grep '^parent-repo/nest-with-state ' | grep -q 'planned'
 check "nested: the nested row reads its own STATE.md board line" $?
 printf '%s' "$NEST_OUT" | grep '^parent-repo ' | grep -q 'in-progress'
 check "nested: the parent keeps its own status (known-positive)" $?
 # The display key is <parent>/<child>; the MAILBOX name is not. A mailbox is
 # addressed by basename(git toplevel) - coord-send.sh's own rule - so a repo
 # named parent-repo/nest-with-state on the board still counts its mail under
 # <coord>/nest-with-state. Reading the compound name against $COORD would find
 # no directory and print INN 0, which is a failed measurement wearing the
 # reassuring value - the one thing this file refuses everywhere.
 mkdir -p "$NEST_COORD/nest-with-state/inbox" "$NEST_COORD/nest-with-state/orders/claimed"
 : > "$NEST_COORD/nest-with-state/inbox/20260101T000000Z-1-from-x.md"
 : > "$NEST_COORD/nest-with-state/inbox/20260101T000000Z-2-from-x.md"
 : > "$NEST_COORD/nest-with-state/orders/$(date -u +%Y%m%dT%H%M%SZ)-3-from-x.md"
 : > "$NEST_COORD/nest-with-state/orders/claimed/20260101T000000Z-4-from-x.md"
 NEST_OUT2="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 nest_cells="$(printf '%s' "$NEST_OUT2" | grep '^parent-repo/nest-with-state ' | cut -c89-)"
 # Exact values, never "not 0": before the fix the row did not exist at all, so
 # `awk '{print $1}'` on an empty string is "" - which is not "0" and would have
 # passed these two checks while measuring nothing. That is state-line-guard
 # section 11's vacuously-green defect, and it was observed here on the red run.
 [ -n "$nest_cells" ]
 check "nested: ground truth - the nested row exists before its cells are read" $?
 # A today-stamped filename, because a PENDING order's age is read from the
 # FILENAME, not the mtime (0.32.1) - a fixed 2026-01 stem would date this cell
 # to whenever the suite happens to run.
 [ "$(printf '%s' "$nest_cells" | awk '{print $1}')" = "1:0d" ]
 check "nested: ORDRE is counted under the mailbox BASENAME, not the compound key" $?
 [ "$(printf '%s' "$nest_cells" | awk '{print $2}')" = "1:0d" ]
 check "nested: FLY likewise reads <coord>/<basename>" $?
 printf '%s' "$NEST_OUT2" | grep '^parent-repo/nest-with-state ' | grep -q ' 2 '
 check "nested: INN reads the basename mailbox, never a fabricated 0" $?
 # Depth 3 is NOT admitted: the order says depth 2 under a depth-1 repo, and a
 # repo nested inside a nested repo is a checkout of a checkout. Widening was
 # not ordered, and an unmeasured widening is the defect ordre 20260818 flagged.
 mkrepo "$NEST_ROOT/parent-repo/nest-with-state/deeper"
 mk_nest_state "$NEST_ROOT/parent-repo/nest-with-state/deeper" deeper planned
 NEST_OUT3="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT3" | grep -q 'deeper'; [ $? -ne 0 ]
 check "nested: depth 3 is not admitted (one level under a depth-1 repo only)" $?
 /bin/rm -rf "$NEST_ROOT/parent-repo/nest-with-state/deeper"
 # A polyrepo container's children are UNCHANGED - their parent is not a repo,
 # so they keep their bare basename and never grow a <parent>/ prefix.
 mkdir -p "$NEST_ROOT/container-dir"
 mkrepo "$NEST_ROOT/container-dir/child-repo"
 mk_nest_state "$NEST_ROOT/container-dir/child-repo" child-repo planned
 NEST_OUT4="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT4" | grep -q '^child-repo '
 check "nested: a polyrepo container's child keeps its bare name (known-positive)" $?
 printf '%s' "$NEST_OUT4" | grep -q 'container-dir/child-repo'; [ $? -ne 0 ]
 check "nested: container children are NOT renamed to <parent>/<child>" $?
 # Same rule under a dot-prefixed depth-1 repo: it is a depth-1 repo, so its
 # STATE-carrying nested repo is admitted on exactly the same criterion. The
 # asymmetry would otherwise be arbitrary - ordinary parents scanned, dot ones
 # not - and nothing in the order distinguishes them.
 mkrepo "$NEST_ROOT/.dotparent"
 mk_nest_state "$NEST_ROOT/.dotparent" .dotparent planned
 mkrepo "$NEST_ROOT/.dotparent/dotnest"
 mk_nest_state "$NEST_ROOT/.dotparent/dotnest" dotnest planned
 NEST_OUT5="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT5" | grep -q '\.dotparent/dotnest'
 check "nested: a dot-prefixed depth-1 repo's nested repo is admitted too" $?
 /bin/rm -rf "$NEST_ROOT" "$NEST_COORD" 2>/dev/null
 # --- 32. The scan reports its own denominator -------------------------------
 # Independent of section 31 and required regardless (the order says so in as
 # many words). Verifiseringsloven ansikt 4 applied to the board's own reading:
 # a repo count alone answers "how many were found" and says nothing about how
 # many directories were LOOKED AT, so a criterion that silently excludes 11 of
 # 12 nested repos is invisible at the surface that is supposed to show it.
 # The line names all four quantities, including the excluded ones.
 DEN_ROOT="$(mktemp -d)"
 DEN_COORD="$(mktemp -d)"
 mk_den_state() {
  {
    echo "# STATE - $2"
    printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
    echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
    echo "Next step for $2."
  } > "$1/STATE.md"
 }
 # Depth-1 directories: 4 (two repos, one polyrepo container, one plain dir).
 mkrepo "$DEN_ROOT/d1-repo-a"
 mk_den_state "$DEN_ROOT/d1-repo-a" d1-repo-a
 mkrepo "$DEN_ROOT/d1-repo-b"
 mk_den_state "$DEN_ROOT/d1-repo-b" d1-repo-b
 mkdir -p "$DEN_ROOT/d1-container"
 mkrepo "$DEN_ROOT/d1-container/contained"
 mk_den_state "$DEN_ROOT/d1-container/contained" contained
 mkdir -p "$DEN_ROOT/d1-emptydir"
 # Nested repos: 3 under d1-repo-a, of which 2 carry a STATE.md.
 mkrepo "$DEN_ROOT/d1-repo-a/n1"; mk_den_state "$DEN_ROOT/d1-repo-a/n1" n1
 mkrepo "$DEN_ROOT/d1-repo-a/n2"; mk_den_state "$DEN_ROOT/d1-repo-a/n2" n2
 mkrepo "$DEN_ROOT/d1-repo-a/n3"
 DEN_OUT="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT" 2>/dev/null)"
 DEN_LINE="$(printf '%s\n' "$DEN_OUT" | grep '^undersoekt:')"
 [ -n "$DEN_LINE" ]
 check "denominator: the board prints an 'undersoekt:' line" $?
 printf '%s' "$DEN_LINE" | grep -q '4 katalog(er) depth 1'
 check "denominator: depth-1 directory count matches the fixture (4)" $?
 printf '%s' "$DEN_LINE" | grep -q '2 polyrepo-container(e)'
 check "denominator: container count matches the fixture (2: one with a repo, one empty)" $?
 printf '%s' "$DEN_LINE" | grep -q '3 nestede repo'
 check "denominator: nested-repo count matches the fixture (3)" $?
 printf '%s' "$DEN_LINE" | grep -q '2 med STATE.md tatt med'
 check "denominator: admitted-nested count matches the fixture (2 of 3)" $?
 # The line must be a real reading, not a constant: change the tree and it moves.
 mkrepo "$DEN_ROOT/d1-repo-a/n4"; mk_den_state "$DEN_ROOT/d1-repo-a/n4" n4
 DEN_OUT2="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT" 2>/dev/null)"
 printf '%s\n' "$DEN_OUT2" | grep '^undersoekt:' | grep -q '4 nestede repo (3 med STATE.md tatt med)'
 check "denominator: the counts follow the tree, they are not hardcoded" $?
 # A root that does not exist contributes nothing and must not silently inflate
 # the denominator - F10's rule, applied to the new counters.
 DEN_OUT3="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT,/nonexistent-root-$$" 2>/dev/null)"
 printf '%s\n' "$DEN_OUT3" | grep '^undersoekt:' | grep -q '4 katalog(er) depth 1'
 check "denominator: a missing scan root adds nothing to the counts" $?
 /bin/rm -rf "$DEN_ROOT" "$DEN_COORD" 2>/dev/null
 # --- 33. --row <repo>: one machine-readable line per column -----------------
 # Order 20260912T202210Z-7588027378 (.claude, operator decision 2026-09-12).
 # The motivation is a measured misreading, not a convenience: on 11.09 the PM
 # read the FLY column off the table BY EYE and got it wrong. Every other
 # rendering that a program consumes emits `key=value` for exactly that reason -
 # the table's fixed-width columns are for a human, and a 34-character repo key
 # already shifts a row two characters right (a stated, unclosed gap). A repo
 # holding a value nobody can grep is a repo whose state is read by counting
 # spaces.
 #
 # It is a RENDERING of the scan every other view already ran, never a second
 # scan - the same rule --brief has carried since it shipped. Two numbers under
 # one name, computed twice, is the defect this file names most often.
 #
 # ONE DEPARTURE, stated rather than smuggled: `upushet=` is not a column the
 # scan computes, and it is measured here, once, for the named repo only. It is
 # in the order's field list, it is exactly the kind of fact that gets misread
 # ("nothing unpushed" vs "not measured"), and measuring it for one repo in a
 # one-repo rendering is not a scan. It never enters the table, the plan or the
 # briefing.
 ROW_ROOT="$(mktemp -d)"
 ROW_COORD="$(mktemp -d)"
 mkrepo "$ROW_ROOT/row-repo"
 {
  echo "# STATE - row-repo"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=blocked; blocked-on=other-repo; next-cost=Opus 5/high -->"
  echo "<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; rationale=x -->"
  echo "The whole next step, well past the 38 characters the table column cuts at."
 } > "$ROW_ROOT/row-repo/STATE.md"
 # Mailbox fixture: 3 pending messages, 2 pending orders, 1 claimed order. The
 # three counts are deliberately three DIFFERENT integers, and that is the whole
 # design of this fixture rather than an arbitrary choice. Built first with
 # 2/1/1, it was mutation-tested by making `fly` read the ORDRE field - the
 # exact 2026-09-11 misreading this rendering exists to close - and the check
 # stayed GREEN, because the two fields held the same digit. A fixture that
 # cannot tell two columns apart is the defect wearing a passing test, in the
 # section written to prevent it. With 3/2/1 that mutation turns it red.
 mkdir -p "$ROW_COORD/row-repo/inbox" "$ROW_COORD/row-repo/orders/claimed"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101010Z-1-from-x.md"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101011Z-2-from-x.md"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101014Z-5-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/20260901T101012Z-3-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/20260901T101015Z-6-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/claimed/20260901T101013Z-4-from-x.md"
 ROW_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo 2>/dev/null)"; rc=$?
 [ "$rc" -eq 0 ]; check "row: a known repo exits 0" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^repo=row-repo$';        check "row: repo= is the board key" $?
 printf '%s\n' "$ROW_OUT" | grep -q "^dir=$ROW_ROOT/row-repo\$"; check "row: dir= is the checkout path" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^status=blocked$';       check "row: status= is the bare token, not the blocked>target display" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^blocked-on=other-repo$';check "row: blocked-on= is its own field" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^next-cost=Opus 5/high$';check "row: next-cost= survives the space and the slash" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^inn=3$';                check "row: inn= counts pending messages" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^ordre=2$';              check "row: ordre= counts pending orders" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^fly=1$';                check "row: fly= counts claimed orders" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^siste=';                check "row: siste= reports the last-commit reading" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^drt=';                  check "row: drt= reports the working-tree reading" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^upushet=';              check "row: upushet= is present" $?
 # The three counts are the whole point: FLY was misread as ORDRE, so a rendering
 # that emitted the same digit under two names would reproduce the defect it
 # exists to close.
 [ "$(printf '%s\n' "$ROW_OUT" | grep -c '^\(inn\|ordre\|fly\)=')" -eq 3 ]
 check "row: inn, ordre and fly are three separate fields" $?
 # NESTE uncut, same argument --brief has: the 38-char cut is the TABLE column's
 # property, and cutting here would make the cut string the only copy.
 printf '%s\n' "$ROW_OUT" | grep -q '^neste=.*38 characters the table column cuts at'
 check "row: neste= carries the whole line, not the table excerpt" $?
 # `neste` is free prose and may contain anything the STATE.md author wrote, so
 # it is LAST - the same rule the RECORDS line itself obeys. A consumer reading
 # field N from the end depends on it.
 [ "$(printf '%s\n' "$ROW_OUT" | tail -1 | cut -d= -f1)" = "neste" ]
 check "row: neste= is the last line" $?
 # One line per field, every line a field: a value that wrapped would be read as
 # a field name by anything grepping ^name=.
 ROW_BAD="$(printf '%s\n' "$ROW_OUT" | grep -v '^[a-z][a-z-]*=' || true)"
 [ -z "$ROW_BAD" ]; check "row: every line is a field=value line:${ROW_BAD:- clean}" $?
 # ASCII, because the row is consumed by awk/sed/grep under bash 3.2 - the same
 # constraint every other emitted block in this file carries. Asserted on a
 # fixture whose own prose is ASCII, so this measures the renderer, not the
 # STATE.md it happened to read.
 if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]'; then rc=1; else rc=0; fi
 check "row: the output is ASCII" "$rc"
 if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]x'; then rc=1; else rc=0; fi
 check "control: that ASCII grep runs at all (no match on a clean string)" "$rc"
 # A repo whose NESTE is NOT ASCII still emits one line per field. The renderer
 # cannot make the operator's Norwegian prose ASCII and must never try - the
 # field NAMES are the machine surface, the value is whatever was written.
 mkrepo "$ROW_ROOT/row-utf8"
 {
  echo "# STATE - row-utf8"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
  printf 'M\xc3\x85LT i dag: ingenting gjenst\xc3\xa5r.\n'
 } > "$ROW_ROOT/row-utf8/STATE.md"
 ROW_U="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-utf8 2>/dev/null)"
 ROW_UBAD="$(printf '%s\n' "$ROW_U" | grep -v '^[a-z][a-z-]*=' || true)"
 [ -z "$ROW_UBAD" ]; check "row: non-ASCII NESTE still yields one field per line" $?
 printf '%s\n' "$ROW_U" | grep -q '^neste=.*ingenting'
 check "row: non-ASCII NESTE is carried through, never mangled or dropped" $?
 # An unknown repo must REFUSE. Emitting an empty block would be the same defect
 # as a bare `command=`: a consumer reading ^status= would get nothing back and
 # read it as a repo with no status, which is a real and different state ("?").
 ROW_ERR="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>&1)"; rc=$?
 [ "$rc" -eq 2 ]; check "row: an unknown repo exits 2" $?
 printf '%s\n' "$ROW_ERR" | grep -q 'no-such-repo'
 check "row: the refusal names the repo it could not find" $?
 ROW_ERR_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>/dev/null)"
 [ -z "$ROW_ERR_OUT" ]; check "row: a refusal writes nothing at all to stdout" $?
 # A missing value is a usage error, not a silently empty row.
 CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row >/dev/null 2>&1
 [ $? -eq 2 ]; check "row: --row with no value exits 2" $?
 # Read-only, asserted rather than assumed: this is the one property every
 # rendering in this file shares and the one a new rendering is most likely to
 # break.
 ROW_BEFORE="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
 CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo >/dev/null 2>&1
 ROW_AFTER="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
 [ "$ROW_BEFORE" = "$ROW_AFTER" ]; check "row: writes nothing - no file added, removed or touched" $?
 # upushet: the three states must stay distinguishable. This fixture has no
 # upstream at all, so the honest answer is "not measured", never 0 - the same
 # rule DRT's ? and coord-count's exit 3 carry. A 0 here would say "nothing is
 # waiting to be pushed" about a repo that has never had a remote.
 printf '%s\n' "$ROW_OUT" | grep -q '^upushet=?$'
 check "row: a repo with no upstream reports upushet=?, never 0" $?
 # Known-positive control, and the case the field exists for: a real upstream
 # with a real unpushed commit must report the count. Without this the ? above
 # would pass on a field that can only ever say ?.
 ROW_UP="$ROW_ROOT/row-upstream"
 mkrepo "$ROW_UP"
 {
  echo "# STATE - row-upstream"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
  echo "Next step."
 } > "$ROW_UP/STATE.md"
 git -C "$ROW_UP" add -A >/dev/null 2>&1
 git -C "$ROW_UP" commit -qm "state" >/dev/null 2>&1
 ROW_BARE="$(mktemp -d)/origin.git"
 git init -q --bare "$ROW_BARE" >/dev/null 2>&1
 git -C "$ROW_UP" remote add origin "$ROW_BARE" >/dev/null 2>&1
 git -C "$ROW_UP" push -q -u origin HEAD >/dev/null 2>&1
 ROW_U0="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
 printf '%s\n' "$ROW_U0" | grep -q '^upushet=0$'
 check "row: control - an upstream with everything pushed reports upushet=0" $?
 echo "more" > "$ROW_UP/extra.txt"
 git -C "$ROW_UP" add -A >/dev/null 2>&1
 git -C "$ROW_UP" commit -qm "unpushed work" >/dev/null 2>&1
 ROW_U1="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
 printf '%s\n' "$ROW_U1" | grep -q '^upushet=1$'
 check "row: one unpushed commit reports upushet=1" $?
 # The table is UNCHANGED by all of this. --row is a rendering, so a field that
 # only exists there must not leak into the view a human reads.
 ROW_TABLE="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" 2>/dev/null)"
 if printf '%s' "$ROW_TABLE" | grep -qi 'upushet'; then rc=1; else rc=0; fi
 check "row: upushet does not leak into the table" "$rc"
 # Structural, in the shape this file already uses for "no write path exists":
 # --row must not run its own repo discovery. A second scan is the defect the
 # rendering rule exists to prevent, and a behavioural test cannot see it.
 grep -q -- '--row' "$BOARD"; check "row: board.sh actually carries the --row flag" $?
 /bin/rm -rf "$ROW_ROOT" "$ROW_COORD" 2>/dev/null
 echo ""
 echo "board-selftest: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ] || exit 1
--- a/scripts/board.sh
+++ b/scripts/board.sh
@ -80,9 +80,8 @@
 # the exact command to start a session there. The 38-char cut is the table
 # column's property, not the record's, so the briefing prints NESTE uncut. Each
 # command is derived by CALLING route.sh with that repo's own four traits -
-# next-cost alone cannot yield it, since it names the row rather than spelling
+# next-cost alone cannot yield it, since the advisor flag is a property of the
-# the command, and there must be exactly one spelling in circulation. A repo
+# ROW. A repo with no route line is told so rather than handed a guess.
 # with no route line is told so rather than handed a guess.
 #
 # --brief is still read-only: it writes nothing. The file write lives in
 # brief-nightly.sh, which renders to a temp file and renames it into place, and
@ -201,24 +200,14 @@
 #            --path P --verification V --reversibility R --scope S
 #            --rationale "why"
 #
-# Model and effort come from route.sh's row table, never from a --model/--effort
+# Model, effort and --advisor come from route.sh's row table, never from a
-# pair: the rubric has exactly one copy, and a dispatch that took the model
+# --model/--effort pair: the advisor flag is a property of the ROW, and a
-# directly would be a second, unscored way to reach the same decision.
+# dispatch that took the model directly would have no honest source for it.
 # --target-pane is a MEASUREMENT (morning --probe-panes) and has no default -
 # see the dispatch() comment for what happens when it is guessed.
 #
 # --row <repo> is a SEVENTH rendering: the table's row for ONE repo, as
 # `field=value` lines a program can grep instead of columns a human counts
 # spaces in. It exists because the columns WERE misread - FLY read as ORDRE on
 # 2026-09-11 - and because every other rendering a program consumes is already
 # key=value. It takes no position: every field is a value the scan already
 # holds, under the name its column carries, with `neste` last and uncut.
 # One exception, stated rather than blended in: `upushet` is not a column, and
 # is measured once for the named repo only. See row_one() for what it can and
 # cannot claim.
 #
 # Usage: board.sh [--roots <dir>[,<dir>...]] [--plain]
-#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage|--row <repo>]
+#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage ...]
 #                 [--focus "<prose>"]
 # Env:   CLAUDE_COORD_DIR overrides the mailbox root.
 #        BOARD_ROOTS      overrides the default scan roots.
@ -235,7 +224,6 @@ INBOX_PLAN=0
 FOCUS=""
 DISPATCH=0
 VOYAGE=0
 ROW=0; ROW_REPO=""
 D_REPO=""; D_PROMPT=""; D_PANE=""; D_ORDER=""
 D_PATH=""; D_VER=""; D_REV=""; D_SCOPE=""; D_RAT=""
@ -250,16 +238,10 @@ while [ $# -gt 0 ]; do
    # bash 3.2: `shift 2` past the end of $# is a no-op -> would loop forever.
    --roots) [ $# -ge 2 ] || { echo "board: --roots requires a value" >&2; exit 2; }
             ROOTS="$2"; shift 2 ;;
-    # Renderings of one scan, so exactly one may be selected: last wins.
+    # Four renderings of one scan, so exactly one may be selected: last wins.
-    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
+    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
-    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
+    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
-    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; ROW=0; shift ;;
+    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; shift ;;
    # One repo, one field=value line per column. Same `shift 2` guard as every
    # other value flag, for the same bash 3.2 reason - and a MISSING value is a
    # usage error rather than an empty row, since an empty row reads exactly
    # like a repo whose every column is blank.
    --row) [ $# -ge 2 ] || { echo "board: --row requires a repo name" >&2; exit 2; }
           ROW=1; ROW_REPO="$2"; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; DISPATCH=0; shift 2 ;;
    # Raw operator prose, forwarded verbatim by the driver: it does not
    # tokenize, match or normalize, so every bit of that work is here. Same
    # `shift 2` guard as --roots, for the same bash 3.2 reason.
@ -267,8 +249,8 @@ while [ $# -gt 0 ]; do
             FOCUS="$2"; shift 2 ;;
    # Dispatch rendering: one repo, one prompt file, one startup command. Same
    # `shift 2` guard as every other value flag, for the same bash 3.2 reason.
-    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
+    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
-    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; ROW=0; shift ;;
+    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; shift ;;
    --repo) [ $# -ge 2 ] || { echo "board: --repo requires a value" >&2; exit 2; }
            D_REPO="$2"; shift 2 ;;
    --prompt-file) [ $# -ge 2 ] || { echo "board: --prompt-file requires a value" >&2; exit 2; }
@ -302,67 +284,13 @@ trunc() { printf '%s' "$1" | LC_ALL=en_US.UTF-8 cut -c1-"$2"; }
 # --- Discovery: git repos at depth 1, plus depth 2 under polyrepo dirs ------
 # A directory that is itself a git repo is one repo; a directory that is not
 # but contains git repos is a polyrepo container (the plugin marketplace) and
-# contributes its children, never itself. A repo nested under a depth-1 REPO is
+# contributes its children, never itself.
 # a third case, admitted on criterion (a) only - see add_nested_repos() below.
 #
 # "Is a repo" tests .git with -e, not -d: a worktree or submodule has .git as a
 # FILE. A plain `git worktree add <root>/feature-x` lands a depth-1 sibling that
 # can CARRY its own STATE.md - a -d test drops it silently. Kept identical in
 # the rollup builder (catalog) on purpose: two readers, one name.
 REPOS=""
 # Dirs admitted by add_nested_repos(), recorded rather than re-derived. The
 # record loop needs to know which entries are nested so it can build the
 # <parent>/<child> key, and the obvious re-derivation ("is my parent dir a git
 # repo?") answers a slightly different question: it would also fire for every
 # depth-1 repo if a SCAN ROOT ever happened to be a git checkout. Discovery
 # already knows the answer exactly; storing it cannot drift from the criterion.
 NESTED_LIST=""
 # --- Denominator counters (order 20260903T190201Z-238406410, .claude) -------
 # A repo COUNT alone answers "how many were found" and is silent about how many
 # directories were looked at, so an admission criterion that excludes 11 of 12
 # nested repos is invisible at the very surface meant to show it - ansikt 4
 # turned on the board's own reading. These four are printed as one line under
 # the table (see UNDERSOEKT below) and are independent of the nested-repo
 # admission itself: the line goes in whether or not anything is admitted.
 N_DEPTH1=0      # directories examined at depth 1, dot-entries included
 N_CONTAINER=0   # of those, entered as polyrepo containers (not themselves repos)
 N_NESTED=0      # git repos found one level under a depth-1 repo
 N_NESTED_IN=0   # of those, admitted because they carry a STATE.md
 # Admission criterion (a), operator decision 2026-09-03: a git repo nested
 # under a directory that is ITSELF a git repo enters the board only when it
 # carries a STATE.md. Measured on the real tree that day: 12 nested repos,
 # exactly 1 with a STATE.md (from-ai-to-chitta/content-sadhguru). The other 11
 # are vendored or experimental checkouts with no declared next step, and they
 # stay invisible ON PURPOSE - they do not even reach the UTEN STATE.md bucket,
 # which is for repos the operator opens.
 #
 # A dedicated function beside add_dot_repos(), never a widening of the `*`
 # loops below, for the identical reason ordre 20260818T124828Z gave for dot
 # repos: routing a depth-1 REPO into the else-branch container scan would admit
 # every nested checkout, which is exactly what criterion (a) declines. One
 # level only - a repo nested inside a nested repo is a checkout of a checkout,
 # and widening past what was ordered is the unmeasured scope creep that order
 # flagged.
 #
 # Bounded gap, stated rather than closed: a DOT-prefixed nested repo is not
 # looked for (the `*` glob here has no dotglob, same as everywhere else in this
 # file). The combination was not measured and not ordered; add_dot_repos exists
 # for the depth-1 and container cases because those were.
 add_nested_repos() {
  for nested in "$1"/*; do
    [ -d "$nested" ] || continue
    [ -e "$nested/.git" ] || continue
    N_NESTED=$((N_NESTED + 1))
    [ -f "$nested/STATE.md" ] || continue
    N_NESTED_IN=$((N_NESTED_IN + 1))
    REPOS="$REPOS
 $nested"
    NESTED_LIST="$NESTED_LIST
 $nested"
  done
 }
 # Picks up dot-prefixed git repos directly under $1 - the Forgejo/GitHub
 # `.profile` org-profile convention, measured invisible to the loops below
@ -376,29 +304,16 @@ $nested"
 # a bare `*` needs dotglob to see them), so no shopt toggle is needed here.
 # Only a dot-entry that IS itself a repo is ever added; one that is not is
 # silently skipped, never recursed into as a container.
 #
 # $2 = "d1" when this is the depth-1 scan of a root. A dot-prefixed depth-1
 # repo IS a depth-1 repo, so it gets the same nested scan an ordinary one gets
 # - the asymmetry would otherwise be arbitrary, and nothing in the admission
 # criterion distinguishes them. Under a polyrepo container the flag is absent:
 # those entries are already at depth 2, and their children would be depth 3.
 add_dot_repos() {
  for dotentry in "$1"/.*; do
    dotbase="$(basename "$dotentry")"
    [ "$dotbase" = "." ] && continue
    [ "$dotbase" = ".." ] && continue
    [ -d "$dotentry" ] || continue
    # Counted as a depth-1 directory that was LOOKED AT even when it is not a
    # repo: the denominator reports what was examined, not what was admitted.
    # It is deliberately never counted as a polyrepo container - a dot-dir that
    # is not a repo is skipped outright, which is ordre 20260818's decision.
    [ "${2:-}" = "d1" ] && N_DEPTH1=$((N_DEPTH1 + 1))
    [ -e "$dotentry/.git" ] || continue
    REPOS="$REPOS
 $dotentry"
    [ "${2:-}" = "d1" ] && add_nested_repos "$dotentry"
  done
  return 0
 }
 # Split on comma via IFS + `set --` rather than an unquoted $(...) expansion:
@ -421,20 +336,13 @@ for root in "$@"; do
    continue
  fi
  ROOTS_OK=$((ROOTS_OK + 1))
-  add_dot_repos "$root" d1
+  add_dot_repos "$root"
  for entry in "$root"/*; do
    [ -d "$entry" ] || continue
    N_DEPTH1=$((N_DEPTH1 + 1))
    if [ -e "$entry/.git" ]; then
      REPOS="$REPOS
 $entry"
      # A depth-1 repo used to end the walk here: the else-branch below is the
      # only place children are ever looked at, and it is unreachable for an
      # entry that is itself a repo. That is what made every nested repo
      # invisible.
      add_nested_repos "$entry"
    else
      N_CONTAINER=$((N_CONTAINER + 1))
      for child in "$entry"/*; do
        [ -e "$child/.git" ] || continue
        REPOS="$REPOS
@ -705,24 +613,7 @@ VOYAGE_CELL_EOF
 printf '%s\n' "$REPOS" | while IFS= read -r d; do
  [ -n "$d" ] || continue
-  # Two names, deliberately: the KEY the board shows and the MAILBOX the coord
+  name="$(basename "$d")"
  # columns read. For every repo but a nested one they are the same string.
  #
  # A nested repo is keyed <parent>/<child> (operator decision 2026-09-03): the
  # bare basename would render a row that says nothing about where the checkout
  # lives, and two repos of the same name - one depth-1, one nested - would
  # collide into indistinguishable rows.
  #
  # The mailbox name is NOT that key. A mailbox is addressed by
  # basename(git toplevel), which is coord-send.sh's own rule and the only name
  # a session in that repo can hold; reading $COORD/<parent>/<child>/inbox would
  # find no directory and print INN 0 - a failed measurement wearing the
  # reassuring value, which is the one thing this file refuses everywhere.
  mbox="$(basename "$d")"
  name="$mbox"
  if printf '%s\n' "$NESTED_LIST" | grep -qxF "$d"; then
    name="$(basename "$(dirname "$d")")/$mbox"
  fi
  state="$d/STATE.md"
  # F6: `git status | wc -l` yields 0 lines whether the tree is CLEAN or git
@ -749,8 +640,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  fi
  inbox=0
-  if [ -d "$COORD/$mbox/inbox" ]; then
+  if [ -d "$COORD/$name/inbox" ]; then
-    inbox="$(ls "$COORD/$mbox/inbox"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    inbox="$(ls "$COORD/$name/inbox"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$inbox" ] || inbox=0
  fi
@ -766,8 +657,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # as mail to such a name is invisible in INN. coord-count.sh is the cross-
  # check for the mail half; there is deliberately no join built for orders.
  orders=0
-  if [ -d "$COORD/$mbox/orders" ]; then
+  if [ -d "$COORD/$name/orders" ]; then
-    orders="$(ls "$COORD/$mbox/orders"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    orders="$(ls "$COORD/$name/orders"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$orders" ] || orders=0
  fi
@ -790,8 +681,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # read as "a session is running here" would be the process axis smuggled in
  # as a file count.
  claimed=0
-  if [ -d "$COORD/$mbox/orders/claimed" ]; then
+  if [ -d "$COORD/$name/orders/claimed" ]; then
-    claimed="$(ls "$COORD/$mbox/orders/claimed"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    claimed="$(ls "$COORD/$name/orders/claimed"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$claimed" ] || claimed=0
  fi
@ -805,9 +696,9 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # measured 2026-08-23), so a claim without an age is that non-claim with its
  # only counter-evidence removed.
  ordersage="-"
-  [ "$orders" -eq 0 ] || ordersage="$(oldest_pending_age "$COORD/$mbox/orders")"
+  [ "$orders" -eq 0 ] || ordersage="$(oldest_pending_age "$COORD/$name/orders")"
  claimedage="-"
-  [ "$claimed" -eq 0 ] || claimedage="$(oldest_order_age "$COORD/$mbox/orders/claimed")"
+  [ "$claimed" -eq 0 ] || claimedage="$(oldest_order_age "$COORD/$name/orders/claimed")"
  # Read for EVERY repo, not just the STATE-less ones: a repo whose plan file
  # is fresh can still have been silent for a year, and that is precisely the
@ -1097,9 +988,9 @@ rows() {
 # --- Briefing rendering (--brief) ------------------------------------------
 # The startup command for one repo, derived from that repo's OWN route line by
-# calling route.sh. Deriving it from next-cost instead would mean a second
+# calling route.sh. Deriving it from next-cost instead would not work even in
-# writer for the same command string, spelled from a rubric NAME rather than
+# principle: the advisor flag is a property of the ROW, and two rows can share
-# from the row table itself. A repo with no route line gets its
+# a model/effort pair while differing on it. A repo with no route line gets its
 # next-cost printed and is told where the command comes from - a guessed
 # command would read as authoritative while being a guess, which is worse than
 # no command at all.
@ -1321,18 +1212,13 @@ fi
 # brief-nightly.sh already owns the briefing's write.
 #
 # THE COST COMES FROM route.sh's ROW TABLE, never from a --model/--effort pair
-# handed in. That is not tidiness: the rubric is a policy with exactly one copy,
+# handed in. That is not tidiness: `--advisor opus` is a property of the ROW,
-# and a dispatch accepting the model directly would be a second way to reach the
+# two rows share a model/effort pair while differing on it, and the CLI accepts
-# same decision - one that records no traits, no rationale and no next-cost, so
+# a wrong advisor silently (it drops it for a Fable main model without failing).
-# nothing afterwards can say whether the ROUTING was wrong or the SCORING was.
+# A dispatch that took the model directly would have no source for that flag,
-# Scoring the four traits is the caller's judgement; turning them into a command
+# and both available guesses are wrong in the same direction - a session that
-# is this lookup.
+# looks peer-reviewed without being. Scoring the four traits is the caller's
-#
+# judgement; turning them into a command is this lookup.
 # Until 2026-09-12 this paragraph rested on `--advisor opus` instead: the flag
 # was a property of the ROW, so a model/effort pair could not yield it. That
 # rule is struck (see route.sh), and the argument is rewritten rather than
 # quietly left standing on a premise the code no longer has - a comment
 # defending a mechanism that was removed is how the next session "restores" it.
 dispatch() {
  # --target-pane is REQUIRED and has no default, the same rule route.sh's
  # --last-effort carries: it is a MEASUREMENT of the world (does the target
@ -1410,8 +1296,8 @@ dispatch() {
  [ -d "$d_dir" ] || { echo "board: the directory for $D_REPO does not exist: $d_dir" >&2; exit 2; }
  # Rejected traits REFUSE. Degrading to a command without them is the worst
-  # available outcome: a command built on three scored traits and one silently
+  # available outcome: a command missing --advisor is indistinguishable from a
-  # dropped one is indistinguishable from a fully scored decision.
+  # row that legitimately has none.
  d_route="$(bash "$ROUTE" --path "$D_PATH" --verification "$D_VER" \
             --reversibility "$D_REV" --scope "$D_SCOPE" --rationale "$D_RAT" 2>&1)" || {
    echo "board: route.sh rejected the traits, so there is no command to give:" >&2
@ -2058,11 +1944,7 @@ voyage() {
    # Order coupling: the repo's PENDING orders (claimed ones are in flight and
    # are not what a reader is looking for when a brief has stopped moving).
    vy_ord=0; vy_ids=""
-    # basename($vy_dir), never $vy_name: a nested repo's board key is
+    for vy_of in "$COORD/$vy_name/orders"/*.md; do
    # <parent>/<child> while its mailbox is addressed by the bare basename
    # (see the record loop's own note). Reading the compound key here would
    # find no directory and report ordre=0 for a repo that has orders.
    for vy_of in "$COORD/$(basename "$vy_dir")/orders"/*.md; do
      [ -f "$vy_of" ] || continue
      vy_ord=$((vy_ord+1))
      vy_ids="$vy_ids$(basename "$vy_of" .md)
@ -2120,114 +2002,6 @@ if [ "$VOYAGE" -eq 1 ]; then
  exit 0
 fi
 # --- Row rendering (--row <repo>) -------------------------------------------
 # A SEVENTH rendering of the same scan, never a second scan, and read-only like
 # every other one. (Order 20260912T202210Z-7588027378 calls it the sixth; by
 # this file's own numbering --inbox-plan is the fourth and --dispatch the fifth,
 # so it is the seventh. The count is corrected here rather than carried wrong,
 # for the same reason every other number in this file is measured.)
 #
 # WHAT IT ANSWERS: the table's row for ONE repo, as `field=value` lines a
 # program can grep. The table is fixed-width and is for a human; reading a
 # column off it by eye is how FLY was misread as ORDRE on 2026-09-11, and a
 # 34-character repo key already shifts a row two characters right - a stated,
 # unclosed gap that makes counting spaces strictly worse than it looks. Every
 # other rendering a program consumes (--plan, --inbox-plan, --dispatch) is
 # key=value for exactly this reason; the default view was the one left out.
 #
 # It takes NO position and adds NO judgement: every field is a value $RECORDS
 # already holds, printed under the name its column carries. The three mailbox
 # counts are three separate fields because they are three separate facts - INN
 # is "others wait on you", ORDRE is "work waits on this repo", FLY is "someone
 # took an order" - and this rendering exists because they were confused.
 #
 # ONE FIELD IS NOT A RENDERING, and it is named rather than blended in:
 # `upushet` is not a column the scan computes. It is measured here, once, for
 # the named repo only, because the order asks for it and because "nothing is
 # waiting to be pushed" and "nobody looked" are exactly the pair this repo
 # refuses to render alike. One reading for one repo in a one-repo view is not a
 # scan; it never enters the table, the plan or the briefing.
 #
 # It reads the remote-TRACKING ref, not the remote. That is a real bound, not a
 # hedge: a stale ref under-reports after someone else pushed, and over-reports
 # after a push this checkout has not fetched. The honest reading of `upushet=N`
 # is "the local ref says N", and `git ls-remote` is still what a claim ABOUT
 # THE WORLD costs.
 row_unpushed() {
  ru_up="$(git -C "$1" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)" || return 1
  [ -n "$ru_up" ] || return 1
  ru_n="$(git -C "$1" rev-list --count "$ru_up..HEAD" 2>/dev/null)" || return 1
  case "$ru_n" in ''|*[!0-9]*) return 1 ;; esac
  printf '%s' "$ru_n"
 }
 row_one() {
  r_rec="$(awk -F'|' -v n="$ROW_REPO" '$3==n {print; exit}' "$RECORDS")"
  # REFUSE rather than emit an empty block. A consumer reading ^status= off an
  # empty output gets nothing back and reads it as a repo with no board line -
  # which is a real, different state this very rendering spells as `?`.
  if [ -z "$r_rec" ]; then
    echo "board: no repo named '$ROW_REPO' in the scanned roots" >&2
    return 2
  fi
  r_disp="$(printf '%s' "$r_rec" | cut -d'|' -f4)"
  r_cost="$(printf '%s' "$r_rec" | cut -d'|' -f5)"
  r_inn="$(printf '%s' "$r_rec" | cut -d'|' -f6)"
  r_drt="$(printf '%s' "$r_rec" | cut -d'|' -f7)"
  r_alder="$(printf '%s' "$r_rec" | cut -d'|' -f8)"
  r_siste="$(printf '%s' "$r_rec" | cut -d'|' -f9)"
  r_dir="$(printf '%s' "$r_rec" | cut -d'|' -f10)"
  r_blocked="$(printf '%s' "$r_rec" | cut -d'|' -f11)"
  r_ordre="$(printf '%s' "$r_rec" | cut -d'|' -f12)"
  r_ordreage="$(printf '%s' "$r_rec" | cut -d'|' -f13)"
  r_fly="$(printf '%s' "$r_rec" | cut -d'|' -f14)"
  r_flyage="$(printf '%s' "$r_rec" | cut -d'|' -f15)"
  r_voy="$(printf '%s' "$r_rec" | cut -d'|' -f16)"
  # `neste` is free prose and may contain a literal '|', which is why it is the
  # last field of the record - so it is taken as "everything from 17 on", never
  # as field 17.
  r_neste="$(printf '%s' "$r_rec" | cut -d'|' -f17-)"
  # The TOKEN, not the display string: the table renders a blocked repo as
  # `blocked>target` because one column has to carry both, and this rendering
  # has two fields and no such constraint. A consumer matching status=blocked
  # must not have to know about the arrow.
  case "$r_disp" in
    blocked\>*) r_status=blocked ;;
    *)          r_status="$r_disp" ;;
  esac
  r_unpushed="$(row_unpushed "$r_dir")" || r_unpushed="?"
  echo "repo=$ROW_REPO"
  echo "dir=$r_dir"
  echo "status=$r_status"
  echo "blocked-on=$r_blocked"
  echo "next-cost=$r_cost"
  echo "inn=$r_inn"
  echo "ordre=$r_ordre"
  echo "ordre-alder=$r_ordreage"
  echo "fly=$r_fly"
  echo "fly-alder=$r_flyage"
  echo "voy=$r_voy"
  echo "drt=$r_drt"
  echo "alder=$r_alder"
  echo "siste=$r_siste"
  echo "upushet=$r_unpushed"
  # LAST, and for the same reason it is last in the record: it is free prose
  # lifted out of a STATE.md, so anything placed after it would be unreachable
  # for a consumer reading from the end. Printed WHOLE - the 38-character cut
  # belongs to the table column, and cutting here would make the cut string the
  # only copy, which is the defect --brief was built to stop.
  echo "neste=$r_neste"
  return 0
 }
 if [ "$ROW" -eq 1 ]; then
  row_one
  exit $?
 fi
 count() { awk -F'|' -v b="$1" '$1==b' "$RECORDS" | wc -l | tr -d ' '; }
 echo "BOARD - tverr-repo oppmerksomhetstavle ($(awk 'END{print NR}' "$RECORDS") repo)"
@ -2276,13 +2050,6 @@ n_nofield="$(awk -F'|' '$4=="?"' "$RECORDS" | wc -l | tr -d ' ')"
 n_unmeas="$(awk -F'|' '$7=="?"' "$RECORDS" | wc -l | tr -d ' ')"
 printf '\nSUM: %s uhaandterte innboks-meldinger, %s ukommiterte filer.\n' "$tot_in" "$tot_dirty"
 # The scan's own denominator (order 20260903T190201Z-238406410, .claude). The
 # repo count in the header answers "how many were found"; this answers "how
 # many were looked at", which is the only way an admission criterion that
 # excludes most nested repos is visible at all. Verifiseringsloven ansikt 4:
 # a measurement without its nevner is read as a fact about the world.
 printf 'undersoekt: %s katalog(er) depth 1, %s polyrepo-container(e), %s nestede repo (%s med STATE.md tatt med).\n' \
  "$N_DEPTH1" "$N_CONTAINER" "$N_NESTED" "$N_NESTED_IN"
 [ "${n_mal:-0}" -gt 0 ] && printf 'ADVARSEL: %s repo har MALFORMED status-token (utenfor det lukkede settet).\n' "$n_mal"
 [ "${n_nofield:-0}" -gt 0 ] && printf 'MERK: %s repo mangler board-linje - status/kost er ukjent (?), NESTE-utdrag brukes.\n' "$n_nofield"
 [ "${n_unmeas:-0}" -gt 0 ] && printf 'MERK: %s repo har umaalbart arbeidstre - git svarte ikke, DRT er ? og IKKE med i summen over.\n' "$n_unmeas"
--- a/scripts/route-selftest.sh
+++ b/scripts/route-selftest.sh
@ -141,8 +141,7 @@ check "all 81 trait combinations emit one of the 4 calculator rows" $?
 # to show the same string back. Runs for all six rows.
 ROOT="$(mktemp -d)"
 MBOX="$(mktemp -d)"
-RL_ROOT=""
+cleanup() { /bin/rm -rf "$ROOT" "$MBOX" 2>/dev/null; }
 cleanup() { /bin/rm -rf "$ROOT" "$MBOX" ${RL_ROOT:+"$RL_ROOT"} 2>/dev/null; }
 trap cleanup EXIT
 rt_bad=0
@ -360,14 +359,13 @@ check "board + route + route-last stacked still yield prose in NESTE" $?
 # --- 9. Startup command and fallback --------------------------------------
 # Two spellings of ONE decision: the rubric name for the board line, the CLI
 # alias for the command the operator pastes. They must never disagree.
-# These assert the WHOLE string, so no flag can be added back to the emitted
+# These assert the WHOLE string, advisor included, so section 14's rule cannot
-# command without a deliberate edit here - the exact-match is the tripwire that
+# be widened without a deliberate edit here - the exact-match is the tripwire.
 # keeps section 14's absence rule from being widened around.
 cmd="$(field partial strong cheap local command)"
 [ "$cmd" = "claude --model opus --effort high" ]; check "command mirrors the row (opus/high)" $?
 cmd="$(field known strong cheap local command)"
-[ "$cmd" = "claude --model sonnet --effort high" ]; check "command mirrors the row (sonnet/high)" $?
+[ "$cmd" = "claude --model sonnet --effort high --advisor opus" ]; check "command mirrors the row (sonnet/high)" $?
 # The rubric requires ALWAYS naming one row cheaper as the quota fallback.
 fb="$(field partial strong cheap local fallback)"
@ -379,7 +377,7 @@ fb="$(field known strong cheap local fallback)"
 # The fallback needs its own pasteable command or the operator translates by
 # hand at exactly the moment they are under quota pressure.
 fbc="$(field partial strong cheap local fallback-command)"
-[ "$fbc" = "claude --model sonnet --effort xhigh" ]; check "fallback ships its own command" $?
+[ "$fbc" = "claude --model sonnet --effort xhigh --advisor opus" ]; check "fallback ships its own command" $?
 # --- 10. The command carries no 'cd' --------------------------------------
 # One repo per terminal tab: a startup command prefixed with cd is wrong by
@ -395,9 +393,9 @@ check "no emitted command contains a cd prefix" "$rc"
 # Model aliases are whatever the INSTALLED claude accepts - never hardcoded
 # without a gate, because an alias that stops resolving turns every emitted
 # command into a paste that fails.
-# Capture the effort TOKEN only. The command ends at the effort today, but the
+# Capture the effort TOKEN only. Anything may legitimately follow it on the
-# pattern stays tail-tolerant: a match that swallowed whatever a later flag
+# command line (--advisor does, since section 14), and a match that swallowed
-# added would report a valid effort as invalid.
+# the tail would report a valid effort as invalid.
 efforts="$(printf '%s' "$out" | sed -n 's/^command=claude --model [a-z]* --effort \([a-z]*\).*/\1/p')"
 case "|low|medium|high|xhigh|max|" in *"|$efforts|"*) rc=0 ;; *) rc=1 ;; esac
 check "emitted effort is in the verified effort set" "$rc"
@ -469,129 +467,117 @@ check "route.sh no longer claims effort is unobservable from inside" "$rc"
 grep -q 'CLAUDE_EFFORT' "$R"
 check "route.sh names the source the caller should measure from" $?
-# --- 14. The advisor is NOT the rubric's to emit --------------------------
+# --- 14. The advisor: capability gap first, stakes second -----------------
-# Struck by operator decision 2026-09-12
+# The advisor is a second, stronger model consulted mid-task, so a session
-# (~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md, cut row 3).
+# carrying one costs more than a session without. It must therefore fire where
-# The rule it replaces fired on two needs - Sonnet rows always, Opus rows at
+# there is a NEED and nowhere else, or it decays into the always-on
-# costly|one-way stakes - and read well. What killed it was a measurement, not
+# advisorModel setting it exists to replace. Two independent needs qualify,
-# a change of taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried
+# and they turn out to be almost disjoint.
 # --advisor opus, because the operator starts sessions by hand and pastes the
 # model and effort, not the whole line. A rule nothing honours is not a policy,
 # it is a claim about the world that the world disagrees with - and this repo's
 # own standing rule is that an emitted value must be evidence, never decoration.
 #
-# So the calculator emits no advisor at all, and the advisor becomes what it
+# 1. THE MAIN MODEL IS SONNET (rows 1-2). Here opus is a genuine capability
-# already was in practice: an operator decision per session. That is a strictly
+#    lift, not a peer: opus judgement at sonnet cost. This is the load-bearing
-# SAFER direction for the one thing the old rule protected - the quota fallback
+#    half, because every fallback-command is one row cheaper and the cheapest
-# is still one row cheaper, it just no longer implies a capability lift nobody
+#    rows are Sonnet - so this is what makes the QUOTA FALLBACK safe to take.
-# was taking.
+#    Pinned below by the row-3-falls-back-to-row-2 case.
 #
-# Pinned as an ABSENCE over the whole trait space rather than on four sampled
+# 2. A MISTAKE IS EXPENSIVE TO UNDO (reversibility costly|one-way). On an Opus
-# rows, because the claim is that no path emits it - the same "no write path
+#    row the advisor is a peer review rather than a lift, which is worth
-# exists" argument the channel split uses. An absence check is worthless
+#    paying for when being wrong is not cheap to reverse.
-# without a known-positive control, so the sweep's own grep is proven able to
+#
-# find a planted advisor before it is trusted to report none.
+# The two barely overlap: costly forces row 3 and one-way forces row 4, so a
 # Sonnet row ALWAYS has reversibility=cheap and trigger 2 can never reach it.
 # Rule 1 covers the Sonnet rows, rule 2 covers the Opus rows.
 #
 # What is deliberately NOT a trigger: verification=none on its own. The set it
 # would add beyond rule 2 is exactly {verification=none AND
 # reversibility=cheap} - mistakes that are cheap to reverse. It survives on the
 # Sonnet rows only via rule 1, which is about the model, not the trait.
 adv="$(field known strong cheap local command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "row 1 (Sonnet/high) carries no advisor" "$rc"
+check "row 1 (Sonnet/high) always carries an advisor" $?
 adv="$(field known weak cheap local command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "row 2 (Sonnet/xhigh) carries no advisor" "$rc"
+check "row 2 (Sonnet/xhigh) always carries an advisor" $?
 adv="$(field known strong costly local command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "reversibility=costly no longer pulls an advisor onto an Opus row" "$rc"
+check "reversibility=costly carries an advisor onto an Opus row" $?
 adv="$(field known strong one-way local command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "reversibility=one-way no longer pulls an advisor onto an Opus row" "$rc"
+check "reversibility=one-way carries an advisor onto an Opus row" $?
 # The Opus rows reached WITHOUT expensive stakes are the whole no-advisor set.
 adv="$(field partial strong cheap local command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 3 via path=partial at cheap stakes takes NO advisor" "$rc"
 adv="$(field known strong cheap multi-file command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 3 via scope=multi-file at cheap stakes takes NO advisor" "$rc"
 adv="$(field known strong cheap cross-cutting command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 4 via scope=cross-cutting at cheap stakes takes NO advisor" "$rc"
 # Rows 5-6 (Fable) are unreachable through this calculator now - section 1
 # pins that directly, and section 3's closed vocabulary covers every command
 # this script can ever emit. There is nothing left here for "Fable takes no
 # advisor" to test: that fact still holds (gated against the installed claude
 # by the CLI check below), but row_advisor()'s branch for it can no longer be
 # exercised through the public interface.
 # The fallback is the half the old rule called load-bearing, so it is pinned
 # in its own right: dropping a row under quota pressure must not reintroduce
 # the flag by the back door.
 adv="$(field known strong one-way local fallback-command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "the row-4 fallback carries no advisor either" "$rc"
+check "row 4 fallback to row 3 keeps the advisor at one-way stakes" $?
 # THE POINT OF RULE 1, pinned. Row 3 at cheap stakes takes no advisor, but its
 # quota fallback is row 2 - a Sonnet row - which does. Dropping a row under
 # quota pressure must not silently drop the safety net with it.
 adv="$(field partial strong cheap local fallback-command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "an Opus row with no advisor still falls back to an advised Sonnet row" $?
 adv="$(field known strong cheap cross-cutting fallback-command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "an Opus row falling back to a Sonnet row carries no advisor" "$rc"
+check "row 4 falling back to row 3 at cheap stakes stays unadvised" "$rc"
-# THE SWEEP: every trait combination the calculator accepts, every line of
+# Closed vocabulary, same reason as the row table: one spelling in circulation.
-# output. 81 combinations, so a rule surviving on one unsampled corner cannot
+# fable is not merely weaker here, it is REJECTED as an advisor outright.
-# hide. Accumulated into one string and grepped once - a per-combination check
+allout="$("$R" --path known --verification strong --reversibility one-way \
-# would add 81 lines to the summary and drown the rest of the suite.
+          --scope cross-cutting --rationale x 2>/dev/null)"
-sweep=""
+bad="$(printf '%s' "$allout" | grep -o -- '--advisor [a-z0-9-]*' | grep -v -- '--advisor opus')"
-for s_path in known partial undetermined; do
+[ -z "$bad" ]; check "the only advisor value ever emitted is opus:${bad:- none other}" $?
  for s_ver in strong weak none; do
    for s_rev in cheap costly one-way; do
      for s_sc in local multi-file cross-cutting; do
        sweep="$sweep
 $("$R" --path "$s_path" --verification "$s_ver" --reversibility "$s_rev" \
      --scope "$s_sc" --rationale x 2>/dev/null)"
      done
    done
  done
 done
 if printf '%s' "$sweep" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "no advisor in any output over all 81 trait combinations" "$rc"
-# Known-positive control: the grep above reports an absence, so it must be
+if command -v claude >/dev/null 2>&1; then
-# shown able to report a presence. Without this the sweep would pass just as
+  # A real gate that spends NO tokens. Advisor validation runs BEFORE the
-# happily against an empty string.
+  # empty-prompt check, so `-p ""` reaches the validator and then exits: a
-if printf '%s' "$sweep claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
+  # valid advisor fails on the missing prompt, an invalid one fails on itself.
-check "control: the sweep's grep does find a planted advisor" "$rc"
+  # --help cannot gate this - it short-circuits before option validation, so
  # even an unknown flag exits 0 and the gate would pass without testing.
  # Row 1-2's trigger is "sonnet main + opus advisor" specifically, so the
  # main model is pinned rather than left to the ambient default.
  ADVOUT="$(claude --model sonnet --advisor opus -p "" 2>&1 | head -3)"
  if printf '%s' "$ADVOUT" | grep -q 'unknown option'; then rc=1; else rc=0; fi
  check "installed claude accepts the --advisor flag at all" "$rc"
-# The help text is the rubric's published form, so the rule has to leave there
+  if printf '%s' "$ADVOUT" | grep -q 'cannot advise'; then rc=1; else rc=0; fi
-# too - a doc line nothing tests is a doc line that drifts, and a struck rule
+  check "installed claude accepts opus advising a sonnet main" "$rc"
 # still written down is worse than one never removed: it reads as current.
 # The literal flag string is absent from route.sh ENTIRELY, including the
 # paragraph that records what was struck - that paragraph names "an opus
 # advisor flag" in words on purpose. A blunt grep cannot tell a description
 # from a specification (the same reason the cache assertion in coord-selftest
 # runs on an extracted path rather than the whole file), and keeping the
 # string out is cheaper than teaching the check to read prose. Do not
 # "restore the quote" here.
 HELPOUT="$("$R" --help 2>/dev/null)"
 if printf '%s' "$HELPOUT" | grep -q -- '--advisor opus'; then rc=1; else rc=0; fi
 check "--help no longer documents emitting --advisor opus" "$rc"
 if printf '%s' "$HELPOUT" | grep -q 'THE ADVISOR is emitted'; then rc=1; else rc=0; fi
 check "--help no longer carries the advisor rule block" "$rc"
 # Removing the rule silently would leave a reader guessing whether the advisor
 # is forbidden, forgotten, or someone else's. It is the third, and the help
 # says which.
 printf '%s' "$HELPOUT" | grep -q 'advisor is an operator decision per session'
 check "--help states whose decision the advisor is instead" $?
 grep -q 'advisor is an operator decision per session' "$R"
 check "route.sh itself carries that sentence, not just its help output" $?
 # --- 14b. Old route lines still parse ------------------------------------
 # Backward compatibility, pinned rather than assumed. Measured on the real
 # tree the day the rule was struck: 0 of 48 `<!-- route:` lines anywhere in
 # ~/repos carry an advisor field at all, so nothing in circulation depends on
 # it - but board.sh's route_cmd_for() reads these lines by trait NAME, and a
 # reader that broke on an unknown field would turn a STATE.md written last
 # month into "that repo has no route line", which is the misreading this whole
 # file exists to prevent.
 RL_ROOT="$(mktemp -d)"; mkdir -p "$RL_ROOT/repo-legacy"
 ( cd "$RL_ROOT/repo-legacy" && git init -q . 2>/dev/null ) || true
 {
  printf '# STATE\n\n## NESTE - START HER\n'
  printf '<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->\n'
  printf '<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; advisor=opus; rationale=legacy line written before the rule was struck -->\n'
  printf 'legacy next step\n'
 } > "$RL_ROOT/repo-legacy/STATE.md"
 RL_OUT="$("$BOARD" --roots "$RL_ROOT" --plan 2>/dev/null)"
 printf '%s' "$RL_OUT" | grep -q '^command=claude --model sonnet --effort high$'
 check "a route line carrying a legacy advisor= field still yields a command" $?
 if printf '%s' "$RL_OUT" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "and the command derived from it carries no advisor" "$rc"
  # row_advisor() never emits '--advisor fable' - it depends on the opposite
  # direction: whether opus can advise a FABLE main model. That is the fact
  # rows 5-6's suppression rests on, so that is what must be gated. (Measured
  # at CC 2.1.226: fable is now itself accepted as an advisor for opus/sonnet
  # mains - a capability-ordering change worth flagging to the operator, but
  # not what this check exists to pin.)
  FABOUT="$(claude --model fable --advisor opus -p "" 2>&1 | head -3)"
  printf '%s' "$FABOUT" | grep -q 'cannot advise'
  check "installed claude still rejects opus advising a fable main" $?
 else
  echo "  skip - claude not on PATH, advisor flag gate not run"
 fi
 echo ""
 echo "route-selftest: $PASS passed, $FAIL failed"
--- a/scripts/route.sh
+++ b/scripts/route.sh
@ -29,7 +29,10 @@
 # departure from it is recorded in STATE as an OVERRIDE, never produced here.
 # Write "Fable 5/high" or "Fable 5/xhigh" into the board line by hand when
 # that is the right call; board.sh still parses both (route-selftest.sh
-# section 6 pins that half).
+# section 6 pins that half). The one fact worth carrying: a Fable session
 # runs without an advisor (row_advisor() below, and gated against the
 # installed claude by route-selftest.sh section 14) - informational, never a
 # gate on reaching the row, since there is no longer a gate to reach.
 #
 # Cheapest first, so the rubric's "always name one row cheaper as the quota
 # fallback" is row minus one, floored at row 1, correct by construction.
@ -63,14 +66,32 @@
 # overkill costs quota every session - but a wrong architecture decision in a
 # published plugin costs more than either.
 #
-# THE ADVISOR IS NOT EMITTED, and that is a decision rather than an omission:
+# THE ADVISOR is emitted into the command as '--advisor opus' - a second,
-# the advisor is an operator decision per session, never the rubric's. Until
+# stronger model consulted at key moments during the session. It is added on a
-# 2026-09-12 this calculator appended an opus advisor flag on a NEED - always on
+# NEED, never unconditionally: an always-on advisor is the global advisorModel
-# the Sonnet rows, and on the Opus rows at costly|one-way stakes. It was struck
+# setting, which burns quota on every session in every repo and is the thing
-# on a measurement: of 54 dispatches issued 08.-12.09 not one carried the flag,
+# this rule exists to replace. Two independent needs qualify:
-# because sessions are started by hand from the model and effort, not from the
+#
-# whole line. A rule nothing honours is not policy, and an emitted value that
+#   rows 1-2   ALWAYS. The main model is Sonnet, so opus is a capability LIFT
-# nobody acts on is decoration in a field whose only job is to be evidence.
+#              rather than a peer - opus judgement at sonnet cost. This is what
 #              makes the FALLBACK safe to take: every fallback is one row
 #              cheaper, and the cheapest rows are the Sonnet ones.
 #   rows 3-4   only at reversibility=costly|one-way. The main model is already
 #              Opus, so the advisor buys peer review, worth paying for when a
 #              mistake is not cheap to undo.
 #
 # Rows 5-6 never reach this logic at all - the calculator cannot select them
 # (see above). Informational only: were the operator to hand-write a Fable
 # command, it would carry no advisor either way, since the CLI rejects every
 # advisor for a Fable main model.
 #
 # The two triggers barely overlap: costly forces row 3 and one-way forces row
 # 4, so a Sonnet row always has reversibility=cheap. verification=none is
 # deliberately not a third trigger - beyond the stakes rule it would only add
 # mistakes that are cheap to reverse, docs sessions among them.
 #
 # Applied per ROW, so 'fallback-command' carries its own correct answer rather
 # than the winning row's.
 #
 # WHERE IT DISAGREES WITH THE RUBRIC'S EXAMPLES. The rows are task-type labels;
 # the traits are a different classification over the same six outcomes. They
@ -267,14 +288,41 @@ row_base_cmd() {
  esac
 }
-# No advisor is appended here or anywhere else - the advisor is an operator
+# THE ADVISOR is a second, stronger model consulted mid-task. It costs real
-# decision per session, not a property this rubric computes (struck
+# tokens per session, so it fires on a NEED and nowhere else - an unconditional
-# 2026-09-12, see the header). row_cmd() is therefore the row's base command
+# advisor is just the global advisorModel setting, which is the thing this
-# and nothing more; it stays a function rather than collapsing into
+# replaces. Two independent needs qualify, and they are almost disjoint:
-# row_base_cmd() because the emitted command and the row table are two
+#
-# separate things that happened to converge, and a later flag would attach
+#   rows 1-2 (Sonnet)  ALWAYS. opus is a capability LIFT here, not a peer:
-# here, to one place, for both the winning row and its fallback.
+#                      opus judgement at sonnet cost. This half is what makes
-row_cmd() { row_base_cmd "$1"; }
+#                      the fallback-command safe, since every fallback is one
 #                      row cheaper and the cheapest rows are Sonnet.
 #   rows 3-4 (Opus)    only at costly|one-way stakes, where the advisor is a
 #                      peer review and being wrong is not cheap to undo.
 #
 # Rows 5-6 (Fable) never reach this function - $ROW can only be 1-4 (see
 # SELECTION above). Informational only: the only advisor this script ever
 # emits is opus (pinned by selftest 14's "the only advisor value ever emitted
 # is opus"), and opus is refused as under-capable for a fable main model -
 # measured against the installed claude, still true at CC 2.1.226 - so a
 # hand-written Fable command carries no advisor either way.
 #
 # costly forces row 3 and one-way forces row 4, so a Sonnet row always has
 # reversibility=cheap - the stakes rule can never reach rows 1-2, and the model
 # rule never reaches rows 3-4. verification=none is deliberately NOT a trigger:
 # beyond the stakes rule it would only add cheap-to-reverse mistakes, and it
 # would put an advisor on every docs session (known/none/cheap/local).
 #
 # Applied per ROW rather than once, because the fallback is a real command the
 # operator pastes under quota pressure and must carry its own correct answer.
 row_advisor() {
  case "$1" in
    1|2) echo " --advisor opus" ;;
    3|4) case "$2" in costly|one-way) echo " --advisor opus" ;; *) echo "" ;; esac ;;
    *)   echo "" ;;
  esac
 }
 row_cmd() { printf '%s%s\n' "$(row_base_cmd "$1")" "$(row_advisor "$1" "$REVERS")"; }
 FB=$((ROW - 1)); [ "$FB" -ge 1 ] || FB=1
--- a/skills/board/SKILL.md
+++ b/skills/board/SKILL.md
@ -23,7 +23,7 @@ description: >-
  user names no repo and no tool — choosing *between* repos is this skill. Not for
  "where were we" inside the current repo: that is this repo's own STATE.md,
  already injected at session start.
-version: "0.34.0"
+version: "0.33.0"
 ---
 # board — which repo deserves the next session
--- a/skills/coord-send/SKILL.md
+++ b/skills/coord-send/SKILL.md
@ -15,7 +15,7 @@ description: >-
  covers retiring a broadcast that has become wrong or obsolete: "retract that
  broadcast", "that announcement is outdated, pull it", "trekk tilbake kringkastingen",
  "den broadcasten er utdatert".
-version: "0.34.0"
+version: "0.33.0"
 ---
 # coord-send — natural-language front door for inter-repo messages
--- a/skills/dispatch/SKILL.md
+++ b/skills/dispatch/SKILL.md
@ -17,7 +17,7 @@ description: >-
  skill. Not for choosing WHICH repo deserves the next session (that is `board`),
  not for scoring model and effort alone (that is `route`), and not for sending a
  message to another repo (that is `coord-send`).
-version: "0.34.0"
+version: "0.33.0"
 ---
 # dispatch — hand a session a task it can actually start on
@ -124,8 +124,8 @@ Two facts about this measurement, both verified 2026-08-16 against the installed
 ### 4. Score the four traits and call `--dispatch`
-Scoring is judgement and it is yours; the model and effort are a lookup and are
+Scoring is judgement and it is yours; the model, effort and advisor flag are a
-`route.sh`'s. Score the task **the dispatched session** will do,
+lookup and are `route.sh`'s. Score the task **the dispatched session** will do,
 using the `route` skill's trait table.
 Pass `--order-id <id>`, not `--prompt-file`. The emitted command is then a thin
@ -140,18 +140,13 @@ empty prompt file, one level up.
 queue to write to. Passing both is refused: the session would be told two
 things.
-`--dispatch` deliberately takes no `--model`/`--effort`. The rubric is a policy
+`--dispatch` deliberately takes no `--model`/`--effort`. `--advisor opus` is a
-with exactly one copy, and a dispatch that took the model directly would be a
+property of the rubric *row* — two rows share a model/effort pair while
-second, unscored way to reach the same decision — one that records no traits, no
+differing on it, and the CLI accepts a wrong advisor silently — so a dispatch
-rationale and no `next-cost`, so nothing afterwards could say whether the
+that took the model directly would have no honest source for that flag. If the
-routing or the scoring was wrong. Score the traits and let the lookup spell the
+right call is a Fable row, the rubric cannot produce it: write that command by
-command. If the right call is a Fable row, the rubric cannot produce it: write
+hand, and say in the handover that it is a recorded override, running without an
-that command by hand and say in the handover that it is a recorded override.
+advisor.
 **No `--advisor` is emitted, by the rubric or by this skill.** That rule was
 struck 2026-09-12 on a measurement — 0 of 54 dispatches carried the flag. The
 advisor is an operator decision per session; do not add one to a dispatch
 command.
 ### 5. Verify, then hand it over
--- a/skills/route/SKILL.md
+++ b/skills/route/SKILL.md
@ -14,7 +14,7 @@ description: >-
  the operator names no model and no tool — choosing the model for the next
  session IS this skill. Not for choosing which REPO gets the next session:
  that is the `board` skill.
-version: "0.34.0"
+version: "0.33.0"
 ---
 # route — what the next session should run with
@ -104,7 +104,8 @@ in STATE as an **override**, never as something this skill produces. If Fable
 is the right call for the next step's *form* (big-picture, review, planning),
 write the board line and the `rule` by hand — `board.sh` still parses
 "Fable 5/high" and "Fable 5/xhigh" — and say so plainly in the rationale rather
-than scoring the four traits to land there.
+than scoring the four traits to land there. One fact worth carrying into that
 override: a Fable session runs without an advisor.
 ## The last-session record
@ -185,26 +186,24 @@ Give the operator the two closing-line items and nothing more:
  the working directory is already right. If the next step belongs in a
  different repo, say so in plain words — that is a different tab, not a `cd`.
-**Paste `command` verbatim.** It is the row's whole spelling: model and effort,
+**Paste `command` verbatim, `--advisor opus` included.** The calculator decides
-and nothing else. Do not add flags the calculator did not emit.
+the advisor per row, and it is not decoration: on a Sonnet row it is what lifts
-
+the session to Opus judgement at Sonnet cost, which is what makes the cheaper
-**The advisor is not this skill's to decide.** Until 2026-09-12 the rubric
+`fallback-command` safe to take under quota pressure. Dropping it because it
-appended an opus advisor on some rows; that rule is struck, on a measurement —
+looks like noise silently removes that. Equally, never *add* it to a command
-of 54 dispatches issued 08.–12.09 not one carried it, because sessions are
+that came back without one — an unconditional advisor is the global
-started by hand from the model and effort. The advisor is now an operator
+`advisorModel` setting, which costs quota in every session in every repo and is
-decision per session. Never add `--advisor` to an emitted command on your own
+the failure mode this rule replaces. `route.sh --help` carries the full rule.
 initiative; if the operator asks for one, that is their call and it belongs in
 the handover as what it is — an operator choice, not a rubric outcome.
 If `command` and `fallback-command` are the same as the current session's model,
 say `/clear` is enough instead — but only if no newly installed plugin or skill
 needs a fresh process to be picked up.
-**An advisor the operator asked for is part of that comparison.** It is a
+**`--advisor` is part of that comparison, not an afterthought.** It is a launch
-launch flag, so `/clear` reuses the process and keeps whatever advisor the
+flag, so `/clear` reuses the process and keeps whatever advisor the session
-session started with — a session that is to gain or lose one needs `/exit` and
+started with. If `command` carries `--advisor opus` and this session was not
-a full command, never `/clear`. The rubric never puts it there; the operator
+launched with it, `/clear` is *not* enough — the operator needs `/exit` and the
-does.
+full command, or the advisor silently never appears.
 Do not paste the whole output block. One row, the rule that produced it, the
 command.
--- a/tests/selftest.test.mjs
+++ b/tests/selftest.test.mjs
@ -4,7 +4,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@ -12,31 +12,8 @@ import { fileURLToPath } from 'node:url';
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 const hook = join(root, 'hooks', 'scripts', 'session-start.mjs');
 // Every bash suite already prints its own total on its last line, and this
 // wrapper already runs all five. Capturing that line here is what makes the
 // README's numbers testable without a SECOND copy of the counting: nothing
 // re-counts `check` calls (loops make that undecidable anyway) and nothing
 // re-runs a suite to read a number the run in progress is already printing.
 // The five suites cost 212s sequentially, measured 2026-09-05 under /bin/bash
 // 3.2 - the marginal cost of the README check is zero because it consumes a
 // run that happens regardless.
 const summaries = new Map();
 function runSuite(name) {
  const script = join(root, 'scripts', `${name}-selftest.sh`);
  try {
    summaries.set(name, execFileSync('bash', [script], { encoding: 'utf8' }));
  } catch (err) {
    // Record what the suite managed to print before failing, then let the
    // failure through: a red suite must stay red here, and the README check
    // below still gets a number to compare rather than a silent absence.
    if (typeof err.stdout === 'string') summaries.set(name, err.stdout);
    throw err;
  }
 }
 test('coord bash selftest passes', () => {
-  runSuite('coord');
+  execFileSync('bash', [join(root, 'scripts', 'coord-selftest.sh')], { encoding: 'utf8' });
 });
 // board.sh reads this plugin's mailbox for its INN column, so the board ships
@ -45,7 +22,7 @@ test('coord bash selftest passes', () => {
 // through CLAUDE_PLUGIN_ROOT, so a board.sh that exists only in
 // ~/.claude/scripts/ would be missing on exactly the path production uses.
 test('board bash selftest passes', () => {
-  runSuite('board');
+  execFileSync('bash', [join(root, 'scripts', 'board-selftest.sh')], { encoding: 'utf8' });
 });
 // route.sh is the WRITER for the next-cost field board.sh already reads, so its
@ -54,7 +31,7 @@ test('board bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a calculator proven only elsewhere is unproven on the
 // one path production uses.
 test('route bash selftest passes', () => {
-  runSuite('route');
+  execFileSync('bash', [join(root, 'scripts', 'route-selftest.sh')], { encoding: 'utf8' });
 });
 // pre-state-line-guard.mjs is a PreToolUse hook, so like session-start.mjs it
@ -62,7 +39,7 @@ test('route bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a guard proven only elsewhere is unproven on the
 // path production actually runs.
 test('state-line-guard bash selftest passes', () => {
-  runSuite('state-line-guard');
+  execFileSync('bash', [join(root, 'scripts', 'state-line-guard-selftest.sh')], { encoding: 'utf8' });
 });
 // The order queue is the second channel beside the mailbox, with the opposite
@ -71,7 +48,7 @@ test('state-line-guard bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, so a queue proven only elsewhere is unproven where it
 // runs.
 test('orders bash selftest passes', () => {
-  runSuite('orders');
+  execFileSync('bash', [join(root, 'scripts', 'orders-selftest.sh')], { encoding: 'utf8' });
 });
 // The engine refuses to invent an identity from the cwd, but the hook is the
@ -211,69 +188,3 @@ test('hook keeps mail and orders in separate blocks, mail first', () => {
  assert.ok(ctx.includes('UNTRUSTED DATA'), 'the mail block lost its authorization framing');
  assert.ok(ctx.includes('OPERATOR-AUTHORIZED'), 'the order block lost its authorization framing');
 });
 // --- README's selftest numbers must rot loudly ------------------------------
 //
 // The badge and the five `## Development` comments are the only public claim
 // about how much this engine is pinned by, and they are the number furthest
 // from the meter: they rotted twice in a row (529 from 0.25.0; then a badge
 // saying 868 beside comments summing to 792 - two different wrong sums of the
 // same fact, neither matching the other, on the same screen). Nothing caught
 // either, because nothing compared them to anything.
 //
 // It lives HERE rather than in one of the five bash suites, and the choice is
 // not arbitrary. The order's parenthetical suggested the suite that already
 // pins README/catalog invariants; measured before choosing, no such suite
 // exists - `grep -ln README scripts/*selftest*.sh` returns board-selftest.sh
 // alone, on two incidental hits (a prose comment and a `research/README.md`
 // fixture). Of the places that could host it, this wrapper is the only one
 // where all five numbers exist at once in a run that already happens: a check
 // inside a suite could see its own count but would have to RE-RUN the other
 // four (212s, measured 2026-09-05) to see theirs, and reading counters out of
 // the scripts is the second copy of the counting this check was asked not to
 // be. `check` calls sit inside loops, so a static count is not merely a second
 // copy - it is a wrong one.
 //
 // The truth source is each suite's own summary line, verbatim, and a suite
 // that stops printing one FAILS here rather than being skipped: an absent
 // measurement must not read as a matching one.
 function suiteTotal(name) {
  const out = summaries.get(name);
  assert.ok(out !== undefined,
    `${name}-selftest produced no captured output: its total was never measured, ` +
    'so the README comparison below would be resting on nothing');
  // Two summary grammars, both already in the tree: coord prints
  // `PASS=N FAIL=M`, the other four print `<name>-selftest: N passed, M failed`
  // and orders adds `, S skipped (of T checks)`. README documents the TOTAL
  // number of checks, so skipped ones count.
  let m = out.match(/^\S+-selftest: (\d+) passed, (\d+) failed(?:, (\d+) skipped)?/m);
  if (m) return Number(m[1]) + Number(m[2]) + Number(m[3] ?? 0);
  m = out.match(/^PASS=(\d+) FAIL=(\d+)/m);
  assert.ok(m, `${name}-selftest printed no summary line this parser recognises`);
  return Number(m[1]) + Number(m[2]);
 }
 test('README states the selftest counts the suites actually reported', () => {
  const readme = readFileSync(join(root, 'README.md'), 'utf8');
  const suites = ['coord', 'board', 'route', 'orders', 'state-line-guard'];
  let sum = 0;
  for (const name of suites) {
    const measured = suiteTotal(name);
    sum += measured;
    const line = readme.match(
      new RegExp(`^\\s*bash scripts/${name}-selftest\\.sh\\s+#\\s+(\\d+) checks`, 'm'));
    assert.ok(line,
      `README's ## Development block has no "N checks" comment for ${name}-selftest.sh`);
    assert.equal(Number(line[1]), measured,
      `README says ${name}-selftest has ${line[1]} checks; it reported ${measured}`);
  }
  // The badge is the sum, and it is compared against the MEASURED total rather
  // than against the five README comments: a badge agreeing with five stale
  // comments is exactly the 868-beside-792 shape, one layer down.
  const badge = readme.match(/badge\/selftest_checks-(\d+)-/);
  assert.ok(badge, 'README has no selftest_checks badge to check');
  assert.equal(Number(badge[1]), sum,
    `README's badge says ${badge[1]} selftest checks; the five suites reported ${sum}`);
 });