feat(route,board): strike the advisor rule, add board.sh --row <repo>

Order 20260912T202210Z-7588027378-from-.claude, operator decision 2026-09-12 (helhetlig vurdering av arbeidssystemet, cut row 3 and the board.sh --row improvement row). One order, two parts, one version bump. THE ADVISOR RULE IS STRUCK. route.sh and board.sh --dispatch emit no --advisor at all. The rule fired per ROW on a need - always on the Sonnet rows (a capability lift, which is what made the quota fallback safe to take), and on the Opus rows at reversibility=costly|one-way - and it read well. It was killed by a MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried the flag, because sessions are started by hand from the model and effort rather than from the whole emitted line. A rule nothing honours is not a policy, and an emitted value nobody acts on is decoration in a field whose only job is to be evidence. The advisor is now what it already was in practice: an operator decision per session, said in one sentence in route.sh --help. The comments that rested on the rule were REWRITTEN, not left standing. board.sh --dispatch still refuses a --model/--effort pair, but the reason is no longer "the advisor is a property of the ROW": it is that the rubric has exactly one copy, and a dispatch taking the model directly would be a second, unscored way to reach the same decision - recording no traits, no rationale and no next-cost, so nothing afterwards could say whether the routing or the scoring was wrong. A comment defending a removed mechanism is how the next session restores it. Both skills carry the correction. Pinned as an ABSENCE over the whole trait space - 81 combinations, every line of output, with a known-positive control proving the sweep's grep can find a planted advisor - rather than on four sampled rows, because the claim is that no path emits it. board.sh --dispatch at reversibility=costly is pinned separately: that is the exact input a reintroduced rule would fire on. The literal string is absent from route.sh entirely, including the paragraph recording what was struck (it says "an opus advisor flag" in words), because a blunt grep cannot tell a description from a specification. Backward compatibility is pinned rather than assumed: a route line carrying a legacy advisor= field still parses and still yields a command - measured, 0 of 48 route lines in ~/repos carry one, but a reader that broke on an unknown field would turn last month's STATE.md into "that repo has no route line". The three CLI gates section 14 carried went with the rule; the suite no longer depends on the installed claude at all. board.sh --row <repo> IS THE SEVENTH RENDERING of the same scan, never a second scan, read-only like every other one. (The order calls it the sixth; by this file's own numbering --inbox-plan is the fourth and --dispatch the fifth. Corrected rather than carried wrong.) It exists because the columns WERE misread: on 11.09 the PM read FLY off the table by eye and got it wrong, while every other rendering a program consumes is already key=value. inn, ordre and fly are three separate fields because they are three separate facts; status is the bare token, never the table's blocked>target display, with blocked-on beside it; neste is last and uncut. An unknown repo exits 2 and writes NOTHING to stdout - an empty block would read as a repo whose every column is blank, which is a real and different state. upushet is the ONE field that is not a rendering of the scan, and it is named rather than blended in: nothing in the scan measures it, so it is read once, for the named repo only, and never enters the table, the plan or the briefing. It reads the remote-TRACKING ref, not the remote, so upushet=N honestly means "the local ref says N"; a repo with no upstream reports ?, never 0. The row fixture's three counts are three DIFFERENT integers (3/2/1), and that is the finding worth recording. Built first with 2/1/1, it was mutation-tested by making fly read the ORDRE field - the exact 11.09 misreading - and the check stayed GREEN, because the two fields held the same digit. A fixture that cannot tell two columns apart is the defect wearing a passing test, inside the section written to prevent it. Suites under /bin/bash 3.2, before -> after: coord 257 -> 257, board 393 -> 427, route 73 -> 73 (13 advisor checks and 3 CLI gates out, 15 absence/legacy checks in, and it no longer varies with claude being on PATH), orders 116 -> 116, state-line-guard 54 -> 54. Sum 893 -> 927, README badge updated to the measured sum. npm test 12/12, fail 0. Verified live against the real tree, not only fixtures: --row repo-mailbox reports fly=1 beside ordre=0 (the distinction that was misread), --row on the nested key from-ai-to-chitta/content-sadhguru resolves, and an unknown repo exits 2. No tag, no push, no catalog change - that is the operator's release-plugin.mjs run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(changelog): the 0.33.1 section that was never written
2026-09-12 23:45:47 +02:00 · 2026-09-05 20:34:06 +02:00 · 2026-09-05 20:33:55 +02:00 · 2026-09-05 07:33:36 +02:00 · 2026-09-05 06:49:15 +02:00 · 2026-09-04 21:35:55 +02:00
23 changed files with 4796 additions and 357 deletions
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.28.0",
+  "version": "0.34.0",
  "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
  "author": {
    "name": "Kjell Tore Guttormsen"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -5,6 +5,538 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 ## [0.34.0] - 2026-09-12
 ### Changed
 - **The advisor rule is struck from the rubric: `route.sh` and `board.sh
  --dispatch` no longer emit `--advisor` at all.** It fired on two needs -
  always on the Sonnet rows, and on the Opus rows at `costly|one-way` stakes -
  and it read well. What killed it was a measurement, not a change of taste:
  of 54 dispatches the PM issued 08.-12.09, **zero** carried the flag, because
  sessions are started by hand from the model and effort rather than from the
  whole emitted line. A rule nothing honours is not a policy, and an emitted
  value nobody acts on is decoration in a field whose only job is to be
  evidence. The advisor is now what it already was in practice: an operator
  decision per session, said in one sentence in `route.sh --help`. The
  direction is the safe one for the single thing the old rule protected - the
  quota fallback is still exactly one row cheaper, it just no longer implies a
  capability lift nobody was taking.
 - **The comments that rested on it were rewritten, not left standing.**
  `board.sh --dispatch` still refuses a `--model`/`--effort` pair, but the
  reason is no longer "the advisor is a property of the ROW": it is that the
  rubric has exactly one copy, and a dispatch taking the model directly would
  be a second, unscored way to reach the same decision - one recording no
  traits, no rationale and no `next-cost`, so nothing afterwards could say
  whether the routing or the scoring was wrong. A comment defending a
  mechanism that has been removed is how the next session restores it.
  `skills/route/SKILL.md` and `skills/dispatch/SKILL.md` carry the same
  correction.
 - Pinned as an ABSENCE over the whole trait space rather than on sampled rows -
  81 trait combinations, every line of output, with a known-positive control
  proving the sweep's grep can find a planted advisor - plus `--dispatch` at
  `reversibility=costly`, the exact input a reintroduced rule would fire on.
  Backward compatibility is pinned too: a route line carrying a legacy
  `advisor=` field still parses and still yields a command (measured the same
  day: 0 of 48 `<!-- route:` lines anywhere in `~/repos` carry one, so nothing
  in circulation depends on it - but a reader that broke on an unknown field
  would turn last month's STATE.md into "that repo has no route line").
 ### Added
 - **`board.sh --row <repo>`: the table's row for one repo, as `field=value`
  lines.** A seventh rendering of the same scan, never a second scan, and
  read-only like every other one. The motivation is a measured misreading: on
  11.09 the PM read the FLY column off the table **by eye** and got it wrong.
  Every other rendering a program consumes (`--plan`, `--inbox-plan`,
  `--dispatch`) is already `key=value`; the default view was the one left out,
  and a 34-character repo key already shifts a row two characters right, which
  makes counting spaces worse than it looks. `inn`, `ordre` and `fly` are three
  separate fields because they are three separate facts, and confusing them is
  what this exists to close. `status` is the bare token, never the table's
  `blocked>target` display, with `blocked-on` beside it; `neste` is last and
  uncut, for the same reason it is last in the record. An unknown repo exits
  **2** and writes nothing to stdout - an empty block would read as a repo whose
  every column is blank, which is a real and different state.
 - `upushet=` is the one field that is **not** a rendering of the scan, and it is
  named rather than blended in: nothing in the scan measures it, so it is read
  once, for the named repo only, and never enters the table, the plan or the
  briefing. It reads the remote-TRACKING ref, not the remote, so `upushet=N`
  honestly means "the local ref says N"; a repo with no upstream reports `?`,
  never `0`, because "nothing is waiting to be pushed" and "nobody looked" are
  exactly the pair this engine refuses to render alike.
 ### Fixed
 - **README's selftest numbers were re-measured, not re-derived.** The badge said
  `selftest_checks-868` and the five `## Development` comments said
  220/360/73/99/40 = 792 - two different wrong sums on the same public surface,
  neither matching the other. The five suites were run under `/bin/bash` (3.2)
  on `b57a1ea` and reported `coord 257`, `board 393`, `route 73`, `orders 116`,
  `state-line-guard 54` = **893**, 0 failed in every summary. 0.33.0's entry
  below records 257+368+73+116+54 = 868 and was true when written; 0.33.1 added
  25 board checks (368 -> 393) without re-summing, and the comment block had been
  stale far longer. No code, no version bump: the number furthest from the meter
  rots first, and only the number moved.
 ## [0.33.1] - 2026-09-04
 ### Added
 - **A git repo nested under a depth-1 repo now enters the board, on a STATE.md
  and nothing wider.** Discovery adds a depth-1 repo and stops, and the
  else-branch container scan - the only place children are ever looked at - is
  unreachable for an entry that is itself a repo. Measured before anything was
  written: **12 nested repos across the real tree, exactly 1 with a STATE.md**
  (`from-ai-to-chitta/content-sadhguru`, which had been running work and
  reporting to nobody). The other 11 are vendored or experimental checkouts and
  stay invisible on purpose - they do not even reach the `UTEN STATE.md` bucket.
  `add_nested_repos()` sits beside `add_dot_repos()` rather than widening the
  `*` loops, for the same reason ordre `20260818T124828Z` gave for dot repos:
  routing a depth-1 repo into the container branch would admit every nested
  checkout. One level only; depth 3 is pinned as NOT admitted. A dot-prefixed
  depth-1 repo gets the same nested scan, since nothing in the criterion
  distinguishes it.
  A nested repo carries **two names**, and conflating them would have put a
  fabricated 0 in three columns. The board KEY is `<parent>/<child>`; the
  MAILBOX name is `basename(git toplevel)`, so `$COORD/<parent>/<child>/inbox`
  finds no directory and INN/ORDRE/FLY would read 0 for a repo that may have
  mail. The record loop carries `mbox` beside `name`, and `--voyage`'s order
  lookup takes `basename($vy_dir)`. Which directories are nested is RECORDED by
  discovery (`NESTED_LIST`), never re-derived from "is my parent a repo?".
 - **The scan reports its own denominator.** `undersoekt: N katalog(er) depth 1,
  M polyrepo-container(e), K nestede repo (J med STATE.md tatt med).` The header
  count answered how many repos were found and nothing about how many were
  looked at, so a criterion excluding 11 of 12 nested repos was invisible on the
  surface built to show it. Real tree 2026-09-04: `43 / 5 / 12 (1 tatt med)`. A
  non-repo dot-directory counts in N and never in M - the line is a denominator,
  not a partition.
 ### Fixed
 - The denominator line's own wording broke an existing check: `polyrepo
  container itself is not listed as a repo` grepped the whole output for
  `polyrepo` and matched the new footer's `polyrepo-container(e)` - the same
  class as a grep reading a comment that EXPLAINS a pattern as an instance of
  it. Now anchored at column 1, which is what it always meant.
 ### Known gaps, stated rather than closed
 - The mailbox-keyed JOINs (`$OWED`, `brief_orphans`, `--inbox-plan`) still key
  on the board name, so a nested repo owing a reply gets no debt tab and is
  listed under `UTENFOR REPO-SKANNEN`. Neither created nor worsened here: before
  this change the repo was absent from `RECORDS` entirely, so both readings were
  already exactly as wrong.
 - A 34-character key overflows the table's `%-32s` REPO column, shifting that
  row two characters right. Same class as `Fable 5.1/xhigh` in KOST; parsing is
  unaffected, and widening the column moves three `cut -c89-` selftest helpers.
 - A dot-prefixed NESTED repo is not looked for. The combination was neither
  measured nor ordered.
 ### Testing
 - `board-selftest.sh` 368 -> 393 checks.
 ## [0.33.0] - 2026-09-04
 ### Added
 - **The FYI sweep is scheduled. Invocation was the gap, not the mechanism.**
  `coord-sweep.sh` shipped in 0.10.0 and had never run once against the real
  mailbox. Measured 2026-09-03 with a denominator
  (`docs/2026-09-03-coordination-debt-measurement.md`): 55 mailbox directories,
  52 carrying an `inbox/`, 27 pending directed messages - of which **23 were
  pure notices**, re-injected at every session start in repos nobody had
  opened. The script was correct and unreachable.
  The order behind this (WP5, `20260902T113745Z-1254925290`) asked for a
  mechanism and named two candidates; the measurement chose neither, and the
  first session returned the order saying so. Bulk-ack for pure notices *was
  already built* - it is this script - so building the second candidate would
  have been two copies of one policy. The broadcast class converges on its own
  (reading sets `seen`), and 34 of 263 unread pairs belong to two mailboxes no
  session can hold, so a TTL would have **closed** those rather than reduced
  them. The operator then chose the window and authorized the schedule.
  `launchd/com.ktg.repo-mailbox-sweep.plist` runs `--write --days 14` daily at
  05:30. That is the entire behavioural change; no new mechanism was built.
 - **The 14-day window is written out in the plist, not inherited from the
  script's default.** It is a policy constant chosen on a measured distribution
  (30 days would have closed 0 messages, 14 closed 7, 7 would have closed 13),
  of the same class as the STATE.md line limit. Leaving it implicit would let a
  later change to `DAYS=14` silently change what an unattended job closes every
  night across every other mailbox on this machine.
  It runs at 05:30, clear of the 06:00 briefing agent, because the briefing
  scans the same mailbox this mutates and the two must not overlap. It does
  **not** change what the briefing reports as debt: since 0.22.0 that figure
  comes from `coord-count.sh`'s `owed` column, and this sweep closes only
  messages that owe nothing. What moves is the raw pending count — the table's
  `INN` column and the volume injected at every session start. Selftest section
  38 asserts the two agents never share an hour.
 - **coord-selftest.sh section 38 pins the launchd templates (+15 checks, 242 ->
  257).** A wrong program path in a plist is the one defect here that nothing
  catches at runtime: the agent loads cleanly and then silently never runs -
  no output to be wrong, no exit status to read, a failure indistinguishable
  from a quiet machine. `launchctl list` proves an agent is *loaded*, never
  that it is *right*.
  The section covers **every** plist in `launchd/`, not just the new one: the
  plist grammar gets one reader here rather than one per agent, which is the
  two-copies-of-one-policy defect this repo has named repeatedly.
  `board-selftest.sh` section 9 still owns `brief-nightly.sh`'s behaviour. Each
  plist must name a script that exists in this checkout, carry a `Label`
  matching its filename, keep its `__CHECKOUT__`/`__HOME__` placeholders (the
  repo is mirrored publicly, and a plist is the one file that would otherwise
  need an absolute home path), and never point into the version-pinned plugin
  cache.
  The cache assertion runs on the **extracted program path, never the whole
  file** - caught by the check itself on its first run: the brief plist's header
  explains in prose why it does *not* point at the cache, and a file-wide grep
  read that explanation as the defect it warns about. Same shape as the board
  line, where prose saying `status=done` must never trigger the done-guard.
  Four controls are mandatory here and present: the extractor really does read
  a path, a plist naming a missing script is judged missing, a `Label`
  disagreeing with its filename is caught, and a program path inside the plugin
  cache is caught. Mutation-verified against the real file: a one-letter typo
  (`coord-sweeep.sh`) turns exactly that check red.
  XML well-formedness is deliberately **not** checked. `plutil` is not
  coreutils, and malformed XML already fails loudly at `launchctl load` - the
  opposite of the silent failure this section exists for. Both files were
  linted by hand at 0.33.0.
 ### Fixed
 - **The README's selftest-checks badge had read 529 since 0.25.0; the real
  total is 868.** A stale count in the one place a reader takes as the
  headline number, corrected while adding to it: 257 + 368 + 73 + 116 + 54.
 ## [0.32.1] - 2026-09-03
 ### Fixed
 - **A pending order's age is read from the FILENAME, never the mtime.**
  `coord-order-done --return` rewrites the order file's mtime, and both age
  surfaces read mtime, so returning an order reset the very reading that says
  how long it has waited. An order returned three times could never look old.
  Found by reading the board immediately after this repo returned an order of
  its own: a file whose name says 2026-09-02 rendered `ORDRE 1:0d` and
  `pending, 0d old` minutes later. The filename is written once, at delivery,
  and nothing rewrites it - which is exactly the fact "how long has this sat
  with no owner" is asking about.
  Two questions, two sources, and the second one does not move: a CLAIMED
  order's age is "how long has it been in flight", which is the claim's own
  mtime and was already right. `board.sh` gains `oldest_pending_age()` beside
  `oldest_order_age()`; `coord-order-inbox.sh` gains `pending_age_of()` beside
  `age_of()`. Switching FLY to the filename would answer the delivery question
  in the column that asks the flight question.
  An unparseable filename yields `?` for the whole reading, never a fabricated
  `0` - the same fail-safe the mtime path already carried, and for the same
  reason: an unmeasured order could be the oldest one.
  Pinned by `orders-selftest.sh` section 11 (116 checks, up from 110) and
  `board-selftest.sh` section 30 (368, up from 360), each with its ground truth
  asserted before anything depends on it and with known-positive controls that
  a freshly delivered order still reads `0d` and that FLY did not move.
  Mutation-verified in both files: restoring the mtime read turns exactly the
  defect checks red and leaves every control green.
  Section 28's fixtures were rewritten as part of this, not incidentally: they
  encoded their intended ages in `touch -t` with fixed 2026-01/2026-08
  filenames, which a filename-based reading makes wrong and time-dependent.
  They now compute their stems from `date -v`, and the section asserts two
  ground truths - the filename for ORDRE, the mtime for FLY - because the two
  columns no longer read the same source.
 ## [0.32.0] - 2026-09-01
 Two commits, and the first of them was already written when this release
 started: `board.sh --voyage` landed on 2026-08-31 and then sat one step past
 `v0.31.0`, unreleased AND unpushed. Every entry point on this machine runs the
 version-pinned plugin cache, so the feature existed in git and did not exist
 for anyone using it. That gap is the reason both changes ship together - they
 are the same plugin and the same bump.
 ### Added
 - **`board.sh --voyage` reports the Voyage briefs in flight** (committed
  2026-08-31, released here). A sixth rendering of the same read-only scan.
  `board` reads STATE lines, which say nothing about a brief, so a programme
  running Voyage across several repos had no shared surface at all: nobody
  could answer which briefs were running, in what phase, and who was waiting on
  whom. Detection is by PROPERTY, never by directory name - a directory counts
  only if it holds `brief.md` or `brief.md.draft` under one of the three
  planning locations the convention recognises - and it walks the FILESYSTEM,
  never the git index: `llm-ingestion-okf` gitignores `.claude/projects/`, so
  `git ls-files` would have reported zero briefs in the one repo actually
  running one. The phase ladder measures ARTIFACTS, not sessions, and says so
  in its legend; three fields refuse to let an absence borrow the shape of a
  measurement (`kvalitet=-` is never `complete`, `research=-` is not
  `research=0`, and the rendering always prints its own denominator). A
  matching `VOY` column sits beside `ORDRE` and `FLY`, never summed with them.
 ### Fixed
 - **`route.sh --last-model` now accepts `Fable 5.1`, and the set stays
  CLOSED.** Fable 5.1 shipped 2026-09-01 and the three-value set refused it, so
  a session that actually ran it could not record what it ran: the record was
  either omitted or written as a name already in the set. A lied record reads
  back months later as a measurement rather than as the gap it is, which is the
  failure mode of the one field whose entire purpose is to be believed later.
  Two boundary decisions were taken rather than deferred. `Fable 5` is KEPT -
  not for backward compatibility (measured: exactly 1 of 45 `route-last` lines
  on this machine carries it) but because `route.sh`'s own row table spells
  rows 5-6 `Fable 5/high` and `Fable 5/xhigh`, so dropping it would make the
  script refuse to record a name its own spec writes. And the set was WIDENED
  rather than replaced by form validation: a `<family> <digits>[.<digits>]`
  pattern would still catch a misspelled family, but would stop catching a
  version that does not exist, letting `Fable 5.2` and `Opus 7` read back as
  evidence that a model ran when it never shipped. The selftest pins that
  choice - `Fable 5.2` / `Fable 6` / `Fable 5.10` are rejected beside the new
  accept case - so a later switch to form validation fails there instead of
  quietly widening what the record can claim. The die message now names the
  repair, since the cost of a hand-maintained list is exactly what was paid
  here.
  Not touched: the row table (still six rows, still emitting only 1-4, Fable
  still a hand-written override) and the note that a Fable session runs without
  an advisor because the CLI does not enforce it.
  Known gap, stated rather than closed: `Fable 5.1/xhigh` is 15 characters and
  overflows `board.sh`'s `%-14s` KOST column, shifting the rest of that row one
  column right. Parsing is unaffected and is now pinned by the round-trip
  section. Widening the column was not ordered in this session and is reported
  rather than made.
 `route-selftest.sh`: 69 -> 73 checks. The other four suites are unchanged
 (coord 242, board 360, orders 110, state-line-guard 54).
 ## [0.31.0] - 2026-08-29
 Two commits landed after `v0.30.0` and, as with that release, neither reaches
 anyone until the tag exists: every entry point on this machine runs the
 version-pinned plugin cache, not the tree. Minor rather than patch because the
 board's table gained a reading it did not have - the age of the oldest queued
 order - while the other change repairs a consumer that was ignoring a signal
 the engine already sent.
 Both are the same class the previous release closed and this one continues: a
 failed or missing measurement rendering as a reassuring value.
 ### Added
 - **`ORDRE` and `FLY` now carry the AGE of the oldest order, rendered `N:Md`.**
  Reading the board, `ORDRE 2` used to look identical whether both orders
  arrived yesterday or both had sat for ten days. The problem was never that
  orders wait - that is a prioritisation call owned by humans - it was that no
  cross-repo surface showed the wait at all: `coord-order-inbox.sh` reports an
  age, but only inside the one repo at SessionStart, so a repo nobody opens
  shows nobody anything. Measured across the live mailbox 2026-08-29: 30
  pending orders over 22 repos, 5 of them ten days old. The age is the OLDEST
  order, never the newest and never a mean - a repo holding one fresh order and
  one ten-day-old order has a ten-day-old problem, and the newest reading is
  exactly what would hide it. `FLY` carries the same reading, where it matters
  at least as much: nothing un-claims an order when the session that took it
  dies. An empty queue still prints a bare `0` ("no orders" and "an order that
  arrived today" are different facts), and an unreadable mtime prints `?` for
  the whole reading rather than silently skipping a file that could have been
  the oldest one.
  The age is DISPLAY only. It is deliberately not in the sort, and `--plan`'s
  `fly=` and every other emitted `key=value` block are untouched, so nothing
  that parses this board changes shape.
 ### Fixed
 - **`board.sh` listened to `coord-count.sh`'s output and ignored its exit
  status, so the failure signal 0.30.0 had just built stopped at the
  producer.** Every call site piped the counter into `awk`, and a pipeline
  reports the last stage's status, so exit 3 - "the mailbox root you named is
  not there; this is not a count of zero" - was discarded each time. Measured
  on the shipped 0.30.0 against a mailbox root that does not exist:
  `coord-count.sh` said "not counted, not zero" and exited 3, while
  `board.sh --brief` answered "Ingen repo skylder noen et svar i dag." and
  `--plan` emitted no warning key at all. For a reader that meant a briefing
  confidently reporting that nobody owes anyone a reply, on the basis of a
  measurement that never happened.
  The board now reports the failure at all five places it speaks, and keeps the
  two causes apart - a missing sibling script and a mailbox root that is not
  there are different repairs. A partial count captured before a failure is
  discarded rather than shown, because a half-count also looks measured. The
  table and `--plain` views are unchanged: they never invoked the counter, and
  now say so instead of implying a measurement nobody attempted.
  Bounded gap, stated rather than closed: the table's own `INN`/`ORDRE`/`FLY`
  columns count with `ls` and read 0 for every repo when the mailbox root is
  absent. Same shape, one source over, and not a `coord-count.sh` consumer -
  named here rather than silently widened into.
 ## [0.30.0] - 2026-08-26
 Two commits landed after `v0.29.0` and neither is reachable: every entry point
 on this machine runs the version-pinned plugin cache, not the tree. Minor
 rather than patch because the behaviour is EXTENDED, not merely repaired -
 `coord-count.sh` and `board.sh` gained a new exit status and the state-line
 guard gained an environment variable. Exit codes are a contract, and the
 installed cache still runs the old one.
 All five defects here are the same class: **a failed measurement rendering as
 a reassuring value** - a broken or uninstrumented query returning a
 positive-looking null, consumed as a fact about the world.
 ### Fixed
 - **`coord-count.sh`: a mailbox root that does not exist was byte-identical to
  one where nobody has pending mail** - zero lines on stdout, exit 0, nothing
  on stderr. `board.sh` consumes that TSV. The contract is now three statuses:
  0 = counted, 2 = usage error, **3 = mailbox root absent**. 3 rather than 2 on
  purpose: 2 already means "you called me wrong" and this means "the world you
  named is not there" - two different repairs, and a consumer that only ever
  sees one integer cannot tell them apart. Both nonzero paths print NOTHING on
  stdout, so neither can be mistaken for a count of zero. What the old
  "always 0" claim protected is kept and made precise: no state OF THE MAILBOX
  can produce a nonzero exit, so a SessionStart still cannot be failed by mail.
  An existing-but-empty root stays a silent, clean 0, and the selftest pins
  that silence as hard as it pins the failure.
 - **`coord-count.sh`'s header promised exit 0 unconditionally, and that was
  already false** - `--exclude` with no value exited 2 - so the documented
  contract contradicted code a reader could run. The header text is now pinned
  by a check of its own: a doc line nothing tests is a doc line that drifts,
  which is how this one drifted.
 - **`board.sh`: `git status --porcelain | wc -l` yields zero lines whether the
  tree is CLEAN or git refused to answer**, so DRT printed **0** and every
  reader took it as "nothing uncommitted here". Reachable, not theoretical:
  discovery tests `.git` with `-e` so worktrees are found, and a worktree whose
  parent checkout was deleted exits 128. The exit status is now the
  discriminator and an unmeasured tree reads **`?`** - the same token
  `coord-count.sh` already uses for an age it could not compute.
  **The fix was worthless without its two awk consumers, and one of them is
  the point:** `--plan`'s free-capacity test compared `$7 + 0`, and `"?"`
  coerces to **0** in arithmetic - so an UNMEASURED tree would have been
  certified as free capacity. That is the defect reappearing one layer down,
  wearing the fix as a disguise. It now compares the field as a STRING against
  exactly `"0"`; only a tree measured clean is clean. The SUM roll-up, where a
  `?` would silently add 0, now NAMES the repos it could not add.
 - **`board.sh`: a scan root that does not exist was skipped in silence**, so a
  typo in `--roots`, a moved home directory and a genuinely empty tree were one
  single output with the denominator never reported. Every bad root is now
  named on stderr; the exit status changes only when NO root was scanned at all
  (**3**, for the same reason as above). A mix still exits 0 and still prints
  the board - some repos really were scanned. This REPLACES an older assertion
  reading `check "missing root is a clean no-op"`: the defect encoded as a
  passing test, which is why nothing ever caught it. `brief-nightly.sh` needs
  no change and gains from this - it already treats a nonzero `--brief` as
  failure and keeps yesterday's briefing, so a mistyped root now preserves the
  file instead of overwriting it with an empty render.
 ### Added
 - **`CLAUDE_STATE_MAX_LINES` overrides the state-line guard's limit**, the same
  kind of knob `CLAUDE_COORD_DIR` is for the mailbox root. As a bare constant
  the limit forced every boundary fixture to hardcode the number the code
  carried - two copies of one policy, both rewritten by hand the last time the
  operator moved it (60 -> 120). It is **not** a bypass claim; this guard has
  always been escapable by writing the file another way. The one thing it must
  never do is silently fail to take effect, so an UNUSABLE value (`""`, `"0"`,
  negatives, anything not made of digits) **denies with a message naming the
  variable** instead of falling back to 120 - a caller who set it and got the
  default anyway would be reading a limit that was never in force.
 ### Changed
 - **The README's Install block is now fenced (` ```bash `)** while the rest of
  the README keeps its indented blocks. The org-side D-census reported this
  repo as the only plugin of 12 with no start command; the premise was
  imprecise - the lines were present, indented - but the finding held, because
  the machine-readable entry point keys on a fenced block and 10 of 11 sibling
  plugin READMEs use one. Measured before and after: 11 of 11 now match. Only
  the Install block was converted; the other 39 indented blocks were not
  ordered changed and converting them would bury a two-line fix in a
  whole-file diff.
 ### Known gaps, stated rather than closed
 - `coord-inbox.sh:57` and `coord-order-inbox.sh:60/64` carry the identical
  `[ -d "$COORD" ] || exit 0` shape that was fixed in `coord-count.sh`. The
  denominator was measured, not estimated, and they were deliberately left
  alone: they are the INJECTION path, their output is prose a session reads
  rather than a TSV a program parses, and their contract really is "never fail
  a SessionStart".
 - `board.sh` does not yet CONSUME `coord-count.sh`'s new exit 3. The signal
  exists; the `HAVE_COUNT` machinery does not read it. Tracked as separate
  work rather than widened into this release in silence.
 ### Testing
 Suites at this release, verified under system bash 3.2 (not Homebrew 5.3):
 coord 242, board 300, route 69, orders 110, state-line-guard 54; `npm test`
 11/11. Every design choice above was mutation-tested, and every negative check
 carries a known-positive control - one selftest section's first cut was
 VACUOUSLY green (wrong basename, plus a fixture path that was never exported)
 and is recorded in `CLAUDE.md` rather than quietly fixed.
 ## [0.29.0] - 2026-08-23
 Answers a question the board could not answer before: which repos are finished
 and can take more work. Ordered as an investigation, not as a column - the
 argument for what was NOT built is in
 `docs/2026-08-23-free-capacity-investigation.md`.
 ### Added
 - **`FLY` column: orders in flight (`orders/claimed/`).** `ORDRE` counted
  pending orders only, so a repo holding one order in flight and a repo holding
  no orders at all both printed `0` - the same digit for two opposite facts.
  Measured the day this was ordered: two panes stood open and idle for 45 hours
  holding finished orders, with full quota authorised, and no column reported
  it. FLY is the same queue in its other state, never summed with ORDRE and
  never a fourth axis.
 - **`--plan` names free capacity**: `ledig_antall=N` plus one
  `ledig=<repo> (<status>)` line per repo with nothing owed, no pending order,
  nothing in flight, a clean tree, at `done` or `deferred`. Such a repo has no
  next step to open a tab for and used to fall out of the plan silently. All
  four conditions are required - measured on the real tree, 4 of 17
  done/deferred repos were not free. Emitted as LINES, never blocks: the plan's
  second consumer discards a block with no `tab=`, so a block would be visible
  to the operator and invisible to the driver. The count prints at 0, so "none
  found" and "not computed" cannot render the same.
 - **`fly=N` on a tab block** whose repo already holds a claimed order. The
  driver types into live panes.
 ### Unchanged, deliberately
 - **No process inspection.** `pgrep`/`ps`/`lsof` were considered and refused,
  and the selftest now asserts their absence structurally with a known-positive
  control. Every other column is a durable filesystem fact reproducible in a
  fixture tree; a process column measures one instant on one machine, needs
  `lsof` to map a process to a repo, and rests on a CPU-vs-elapsed THRESHOLD -
  which would make the board decide a session is dead, the same thing the order
  queue is already forbidden from doing.
 - **FLY does not mean a session is alive**, and the on-screen legend says so.
  Nothing un-claims an order when the session that claimed it dies: one order on
  the live mailbox had been claimed for 117 hours. Selftest section 24 pins the
  denial as a check on the legend text.
 ### Known gap, stated rather than closed
 An open, idle pane in a `planned` repo with no claimed order and no queued work
 is still invisible, and cannot be seen from the filesystem at all. Closing it
 needs a terminal-side measurement supplied inward by the driver that already
 probes panes - the same direction `--dispatch --target-pane` already uses.
 ## [0.28.0] - 2026-08-20
 Five fixes were committed and pushed after `v0.27.0` and none of them was
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -16,7 +16,7 @@ marketplace plugin. Three components, one boundary:
  `coord-done.sh` archives, `coord-count.sh` counts without delivering,
  `coord-sweep.sh` closes the aged FYI backlog machine-wide.
  Everything is pinned by `coord-selftest.sh`
-  (230 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
+  (257 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
  **`ktg-plugin-marketplace` is a RETIRED `--to` address (operator decision
  2026-08-15), rejected rather than redirected.** It is a polyrepo directory,
@ -94,6 +94,62 @@ marketplace plugin. Three components, one boundary:
  the class, defaulting to `--write`, or dropping the log each independently
  turn this from a bounded cleanup into silent data loss.
  **Order 20260902T113745Z-1254925290 (WP5, 2026-09-02, amended by the operator
  2026-09-03): the sweep was CORRECT AND UNREACHABLE, and the fix is a schedule,
  not a mechanism.** It shipped in 0.10.0 and had never run once against the
  real mailbox. Measured 2026-09-03 with a denominator
  (`docs/2026-09-03-coordination-debt-measurement.md`): 55 mailbox directories,
  52 with an `inbox/`, 27 pending directed messages, of which **23 were pure
  notices** being re-injected at every session start in repos nobody had opened.
  The order asked for a mechanism and named two candidates; the measurement
  chose neither, and the session returned it saying so. Bulk-ack for pure
  notices *was already built* - this script - so building the order's candidate
  B would have been two copies of one policy; and the broadcast class converges
  on its own (reading sets `seen`), with 34 of 263 unread pairs belonging to two
  mailboxes no session can hold, so a TTL would have **closed** those, not
  reduced them. `launchd/com.ktg.repo-mailbox-sweep.plist` is the entire
  0.33.0 change. **Invocation was the gap.**
  **The 14-day window is written OUT in the plist, never left to the script's
  default.** It is a policy constant the operator chose on a measured
  distribution (30d -> 0 messages, 14d -> 7, 7d -> 13), of the same class as the
  STATE.md line limit - so a later change to `DAYS=14` in the script must not
  silently change what an unattended nightly job closes across every other
  mailbox on this machine. (A hard count belongs in the dated measurement doc,
  not here: it was 52 with an `inbox/` on 2026-09-03 and 53 a day later.)
  The agent runs at **05:30**, clear of the 06:00 briefing agent, because the
  briefing scans the same mailbox this mutates; selftest section 38 asserts the
  two hours differ. It does **not** change the briefing's DEBT figure - since
  0.22.0 that is read from `coord-count.sh`'s `owed` column, and this sweep
  closes only messages that owe nothing, so the debt listing is byte-identical
  before and after. What moves is the raw pending count (the table's `INN`
  column, `--brief`'s FYI-only naming, and the volume injected at every session
  start). The first cut of this paragraph claimed the sweep made the briefing
  report "the debt that remains" - an overclaim, caught in review, and recorded
  here because it is the kind of plausible sentence that survives a reread.
  **`launchctl list` proves an agent is LOADED, never that it is RIGHT, and a
  wrong program path is the one defect in this repo that nothing catches at
  runtime** - the agent simply never runs, in silence, with no output to be
  wrong and no exit status to read. Two separate things close it, and neither
  substitutes for the other: `launchctl start <label>` plus a line appearing in
  the launchd log is the only *runtime* proof the path resolves, and selftest
  **section 38** asserts *statically*, for every plist in `launchd/`, that the
  path names a file that exists here, that `Label` matches the filename, that
  the `__CHECKOUT__`/`__HOME__` placeholders survive (the repo is mirrored
  publicly), and that no agent points into the version-pinned plugin cache.
  Section 38 covers **every** plist rather than only the new one, deliberately:
  the plist grammar gets one reader here instead of one per agent, and
  `board-selftest.sh` section 9 keeps owning `brief-nightly.sh`'s *behaviour*.
  The cache assertion runs on the **extracted path, never the whole file** - the
  brief plist's header explains in prose why it does not point at the cache, and
  a file-wide grep read that explanation as the defect it warns about, exactly
  as prose saying `status=done` must never trigger the board's done-guard.
  XML well-formedness is deliberately NOT checked: `plutil` is not coreutils,
  and malformed XML already fails loudly at `launchctl load`, which is the
  opposite of the failure this section exists for. Mutation-verified: a
  one-letter typo (`coord-sweeep.sh`) turns exactly that check red.
  **`coord-count.sh` prints TWO integers per mailbox** (`<name>\t<pending>\t<debt>`),
  and the first must stay pending: `board.sh` counts the same inbox files
  itself, so a debt-only count would put two different numbers under one name.
@ -102,6 +158,39 @@ marketplace plugin. Three components, one boundary:
  field means a reply IS owed, because every message written before 0.11.0
  lacks it.
  **F5+F14 (2026-08-26): the header promised exit 0 unconditionally, and both
  halves of that were false - one of them silently.** `--exclude` with no value
  already exited 2 (F14), so the documented contract contradicted the code a
  reader could run. Worse, `[ -d "$COORD" ] || exit 0` (F5) made a mailbox root
  that DOES NOT EXIST byte-identical to one where nobody has pending mail: zero
  lines on stdout, exit 0, nothing on stderr. `board.sh` consumes this TSV.
  That is Verifiseringsloven ansikt 4 in the transport itself - a broken query
  returning a positive-looking null, read as a fact about the world. The
  contract is now three statuses: 0 = counted, 2 = usage error, 3 = mailbox root
  absent. **3 rather than 2 on purpose:** 2 already means "you called me wrong"
  and this means "the world you named is not there" - two different repairs,
  and a consumer that only ever sees one integer cannot tell them apart. Both
  nonzero paths print NOTHING on stdout, so neither can be mistaken for a count
  of zero. What the old "always 0" claim was protecting is kept and made
  precise: no state OF THE MAILBOX can produce a nonzero exit - not an empty
  root, not a malformed message, not an unreadable date - so a SessionStart
  still cannot be failed by mail. An EXISTING but empty root stays a silent,
  clean 0, and selftest section 36 pins that silence as hard as it pins the
  failure: a warning on the ordinary path would train every reader to ignore
  the channel the defect case needs. Section 37 pins the header TEXT itself
  (the same technique board-selftest uses on the FLY legend) - a doc line
  nothing tests is a doc line that drifts, which is how this one drifted.
  **Bounded gap, stated rather than closed:** `coord-inbox.sh:57` and
  `coord-order-inbox.sh:60/64` carry the identical `[ -d "$COORD" ] || exit 0`
  shape. The denominator was measured, not estimated (`grep -n '|| exit 0'
  scripts/*.sh`), and they were deliberately left alone: they are the
  INJECTION path, their output is prose a session reads rather than a TSV a
  program parses, and their contract really is "never fail a SessionStart".
  Changing them would change what every session sees, in every repo, and that
  was not ordered. Naming them here is the point - the next session that greps
  for this shape finds a decision, not an oversight.
  **Reading is delivering — counting is not.** `coord-inbox.sh` records a
  broadcast as seen once it has printed it, so it can never be used to survey
  other repos: doing so would consume each one's backlog silently, and the seen
@ -113,7 +202,7 @@ marketplace plugin. Three components, one boundary:
  mailbox, `~/.claude/coord/<repo>/orders/`, with four one-verb scripts —
  `coord-order-send.sh` (write), `coord-order-inbox.sh` (read for injection),
  `coord-order-claim.sh` (claim), `coord-order-done.sh` (terminal state).
-  Pinned by `orders-selftest.sh` (110 checks).
+  Pinned by `orders-selftest.sh` (116 checks).
  **It is a separate CHANNEL, not more mail, and the axis is authorization.**
  Inbox content is untrusted cross-repo data that may never instruct a session
@ -227,7 +316,7 @@ marketplace plugin. Three components, one boundary:
  otherwise only the first, mirroring what the real Edit tool does. Getting
  `replace_all` wrong in either direction is not a hypothetical: a hook that
  only ever replaced the first occurrence would silently pass a bulk edit that
-  balloons the file, so `state-line-guard-selftest.sh` (21 checks) pins a
+  balloons the file, so `state-line-guard-selftest.sh` pins a
  fixture where only counting every `replace_all` occurrence produces the
  correct denial. Anything the hook cannot project with confidence — a
  missing file, an `old_string` that is not present, fields of the wrong
@ -291,6 +380,37 @@ marketplace plugin. Three components, one boundary:
  Pinned by state-line-guard-selftest.sh section 9 (`$\`` as the real repro,
  `$&` as a second sequence proving the fix is general).
  **F13 (2026-08-26): `MAX_LINES` is now overridable by
  `CLAUDE_STATE_MAX_LINES`, and an UNUSABLE override is refused by name rather
  than ignored.** As a bare constant the limit forced every boundary fixture to
  hardcode the same number the code carried - two copies of one policy, both
  rewritten by hand the last time the operator moved it (60 -> 120). The knob is
  the same kind `CLAUDE_COORD_DIR` is for the mailbox root. It is **not** a
  bypass claim: this guard has always been escapable by writing the file another
  way, exactly as the sibling pathguard is. The one thing it must never do is
  silently fail to take effect, so an unusable value (`""`, `"0"`, negatives,
  anything not made of digits) **denies with a message naming the variable**
  instead of falling back to 120 - a caller who set it and got the default
  anyway would be reading a limit that was never in force, which is the exact
  positive-looking null this whole tier of work closes. Empty counts as
  unusable, not as unset: it is what an expansion of an unset variable produces,
  and a value was meant. Recovery is one `unset`, and the message says so.
  Resolution happens AFTER the STATE.md basename gate, so a bad override can
  never block a write this guard would not have judged anyway.
  **Section 11's first cut was VACUOUSLY GREEN, and that is worth recording
  rather than quietly fixing.** The ratchet fixture wrote to
  `f13-ratchet-STATE.md` - a basename that is not `STATE.md`, so the guard
  allowed the write without measuring anything - and its path variable was not
  exported when `node` read it, so the fixture file was never created either.
  Two independent faults, one passing check, testing nothing. It was caught by
  an `ERR_INVALID_ARG_TYPE` trace in `npm test` output that a green summary
  line would otherwise have buried. The section now asserts its own ground
  truth (the oversized file really is 40 lines) before the check that depends
  on it, and carries the inverse case (growing that same file is still denied),
  so neither fault can recur silently. Mutation-verified: removing the ratchet
  now turns the check red, which it could not do before.
  **Since ORDRE 42 (operator, 2026-08-16) it carries a SECOND invariant: the
  projected content may not claim `status=done` in its board line while the
  repo holds commits the branch's upstream does not have.** Measured that day:
@ -347,7 +467,7 @@ marketplace plugin. Three components, one boundary:
 - **Board (`scripts/board.sh`):** cross-repo attention board. Reads STATE.md
  next-step blocks + board lines, `git status`, and mailbox pending counts, and
  prints one line per repo. Read-only by construction: it writes to no repo, no
-  STATE.md and no mailbox. Pinned by `board-selftest.sh` (259 checks).
+  STATE.md and no mailbox. Pinned by `board-selftest.sh` (427 checks).
  **It lives here because the mailbox is one of its three inputs, and it carries
  the same axis distinction the mailbox does.** A pending count means *others
@ -519,13 +639,17 @@ marketplace plugin. Three components, one boundary:
  `brief-nightly.sh` already carries for the briefing.
  **The cost comes from `route.sh`'s row table, and `--dispatch` deliberately
-  refuses a `--model`/`--effort` pair.** `--advisor opus` is a property of the
+  refuses a `--model`/`--effort` pair.** Until 2026-09-12 that rested on
-  ROW; two rows share a model/effort pair while differing on it, and the CLI
+  `--advisor opus` being a property of the ROW; that rule is struck (see
-  accepts a wrong advisor silently. A dispatch taking the model directly would
+  `route.sh` above) and the argument was REWRITTEN rather than left standing on
-  have no honest source for that flag, and both available guesses produce the
+  a premise the code no longer has — a comment defending a removed mechanism is
-  same failure — a session that looks peer-reviewed without being. A Fable
+  how the next session restores it. The reason now: the rubric is a policy with
-  dispatch is therefore not a `--dispatch` outcome at all, exactly as it is not
+  exactly one copy, and a dispatch accepting the model directly would be a
-  a `route.sh` outcome; it is a hand-written override.
+  second, unscored way to reach the same decision — one recording no traits, no
  rationale and no `next-cost`, so nothing afterwards could say whether the
  ROUTING was wrong or the SCORING was. A Fable dispatch is therefore not a
  `--dispatch` outcome at all, exactly as it is not a `route.sh` outcome; it is
  a hand-written override.
  **`--target-pane yes|no` is REQUIRED, with no default, and that is the same
  rule `--last-effort` carries.** It is a measurement of the world — does the
@ -567,6 +691,55 @@ marketplace plugin. Three components, one boundary:
  `coord-inbox` or `board`. The dependency runs one way: the driver consumes the
  plan, the plan never knows a terminal exists.
  **Order 20260826T115026Z-9982513971 (2026-08-26): board consumed
  `coord-count.sh`'s STDOUT and threw away its EXIT STATUS, so the whole
  three-status contract F5 had just built stopped at the producer.** Every call
  site piped it (`bash coord-count.sh 2>/dev/null | awk ...`), and a pipeline
  reports the LAST stage's status, so `exit 3` - "the mailbox root you named is
  not there, not counted, not zero" - was discarded at each one. `HAVE_COUNT`
  only ever tested that the SIBLING FILE exists, which is a strictly weaker
  question. Measured on the shipped 0.30.0 script against a mailbox root that
  does not exist: `coord-count.sh` printed "not counted, not zero" and exited 3
  while `--brief` answered "Ingen repo skylder noen et svar i dag." and `--plan`
  emitted no `advarsel=` key at all. A gate that can fail whose consumer does not
  listen is a gate that does not fall. It was carved out of F5 deliberately
  rather than swept in - that session scoped itself to `coord-count.sh` and said
  widening in silence was not its call, and the operator agreed - which is why
  this is its own order and its own commit.
  **`COUNT_OK` is the measurement's verdict; `HAVE_COUNT` stays, and the two
  messages stay DISTINCT.** "The sibling is missing" is repaired by restoring a
  file, "the world you named is not there" by fixing `CLAUDE_COORD_DIR` - the
  same reason `coord-count.sh`'s own 2 and 3 are different statuses, and a
  reader handed one "unavailable" for both cannot tell which repair to make.
  `$COUNT_WHY` carries the exact reason, including the status number, into all
  five reporting sites, and any nonzero is caught - the rule is "the measurement
  failed", not "3 specifically". A partial stdout captured before a failure is
  DISCARDED: a half-count is the same defect one layer down, since it also looks
  measured. Selftest section 27 pins the failure cases behind SIX known-positive
  controls (an existing root still names its debtor; a successful measurement
  warns about nothing; an existing but EMPTY root still claims zero debt) plus a
  ground-truth assertion that `coord-count.sh` really does exit 3 on that input,
  so a future coord-count that stops doing so fails the section rather than
  silently disarming it. Mutation-verified: restoring `if true` in place of the
  status test turns exactly those seven checks red and leaves all six controls
  green.
  **The three separate `coord-count.sh` invocations `--brief` used to make are
  now one.** With a status to honour, three runs would mean three statuses to
  reconcile; `coord-count.sh` writes nothing, so one reading is the same reading.
  The table and `--plain` views still never invoke it at all - they read the
  mailbox only through what `RECORDS` already counted, and `$COUNT_WHY` says so
  in those words rather than claiming a measurement nobody attempted.
  **Bounded gap, stated rather than closed:** the TABLE's own `INN`/`ORDRE`/`FLY`
  columns count with `ls "$COORD/$name/..."`, which yields 0 for every repo when
  the mailbox root is absent - the same "failed measurement renders as a
  reassuring value" shape, one source over. It is NOT a `coord-count.sh`
  consumer, so consuming exit 3 cannot reach it, and the order scoped itself to
  exit 3 and warned by name against silent widening. Naming it here is the
  point: the next session finds a decision, not an oversight.
  It also cross-checks itself against `coord-count.sh`, and that is not
  belt-and-braces. The repo scan and the mailbox are two different populations:
  a mailbox can carry a name no scan will ever produce — a declared non-git
@ -651,6 +824,48 @@ marketplace plugin. Three components, one boundary:
  find a live one when planted - never behaviourally, because there is no
  behaviour to pin.**
  **F6+F10 (2026-08-26): two of the board's own readings turned a FAILED
  measurement into a reassuring value.** `git -C "$d" status --porcelain
  2>/dev/null | wc -l` yields zero lines whether the tree is CLEAN or git
  refused to answer at all, so DRT printed **0** - and every reader took that
  as "nothing uncommitted here" (F6). It is reachable, not theoretical:
  discovery tests `.git` with `-e` precisely so worktrees are found, and a
  worktree whose parent checkout was deleted exits **128** here (measured
  directly before the fixture was written, and the fixture asserts that ground
  truth itself so a future git that starts answering fails the check rather
  than silently disarming the section). The exit status is now the
  discriminator and an unmeasured tree reads **`?`** - the same token
  `coord-count.sh` already uses for an age it could not compute, for the same
  fail-safe reason. **The fix is worthless without its two awk consumers, and
  one of them is the whole point:** `--plan`'s free-capacity test compared
  `$7 + 0`, and `"?"` coerces to **0** in arithmetic, so an UNMEASURED tree
  would have been certified as free capacity - the defect reappearing one
  layer down, wearing the fix as a disguise. It now compares the field as a
  STRING against exactly `"0"`; only a tree measured clean is clean. Mutation
  test: restoring the numeric comparison turns exactly that one check red
  while both controls (clean repo still free, dirty repo still not) stay
  green. The SUM roll-up sums the same field, where a `?` adds 0 and quietly
  understates the total, so it now NAMES the repos it could not add -
  labelled, never silently dropped, the same rule `--plan` already applies to
  repos with no board line. Every SHELL consumer prints the field with `%s`
  and was unaffected; that denominator was measured, not assumed.
  **F10 is the same defect at the scan boundary.** `[ -d "$root" ] || continue`
  skipped a bad root in silence, and a scan that then found nothing exited 0
  printing nothing - so a typo in `--roots`, a moved home directory and a
  genuinely empty tree were one single output, with the nevner never reported.
  Every bad root is now NAMED on stderr; the exit status changes only when NO
  root was scanned at all (**3**, matching `coord-count.sh`'s F5 fix for the
  same reason). **A mix still exits 0 and still prints the board** - some repos
  really were scanned, so the board is real; the reader just also learns that
  one root contributed nothing because it is absent rather than because it is
  empty. An EXISTING but empty root stays a silent, clean 0. This REPLACES an
  older assertion reading `check "missing root is a clean no-op"` - the defect
  encoded as a passing test, which is why nothing ever caught it.
  `brief-nightly.sh` needed no change and gains from this: it already treats a
  nonzero `--brief` as failure and keeps yesterday's briefing, so a mistyped
  root now preserves the file instead of overwriting it with an empty render.
  **Ordre 20260818T124828Z (2026-08-18): repo discovery had no dotglob, so a
  dot-prefixed repo (`.profile`, the Forgejo/GitHub org-profile convention)
  was permanently invisible to the board - not listed, and `--dispatch
@ -691,6 +906,101 @@ marketplace plugin. Three components, one boundary:
  it was exactly the unmeasured side effect the order flagged, and nothing
  in `~/repos` currently needs it (`.claude` has no repo children today).
  **Ordre 20260903T190201Z-238406410 (2026-09-03, operator decision the same
  day): a git repo nested under a depth-1 REPO was invisible to the board, and
  the admission that closes it is criterion (a) - a STATE.md - never "all
  nested repos".** Discovery adds a depth-1 repo and stops; the else-branch
  container scan is the only place children are ever looked at, and it is
  unreachable for an entry that is itself a repo. Measured on the real tree
  before anything was written: **12 nested repos across the tree, exactly 1
  with a STATE.md** (`from-ai-to-chitta/content-sadhguru`, which had been
  running work and reporting to nobody). The other 11 are vendored or
  experimental checkouts under `claude-code-100x/`; the operator's decision is
  that they stay invisible ON PURPOSE - they do not even reach the `UTEN
  STATE.md` bucket, because that bucket is for repos someone opens. Verified
  after the fix with `board.sh`, not from memory:
  `from-ai-to-chitta/content-sadhguru in-progress ... Sonnet 5/high`, and
  `--plan` gives it a real tab with a `paste=` line.
  **`add_nested_repos()` beside `add_dot_repos()`, never a widening of the `*`
  loops - the same argument ordre 20260818T124828Z made for dot repos, and the
  order made it again before this repo wrote a line.** Routing a depth-1 repo
  into the container branch would admit every nested checkout, which is exactly
  what criterion (a) declines. One level only: a repo inside a nested repo is a
  checkout of a checkout, and the selftest pins that depth 3 is NOT admitted. A
  dot-prefixed depth-1 repo gets the same nested scan an ordinary one gets
  (`add_dot_repos` takes a `d1` flag for it) - the asymmetry would otherwise be
  arbitrary, and nothing in the criterion distinguishes them.
  **A nested repo now has TWO names, and conflating them would have put a
  fabricated 0 in three columns.** The board KEY is `<parent>/<child>` as the
  order specifies - a bare basename says nothing about where the checkout lives
  and would collide with a same-named depth-1 repo. The MAILBOX name is not
  that key: a mailbox is addressed by `basename(git toplevel)`, which is
  `coord-send.sh`'s own rule and the only name a session in that repo can hold,
  so `$COORD/<parent>/<child>/inbox` finds no directory and INN/ORDRE/FLY print
  0 for a repo that may have mail. That is the failed measurement wearing the
  reassuring value, in three columns at once. The record loop therefore carries
  `mbox` beside `name`, and `--voyage`'s order lookup takes `basename($vy_dir)`
  for the same reason. Mutation-verified: reverting the eight `$COORD/$mbox`
  reads to `$COORD/$name` turns exactly the three mailbox checks red with every
  other check in the section green.
  **Which nested dirs those are is RECORDED by discovery, not re-derived.** The
  obvious re-derivation ("is my parent directory a git repo?") answers a
  slightly different question and would prefix every depth-1 repo if a scan
  root ever happened to be a checkout; `NESTED_LIST` cannot drift from the
  criterion because discovery is what writes it.
  **The denominator line is independent of all of that and went in regardless,
  because the order said so and because it is ansikt 4 pointed at the board's
  own reading.** `undersoekt: N katalog(er) depth 1, M polyrepo-container(e),
  K nestede repo (J med STATE.md tatt med).` The header's repo count answers
  "how many were found"; nothing answered "how many were looked at", so a
  criterion excluding 11 of 12 nested repos was invisible at the surface built
  to show it. Real tree, 2026-09-04: `43 katalog(er) depth 1, 5
  polyrepo-container(e), 12 nestede repo (1 med STATE.md tatt med)`. A
  non-repo dot-dir counts in N (it WAS examined) and never in M (it is
  deliberately not a container - ordre 20260818's decision), so the line is a
  denominator, not a partition. Selftest section 32 pins each number against a
  fixture, then changes the tree and asserts the numbers move, so a hardcoded
  constant cannot pass.
  **The line's own wording broke an existing check, and that is the finding
  worth recording.** `check "polyrepo container itself is not listed as a
  repo"` grepped the WHOLE output for `polyrepo`, so the footer's
  `polyrepo-container(e)` matched and the check went red on a board that was
  behaving correctly - the same defect class as coord-selftest section 38's
  cache grep reading a comment that EXPLAINS a pattern as an instance of it,
  and as the done-guard's rule that prose saying `status=done` must not trigger
  it. The check is now anchored at column 1, which is what it always meant: a
  container has no ROW.
  **Bounded gap, stated rather than closed (1): the mailbox-keyed JOINS still
  key on the board name.** `--brief`/`--plan`'s `$OWED` join, `brief_orphans`
  and `--inbox-plan` match `coord-count.sh`'s mailbox names against RECORDS
  field 3, so a nested repo owing a reply would not get a debt tab and would be
  listed under `UTENFOR REPO-SKANNEN`. This change neither creates nor worsens
  that: before it, the repo was not in RECORDS at all, so both readings were
  already exactly as wrong. Closing it means threading a mailbox key through
  six awk programs, which was not ordered and is not a discovery change.
  Reported to `.claude` for its own order.
  **Bounded gap, stated rather than closed (2): a 34-character key overflows
  the table's `%-32s` REPO column**, shifting `from-ai-to-chitta/content-sadhguru`'s
  row two characters right. Same class as `Fable 5.1/xhigh` overflowing the
  `%-14s` KOST column, and handled the same way: parsing is unaffected (every
  rendering that a driver reads is `key=value`), widening the column moves every
  fixed offset including three `cut -c89-` selftest helpers, and it is a
  rendering change nobody ordered. Truncating instead would be worse - it would
  destroy the very identity the compound key exists to carry, and break
  copy-paste into `--dispatch --repo`.
  **Bounded gap, stated rather than closed (3):** a DOT-prefixed *nested* repo
  is not looked for. The `*` glob in `add_nested_repos()` has no dotglob, the
  combination was neither measured nor ordered, and `add_dot_repos` exists for
  the depth-1 and container cases only because those were.
  **Ordre 20260820T204409Z (2026-08-20): `route_cmd_for()`'s four trait
  extractions searched the WHOLE route line, and `.*trait=` is greedy, so a
  rationale that names a trait won the match over the field itself.**
@ -742,7 +1052,7 @@ marketplace plugin. Three components, one boundary:
  rationale, and prints one block of `key=value` lines: the rubric row, the rule
  that fired, the `next-cost` value, a pasteable startup command, the one-row
  cheaper fallback, and the STATE.md comment lines. Pinned by
-  `route-selftest.sh` (69 checks).
+  `route-selftest.sh` (73 checks).
  **It is here because it is the WRITER for the field `board.sh` already reads.**
  `next-cost` had a reader and no writer, so it was hand-typed every session and
@ -760,23 +1070,38 @@ marketplace plugin. Three components, one boundary:
  and belongs to the skill; turning scores into a row is a lookup and takes zero
  model calls.
-  **`--advisor opus` is emitted per ROW, on a need, never unconditionally.**
+  **NO `--advisor` is emitted, by this calculator or by `board.sh --dispatch`
-  Rows 1-2 always carry it (Sonnet main model, so opus is a capability lift —
+  (operator decision 2026-09-12, `~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md`
-  and since every fallback is one row cheaper and the cheap rows are Sonnet,
+  § 4, cut row 3).** The struck rule fired per ROW on a need — always on the
-  this is what makes the quota fallback safe to take); rows 3-4 only at
+  Sonnet rows (a capability lift, which is what made the quota fallback safe to
-  `reversibility=costly|one-way` (Opus main model, so it buys peer review where
+  take), and on the Opus rows at `reversibility=costly|one-way` (peer review
-  a mistake is not cheap to undo); rows 5-6 never, because the CLI rejects every
+  where a mistake is not cheap to undo). It read well and it was killed by a
-  advisor for a Fable main model. The alternative — the global `advisorModel`
+  MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.–12.09, **zero**
-  setting written by `/advisor` — is what this replaces: it applies to every
+  carried the flag, because sessions are started by hand from the model and
-  session in every repo, which is how it burned quota before. The two triggers
+  effort rather than from the whole emitted line. A rule nothing honours is not
-  are almost disjoint by construction, since `costly` forces row 3 and `one-way`
+  a policy, and an emitted value nobody acts on is decoration in a field whose
-  forces row 4, so a Sonnet row always has `reversibility=cheap`.
+  only job is to be evidence. The advisor is now what it already was in
-  `verification=none` is deliberately NOT a third trigger: beyond the stakes
+  practice: **an operator decision per session**, said in one sentence in
-  rule it would only add mistakes that are cheap to reverse, docs sessions
+  `route.sh --help`.
-  (`known/none/cheap/local`) among them. Section 14 pins the rule and gates the
+  The absence is pinned over the WHOLE trait space — 81 combinations, every
-  three CLI facts it rests on against the installed `claude` without spending a
+  line of output, with a known-positive control proving the sweep's grep can
-  token — advisor validation runs before the empty-prompt check, so `-p ""`
+  find a planted advisor — rather than on four sampled rows, because the claim
-  reaches the validator and stops there.
+  is that no path emits it. `--dispatch` at `reversibility=costly` is pinned
  separately: that is the exact input a reintroduced rule would fire on.
  The three CLI gates section 14 used to carry (does `claude` accept
  `--advisor`, does it accept opus advising sonnet, does it still reject opus
  advising fable) went with the rule — they existed to gate facts the rule
  rested on, and the suite no longer depends on the installed `claude` at all.
  **The literal string `--advisor opus` is absent from `route.sh` ENTIRELY,
  including the paragraph recording what was struck** (it says "an opus advisor
  flag" in words): a blunt grep cannot tell a description from a specification,
  the same reason coord-selftest's cache assertion runs on an extracted path
  rather than the whole file. Do not restore the quote.
  Backward compatibility is pinned rather than assumed: a route line carrying a
  legacy `advisor=` field still parses and still yields a command. Measured the
  same day — **0 of 48** `<!-- route:` lines anywhere in `~/repos` carry one, so
  nothing in circulation depends on it, but a reader that broke on an unknown
  field would turn last month's STATE.md into "that repo has no route line".
  **Rows 5-6 are never a `route.sh` outcome.** Until 2026-08-06 they fired
  only from an explicit `--opus-xhigh-failed` flag, mirroring a global
@ -802,15 +1127,333 @@ marketplace plugin. Three components, one boundary:
  startup command. Corollary pinned by section 13: `skills/route/SKILL.md` must
  never declare an `effort:` frontmatter field, because frontmatter overrides the
  session effort and the reading would then measure the skill, not the session.
  **Order 20260901T185028Z-3612729538 (2026-09-01): `--last-model` was a closed
  set of three, Fable 5.1 shipped that day, and the refusal turned a
  measurement into a lie.** A session that genuinely ran Fable 5.1 could not
  record what it ran, so its record was either omitted or written as a name
  already in the set - and a lied record reads back months later as a
  measurement rather than as the gap it is. The whole point of the four
  `--last-*` fields is to be readable evidence, so this is the field's own
  failure mode, not a cosmetic one. Both edit sites moved, never one: the usage
  block and the validating case, because fixing the case alone is the
  two-copies-of-one-policy defect this file names repeatedly.
  **"Fable 5" is KEPT, and the reason is NOT backward compatibility.** The
  nevner was measured rather than assumed - exactly 1 of 45 `route-last` lines
  across the machine carries it - which is thin enough that a future session
  would happily "clean up" the one stale line and then drop the value. The
  load-bearing reason is that `route.sh`'s own row table spells rows 5-6
  `Fable 5/high` and `Fable 5/xhigh`. Dropping the value would make the script
  refuse to record a name its own spec writes.
  **The set is WIDENED, never replaced by form validation, and the selftest is
  what makes that a fact rather than a paragraph.** A pattern like
  `<family> <digits>[.<digits>]` would still catch a misspelled family and a
  drifted case (`opus 5`), and would stop catching **a version that does not
  exist**: `Fable 5.2` and `Opus 7` would both pass and read back as evidence
  that a model ran when it never shipped - the positive-looking null this repo
  refuses everywhere else, in the one field whose entire purpose is to be
  believed later. Section 8b therefore rejects `Fable 5.2` / `Fable 6` /
  `Fable 5.10` beside the accept case, so a later switch to form validation
  fails here instead of silently widening what the record can claim. The cost
  of the closed set is real and was paid before the choice was made, so the die
  message now names the repair - a newly shipped model is ADDED to the list,
  never approximated to a value already in it.
  Untouched, deliberately: the row table (still six rows; `route.sh` still
  emits only 1-4, and Fable remains a hand-written override), and the note that
  a Fable session runs without an advisor because the CLI does not enforce it.
  **Bounded gap, stated rather than closed:** `Fable 5.1/xhigh` is 15
  characters and overflows `board.sh`'s `%-14s` KOST column, shifting the rest
  of that row one column right. Parsing is unaffected - `next-cost` extraction
  is free text, and selftest section 6 now pins that the point release survives
  the round trip - so this is alignment, not data. Widening the column is a
  `board.sh` rendering change nobody ordered in this session, which is also why
  the value is deliberately ABSENT from section 6's widest-value loop: adding
  it there would go red, and the red would be the unfixed gap wearing a broken
  test's clothes. Reported to `.claude` instead.
 - **Board's ORDRE column** counts PENDING orders per repo with the identical
  idiom as INN, and the two are never summed: INN is "others are waiting on
  YOU" (outgoing obligation), ORDRE is "authorized work is waiting on this
-  REPO" (incoming). Claimed orders are excluded — the column answers what a
+  REPO" (incoming). Claimed orders are excluded from THIS column — it answers
-  session can pick up, and one in flight cannot be. Bounded gap, stated rather
+  what a session can pick up, and one in flight cannot be; since 0.29.0 they are
  counted in FLY beside it (below). Bounded gap, stated rather
  than closed: an order addressed to a mailbox with no matching directory in
  the scanned roots is invisible here, exactly as mail to such a name is
  invisible in INN. There is deliberately no join built for it; `coord-count.sh`
  is the cross-check for the mail half only.
  **Order 20260823T162951Z (2026-08-23): ORDRE alone printed the SAME DIGIT for
  two opposite facts, and the fix is a second column, not a fourth axis.** A
  repo holding one order in flight and a repo holding no orders at all both
  read `ORDRE 0` — "work is happening here" and "nothing is waiting here" were
  byte-identical rows. Measured the day the order was written: two panes stood
  open and idle for 45 hours holding finished orders, during a window with full
  quota authorised, and no column on the board reported it. **FLY** counts
  `orders/claimed/` — the same queue in its other state, which is why it is a
  second reading of a source the board already had rather than a new source,
  and why it is never summed with ORDRE. Verified live: one repo moved from
  `ORDRE 0` to `ORDRE 0 / FLY 1` beside another still reading `ORDRE 0 / FLY 0`
  and genuinely holding nothing.
  **FLY never claims a session is ALIVE, and the legend denies it in those
  words.** A claim is a `mv` a session performed once; nothing un-claims it when
  that session dies, which is precisely why `coord-order-inbox.sh` already shows
  claimed orders with their in-flight age. Measured on the live mailbox the same
  day: one order had been claimed for **117 hours**. Rewording the column into
  "a session is running here" would be the process axis smuggled in as a file
  count. Selftest section 24 pins the denial as a check on the legend TEXT, so
  the wording is engine behavior and not prose.
  **Order 20260829T045435Z-276822386 (2026-08-29): both columns were pure
  COUNTS, so ORDRE 2 read identically whether both orders arrived yesterday or
  both had sat for ten days.** They now render `N:Md` - the count and the age of
  the oldest order. The defect was never that orders sit there; that is a
  prioritisation question owned by humans. It was that NO SURFACE SHOWED THE AGE
  ACROSS REPOS: `coord-order-inbox.sh` does show one ("1d old"), but only inside
  the one repo at SessionStart, so a repo nobody opens shows nobody anything.
  Measured across the live mailbox that day with `find ~/.claude/coord -path
  '*/orders/*.md' -maxdepth 3 -type f`: 30 pending orders over 22 repos, 5 of
  them ten days old. This is not a new mechanism in the file - ALDER (STATE.md
  mtime) and SISTE (last commit) already read a clock the same way; it is a
  third application of a measurement `board.sh` was already making.
  **The age is the OLDEST order, never the newest and never a mean.** A repo
  holding one fresh order and one ten-day-old order has a ten-day-old problem,
  and the newest reading is precisely what would hide that case. Mutation-
  verified: flipping `-lt` to `-gt` in `oldest_order_age()` turns exactly the
  two oldest-specific checks red while every control stays green. FLY carries
  the identical reading, and there it matters at least as much: nothing
  un-claims an order when the session that took it dies, so a claim with no age
  is the 117-hour claim above with its only counter-evidence removed.
  **An empty queue prints a BARE 0, and an unreadable mtime prints `?`.** "No
  orders" and "an order that arrived today" are two different facts - the same
  reason FLY exists beside ORDRE in the first place - so `0` never grows a
  `:0d`. `?` is reported for the WHOLE reading rather than skipping the file,
  because an unmeasured file could be the oldest one, which makes "oldest" a
  claim the function is no longer entitled to make; it is the same token
  `coord-count.sh` and DRT already use for a measurement that failed.
  **The age is DISPLAY only - it is deliberately NOT in the sort.** Putting it
  in the ranking would silently reorder a parser living in another repo, which
  is the standing rule two sections up, and the order made it an explicit
  condition: a new sort axis would have to be stated in the commit message and
  in `--help`. It was not needed, so it was not taken. `--plan`'s `fly=` key and
  every other emitted `key=value` block are likewise untouched: the requirement
  is that a HUMAN reading the board can see an order is old without opening the
  repo, and the table is where that is read. Selftest section 28 builds a
  throwaway coord tree with `touch -t` mtimes and asserts its OWN ground truth
  (the stale fixture really is 10 days old) before anything depends on it, so a
  broken `touch -t` fails there rather than turning the section into a test of
  nothing.
  **Order 20260903T185736Z-1290610855 (2026-09-03): the PENDING age read the
  mtime, and `coord-order-done --return` rewrites it - so putting an order back
  reset the very reading that says how long it has waited.** An order returned
  three times could never look old, on the one surface that exists precisely so
  a repo nobody opens still shows something. Found by reading the board right
  after this repo returned an order of its own, not by looking for it: a file
  whose name says 2026-09-02 rendered `ORDRE 1:0d` minutes later. It is the
  same class as every other reading hardened here - a failed or reset
  measurement rendering as a reassuring value - with the twist that the reset
  was performed by the engine itself.
  **Two questions, two sources, and only one of them moved.** A PENDING order's
  age is "how long has this sat with no owner" = now - DELIVERY time, and only
  the filename carries that; it is written once and nothing rewrites it. A
  CLAIMED order's age is "how long has it been in flight", which is the claim's
  own mtime and was already right - so `oldest_pending_age()` sits BESIDE
  `oldest_order_age()` rather than replacing it, and `coord-order-inbox.sh`
  keeps `age_of` for the claim marker next to a new `pending_age_of`. Switching
  FLY to the filename would answer the delivery question in the column that
  asks the flight question. An unparseable filename yields `?` for the whole
  reading, never a fabricated `0`, because an unmeasured order could be the
  oldest one - the same rule the mtime path already carried.
  **Section 28's fixtures had to be rewritten, and that is the finding worth
  recording.** They encoded their intended ages in `touch -t` while their
  filenames held fixed 2026-01/2026-08 dates, which a filename-based reading
  makes both wrong and time-dependent - the checks would have started failing
  on their own as the wall clock moved past them. They now compute their stems
  from `date -v`, and the section asserts TWO ground truths, the filename for
  ORDRE and the mtime for FLY, because a fixture check guarding only one source
  leaves the other assertion resting on nothing. Mutation-verified in both
  files: restoring the mtime read turns exactly the defect checks red with
  every control green.
  **There is deliberately NO process inspection, and the selftest asserts it
  structurally** (no live `pgrep`/`pkill`/`lsof` in `board.sh`, with a
  known-positive control proving the grep can find a planted call). Four
  compounding reasons, argued in full in
  `docs/2026-08-23-free-capacity-investigation.md`: every other column is a
  durable filesystem fact reproducible in the fixture tree, while a process
  column measures one instant on one machine and could not be pinned here at
  all; mapping a process to a repo needs its cwd, hence `lsof`, against the
  zero-dependency convention; the ELAPSED-vs-CPU discriminator is a THRESHOLD,
  so encoding it makes the board decide a session is dead — the identical thing
  the order queue is already forbidden from doing ("nothing here expires
  anything, and building expiry would make the engine decide that a session is
  dead, which it cannot know"); and the file-based signal is no substitute
  either, which the 117-hour claim proves. The board reports the claim and
  refuses the inference.
 - **`--plan` NAMES free capacity as lines, never as blocks (0.29.0).**
  `ledig_antall=N` plus one `ledig=<repo> (<status>)` line per repo with nothing
  OWED (not merely nothing pending — a notice is not an obligation), no pending
  order, nothing in flight, a clean tree, at `done` or `deferred`. Such a repo
  has no next step to open a tab for and used to simply fall OUT of the plan —
  correctly, but silently, which is where new capacity went unseen. All four
  conditions are load-bearing and `status=done` alone is not the same set:
  measured 2026-08-23, 13 of 17 done/deferred repos were free and 4 were not
  (two held a pending order, one owed a reply, one had an uncommitted tree).
  The LINE form is the design, not a formatting choice: `morning`'s `plan_parse`
  discards a block with no `tab=`, so a free repo emitted as a block would be
  visible to the operator and invisible to the driver, while a line is visible
  to both and can never be opened as a tab. The count prints at 0 too, so
  "none found" and "not computed" cannot render the same. A tab block whose repo
  holds a claimed order carries `fly=N` beside it — the driver types into live
  panes.
  **The gap this leaves is stated rather than closed:** an open, idle pane in a
  `planned` repo with no claimed order and no queued work is still invisible,
  and cannot be seen from the filesystem at all — nothing there distinguishes
  it from a `planned` repo nobody has opened. Closing it needs a terminal-side
  measurement supplied INWARD by the driver that already probes panes, the same
  way `--dispatch` requires `--target-pane` to be measured by the caller and
  passed in. Not built: not ordered, and keeping it out keeps the dependency
  running one way.
 - **`--voyage` is the SIXTH rendering, and it exists because `board` read STATE
  lines and knew nothing about a brief.** Order 20260831T135934Z-696228720
  (`.claude`, 2026-08-31) fired the programme-level B1 row once `/trekplan` had
  been delivered in `llm-ingestion-okf`, so the fields could be chosen against a
  run that had gone the whole way (`brief.md.draft` 30.08 -> `brief.md` -> four
  research topics + README 31.08 14:19-14:54 -> `plan.md` 15:30) rather than
  guessed. A programme with Voyage in several repos had no shared surface at
  all: nobody could answer which briefs were in flight, in what phase, and who
  was waiting on whom. Read-only holds untouched - every field is a read.
  **Detection is by PROPERTY, never by directory name, and never through the git
  index.** The global CLAUDE.md says plans and briefs are defined by properties
  and recognises three locations (`.claude/projects/`, `docs/`,
  `features/<n>-<name>/`), so a directory counts iff it HOLDS `brief.md` or
  `brief.md.draft` under one of them. The index-based alternative was refused on
  a measurement the order supplied and this repo re-checked: `llm-ingestion-okf`
  gitignores `.claude/projects/` (commit 087be0b), so `git ls-files` would report
  ZERO briefs in the one repo actually running one - a broken query returning a
  positive-looking null, which is ansikt 4 pointed at our own tooling.
  Mutation-verified: swapping the filesystem test for `git ls-files` turns 23
  checks red, and the fixture asserts its own ground truth (`git check-ignore`
  really does ignore it) before anything depends on it. The known-negative
  control the location rule already passes is a real one - `maskinrommet`'s
  `serier/*/brief.md` are content briefs, not Voyage projects, and sit outside
  all three locations.
  **The phase ladder measures ARTIFACTS, not sessions, and the legend says so in
  those words.** `brief-draft` -> `brief` -> `research` -> `plan` -> `execute` ->
  `review`, furthest artifact present wins. The bound is stated rather than
  hidden: `/trekexecute` leaves a file behind only in its MULTI-session form
  (`.session-state.local.json`), so a plan executed in one session leaves nothing
  and `plan` is the last thing the filesystem can prove. Nothing here claims a
  session is alive - the same refusal `FLY` carries, and pinned the same way, as
  a check on the legend TEXT.
  **Three fields where an ABSENCE must not borrow the shape of a measurement.**
  `brief_quality` is read from the FRONTMATTER BLOCK ONLY (a body line is
  untrusted text and must not speak for the brief, the same rule
  `coord-count.sh` applies to `reply-expected`), and an absent field reads `-`,
  never `complete`: measured across the real tree 2026-08-31, only 8 of ~40
  briefs carry it at all. `research=-` (no directory, never started) and
  `research=0` (a directory holding nothing) are different facts - the completed
  run's `research/README.md` opened with "this directory held 0 files when the
  session started", and no board could show that. And `--voyage` always prints
  its own denominator; a tree with no projects says `ingen=0 ... funnet i N
  skannede repo` rather than rendering as an empty page.
  **Blocking decisions are counted at DECLARATION SITES, not mentions.** The
  pattern `[BLOCKING DECISION, before S<n>]` occurs on FOUR lines of the real
  brief, of which ONE declares it and three refer to it in prose, so a bare
  `grep -c` answers 4 where the honest answer is 1. The bracket must open the
  line's content after list markers, headings and bold. Mutation-verified:
  replacing the anchored pattern with the bare string turns exactly three checks
  red, the known-negative control (a brief whose only occurrences are prose must
  count 0) among them. It reports what the brief DECLARES and infers nothing
  about resolution - board reports and refuses the inference.
  **The age is the NEWEST artifact, which INVERTS the oldest-wins rule ORDRE and
  FLY carry, deliberately.** An order queue's problem is the oldest item still
  waiting; a project's problem is that its most recent activity is old
  ("nothing has happened here for N days"). Both answer the same question about
  a different object. Mutation-verified: flipping `-gt` to `-lt` turns exactly
  the one oldest/newest check red with every control green. The repo-level `VOY`
  cell then takes the STALEST project's age, which is the oldest-wins rule
  applied one level up.
  **`VOY` is display-only, never summed with `ORDRE`/`FLY`, and never in the
  sort** - the standing rule that a new ranking axis would silently reorder a
  parser living in another repo. It is not in `--plan`'s `key=value` blocks
  either: the requirement is that a human reading the board can see a brief is
  standing still, and the table is where that is read. The per-project detail
  lives in `--voyage` alone, because one cell cannot carry a phase when a repo
  holds seven briefs (`portfolio-optimiser` holds 20).
  **The cost was measured rather than assumed, and this file's old "~3s" claim
  did not survive it.** Shipped 0.31.0 takes **6.3s** over the real 52-repo tree;
  with `VOY` it is **7.7-9.2s**. The first cut called `stat` once per artifact
  and took 13.4s - the batched form (`find ... -exec stat -f %m {} +`, one
  `find` and one `stat` per project) is what makes the column affordable beside
  the table. Live verification against the completed run reproduced every field
  the order named: `fase=plan`, `kvalitet=complete`, `blokkerende=1`,
  `blokkerende_gate=S4`, `research=5`, and it is the only project of 51 across
  14 repos with an open blocking decision.
  **Bounded gap, stated rather than closed:** whether a detected project is
  still "in flight" is NOT decided here. Distinguishing a live brief from a
  finished one needs a threshold, and encoding one would make the board decide
  that work is abandoned - the identical thing the order queue is already
  forbidden from doing ("nothing here expires anything"). The board reports
  phase and age and leaves the judgement to the reader, which is why 51
  projects are listed rather than some filtered subset.
 - **`--row <repo>` is the SEVENTH rendering: the table's row for ONE repo, as
  `field=value` lines** (order 20260912T202210Z-7588027378, operator decision
  2026-09-12). Same scan, never a second one, read-only like every other
  rendering. **The order calls it the sixth; by this file's own numbering
  `--inbox-plan` is the fourth and `--dispatch` the fifth, so it is the
  seventh** — corrected here rather than carried wrong.
  **It exists because the columns WERE misread.** On 2026-09-11 the PM read the
  FLY column off the table by eye and got it wrong. Every other rendering a
  program consumes (`--plan`, `--inbox-plan`, `--dispatch`) is already
  `key=value`; the default view was the one left out, and the 34-character
  nested-repo key already shifts a row two characters right (a stated, unclosed
  gap), which makes counting spaces worse than it looks. `inn`, `ordre` and
  `fly` are three separate fields because they are three separate facts, and
  confusing them is the whole reason this exists. `status` is the bare token,
  never the table's `blocked>target` display, with `blocked-on` beside it;
  `neste` is last and uncut, for the same reason it is last in the record. An
  unknown repo exits **2** and writes NOTHING to stdout — an empty block would
  read as a repo whose every column is blank, which is a real and different
  state (`?`).
  **`upushet` is the one field that is NOT a rendering of the scan, and it is
  named rather than blended in.** Nothing in the scan measures it, so it is
  read once, for the named repo only, and never enters the table, the plan or
  the briefing. It reads the remote-TRACKING ref, not the remote: `upushet=N`
  honestly means "the local ref says N", and `git ls-remote` is still what a
  claim ABOUT THE WORLD costs. A repo with no upstream reports `?`, never `0` —
  "nothing is waiting to be pushed" and "nobody looked" are exactly the pair
  this engine refuses to render alike.
  **The fixture's three counts are three DIFFERENT integers (3/2/1), and that
  is the finding worth recording.** Built first with 2/1/1, it was
  mutation-tested by making `fly` read the ORDRE field — the exact 11.09
  misreading — and the check stayed GREEN, because the two fields held the same
  digit. A fixture that cannot tell two columns apart is the defect wearing a
  passing test, inside the section written to prevent it.
 - **Skills (`skills/coord-send/`, `skills/board/`, `skills/route/`, `skills/dispatch/`):** natural-language front
  doors mapping user intent to engine invocations. No mailbox logic lives here
  either. `board` additionally owns the *ranking* — which repo wins and why —
@ -858,13 +1501,55 @@ obligations in another repo.
 - Zero dependencies everywhere: bash + coreutils in the engine, `node:`
  builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
-  `bash scripts/coord-selftest.sh` must exit 0 (230/230),
+  `bash scripts/coord-selftest.sh` must exit 0 (257/257),
-  `bash scripts/board-selftest.sh` must exit 0 (259/259),
+  `bash scripts/board-selftest.sh` must exit 0 (427/427),
-  `bash scripts/route-selftest.sh` must exit 0 (69/69),
+  `bash scripts/route-selftest.sh` must exit 0 (73/73),
-  `bash scripts/orders-selftest.sh` must exit 0 (110/110) and
+  `bash scripts/orders-selftest.sh` must exit 0 (116/116) and
-  `bash scripts/state-line-guard-selftest.sh` must exit 0 (40/40).
+  `bash scripts/state-line-guard-selftest.sh` must exit 0 (54/54).
 - English for all code, docs, and commit messages (public repo). Norwegian
  trigger aliases in the skill description are deliberate.
 - **README's Install block is FENCED (```bash) while the rest of the README
  uses indented code blocks, and that asymmetry is deliberate - do not
  "harmonize" it.** The org-side D-census (`.claude`, ordre
  20260820T221658Z) reported repo-mailbox as the only plugin of 12 with no
  start command, with a known-positive control proving its query could find
  one in the other 10. The commands were in fact present, in an INDENTED
  block - so the census's wording overstated the null, but its finding held:
  the machine-readable entry point (D2b) keys on a fenced block, and 10 of
  11 sibling plugin READMEs use one. Measured here before changing anything,
  and re-measured after: 11 of 11 now match. Only the Install block was
  converted; converting the other 39 indented blocks was not ordered and
  would bury a two-line fix in a whole-file diff.
 - **README's selftest numbers are pinned by `tests/selftest.test.mjs`, and the
  check lives there rather than in one of the five bash suites for a measured
  reason.** The badge and the five `## Development` comments rotted twice in a
  row - 529 carried from 0.25.0, then a badge saying 868 beside comments summing
  to 792, two different wrong sums of the same fact on the same screen - because
  nothing compared them to anything. The order behind the fix
  (`20260905T053602Z-6743615726`) suggested hosting it in whichever suite
  already pins README/catalog invariants; measured before choosing, **no such
  suite exists** (`grep -ln README scripts/*selftest*.sh` returns
  `board-selftest.sh` alone, on two incidental hits - a prose comment and a
  `research/README.md` fixture). This wrapper is the only place where all five
  numbers exist at once in a run that already happens: `runSuite()` captures
  each suite's own summary line, so the truth source is the line the suite
  prints, never a re-count. A check inside one suite could see its own total but
  would have to RE-RUN the other four (**212s sequentially**, measured
  2026-09-05 under `/bin/bash` 3.2) to see theirs, and grepping `check` calls out
  of the scripts is both the second copy of the counting and a wrong one, since
  those calls sit inside loops. The badge is compared against the MEASURED sum,
  not against the five README comments - a badge agreeing with five stale
  comments is the 868-beside-792 shape one layer down - and a suite that stops
  printing a summary FAILS the check rather than being skipped, because an
  absent measurement must not read as a matching one. It adds no bash check, so
  the five counts and the 893 badge are unchanged by its arrival.
  Mutation-verified in both directions: `73 -> 74` on the route comment gives
  "README says route-selftest has 74 checks; it reported 73", `893 -> 894` on
  the badge gives "README's badge says 894 selftest checks; the five suites
  reported 893", and the restored file is 12/12 green. **Bounded gap, stated
  rather than closed:** `CLAUDE.md`'s own copies of the five counts (in this
  section, above) are NOT checked - a second surface carrying the same numbers,
  measured and left alone because widening the check to it was not ordered.
 - Conventional Commits: `type(scope): description`.
 ## Commands
@ -872,7 +1557,7 @@ obligations in another repo.
 - Test: `bash scripts/coord-selftest.sh`, `bash scripts/board-selftest.sh`,
  `bash scripts/route-selftest.sh`, `bash scripts/orders-selftest.sh` and
  `bash scripts/state-line-guard-selftest.sh` (or `npm test`, the Node wrapper
-  around all five plus the hook tests)
+  around all five plus the hook tests and the README-number check)
 - Order queue smoke test: `CLAUDE_COORD_DIR=$(mktemp -d) bash
  scripts/coord-order-send.sh --to smoke --from tester --subject s --message m`
  then `CLAUDE_COORD_DIR=<same> bash scripts/coord-order-inbox.sh --repo smoke`
@ -881,7 +1566,11 @@ obligations in another repo.
 - Hook smoke test: `node hooks/scripts/session-start.mjs` (expects JSON on stdout)
 - State-line-guard smoke test: `echo '{"tool_name":"Write","tool_input":{"file_path":"/tmp/STATE.md","content":"x\n"}}' | node hooks/scripts/pre-state-line-guard.mjs; echo $?`
  (expects exit 0, no output — a one-line STATE.md is under the limit)
- Board smoke test: `bash scripts/board.sh` (read-only, ~3s over the real tree)
+- Board smoke test: `bash scripts/board.sh` (read-only, ~8s over the real
  52-repo tree - measured 2026-08-31; the older "~3s" figure predated both
  the current tree size and the VOY column)
 - Voyage smoke test: `bash scripts/board.sh --voyage` (read-only, writes
  nothing; ~22s, since it greps every detected brief)
 - Briefing smoke test: `bash scripts/board.sh --brief` (read-only, writes
  nothing). `brief-nightly.sh` DOES write — it overwrites `$CLAUDE_BRIEF_FILE`
  (default `~/.claude/briefing.md`), so point that at a scratch path when
@ -897,6 +1586,13 @@ obligations in another repo.
 - Sweep smoke test: `bash scripts/coord-sweep.sh` (dry-run is the default, so
  this writes nothing; never add `--write` to a smoke test against the real
  mailbox)
 - launchd template check: `plutil -lint launchd/*.plist` (XML only). The paths,
  labels, placeholders and schedule are pinned by coord-selftest section 38 —
  run that, not `launchctl list`, to find a broken plist. Installing an agent
  is `sed` + `launchctl load` (see the header of either plist); proving it
  works is `launchctl start <label>` plus a new line in
  `~/Library/Logs/repo-mailbox-<brief|sweep>.log`, which is a DIFFERENT file
  from the sweep's own closure log at `$CLAUDE_COORD_DIR/_sweep.log`
 ## Release
--- a/README.md
+++ b/README.md
@ -10,11 +10,11 @@ Session A in repo X leaves a message for repo Y; the next session in repo Y gets
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
-![Version](https://img.shields.io/badge/version-0.28.0-blue)
+![Version](https://img.shields.io/badge/version-0.34.0-blue)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-4-orange)
 ![CLI scripts](https://img.shields.io/badge/CLI_scripts-8-blue)
-![Selftest checks](https://img.shields.io/badge/selftest_checks-529-blue)
+![Selftest checks](https://img.shields.io/badge/selftest_checks-927-blue)
 ---
@ -71,8 +71,10 @@ Message format (filename `<UTC-timestamp>-<uniq>-from-<sender>.md`):
 ## Install
-    claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
+```bash
-    claude plugin install repo-mailbox@ktg-plugin-marketplace
+claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
 claude plugin install repo-mailbox@ktg-plugin-marketplace
 ```
 The plugin ships empty: your mailbox is created lazily on first send, on your machine, and stays there.
@ -84,7 +86,7 @@ The plugin ships empty: your mailbox is created lazily on first send, on your ma
 Since v0.8.0 it closes with one aggregate line about mail pending in *other* mailboxes, so an empty inbox no longer reads as "all clear" while messages sit unanswered elsewhere. Two integers, never a roster: naming the other mailboxes would put their situation inside your repo's injection, and the line explicitly disclaims the obligation it sits beneath — those counts are not yours to handle, and counting them delivered nothing.
-**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked.
+**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked. Discovery takes git repos at depth 1, the children of a polyrepo container, and — since 0.33.1 — a repo nested under a depth-1 repo **only when it carries a `STATE.md`**: measured on the real tree, 12 such checkouts existed and exactly 1 had one, so admitting all of them would have buried the board in vendored clones. Every run prints its own denominator (`undersoekt: N katalog(er) depth 1, M polyrepo-container(e), K nestede repo (J med STATE.md tatt med)`), because a repo count alone says how many were found and nothing about how many were looked at.
 The mailbox is one of its three inputs, which is why the board lives here. Note the axis: a repo's pending count means *others are waiting on it*, an obligation it owes outward. Who a repo waits *on* comes only from its own board line, because the message format has no reply-to field.
@ -112,6 +114,8 @@ Ownership is explicit rather than implied. An order is pending until a session *
    coord-count.sh [--exclude <mailbox>]                                   # per mailbox: pending + replies owed, delivering nothing
    coord-sweep.sh [--write] [--days <n>] [--log <path>]                   # close aged notices machine-wide (dry-run by default)
    board.sh [--roots <dir>[,<dir>...]] [--brief|--plan] [--focus "<prose>"]  # cross-repo attention board (read-only)
    board.sh --voyage                                                        # Voyage briefs in flight (read-only)
    board.sh --row <repo>                                                    # one repo's row as field=value lines (read-only)
    board.sh --dispatch --repo <name> --order-id <id> \
             --target-pane <yes|no> --path <v> ... --rationale "<why>"     # startup command for a session in <name>
    coord-order-send.sh --to <repo> --subject "<s>" --prompt-file <abs path>  # deliver a work order into <repo>'s queue
@ -127,11 +131,28 @@ The reply/resolve hints the hook injects (`-> reply: coord-send --reply-to …
 **`coord-sweep.sh` is the only script that closes a message without a human in the loop**, and it is bounded to one mechanically decidable class: a directed message whose sender declared `reply-expected: no`, older than a grace window (default 14 days). A message that owes a reply is never touched, at any age, with any flag — answering it would mean deciding something on the receiving repo's behalf. Dry-run is the default, inverted from every other script here, because this is the one that destroys pending state. Every closure appends a line naming the sender and subject: a directed message has no seen-tracking, so the sweep cannot tell "seen and ignored" from "never delivered", and a notice to a repo left unopened for the whole window is closed *unread*. The log is what keeps that from being silent.
-**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` alone cannot produce the advisor flag. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
+**Since 0.33.0 that sweep is scheduled, and the schedule is the whole feature — invocation was the gap, not the mechanism.** `coord-sweep.sh` shipped in 0.10.0 and had then never run once: measured 2026-09-03 across 52 mailboxes, 27 pending directed messages, of which 23 were pure notices being re-injected at every session start in repos nobody had opened. The script was correct and unreachable, so nothing new was built — a second mechanism would have been two copies of a policy that already existed. `launchd/com.ktg.repo-mailbox-sweep.plist` runs `--write --days 14` daily at 05:30, half an hour *before* the briefing agent — not because it changes what the briefing reports, but because the briefing scans the same mailbox this mutates, and the two must not overlap. The briefing's *debt* figure is in fact unaffected: since 0.22.0 it is computed from `coord-count.sh`'s `owed` column, and this sweep closes only messages that owe nothing. What the sweep moves is the raw pending count — the table's `INN` column, and the volume every repo gets injected at session start. The window is written out in the plist rather than left to the script's default: it is a policy constant decided on a measured distribution (30 days would have closed 0 messages, 14 closed 7, 7 would have closed 13), and changing a default must never silently change what an unattended job closes every night.
-It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly; it points at a checkout, never at the version-pinned plugin cache.
+Both agents are **templates**, carrying `__CHECKOUT__`/`__HOME__` placeholders rather than absolute paths, because this repo is mirrored publicly. Substitute them at install time:
-**`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and one deterministic score decides it: `40 ×` repos released transitively, `15 ×` unhandled inbox messages, plus small bonuses for live work and for a cheap `next-cost` row. Four hard buckets preceded it and could not express "this repo owes one message and releases two others" — which is how a blocked chain's root ended up ranked *below* the repos waiting on it. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the dominant term, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
+```bash
 sed -e "s|__CHECKOUT__|$PWD|g" -e "s|__HOME__|$HOME|g" \
    launchd/com.ktg.repo-mailbox-sweep.plist \
    > ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 ```
 **`launchctl list` proves an agent is *loaded*, never that it is *right*.** A plist naming a script that does not exist loads cleanly and then silently never runs — there is no output to be wrong and no exit status to read, so the failure looks exactly like a quiet machine. Two separate things close that: `launchctl start <label>` followed by a line appearing in `~/Library/Logs/repo-mailbox-sweep.log` is the only runtime proof the program path resolves, and `coord-selftest.sh` section 38 asserts statically, for *every* plist in `launchd/`, that the path it names is a file that exists in this repo, that the `Label` matches the filename, that the placeholders survive, and that no agent points into the version-pinned plugin cache. Note that the launchd log is not the closure log: `$CLAUDE_COORD_DIR/_sweep.log` is where the record of each closed notice lives.
 **`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` names the row rather than spelling the command and there must be exactly one spelling in circulation. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
 It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly at 06:00; like the sweep agent above it points at a checkout, never at the version-pinned plugin cache, and it is pinned by the same section 38 checks.
 **`board.sh --voyage` reports the Voyage briefs in flight**, a sixth rendering of the same scan. `board` reads STATE lines, which say nothing about a brief, so a programme running Voyage across several repos had no shared surface: nobody could answer which briefs were running, in what phase, and who was waiting on whom. Detection is by **property, never by directory name** — a directory holding `brief.md` or `brief.md.draft` under any of the three planning locations the convention recognises (`.claude/projects/`, `docs/`, `features/<n>-<name>/`) — and it walks the **filesystem, never the git index**: a repo that gitignores `.claude/projects/` would otherwise report zero briefs while actually running one. The phase ladder measures *artifacts*, not sessions: a plan executed in a single session leaves no file behind, so `plan` is the last thing the filesystem can prove, and nothing here claims a session is alive. `brief_quality` is read out of the brief's frontmatter and an absent field reads `-`, never `complete`; a research directory that exists and holds nothing reads `0`, distinct from the `-` that means no research step was ever started. The table carries a matching `VOY` column beside `ORDRE` and `FLY` — the same class of durable filesystem fact, and never summed with them.
 **`board.sh --row <repo>` renders one repo's row as `field=value` lines**, a seventh rendering of the same scan and the only one that answers about a single repo. It exists because the table's columns *were* misread: the fixed-width view is for a human, and reading a column off it by eye is how `FLY` was read as `ORDRE` on 2026-09-11 — while every other rendering a program consumes is already `key=value`. `inn`, `ordre` and `fly` are three separate fields because they are three separate facts; `status` is the bare token rather than the table's `blocked>target` display, with `blocked-on` beside it; `neste` is last and uncut. An unknown repo exits **2** and writes nothing, because an empty block would read as a repo whose every column is blank — a real and different state. One field is deliberately *not* a rendering of the scan and is named as such: `upushet` is measured once, for that repo only, from the remote-**tracking** ref rather than the remote, so a repo with no upstream reports `?` and never `0`.
 **`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and **five ordered groups** decide it, each a lookup over a field the scan already read rather than a weighted score: (1) **chain-root credit**, most repos released first; (2) **debt**, most-owed-first, whatever the status; (3) `planned`; (4) `in-progress`; (5) `?`/`MALFORMED` — undeclared, last and labelled. Within a group, ties break on a cheap Sonnet `next-cost` row, then oldest plan first. A 0.19.0 weighted score (`40 ×` repos released, `15 ×` unhandled inbox messages) briefly stood in this spot and *could* express "this repo owes one message and releases two others" as a single number — but re-tuning those two coefficients would have silently reordered a parser living in another repo, with no test here able to hold a ranking stable for a consumer it can't see; the operator replaced it with the group order in 0.20.0 for that reason. Groups 3 and 4 are `planned` above `in-progress`, inverted from every earlier version by the same decision: turning a decision into motion is the slow step, live work is already moving. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the group that placed the repo, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
 **`--focus "<prose>"` narrows that plan to one subject, and reports what it held back.** It is the only cutoff this format has, which is why the report is a condition of the feature rather than a refinement of it: `--plan` documents that it hides nothing and labels what it cannot rank, so a silent filter would break a property already written down. The same run prints the subjects the prose resolved to, how many blocks were removed, how many `STATE.md` were searched, and — named, not counted — the repos that *mention* a resolved subject without declaring a marker line. That last class is enumerated because it is where the misses live: a repo can be a heavy participant and never have written a marker, and no string measurement finds it until the held-back population is listed. Each surviving block carries the declaration it survived on. Prose matching nothing prints the *full* plan and says so, since the phrase arrives verbatim from a person and a typo must not empty the day. The subject vocabulary is read from the scanned `STATE.md` themselves, so the "reads `STATE.md` and no other file" invariant is untouched.
@ -177,12 +198,12 @@ Note that raising the inbox's priority (Rule 7) deliberately does **not** widen
 ## Development
-    bash scripts/coord-selftest.sh              # 220 checks against a throwaway mailbox
+    bash scripts/coord-selftest.sh              # 257 checks against a throwaway mailbox
-    bash scripts/board-selftest.sh              # 237 checks against a throwaway repo tree
+    bash scripts/board-selftest.sh              # 427 checks against a throwaway repo tree
-    bash scripts/route-selftest.sh              # 69 checks, incl. the route->board round trip
+    bash scripts/route-selftest.sh              # 73 checks, incl. the route->board round trip
-    bash scripts/orders-selftest.sh             # 99 checks, incl. the 20-way barriered claim race
+    bash scripts/orders-selftest.sh             # 116 checks, incl. the 20-way barriered claim race
-    bash scripts/state-line-guard-selftest.sh   # 40 checks, incl. the Edit replace_all projection and the ratchet
+    bash scripts/state-line-guard-selftest.sh   # 54 checks, incl. the Edit replace_all projection and the ratchet
-    npm test                                    # all five selftests plus the hook tests, via node --test
+    npm test                                    # all five selftests, the hook tests, and the README-number check
 TDD is the house rule: every behavior change lands with a failing selftest check first.
--- a/docs/2026-08-23-free-capacity-investigation.md
+++ b/docs/2026-08-23-free-capacity-investigation.md
@ -0,0 +1,127 @@
 # Which repos are free? The investigation, and where it stopped
 Ordered 2026-08-23. The operator's words, translated: *"we need more precision
 about you knowing which repos are finished and can take more work."* What was
 ordered was an investigation and a design, not a named column — the sending repo
 supplied the problem and the measurements and left the shape of the answer here.
 Repos are unnamed throughout. This is a public mirror, and which repo was idle
 for how long is not a fact this file needs to carry to make its argument.
 ## The incident
 A session read the board's `ORDRE` column, ran `pgrep -fl claude`, and told the
 operator that four sessions were working. The operator looked at their screen:
 one was. Measured afterwards, two of the four processes had accumulated ~38
 minutes of CPU across **45 hours** of wall clock. They were open panes sitting at
 a prompt, holding finished orders, during a window in which full quota had been
 authorised against a deadline four days out.
 Nothing on the board reported it, and that is the part this file is about.
 ## Three blind spots, one of which was ours
 1. **`ORDRE` counted pending orders only.** So a repo with one order in flight
   and a repo with no orders at all both printed `0`. The same digit for two
   opposite facts — "work is happening here" and "nothing is waiting here" —
   with no way to tell them apart. This one is a defect in this repo's own
   rendering, and it is fixed.
 2. **`STATUS` describes the plan, not the capacity.** `done` does mean "no open
   step", which is close to what the operator wanted; `planned` and
   `in-progress` say nothing about whether anyone is actually sitting there. One
   of the idle repos was `planned` for the full 45 hours, entirely correctly.
 3. **A process proves existence, not activity.** `pgrep` finds a session that
   finished everything and went quiet. This one is not ours to fix — see below.
 ## What was changed
 ### `FLY`: the order queue's other state
 A second count over `orders/claimed/`, printed in its own column beside `ORDRE`
 and never summed with it. Same queue, other state — **not a fourth axis**, which
 is why it is a second reading of a source the board already had rather than a new
 source.
 Verified live on the day it shipped: one repo went from `ORDRE 0` (reading as
 "nothing here") to `ORDRE 0 / FLY 1`, next to another repo still reading
 `ORDRE 0 / FLY 0` and genuinely holding nothing. Those two rows had been
 byte-identical the day before.
 **What `FLY` does not mean, and must never be reworded into: that a session is
 alive.** A claim is a `mv` a session performed once. Nothing un-claims it when
 that session dies — which is exactly why the order queue's read path already
 shows claimed orders with their in-flight age. Measured on the live mailbox the
 same day: one order had been sitting claimed for **117 hours**. `FLY` is evidence
 that someone took the order. It is not evidence that anyone is still working it,
 and the on-screen legend says so in those words, because a column that read as "a
 session is running here" would be the process axis smuggled in as a file count.
 ### `--plan` names free capacity
 `ledig_antall=N`, then one `ledig=<repo> (<status>)` line per free repo. Free
 means all four at once: nothing **owed** (not merely nothing pending — a notice
 is not an obligation), no pending order, nothing in flight, clean tree, at
 `done` or `deferred`.
 All four conditions are load-bearing. Measured on the real tree the same day: of
 17 `done`/`deferred` repos, **13 were free and 4 were not** — two held a pending
 order, one owed a reply, one had an uncommitted tree. `status=done` alone would
 have named the wrong set roughly a quarter of the time.
 It is emitted as **lines, never as blocks**, and that is the whole design rather
 than a formatting preference. The plan's second consumer opens one pane per
 block and discards any block without a `tab=` key; a free repo written as a block
 would therefore be visible to the operator and invisible to the driver. A line is
 visible to both and can never be opened as a tab by accident. The count prints
 even when it is zero, so "none found" and "not computed" cannot render as the
 same output.
 A tab block whose repo already holds a claimed order additionally carries
 `fly=N`. The driver types into live panes; it should be able to see that first.
 ## What was NOT changed, and the argument for it
 **The board still inspects no processes.** No `pgrep`, no `ps`, no `lsof`, and a
 structural check in the selftest now says so with a known-positive control
 proving the grep can find a planted call. This was the order's open design
 question, and the answer is no, for four reasons that compound:
 1. **Every other column is a durable filesystem fact.** They survive a reboot and
   they are reproducible in a throwaway fixture tree under `CLAUDE_COORD_DIR`. A
   process column measures the operator's machine at one instant. There is no
   fixture for it, so it would ship as an unmeasured assumption wearing a passing
   test — this repo's own named defect class.
 2. **Mapping a process to a repo needs its working directory**, which on macOS
   means `lsof`. That is a new external dependency against a stated zero-
   dependency convention, for a number that would still not mean what a reader
   would take it to mean.
 3. **The discriminator is a threshold, and a threshold is a verdict.** "38
   minutes of CPU across 45 hours is idle" is a judgement about a session's
   liveness. Encoding it makes the board decide that a session is dead. The order
   queue is already forbidden from doing exactly this: nothing there expires
   anything, because building expiry would require the engine to know something
   it cannot. A process column is that same rule broken on a different surface.
 4. **The file-based signal is not a substitute either**, and pretending otherwise
   would just move the error. The 117-hour claim is the proof. So the board
   reports the claim and refuses the inference, which is what "prints evidence
   and takes no position" has always meant here.
 The gap this leaves is real and is stated rather than closed: **a pane that is
 open and idle with no claimed order and no queued work is still invisible to the
 board.** Such a repo now shows up in `ledig=` if it is `done`/`deferred` and
 clean, which covers the common case; a `planned` repo with an idle pane does not,
 and cannot, because nothing in the filesystem distinguishes it from a `planned`
 repo nobody has opened. Closing that needs a terminal-side measurement, and that
 belongs to whatever drives the terminal, not to the mailbox.
 ## What this does not answer
 The order asked whether the board should say anything about open tabs *at all*.
 It now says nothing about them, deliberately. If the operator later wants pane
 occupancy on the board, the honest construction is for the terminal driver —
 which already probes panes and already consumes `--plan` — to supply that fact
 inward, the same way `--dispatch` requires `--target-pane` to be measured by the
 caller and passed in rather than looked up here. That direction keeps the
 dependency running one way and keeps this repo unable to break on a terminal
 API. It was not built, because it was not ordered and the operator has not asked
 for it.
--- a/docs/2026-09-03-coordination-debt-measurement.md
+++ b/docs/2026-09-03-coordination-debt-measurement.md
@ -0,0 +1,152 @@
 # Coordination debt: what does not converge, and why building a second
 # mechanism would have been wrong
 Measured 2026-09-03 against the live mailbox, for order
 `20260902T113745Z-1254925290-from-.claude` (WP5). Every number below was
 produced by a command, and every negative result carries the control that
 proves the query could have found something.
 The order offered two candidate mechanisms and said to choose by measurement,
 not taste: a broadcast TTL, or a bulk-ack for pure notices. The measurement
 chose neither. One of them is already built and has never been run; the other
 addresses the class that converges on its own.
 ## Denominators
 | population | count |
 |---|---|
 | mailbox directories under the coord root | 55 |
 | of those, holding an `inbox/` | 52 |
 | pending directed messages across all inboxes | 27 |
 | broadcasts in `_broadcast/inbox/` | 17 |
 | (mailbox x broadcast) delivery pairs | 884 |
 The three directories with no `inbox/` are named rather than silently dropped:
 `jobbsok`, `mediemon`, `medieovervaaking`. 55 - 3 = 52 is the reconciliation,
 stated because an unreconciled pair of denominators in one report is the same
 positive-looking null this engine refuses everywhere else.
 ## The two classes behave in opposite directions
 **Directed messages do not converge.** They are re-injected at every session
 start until a session closes them by hand. Of the 27 pending, 4 owe a reply and
 23 are pure notices (`reply-expected: no`). By age:
 | class | <7d | 7-13d | 14-29d | >=30d |
 |---|---|---|---|---|
 | owes a reply | 0 | 3 | 1 | 0 |
 | pure notice | 10 | 6 | 7 | 0 |
 **Broadcasts converge on their own.** Reading one records it as seen, so a
 mailbox clears its whole backlog on its next session. 263 of the 884 pairs are
 unread (29.8%), and the distribution shows the self-clearing: 10 mailboxes are
 fully current, 26 sit at exactly 6 unread (the newest announcements), and the
 tail is short.
 ## The floor under the broadcast number, which strengthens the case
 Two mailboxes hold all 17 broadcasts unread, and neither can ever read them:
 - `ktg-plugin-marketplace` is a **retired `--to` address**. It is a polyrepo
  directory, not a git repo, so `basename(git toplevel)` can never resolve to
  it and no session can hold that identity. This is already documented as
  engine behaviour; the 17 unread are its permanent consequence.
 - `llm-ingestion-guard` has no checkout anywhere under `/Users/ktg`
  (`find -maxdepth 4`, with `llm-ingestion-okf` as the known-positive control
  proving the query finds a real one) and no `.origin`. It also holds the
  single oldest pending notice, 24 days.
 So **34 of 263 unread pairs (12.9%) are a permanent floor no TTL would reduce
 to zero** - it would close them, but it would be closing announcements for
 mailboxes that were never going to read anything. `.origin` absence alone is
 NOT a proxy for unholdable: `repos` also lacks one, yet sits at 2 unread of 17,
 which is only possible if something reads it.
 ## Why no second mechanism was built
 `coord-sweep.sh` already **is** the bulk-ack for pure notices: machine-wide,
 one mechanically decidable class (`reply-expected: no`, older than a grace
 window), dry-run by default, closing through `coord-done.sh`, logging sender
 and subject for every closure. Building the order's second candidate would have
 been a second copy of a shipped policy - the defect class this repo names
 repeatedly.
 Its own dry-run reports what it would close today, and the figures agree
 exactly with the independent classification above:
    --days 30  ->  0 messages
    --days 14  ->  7 messages
    --days  7  -> 13 messages
 **The gap is invocation, not mechanism.** No `_sweep.log` exists at the default
 path, and no sweep log exists anywhere under `~/.claude` (the one `*sweep*` hit
 is an unrelated plugin file) - stated that way because `--log` can override the
 default, so an absent default-path log alone would not prove it never ran.
 ## What remains, and why it is not this repo's call
 Making the notice class converge without opening each repo means running
 `coord-sweep.sh --write` unattended. That closes mail in 51 other repos'
 inboxes, unread, and the script's own design says so in as many words: a notice
 to a repo left unopened for the whole window is closed unread, and the log is
 the only thing standing between that and a silent disappearance.
 Deciding that on another repo's behalf is the one anti-pattern with no
 exception clause, and the grace window is a policy constant of the same class
 as the STATE.md line limit, which was an operator decision both times it moved.
 Dry-run is the default precisely because this is the script that destroys
 pending state; flipping that to a schedule is the operator's act, not a
 plugin's.
 The messages that owe a reply are untouched by any of this, at any age, with
 any flag. That is not a gap to close later - it is the rule that keeps a
 procedural duty from becoming a substantive one.
 ---
 ## Appendix: the before-state, captured 2026-09-04 08:0x UTC
 The operator authorized the sweep on 2026-09-03 (14-day window, scheduled via
 launchd). This is `coord-count.sh` immediately before the authorized
 `--write --days 14` run, recorded here because a before-state stops existing
 the moment the write happens, and the order asks for debt before/after with a
 denominator.
    mailbox                        pending  owed  origin-age
    app-creator                          1     1  -
    claude-playlist-corpus               1     0  -
    graceful-handoff                     3     0  -
    human-friendly-style                 1     0  -
    ki-produktivitetsmodell              1     0  -
    llm-ingestion-guard                  1     0  25
    llm-security                         2     0  -
    mcp-servere                          2     0  -
    okr                                  1     0  -
    org-ops                              5     2  -
    portfolio-optimiser-commons          3     0  -
    repo-standard                        1     1  -
    wiki-advise                          2     0  -
    .claude                              1     0  -
    .profile                             1     0  -
    ------------------------------------------------------
    15 mailboxes with pending mail      26     4
 `$CLAUDE_COORD_DIR/_sweep.log` did not exist: the sweep had still never run.
 **The control this file exists to make runnable:** after the write, the `owed`
 column must be BYTE-IDENTICAL (total 4), because the sweep spares every message
 that owes a reply at any age. A changed `owed` figure means the sweep closed
 something it must never touch, and is a defect, not a result.
 **The dry-run said 11, not the 7 this document measured a day earlier, and the
 gap is entirely the moving cutoff.** Verified two ways rather than assumed.
 Yesterday's 14-day cutoff was ~20260820T184902; today's is 20260821T055442.
 Four notices timestamped 2026-08-20 between those two instants
 (`human-friendly-style` T210113Z, `ki-produktivitetsmodell` T205611Z, `org-ops`
 T210955Z and T211358Z) crossed the boundary in one calendar day: 7 + 4 = 11.
 Independently, `--days 15` today yields 6, and those 6 plus
 `mcp-servere/20260820T104644Z` - which sits between the 15-day cutoff and
 yesterday's 14-day one - reconstruct yesterday's 7 exactly. The engine is
 consistent; the 7 was a measurement of a moment, never a constant, and reading
 it as one would have been face 3 of the verification law pointed at our own
 report.
--- a/hooks/scripts/pre-state-line-guard.mjs
+++ b/hooks/scripts/pre-state-line-guard.mjs
@ -5,6 +5,10 @@
 // ~120-line convention (global CLAUDE.md's Kontinuitets-system section;
 // raised from ~60 by operator decision 2026-08-14).
 //
 // Env: CLAUDE_STATE_MAX_LINES overrides that limit (positive integer). An
 // UNUSABLE value is refused by name, never silently ignored - see
 // resolveMaxLines() below for why that direction is the safe one.
 //
 // PreToolUse, not PostToolUse: org-ops' work order (20260814T144553Z) asked
 // for a PostToolUse hook, but PostToolUse fires AFTER the tool already ran
 // and cannot undo the write (confirmed against the official hooks docs,
@ -112,7 +116,34 @@ import { readFileSync } from 'node:fs';
 import { basename, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
-const MAX_LINES = 120;
+const DEFAULT_MAX_LINES = 120;
 // F13: the limit was a bare constant, so a selftest of the BOUNDARY had to
 // hardcode the same number the code carries - two copies of one policy, and
 // every fixture had to be rewritten by hand the last time the operator moved
 // it (60 -> 120, 2026-08-14). CLAUDE_STATE_MAX_LINES is the same kind of knob
 // CLAUDE_COORD_DIR is for the mailbox root: it lets a test pin the boundary at
 // a cheap value, and it lets the operator move the limit without a release.
 //
 // It is not a bypass claim. This guard has always been escapable by writing
 // the file another way (Bash, an editor), exactly as the sibling pathguard is.
 // The one thing it must never do is silently fail to take effect, which is why
 // an UNUSABLE value returns null and is refused by name below rather than
 // falling back to the default: a caller who set the variable and got 120
 // anyway would be reading a limit that was never in force - the same
 // positive-looking null this whole class of fix exists to close.
 //
 // Refused: "" (a variable expanded from something unset - a value was meant),
 // "0" and negatives (a limit no write can satisfy), and anything not made of
 // digits ("abc", "12.5", "1e3"). Unset is NOT unusable; it is the normal case.
 function resolveMaxLines() {
  const raw = process.env.CLAUDE_STATE_MAX_LINES;
  if (raw === undefined) return DEFAULT_MAX_LINES;
  if (!/^[0-9]+$/.test(raw)) return null;
  const n = Number(raw);
  if (!Number.isSafeInteger(n) || n < 1) return null;
  return n;
 }
 function allow() {
  process.exit(0);
@ -150,6 +181,22 @@ if (
  allow();
 }
 // Resolved here, AFTER the STATE.md gate above: an unusable override must not
 // block a Write this guard would never have judged in the first place.
 const MAX_LINES = resolveMaxLines();
 if (MAX_LINES === null) {
  process.stderr.write(
    `\n[repo-mailbox] STATE LINE GUARD: ${toolName} blocked\n` +
    `  File: ${filePath}\n` +
    `  CLAUDE_STATE_MAX_LINES is set to ${JSON.stringify(process.env.CLAUDE_STATE_MAX_LINES)}, ` +
    `which is not a positive whole number of lines.\n\n` +
    `The limit was NOT applied and the write was NOT judged. Set ` +
    `CLAUDE_STATE_MAX_LINES to a positive integer, or unset it to use the ` +
    `default of ${DEFAULT_MAX_LINES}.\n`
  );
  process.exit(2);
 }
 let projected;
 let currentLines;
 if (toolName === 'Write') {
--- a/launchd/com.ktg.repo-mailbox-sweep.plist
+++ b/launchd/com.ktg.repo-mailbox-sweep.plist
@ -0,0 +1,99 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
  Daily FYI sweep. Closes directed messages whose sender declared
  reply-expected: no and whose filename timestamp is older than 14 days, across
  every mailbox on this machine, through coord-done.sh.
  INVOCATION WAS THE GAP, NOT THE MECHANISM. coord-sweep.sh shipped in 0.10.0
  and had never run once against the real mailbox - measured 2026-09-03: 27
  pending directed messages, 23 of them pure notices nobody was ever going to
  act on, re-injected at every session start in repos nobody had opened. The
  script was correct and unreachable. This file is the whole fix; no new
  mechanism was built, and building a second one would have been two copies of
  a policy that already existed.
  THE 14-DAY WINDOW IS THE OPERATOR'S CONSTANT, NOT A DEFAULT WEARING A
  SCHEDULE (decided 2026-09-03, on a measured distribution: 30d -> 0 messages,
  14d -> 7, 7d -> 13). It is written out explicitly here rather than left to
  coord-sweep.sh's own default, so that changing the script's default can never
  silently change what this agent closes every night.
  WHAT IT CAN NEVER DO. A message that owes a reply is untouched at any age -
  the script's own rule, not this file's. This agent only supplies the
  invocation; every bound on what gets closed lives in coord-sweep.sh, and the
  closure log ($CLAUDE_COORD_DIR/_sweep.log, NOT the launchd log below) is the
  only record that a notice closed unread ever existed.
  THE TWO AGENTS MUST NEVER SHARE AN HOUR. com.ktg.repo-mailbox-brief renders
  at 06:00 from a scan of the same mailbox this mutates, so a briefing rendered
  mid-sweep reads a mailbox changing underneath it. This runs at 05:30, clear of
  it; coord-selftest.sh section 38 asserts the two hours differ.
  What it does NOT change is the briefing's DEBT figure. Since 0.22.0 that is
  computed from coord-count.sh's `owed` column, and this sweep closes only
  messages that owe nothing - so the debt listing is identical before and after.
  What moves is the raw pending count (the table's INN column, the FYI-only
  naming in --brief, and the volume every repo gets injected at session start).
  Claiming the briefing reports "the debt that remains" because of this agent
  would be an overclaim; the ordering exists for the read/write overlap alone.
  ZERO MODEL CALLS, same as the briefing and for the same reason: the operator
  authenticates by subscription, so a headless `claude -p` job would draw from
  the same quota pool as interactive work. This runs one shell script.
  PATH: every binary this touches (bash, date, grep, sed, basename, tr, cut)
  lives in /usr/bin or /bin, so launchd's minimal default PATH is sufficient
  and no EnvironmentVariables block is needed.
  The program path points at the SOURCE REPO, deliberately. The alternative is
  version-pinned (~/.claude/plugins/cache/.../repo-mailbox/<version>/...), so
  an agent pointing there would break silently on the next version bump - and a
  second copy of these scripts on disk is the exact defect class that produced
  the 0.12.1 stale-fallback bug.
  This file is a TEMPLATE. It carries no absolute home path on purpose: the
  repo is mirrored publicly, and a plist is the one file here that would need
  one. Substitute both placeholders at install time.
  Install:  sed -e "s|__CHECKOUT__|$PWD|g" -e "s|__HOME__|$HOME|g" \
                launchd/com.ktg.repo-mailbox-sweep.plist \
                > ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
            launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
  Verify:   launchctl list | grep com.ktg.repo-mailbox-sweep     # loaded only
            launchctl start com.ktg.repo-mailbox-sweep           # proves the path
            tail ~/Library/Logs/repo-mailbox-sweep.log           # the actual proof
  Remove:   launchctl unload ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
  `launchctl list` proves the agent is LOADED, never that it does anything
  right: a wrong program path produces a loaded agent that silently never runs.
  Only `launchctl start` plus a line in the log below proves the path resolves.
 -->
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.ktg.repo-mailbox-sweep</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>__CHECKOUT__/scripts/coord-sweep.sh</string>
        <string>--write</string>
        <string>--days</string>
        <string>14</string>
    </array>
    <key>StandardErrorPath</key>
    <string>__HOME__/Library/Logs/repo-mailbox-sweep.log</string>
    <key>StandardOutPath</key>
    <string>__HOME__/Library/Logs/repo-mailbox-sweep.log</string>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>5</integer>
        <key>Minute</key>
        <integer>30</integer>
    </dict>
 </dict>
 </plist>
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.28.0",
+  "version": "0.34.0",
  "private": true,
  "type": "module",
  "engines": {
--- a/scripts/board-selftest.sh
+++ b/scripts/board-selftest.sh
--- a/scripts/board.sh
+++ b/scripts/board.sh
--- a/scripts/coord-count.sh
+++ b/scripts/coord-count.sh
@ -35,7 +35,20 @@
 #   --exclude <mailbox>  omit one mailbox (the caller's own, whose inbox is
 #                        already injected in full).
 # Env: CLAUDE_COORD_DIR overrides the mailbox root.
-# Exit: always 0 - this runs at session start and must never fail one.
+# Exit: 0 = counted (zero or more mailboxes have pending mail)
 #       2 = usage error, nothing counted
 #       3 = mailbox root does not exist, nothing counted
 #
 # The header used to promise exit 0 unconditionally, on the grounds that this
 # runs at session start and must never fail one - and that was false in both
 # directions (F14). It exited 2 on a usage error already, and - worse - it exited 0 with zero lines when the mailbox root
 # was ABSENT, which is byte-identical to "no mailbox has pending mail" on every
 # channel a consumer can read (F5). board.sh consumes this TSV. That is
 # Verifiseringsloven ansikt 4: a broken query returning a positive-looking null.
 # What the old claim was protecting is kept and made precise: no state OF THE
 # MAILBOX can ever produce a nonzero exit - not an empty root, not a malformed
 # message, not an unreadable date. Only the caller (2) or a missing root (3)
 # can, and both print nothing on stdout, so neither can be mistaken for a count.
 # ASCII only, bash 3.2 safe.
 set -u
 export LC_ALL=C
@ -56,7 +69,15 @@ while [ $# -gt 0 ]; do
  esac
 done
-[ -d "$COORD" ] || exit 0
+# Not `|| exit 0`: see the F5 paragraph in the header. Status 3 rather than 2
 # because 2 is already "you called me wrong" and this is "the world you named
 # is not there" - two different repairs, and a consumer that only ever sees one
 # integer cannot tell them apart. stdout stays empty on purpose: 3 is not a
 # count of zero, it is the absence of a count.
 if [ ! -d "$COORD" ]; then
  echo "coord-count: mailbox root does not exist: $COORD (not counted, not zero)" >&2
  exit 3
 fi
 # GNU/BSD date flavor, detected once per run (not per mailbox): BSD date
 # rejects --version outright (exit nonzero, "illegal option" - measured on
--- a/scripts/coord-order-inbox.sh
+++ b/scripts/coord-order-inbox.sh
@ -73,6 +73,31 @@ age_of() {
  if [ -n "$ao_m" ]; then echo $(( (NOW - ao_m) / 86400 )); else echo "?"; fi
 }
 # Delivery age in whole days, read from the FILENAME's timestamp and never from
 # the mtime. ORDRE 20260903T185736Z-1290610855: `--return` rewrites the order
 # file's mtime, so an order returned three times reported as brand new - the
 # reading that exists to say "this has sat here a long time" was reset by the
 # act of putting it back. The filename is written once, at delivery, and nothing
 # rewrites it, which is exactly the fact a PENDING age is asking about.
 #
 # This is NOT the claimed case. A claim's age is "how long has it been in
 # flight", which is the claim marker's mtime - a different question with a
 # different right answer, so age_of stays and stays used there.
 #
 # A name the grammar does not produce has no readable delivery time and yields
 # "?" - the same fail-safe age_of already used for an unreadable mtime, never a
 # fabricated 0, which would make an unmeasured order look new.
 pending_age_of() {
  pao_ts="$(basename "$1")"; pao_ts="${pao_ts%%-*}"
  case "$pao_ts" in
    [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z) ;;
    *) echo "?"; return 0 ;;
  esac
  pao_n="$(printf '%s' "$pao_ts" | tr -dc '0-9')"
  pao_e="$(date -u -j -f %Y%m%d%H%M%S "$pao_n" +%s 2>/dev/null)"
  if [ -n "$pao_e" ]; then echo $(( (NOW - pao_e) / 86400 )); else echo "?"; fi
 }
 field_of() {
  # Bounded to the frontmatter block: a body line must never be able to forge a
  # header field the reader is told to trust.
@ -92,7 +117,7 @@ for f in "$ORDERS"/*.md; do
  # next session the same dead premise with no warning that it is dead.
  ret="$(grep -m1 '^<!-- order-returned:' "$f" 2>/dev/null | sed -e 's/^<!-- order-returned:[[:space:]]*//' -e 's/[[:space:]]*-->$//')"
  OUT="${OUT}
--- order: ${id} (from ${from}, pending, $(age_of "$f")d old) ---
+--- order: ${id} (from ${from}, pending, $(pending_age_of "$f")d old) ---
 subject: ${subj}"
  [ -n "$ret" ] && OUT="${OUT}
 returned earlier: ${ret}"
--- a/scripts/coord-selftest.sh
+++ b/scripts/coord-selftest.sh
@ -1159,6 +1159,235 @@ check "F7(f): control - a dot-prefixed target name still delivers" $?
 /bin/rm -rf "$F7DIR" 2>/dev/null
 # 36. F5 - a missing mailbox ROOT and an empty one are two different facts, and
 # coord-count.sh used to report them identically: `[ -d "$COORD" ] || exit 0`,
 # zero lines on stdout, exit 0, nothing on stderr. A consumer reading that TSV
 # (board.sh does) cannot tell "no mailbox has pending mail" from "the root I
 # was pointed at is not there" - Verifiseringsloven ansikt 4 exactly: a broken
 # query returning a positive-looking null, consumed as a fact about the world.
 # The two are now distinguishable by EXIT STATUS and a stderr line. Status 3 is
 # new and deliberately not 2: 2 already means "you called me wrong" (a usage
 # error, nothing counted), 3 means "the world you named is not there". Both
 # print nothing on stdout, so no consumer can mistake either for a count.
 #
 # The three cases below are the whole point - they must not collapse into one.
 F5DIR="$(mktemp -d)"
 # (a) The known-positive control FIRST: an EXISTING root holding real mail must
 # still count it. A guard that exits 3 on everything would pass every negative
 # check below while having destroyed the script, and this is what proves the
 # query can still find.
 CLAUDE_COORD_DIR="$F5DIR" "$SEND" --to f5box --from tester --subject s --message m >/dev/null 2>&1
 f5a_err="$F5DIR/../f5a.err"
 f5a_out="$(CLAUDE_COORD_DIR="$F5DIR" "$COUNT" 2>"$f5a_err")"; f5a_rc=$?
 [ "$f5a_rc" -eq 0 ] && printf '%s' "$f5a_out" | grep -q '^f5box	1	1	'
 check "F5(a): control - an existing root with mail still counts it and exits 0" $?
 # (b) An EXISTING but EMPTY root: the genuine "nobody has pending mail" answer.
 # Exit 0, no stdout, and NOTHING on stderr - a warning here would make the
 # ordinary case noisy and train every reader to ignore the channel that case
 # (c) needs.
 F5EMPTY="$(mktemp -d)"
 f5b_err="$F5DIR/../f5b.err"
 f5b_out="$(CLAUDE_COORD_DIR="$F5EMPTY" "$COUNT" 2>"$f5b_err")"; f5b_rc=$?
 [ "$f5b_rc" -eq 0 ] && [ -z "$f5b_out" ] && [ ! -s "$f5b_err" ]
 check "F5(b): an existing but empty root is a silent, clean zero (exit 0)" $?
 # (c) The defect: a root that does not exist. Pre-fix this was byte-identical
 # to (b) on every channel a consumer can read.
 f5c_err="$F5DIR/../f5c.err"
 f5c_out="$(CLAUDE_COORD_DIR="$F5DIR/no/such/root" "$COUNT" 2>"$f5c_err")"; f5c_rc=$?
 [ "$f5c_rc" -eq 3 ]
 check "F5(c): a missing mailbox root exits 3, not 0" $?
 [ -z "$f5c_out" ]
 check "F5(c): a missing root still prints NO count line (3 is not a count)" $?
 [ -s "$f5c_err" ] && grep -q 'coord-count' "$f5c_err" && grep -q 'not counted' "$f5c_err"
 check "F5(c): a missing root says so on stderr, naming what was not measured" $?
 # (d) Ground truth that (b) and (c) really are distinguishable now. This is the
 # defect stated as one predicate rather than as three separate assertions: it
 # fails if any future change collapses the two readings again, including one
 # that keeps both exit codes but drops the stderr line.
 [ "$f5b_rc" -ne "$f5c_rc" ]
 check "F5(d): empty root and missing root no longer report the same status" $?
 /bin/rm -rf "$F5EMPTY" "$F5DIR/../f5a.err" "$F5DIR/../f5b.err" "$F5DIR/../f5c.err" 2>/dev/null
 # 37. F14 - the header's exit contract said "always 0" while the script exited
 # 2 on `--exclude` with no value, and now exits 3 on a missing root (36 above).
 # The header IS the contract: it is what `-h` prints, so a consumer that reads
 # it and trusts it is reading a false claim. Pinned as a check on the HELP TEXT
 # for the same reason board-selftest pins the FLY legend wording - the text is
 # engine behavior, not prose, and a doc line nothing tests is a doc line that
 # drifts.
 f14_help="$(CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --help 2>/dev/null)"; f14_rc=$?
 [ "$f14_rc" -eq 0 ] && [ -n "$f14_help" ] && printf '%s' "$f14_help" | grep -q '^Exit:'
 check "F14: control - --help still exits 0 and prints an Exit: contract" $?
 # Ground truth for the claim the old header contradicted.
 f14b_rc=0
 CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --exclude >/dev/null 2>&1 || f14b_rc=$?
 [ "$f14b_rc" -eq 2 ]
 check "F14: ground truth - --exclude with no value really does exit 2" $?
 printf '%s' "$f14_help" | grep -q 'always 0'
 [ $? -ne 0 ]
 check "F14: the header no longer claims the script always exits 0" $?
 printf '%s' "$f14_help" | grep -q '2 *= *usage error'
 check "F14: the header documents exit 2 (usage error, nothing counted)" $?
 printf '%s' "$f14_help" | grep -q '3 *= *mailbox root'
 check "F14: the header documents exit 3 (missing root, nothing counted)" $?
 # The reason the "always 0" claim existed at all must survive its removal: the
 # session-start path must still not be failable by mailbox STATE. Every exit
 # above 0 is a caller/world error, never "this mailbox has awkward contents".
 f14c_rc=0
 CLAUDE_COORD_DIR="$F5DIR" "$COUNT" --exclude f5box >/dev/null 2>&1 || f14c_rc=$?
 [ "$f14c_rc" -eq 0 ]
 check "F14: control - a correct call over a real root still exits 0" $?
 /bin/rm -rf "$F5DIR" 2>/dev/null
 # 38. The launchd templates. A wrong program path in a plist is the one defect
 # in this repo that NOTHING catches at runtime: the agent simply never runs, in
 # silence, and `launchctl list` confirms only that it is LOADED, never that it
 # does anything right. There is no output to be wrong, no exit status to read -
 # the failure looks exactly like a quiet machine. So the path is asserted here,
 # statically, against the file it actually names.
 #
 # This section covers EVERY plist in launchd/, not only the sweep agent that
 # 0.33.0 adds, and that is deliberate: the plist grammar has one reader here
 # rather than one per agent. Two half-checks in two suites would drift, which is
 # the two-copies-of-one-policy defect this repo names repeatedly. board-selftest
 # still owns brief-nightly.sh's BEHAVIOUR (section 9); this owns the templates.
 #
 # Deliberately NOT checked here: XML well-formedness. `plutil` is not coreutils,
 # and malformed XML is the one plist defect that already fails LOUDLY - launchctl
 # load rejects it on the spot. This section is for the defect that does not: a
 # path that is merely wrong. Both files were linted by hand at 0.33.0.
 LAUNCHD="$DIR/../launchd"
 REPOROOT="$(cd "$DIR/.." && pwd)"
 # One reader, shared by the real files below AND by the control at the end. A
 # control that runs different code from the case it certifies proves nothing
 # about it. The program path is the <string> carrying the checkout placeholder;
 # the install instructions in the header comment name __CHECKOUT__ too, which is
 # why <string> has to match first.
 plist_program_path() {
  grep '<string>' "$1" 2>/dev/null | grep '__CHECKOUT__' | head -1 \
    | sed -e 's/.*<string>//' -e 's|</string>.*||'
 }
 plist_label() {
  grep -A1 '<key>Label</key>' "$1" 2>/dev/null | grep '<string>' | head -1 \
    | sed -e 's/.*<string>//' -e 's|</string>.*||'
 }
 plist_hour() {
  grep -A1 '<key>Hour</key>' "$1" 2>/dev/null | grep '<integer>' | head -1 \
    | sed -e 's/.*<integer>//' -e 's|</integer>.*||'
 }
 plist_n=0
 for p in "$LAUNCHD"/*.plist; do
  [ -e "$p" ] || continue
  plist_n=$((plist_n + 1))
  pb="$(basename "$p")"
  # launchctl addresses an agent by Label, the operator by filename. When they
  # disagree, load/start/unload silently act on a different agent than the one
  # being edited.
  lbl="$(plist_label "$p")"
  [ -n "$lbl" ] && [ "$lbl" = "${pb%.plist}" ]
  check "launchd $pb: Label matches the filename" $?
  # The check this section exists for.
  prog="$(plist_program_path "$p")"
  [ -n "$prog" ] && [ -s "$REPOROOT/${prog#__CHECKOUT__/}" ]
  check "launchd $pb: ProgramArguments names a script that exists here" $?
  # The repo is mirrored publicly and a plist is the one file that would
  # otherwise carry an absolute home path. It stays a TEMPLATE.
  grep -q '__HOME__' "$p"
  check "launchd $pb: log paths stay a __HOME__ placeholder (public mirror)" $?
  # The cache path is version-pinned, so an agent pointing there breaks silently
  # on the next bump - and a second copy of these scripts on disk is the exact
  # defect class that produced the 0.12.1 stale-fallback bug. Asserted on the
  # EXTRACTED PATH, never on the whole file: the brief plist's header explains in
  # prose why it does not point at the cache, and a file-wide grep read that
  # explanation as the defect it warns about. Same shape as the board line, where
  # prose saying status=done must never trigger the done-guard.
  case "$prog" in *plugins/cache*) false ;; *) true ;; esac
  check "launchd $pb: the program path is not the version-pinned plugin cache" $?
 done
 [ "$plist_n" -ge 2 ]
 check "launchd: both agent templates are present (brief + sweep)" $?
 # The grace window is the OPERATOR's policy constant (14 days, decided
 # 2026-09-03), not the script's default wearing a schedule. An agent quietly
 # running a different window would close a different population every night with
 # nothing reporting the change.
 SWEEPPL="$LAUNCHD/com.ktg.repo-mailbox-sweep.plist"
 grep -q '<string>--write</string>' "$SWEEPPL" 2>/dev/null \
  && grep -q '<string>--days</string>' "$SWEEPPL" 2>/dev/null \
  && grep -q '<string>14</string>' "$SWEEPPL" 2>/dev/null
 check "launchd sweep: the agent runs --write --days 14, the authorized window" $?
 # The briefing READS the mailbox the sweep MUTATES, so the two must not fire in
 # the same minute: a briefing rendered mid-sweep counts messages that are being
 # closed underneath it.
 hb="$(plist_hour "$LAUNCHD/com.ktg.repo-mailbox-brief.plist")"
 hs="$(plist_hour "$SWEEPPL")"
 [ -n "$hb" ] && [ -n "$hs" ] && [ "$hb" != "$hs" ]
 check "launchd: the two agents run at different hours (the brief reads what the sweep mutates)" $?
 # Mandatory controls. A path check with no negative case is a check that cannot
 # go red, which this repo has shipped once already (section 11's vacuous first
 # cut) and will not ship again.
 BADPL="$CLAUDE_COORD_DIR/bad.plist"
 {
  echo '<plist version="1.0"><dict>'
  echo '<key>Label</key>'
  echo '<string>com.ktg.repo-mailbox-bad</string>'
  echo '<key>ProgramArguments</key>'
  echo '<array>'
  echo '<string>/bin/bash</string>'
  echo '<string>__CHECKOUT__/scripts/no-such-script.sh</string>'
  echo '</array>'
  echo '</dict></plist>'
 } > "$BADPL"
 [ "$(plist_program_path "$BADPL")" = "__CHECKOUT__/scripts/no-such-script.sh" ]
 check "launchd control: the extraction really does read a program path" $?
 badprog="$(plist_program_path "$BADPL")"
 [ -s "$REPOROOT/${badprog#__CHECKOUT__/}" ]; [ $? -ne 0 ]
 check "launchd control: a plist naming a missing script is judged missing" $?
 [ "$(plist_label "$BADPL")" = "bad" ]; [ $? -ne 0 ]
 check "launchd control: a Label disagreeing with the filename is caught" $?
 # The cache check needs its own control, because narrowing it from the whole file
 # to the extracted path is exactly the kind of narrowing that can quietly stop
 # catching anything.
 CACHEPL="$CLAUDE_COORD_DIR/cache.plist"
 {
  echo '<plist version="1.0"><dict>'
  echo '<key>ProgramArguments</key>'
  echo '<array>'
  echo '<string>/bin/bash</string>'
  echo '<string>__CHECKOUT__/.claude/plugins/cache/repo-mailbox/0.33.0/scripts/coord-sweep.sh</string>'
  echo '</array>'
  echo '</dict></plist>'
 } > "$CACHEPL"
 cprog="$(plist_program_path "$CACHEPL")"
 case "$cprog" in *plugins/cache*) true ;; *) false ;; esac
 check "launchd control: a program path INSIDE the plugin cache is caught" $?
 /bin/rm -f "$BADPL" "$CACHEPL" 2>/dev/null
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]
--- a/scripts/orders-selftest.sh
+++ b/scripts/orders-selftest.sh
@ -336,7 +336,7 @@ printf '%s' "$bout" | grep -q 'ordrepo'; check "board table lists the fixture re
 # Matched on the rendered row rather than by awk field number: KOST is
 # "Sonnet 5/high", which contains a space, so a field index would be counting
 # the wrong columns and would keep "passing" if the layout shifted.
-printf '%s' "$bout" | grep -qE '^ordrepo[[:space:]]+planned[[:space:]]+Sonnet 5/high[[:space:]]+1[[:space:]]+2[[:space:]]'
+printf '%s' "$bout" | grep -qE '^ordrepo[[:space:]]+planned[[:space:]]+Sonnet 5/high[[:space:]]+1[[:space:]]+2:0d[[:space:]]'
 check "board prints INN 1 and ORDRE 2 side by side, never summed" $?
 # --dispatch --order-id: the thin starter form. The order text lives in the
@ -408,6 +408,69 @@ CLAUDE_COORD_DIR="$O10DIR" "$SEND" --to .profile --from tester --subject s --mes
 check "10d: control - a dot-prefixed target name still receives its order" $?
 /bin/rm -rf "$O10DIR" 2>/dev/null
 # --- 11. Pending age comes from the FILENAME, never the mtime ---------------
 # ORDRE 20260903T185736Z-1290610855: `--return` rewrites the order file's
 # mtime, and both age surfaces read mtime, so an order returned three times can
 # never read as old. Measured on the live queue before the order was written: a
 # file whose name says 2026-09-02 reported "0d old" minutes after a return.
 #
 # PM decision, and it is two questions with two answers: a PENDING order's age
 # is "how long has this sat with no owner" = now - the DELIVERY time, which only
 # the filename carries; a CLAIMED order's age is "how long has it been in
 # flight" = the claim marker's mtime, which is already right and stays.
 O11DIR="$WORK/o11"; mkdir -p "$O11DIR"
 o11_old_ts="$(date -u -v-2d +%Y%m%dT%H%M%SZ 2>/dev/null)"
 CLAUDE_COORD_DIR="$O11DIR" "$SEND" --to o11repo --from dispatcher \
  --subject "aged order" --message "body" >/dev/null 2>&1
 o11_q="$O11DIR/o11repo/orders"
 o11_orig="$(ls -1 "$o11_q"/*.md 2>/dev/null | head -1)"
 o11_id="$(basename "$o11_orig" .md)"
 o11_aged_id="${o11_old_ts}-${o11_id#*-}"
 mv "$o11_orig" "$o11_q/$o11_aged_id.md" 2>/dev/null
 # Ground truth FIRST, so a broken `date -v` fails here instead of turning the
 # whole section into a test of nothing (the F13 section-11 lesson).
 [ -n "$o11_old_ts" ] && [ -f "$o11_q/$o11_aged_id.md" ]
 check "11a: ground truth - the fixture order's filename timestamp is 2 days old" $?
 # Drive the REAL defect: claim it, then return it. The return is what rewrites
 # the mtime, so this is the path that produced the live 0d reading.
 CLAUDE_COORD_DIR="$O11DIR" "$CLAIM" --repo o11repo "$o11_aged_id" >/dev/null 2>&1
 CLAUDE_COORD_DIR="$O11DIR" "$ODONE" --repo o11repo "$o11_aged_id" --return --reason "test" >/dev/null 2>&1
 o11_mtime="$(stat -f %m "$o11_q/$o11_aged_id.md" 2>/dev/null)"
 o11_now="$(date +%s)"
 [ -n "$o11_mtime" ] && [ $(( o11_now - o11_mtime )) -lt 300 ]
 check "11b: ground truth - the return really did rewrite the file's mtime to now" $?
 o11_out="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11repo 2>/dev/null)"
 printf '%s' "$o11_out" | grep -q 'pending, 2d old'
 check "11c: a returned order reports its DELIVERY age (2d), not 0d" $?
 # Known-positive control: the reading must still be able to say 0d, or 11c
 # would pass just as well against a function that always prints 2.
 CLAUDE_COORD_DIR="$O11DIR" "$SEND" --to o11fresh --from dispatcher \
  --subject "fresh order" --message "body" >/dev/null 2>&1
 o11_fresh="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11fresh 2>/dev/null)"
 printf '%s' "$o11_fresh" | grep -q 'pending, 0d old'
 check "11d: control - a freshly delivered order still reports 0d" $?
 # FLY is the OTHER question and must not move: the claim marker's mtime is when
 # the claim happened, and an order with an ancient filename claimed just now has
 # been in flight for 0 days.
 CLAUDE_COORD_DIR="$O11DIR" "$CLAIM" --repo o11repo "$o11_aged_id" >/dev/null 2>&1
 o11_fly="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11repo 2>/dev/null)"
 printf '%s' "$o11_fly" | grep -q 'CLAIMED 0d ago'
 check "11e: FLY age still comes from the claim marker's mtime, not the filename" $?
 # A name the grammar does not produce has no readable delivery time. It must
 # read "?" - the same fail-safe the mtime path already used, never a fabricated
 # 0, which would make an unmeasured order look brand new.
 mkdir -p "$O11DIR/o11bad/orders"
 printf -- '---\nfrom: x\nsubject: s\n---\nbody\n' > "$O11DIR/o11bad/orders/not-a-timestamp.md"
 o11_bad="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11bad 2>/dev/null)"
 printf '%s' "$o11_bad" | grep -q 'pending, ?d old'
 check "11f: an unparseable filename timestamp reads ?, never 0" $?
 echo
 echo "orders-selftest: $PASS passed, $FAIL failed, $SKIP skipped (of $((PASS+FAIL+SKIP)) checks)"
 [ "$FAIL" -eq 0 ] || exit 1
--- a/scripts/route-selftest.sh
+++ b/scripts/route-selftest.sh
@ -141,7 +141,8 @@ check "all 81 trait combinations emit one of the 4 calculator rows" $?
 # to show the same string back. Runs for all six rows.
 ROOT="$(mktemp -d)"
 MBOX="$(mktemp -d)"
-cleanup() { /bin/rm -rf "$ROOT" "$MBOX" 2>/dev/null; }
+RL_ROOT=""
 cleanup() { /bin/rm -rf "$ROOT" "$MBOX" ${RL_ROOT:+"$RL_ROOT"} 2>/dev/null; }
 trap cleanup EXIT
 rt_bad=0
@ -169,6 +170,16 @@ done
 # rather than produced by "$R".
 rt_case "rt-5" "Fable 5/high"
 rt_case "rt-6" "Fable 5/xhigh"
 # A hand-written Fable 5.1 board line. next-cost extraction is free text, so
 # board.sh parses the point release back unchanged - pinned here so a later
 # narrowing of that extraction fails in this suite rather than in the
 # operator's eye. MEASURED GAP, stated rather than closed: at 15 characters it
 # overflows the %-14s KOST column and shifts the rest of that row one column
 # right. That is a board.sh rendering change nobody ordered in this session, so
 # it is reported to .claude, not fixed here - which is also why "Fable
 # 5.1/xhigh" is deliberately absent from the widest-value loop below. Adding it
 # there would go red, and the red would be the unfixed gap, not a broken test.
 rt_case "rt-51" "Fable 5.1/xhigh"
 OUT="$(CLAUDE_COORD_DIR="$MBOX" "$BOARD" --roots "$ROOT" 2>/dev/null)"
 for want in "Sonnet 5/high" "Sonnet 5/xhigh" "Opus 5/high" "Opus 5/xhigh" \
@ -176,6 +187,8 @@ for want in "Sonnet 5/high" "Sonnet 5/xhigh" "Opus 5/high" "Opus 5/xhigh" \
  printf '%s' "$OUT" | grep -q "$want" || { rt_bad=$((rt_bad+1)); echo "    board lost: [$want]"; }
 done
 [ "$rt_bad" -eq 0 ]; check "round trip: board.sh parses back all 6 emitted values" $?
 printf '%s' "$OUT" | grep -q 'Fable 5\.1/xhigh'
 check "board parses back a hand-written Fable 5.1 next-cost" $?
 # board.sh renders KOST with %-14s; a longer value shoves the whole row right
 # even though it parsed fine. Measure the widest string the table can emit -
@ -272,6 +285,43 @@ check "no route-last line when the record is omitted" "$rc"
     --last-completed yes --last-corrections 0 >/dev/null 2>&1
 [ $? -eq 0 ]; check "--last-model/-effort accept every legal value" $?
 # Fable 5.1 shipped 2026-09-01 and the closed set refused it, so a session that
 # actually ran it could not record what it ran: the record was either omitted
 # or LIED, and a lied record reads back months later as a measurement. The set
 # is WIDENED, never replaced by form validation - the check below is what makes
 # that choice machine-verified instead of prose. "Fable 5" stays legal for a
 # reason stronger than the one STATE.md on this machine that still carries it:
 # route.sh's OWN row table spells rows 5-6 "Fable 5/high" and "Fable 5/xhigh",
 # so dropping it would make the script refuse to record a value its own spec
 # names. The check above this one is what goes red if anyone drops it.
 "$R" --path known --verification strong --reversibility cheap --scope local \
     --rationale x --last-model "Fable 5.1" --last-effort xhigh \
     --last-completed yes --last-corrections 0 >/dev/null 2>&1
 [ $? -eq 0 ]; check "--last-model accepts the Fable 5.1 point release" $?
 # The set is still CLOSED after being widened, and this is the whole cost of
 # NOT switching to form validation. A pattern like "<family> <digits>[.<digits>]"
 # would accept every line below, and would stop catching a version that does
 # not exist - which reads back later as evidence that a model ran when it never
 # shipped. That is the positive-looking null this repo refuses everywhere else.
 fable_bad=0
 for bad in "Fable 5.2" "Fable 6" "Fable 5.10"; do
  "$R" --path known --verification strong --reversibility cheap --scope local \
       --rationale x --last-model "$bad" --last-effort xhigh \
       --last-completed yes --last-corrections 0 >/dev/null 2>&1
  [ $? -eq 2 ] || { fable_bad=$((fable_bad+1)); echo "    accepted a model that does not exist: [$bad]"; }
 done
 [ "$fable_bad" -eq 0 ]; check "the model set stays CLOSED after Fable 5.1 (no form validation)" $?
 # Accepting the value is not the same as RECORDING it. The record is what the
 # next session reads back, so the emitted line must carry the point release
 # verbatim rather than collapsing it to the family name.
 LAST51="$("$R" --path known --verification strong --reversibility cheap --scope local \
          --rationale x --last-model "Fable 5.1" --last-effort xhigh \
          --last-completed yes --last-corrections 0 2>/dev/null | sed -n 's/^route-last=//p')"
 printf '%s' "$LAST51" | grep -q '^<!-- route-last: model=Fable 5.1; effort=xhigh; completed=yes; corrections=0 -->$'
 check "route-last carries Fable 5.1 verbatim into the emitted line" $?
 # The record is telemetry and must NOT silently change what the calculator
 # outputs - a "completed=no" record describes what happened, and covers
 # context exhaustion, an operator interrupt and a block on another repo just
@ -310,13 +360,14 @@ check "board + route + route-last stacked still yield prose in NESTE" $?
 # --- 9. Startup command and fallback --------------------------------------
 # Two spellings of ONE decision: the rubric name for the board line, the CLI
 # alias for the command the operator pastes. They must never disagree.
-# These assert the WHOLE string, advisor included, so section 14's rule cannot
+# These assert the WHOLE string, so no flag can be added back to the emitted
-# be widened without a deliberate edit here - the exact-match is the tripwire.
+# command without a deliberate edit here - the exact-match is the tripwire that
 # keeps section 14's absence rule from being widened around.
 cmd="$(field partial strong cheap local command)"
 [ "$cmd" = "claude --model opus --effort high" ]; check "command mirrors the row (opus/high)" $?
 cmd="$(field known strong cheap local command)"
-[ "$cmd" = "claude --model sonnet --effort high --advisor opus" ]; check "command mirrors the row (sonnet/high)" $?
+[ "$cmd" = "claude --model sonnet --effort high" ]; check "command mirrors the row (sonnet/high)" $?
 # The rubric requires ALWAYS naming one row cheaper as the quota fallback.
 fb="$(field partial strong cheap local fallback)"
@ -328,7 +379,7 @@ fb="$(field known strong cheap local fallback)"
 # The fallback needs its own pasteable command or the operator translates by
 # hand at exactly the moment they are under quota pressure.
 fbc="$(field partial strong cheap local fallback-command)"
-[ "$fbc" = "claude --model sonnet --effort xhigh --advisor opus" ]; check "fallback ships its own command" $?
+[ "$fbc" = "claude --model sonnet --effort xhigh" ]; check "fallback ships its own command" $?
 # --- 10. The command carries no 'cd' --------------------------------------
 # One repo per terminal tab: a startup command prefixed with cd is wrong by
@ -344,9 +395,9 @@ check "no emitted command contains a cd prefix" "$rc"
 # Model aliases are whatever the INSTALLED claude accepts - never hardcoded
 # without a gate, because an alias that stops resolving turns every emitted
 # command into a paste that fails.
-# Capture the effort TOKEN only. Anything may legitimately follow it on the
+# Capture the effort TOKEN only. The command ends at the effort today, but the
-# command line (--advisor does, since section 14), and a match that swallowed
+# pattern stays tail-tolerant: a match that swallowed whatever a later flag
-# the tail would report a valid effort as invalid.
+# added would report a valid effort as invalid.
 efforts="$(printf '%s' "$out" | sed -n 's/^command=claude --model [a-z]* --effort \([a-z]*\).*/\1/p')"
 case "|low|medium|high|xhigh|max|" in *"|$efforts|"*) rc=0 ;; *) rc=1 ;; esac
 check "emitted effort is in the verified effort set" "$rc"
@ -418,117 +469,129 @@ check "route.sh no longer claims effort is unobservable from inside" "$rc"
 grep -q 'CLAUDE_EFFORT' "$R"
 check "route.sh names the source the caller should measure from" $?
-# --- 14. The advisor: capability gap first, stakes second -----------------
+# --- 14. The advisor is NOT the rubric's to emit --------------------------
-# The advisor is a second, stronger model consulted mid-task, so a session
+# Struck by operator decision 2026-09-12
-# carrying one costs more than a session without. It must therefore fire where
+# (~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md, cut row 3).
-# there is a NEED and nowhere else, or it decays into the always-on
+# The rule it replaces fired on two needs - Sonnet rows always, Opus rows at
-# advisorModel setting it exists to replace. Two independent needs qualify,
+# costly|one-way stakes - and read well. What killed it was a measurement, not
-# and they turn out to be almost disjoint.
+# a change of taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried
 # --advisor opus, because the operator starts sessions by hand and pastes the
 # model and effort, not the whole line. A rule nothing honours is not a policy,
 # it is a claim about the world that the world disagrees with - and this repo's
 # own standing rule is that an emitted value must be evidence, never decoration.
 #
-# 1. THE MAIN MODEL IS SONNET (rows 1-2). Here opus is a genuine capability
+# So the calculator emits no advisor at all, and the advisor becomes what it
-#    lift, not a peer: opus judgement at sonnet cost. This is the load-bearing
+# already was in practice: an operator decision per session. That is a strictly
-#    half, because every fallback-command is one row cheaper and the cheapest
+# SAFER direction for the one thing the old rule protected - the quota fallback
-#    rows are Sonnet - so this is what makes the QUOTA FALLBACK safe to take.
+# is still one row cheaper, it just no longer implies a capability lift nobody
-#    Pinned below by the row-3-falls-back-to-row-2 case.
+# was taking.
 #
-# 2. A MISTAKE IS EXPENSIVE TO UNDO (reversibility costly|one-way). On an Opus
+# Pinned as an ABSENCE over the whole trait space rather than on four sampled
-#    row the advisor is a peer review rather than a lift, which is worth
+# rows, because the claim is that no path emits it - the same "no write path
-#    paying for when being wrong is not cheap to reverse.
+# exists" argument the channel split uses. An absence check is worthless
-#
+# without a known-positive control, so the sweep's own grep is proven able to
-# The two barely overlap: costly forces row 3 and one-way forces row 4, so a
+# find a planted advisor before it is trusted to report none.
 # Sonnet row ALWAYS has reversibility=cheap and trigger 2 can never reach it.
 # Rule 1 covers the Sonnet rows, rule 2 covers the Opus rows.
 #
 # What is deliberately NOT a trigger: verification=none on its own. The set it
 # would add beyond rule 2 is exactly {verification=none AND
 # reversibility=cheap} - mistakes that are cheap to reverse. It survives on the
 # Sonnet rows only via rule 1, which is about the model, not the trait.
 adv="$(field known strong cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 1 (Sonnet/high) always carries an advisor" $?
+check "row 1 (Sonnet/high) carries no advisor" "$rc"
 adv="$(field known weak cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 2 (Sonnet/xhigh) always carries an advisor" $?
+check "row 2 (Sonnet/xhigh) carries no advisor" "$rc"
 adv="$(field known strong costly local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "reversibility=costly carries an advisor onto an Opus row" $?
+check "reversibility=costly no longer pulls an advisor onto an Opus row" "$rc"
 adv="$(field known strong one-way local command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "reversibility=one-way carries an advisor onto an Opus row" $?
 # The Opus rows reached WITHOUT expensive stakes are the whole no-advisor set.
 adv="$(field partial strong cheap local command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 3 via path=partial at cheap stakes takes NO advisor" "$rc"
+check "reversibility=one-way no longer pulls an advisor onto an Opus row" "$rc"
 adv="$(field known strong cheap multi-file command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 3 via scope=multi-file at cheap stakes takes NO advisor" "$rc"
 adv="$(field known strong cheap cross-cutting command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 4 via scope=cross-cutting at cheap stakes takes NO advisor" "$rc"
 # Rows 5-6 (Fable) are unreachable through this calculator now - section 1
 # pins that directly, and section 3's closed vocabulary covers every command
 # this script can ever emit. There is nothing left here for "Fable takes no
 # advisor" to test: that fact still holds (gated against the installed claude
 # by the CLI check below), but row_advisor()'s branch for it can no longer be
 # exercised through the public interface.
 # The fallback is the half the old rule called load-bearing, so it is pinned
 # in its own right: dropping a row under quota pressure must not reintroduce
 # the flag by the back door.
 adv="$(field known strong one-way local fallback-command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "row 4 fallback to row 3 keeps the advisor at one-way stakes" $?
 # THE POINT OF RULE 1, pinned. Row 3 at cheap stakes takes no advisor, but its
 # quota fallback is row 2 - a Sonnet row - which does. Dropping a row under
 # quota pressure must not silently drop the safety net with it.
 adv="$(field partial strong cheap local fallback-command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "an Opus row with no advisor still falls back to an advised Sonnet row" $?
 adv="$(field known strong cheap cross-cutting fallback-command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 4 falling back to row 3 at cheap stakes stays unadvised" "$rc"
+check "the row-4 fallback carries no advisor either" "$rc"
-# Closed vocabulary, same reason as the row table: one spelling in circulation.
+adv="$(field partial strong cheap local fallback-command)"
-# fable is not merely weaker here, it is REJECTED as an advisor outright.
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-allout="$("$R" --path known --verification strong --reversibility one-way \
+check "an Opus row falling back to a Sonnet row carries no advisor" "$rc"
          --scope cross-cutting --rationale x 2>/dev/null)"
 bad="$(printf '%s' "$allout" | grep -o -- '--advisor [a-z0-9-]*' | grep -v -- '--advisor opus')"
 [ -z "$bad" ]; check "the only advisor value ever emitted is opus:${bad:- none other}" $?
-if command -v claude >/dev/null 2>&1; then
+# THE SWEEP: every trait combination the calculator accepts, every line of
-  # A real gate that spends NO tokens. Advisor validation runs BEFORE the
+# output. 81 combinations, so a rule surviving on one unsampled corner cannot
-  # empty-prompt check, so `-p ""` reaches the validator and then exits: a
+# hide. Accumulated into one string and grepped once - a per-combination check
-  # valid advisor fails on the missing prompt, an invalid one fails on itself.
+# would add 81 lines to the summary and drown the rest of the suite.
-  # --help cannot gate this - it short-circuits before option validation, so
+sweep=""
-  # even an unknown flag exits 0 and the gate would pass without testing.
+for s_path in known partial undetermined; do
-  # Row 1-2's trigger is "sonnet main + opus advisor" specifically, so the
+  for s_ver in strong weak none; do
-  # main model is pinned rather than left to the ambient default.
+    for s_rev in cheap costly one-way; do
-  ADVOUT="$(claude --model sonnet --advisor opus -p "" 2>&1 | head -3)"
+      for s_sc in local multi-file cross-cutting; do
-  if printf '%s' "$ADVOUT" | grep -q 'unknown option'; then rc=1; else rc=0; fi
+        sweep="$sweep
-  check "installed claude accepts the --advisor flag at all" "$rc"
+$("$R" --path "$s_path" --verification "$s_ver" --reversibility "$s_rev" \
      --scope "$s_sc" --rationale x 2>/dev/null)"
      done
    done
  done
 done
 if printf '%s' "$sweep" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "no advisor in any output over all 81 trait combinations" "$rc"
-  if printf '%s' "$ADVOUT" | grep -q 'cannot advise'; then rc=1; else rc=0; fi
+# Known-positive control: the grep above reports an absence, so it must be
-  check "installed claude accepts opus advising a sonnet main" "$rc"
+# shown able to report a presence. Without this the sweep would pass just as
 # happily against an empty string.
 if printf '%s' "$sweep claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
 check "control: the sweep's grep does find a planted advisor" "$rc"
 # The help text is the rubric's published form, so the rule has to leave there
 # too - a doc line nothing tests is a doc line that drifts, and a struck rule
 # still written down is worse than one never removed: it reads as current.
 # The literal flag string is absent from route.sh ENTIRELY, including the
 # paragraph that records what was struck - that paragraph names "an opus
 # advisor flag" in words on purpose. A blunt grep cannot tell a description
 # from a specification (the same reason the cache assertion in coord-selftest
 # runs on an extracted path rather than the whole file), and keeping the
 # string out is cheaper than teaching the check to read prose. Do not
 # "restore the quote" here.
 HELPOUT="$("$R" --help 2>/dev/null)"
 if printf '%s' "$HELPOUT" | grep -q -- '--advisor opus'; then rc=1; else rc=0; fi
 check "--help no longer documents emitting --advisor opus" "$rc"
 if printf '%s' "$HELPOUT" | grep -q 'THE ADVISOR is emitted'; then rc=1; else rc=0; fi
 check "--help no longer carries the advisor rule block" "$rc"
 # Removing the rule silently would leave a reader guessing whether the advisor
 # is forbidden, forgotten, or someone else's. It is the third, and the help
 # says which.
 printf '%s' "$HELPOUT" | grep -q 'advisor is an operator decision per session'
 check "--help states whose decision the advisor is instead" $?
 grep -q 'advisor is an operator decision per session' "$R"
 check "route.sh itself carries that sentence, not just its help output" $?
 # --- 14b. Old route lines still parse ------------------------------------
 # Backward compatibility, pinned rather than assumed. Measured on the real
 # tree the day the rule was struck: 0 of 48 `<!-- route:` lines anywhere in
 # ~/repos carry an advisor field at all, so nothing in circulation depends on
 # it - but board.sh's route_cmd_for() reads these lines by trait NAME, and a
 # reader that broke on an unknown field would turn a STATE.md written last
 # month into "that repo has no route line", which is the misreading this whole
 # file exists to prevent.
 RL_ROOT="$(mktemp -d)"; mkdir -p "$RL_ROOT/repo-legacy"
 ( cd "$RL_ROOT/repo-legacy" && git init -q . 2>/dev/null ) || true
 {
  printf '# STATE\n\n## NESTE - START HER\n'
  printf '<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->\n'
  printf '<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; advisor=opus; rationale=legacy line written before the rule was struck -->\n'
  printf 'legacy next step\n'
 } > "$RL_ROOT/repo-legacy/STATE.md"
 RL_OUT="$("$BOARD" --roots "$RL_ROOT" --plan 2>/dev/null)"
 printf '%s' "$RL_OUT" | grep -q '^command=claude --model sonnet --effort high$'
 check "a route line carrying a legacy advisor= field still yields a command" $?
 if printf '%s' "$RL_OUT" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "and the command derived from it carries no advisor" "$rc"
  # row_advisor() never emits '--advisor fable' - it depends on the opposite
  # direction: whether opus can advise a FABLE main model. That is the fact
  # rows 5-6's suppression rests on, so that is what must be gated. (Measured
  # at CC 2.1.226: fable is now itself accepted as an advisor for opus/sonnet
  # mains - a capability-ordering change worth flagging to the operator, but
  # not what this check exists to pin.)
  FABOUT="$(claude --model fable --advisor opus -p "" 2>&1 | head -3)"
  printf '%s' "$FABOUT" | grep -q 'cannot advise'
  check "installed claude still rejects opus advising a fable main" $?
 else
  echo "  skip - claude not on PATH, advisor flag gate not run"
 fi
 echo ""
 echo "route-selftest: $PASS passed, $FAIL failed"
--- a/scripts/route.sh
+++ b/scripts/route.sh
@ -29,10 +29,7 @@
 # departure from it is recorded in STATE as an OVERRIDE, never produced here.
 # Write "Fable 5/high" or "Fable 5/xhigh" into the board line by hand when
 # that is the right call; board.sh still parses both (route-selftest.sh
-# section 6 pins that half). The one fact worth carrying: a Fable session
+# section 6 pins that half).
 # runs without an advisor (row_advisor() below, and gated against the
 # installed claude by route-selftest.sh section 14) - informational, never a
 # gate on reaching the row, since there is no longer a gate to reach.
 #
 # Cheapest first, so the rubric's "always name one row cheaper as the quota
 # fallback" is row minus one, floored at row 1, correct by construction.
@ -66,32 +63,14 @@
 # overkill costs quota every session - but a wrong architecture decision in a
 # published plugin costs more than either.
 #
-# THE ADVISOR is emitted into the command as '--advisor opus' - a second,
+# THE ADVISOR IS NOT EMITTED, and that is a decision rather than an omission:
-# stronger model consulted at key moments during the session. It is added on a
+# the advisor is an operator decision per session, never the rubric's. Until
-# NEED, never unconditionally: an always-on advisor is the global advisorModel
+# 2026-09-12 this calculator appended an opus advisor flag on a NEED - always on
-# setting, which burns quota on every session in every repo and is the thing
+# the Sonnet rows, and on the Opus rows at costly|one-way stakes. It was struck
-# this rule exists to replace. Two independent needs qualify:
+# on a measurement: of 54 dispatches issued 08.-12.09 not one carried the flag,
-#
+# because sessions are started by hand from the model and effort, not from the
-#   rows 1-2   ALWAYS. The main model is Sonnet, so opus is a capability LIFT
+# whole line. A rule nothing honours is not policy, and an emitted value that
-#              rather than a peer - opus judgement at sonnet cost. This is what
+# nobody acts on is decoration in a field whose only job is to be evidence.
 #              makes the FALLBACK safe to take: every fallback is one row
 #              cheaper, and the cheapest rows are the Sonnet ones.
 #   rows 3-4   only at reversibility=costly|one-way. The main model is already
 #              Opus, so the advisor buys peer review, worth paying for when a
 #              mistake is not cheap to undo.
 #
 # Rows 5-6 never reach this logic at all - the calculator cannot select them
 # (see above). Informational only: were the operator to hand-write a Fable
 # command, it would carry no advisor either way, since the CLI rejects every
 # advisor for a Fable main model.
 #
 # The two triggers barely overlap: costly forces row 3 and one-way forces row
 # 4, so a Sonnet row always has reversibility=cheap. verification=none is
 # deliberately not a third trigger - beyond the stakes rule it would only add
 # mistakes that are cheap to reverse, docs sessions among them.
 #
 # Applied per ROW, so 'fallback-command' carries its own correct answer rather
 # than the winning row's.
 #
 # WHERE IT DISAGREES WITH THE RUBRIC'S EXAMPLES. The rows are task-type labels;
 # the traits are a different classification over the same six outcomes. They
@ -113,7 +92,7 @@
 #   route.sh --path <v> --verification <v> --reversibility <v> --scope <v>
 #            --rationale <text>
 #
-#   route.sh ... --last-model <Sonnet 5|Opus 5|Fable 5>
+#   route.sh ... --last-model <Sonnet 5|Opus 5|Fable 5|Fable 5.1>
 #                --last-effort <low|medium|high|xhigh|max>
 #                --last-completed <yes|no> --last-corrections <n>
 #
@ -208,9 +187,31 @@ if [ "$L_SET" -eq 1 ]; then
  # this record back as evidence months from now, so a drifted spelling
  # ("opus 5" for "Opus 5") rebuilds the reader-versus-writer drift this whole
  # script exists to remove, one field over.
  # THE SET IS CLOSED, AND STAYS CLOSED - decided 2026-09-01 when Fable 5.1
  # shipped and was refused here. Both boundary questions were live:
  #
  # (a) "Fable 5" is KEPT alongside the point release. The reason is not
  #     backward compatibility with the one STATE.md on this machine that still
  #     carries it (measured: 1 of 45 route-last lines) - it is that the row
  #     table above spells rows 5-6 "Fable 5/high" and "Fable 5/xhigh".
  #     Dropping the value would make this script refuse to record a name its
  #     own spec writes.
  #
  # (b) The set was WIDENED rather than replaced by form validation. A pattern
  #     like "<family> <digits>[.<digits>]" would still catch a misspelled
  #     family and a drifted case, and would stop catching A VERSION THAT DOES
  #     NOT EXIST: "Fable 5.2" and "Opus 7" would both pass and read back
  #     months later as evidence that a model ran when it never shipped. This
  #     field is telemetry read as evidence, so a silently-accepted lie is
  #     worse than a loud refusal.
  #
  # The cost of that choice is real and was paid before it was made: a session
  # that genuinely ran Fable 5.1 could not record it, so its record was omitted
  # or lied. The list must therefore be extended the day a model ships, and the
  # die message says so rather than leaving the caller to guess.
  case "$L_MODEL" in
-    "Sonnet 5"|"Opus 5"|"Fable 5") ;;
+    "Sonnet 5"|"Opus 5"|"Fable 5"|"Fable 5.1") ;;
-    *) die "--last-model: '$L_MODEL' is not a row-table model (Sonnet 5|Opus 5|Fable 5)" ;;
+    *) die "--last-model: '$L_MODEL' is not a row-table model (Sonnet 5|Opus 5|Fable 5|Fable 5.1) - a newly shipped model must be added to this list in route.sh, never approximated to a name that is already in it" ;;
  esac
  case "$L_EFFORT" in
    low|medium|high|xhigh|max) ;;
@ -266,41 +267,14 @@ row_base_cmd() {
  esac
 }
-# THE ADVISOR is a second, stronger model consulted mid-task. It costs real
+# No advisor is appended here or anywhere else - the advisor is an operator
-# tokens per session, so it fires on a NEED and nowhere else - an unconditional
+# decision per session, not a property this rubric computes (struck
-# advisor is just the global advisorModel setting, which is the thing this
+# 2026-09-12, see the header). row_cmd() is therefore the row's base command
-# replaces. Two independent needs qualify, and they are almost disjoint:
+# and nothing more; it stays a function rather than collapsing into
-#
+# row_base_cmd() because the emitted command and the row table are two
-#   rows 1-2 (Sonnet)  ALWAYS. opus is a capability LIFT here, not a peer:
+# separate things that happened to converge, and a later flag would attach
-#                      opus judgement at sonnet cost. This half is what makes
+# here, to one place, for both the winning row and its fallback.
-#                      the fallback-command safe, since every fallback is one
+row_cmd() { row_base_cmd "$1"; }
 #                      row cheaper and the cheapest rows are Sonnet.
 #   rows 3-4 (Opus)    only at costly|one-way stakes, where the advisor is a
 #                      peer review and being wrong is not cheap to undo.
 #
 # Rows 5-6 (Fable) never reach this function - $ROW can only be 1-4 (see
 # SELECTION above). Informational only: the only advisor this script ever
 # emits is opus (pinned by selftest 14's "the only advisor value ever emitted
 # is opus"), and opus is refused as under-capable for a fable main model -
 # measured against the installed claude, still true at CC 2.1.226 - so a
 # hand-written Fable command carries no advisor either way.
 #
 # costly forces row 3 and one-way forces row 4, so a Sonnet row always has
 # reversibility=cheap - the stakes rule can never reach rows 1-2, and the model
 # rule never reaches rows 3-4. verification=none is deliberately NOT a trigger:
 # beyond the stakes rule it would only add cheap-to-reverse mistakes, and it
 # would put an advisor on every docs session (known/none/cheap/local).
 #
 # Applied per ROW rather than once, because the fallback is a real command the
 # operator pastes under quota pressure and must carry its own correct answer.
 row_advisor() {
  case "$1" in
    1|2) echo " --advisor opus" ;;
    3|4) case "$2" in costly|one-way) echo " --advisor opus" ;; *) echo "" ;; esac ;;
    *)   echo "" ;;
  esac
 }
 row_cmd() { printf '%s%s\n' "$(row_base_cmd "$1")" "$(row_advisor "$1" "$REVERS")"; }
 FB=$((ROW - 1)); [ "$FB" -ge 1 ] || FB=1
--- a/scripts/state-line-guard-selftest.sh
+++ b/scripts/state-line-guard-selftest.sh
@ -565,6 +565,114 @@ run_hook "$P"
 [ "$HOOK_EXIT" -eq 0 ]; check "Edit: correcting done -> blocked is allowed with unpushed commits" $?
 unset SG_PATH SG_CONTENT
 # --- 11. F13: the line limit is overridable, and an unusable override is loud
 # The limit was a bare `const MAX_LINES = 120`, so a test of the BOUNDARY had
 # no choice but to hardcode 120 in every fixture - which means the tests and
 # the code encoded the same number twice, and section 1's boundary fixtures
 # would have to be rewritten by hand the next time the operator moves it (they
 # already were once, 60 -> 120). CLAUDE_STATE_MAX_LINES makes the boundary
 # testable at a cheap value AND gives the operator the same knob
 # CLAUDE_COORD_DIR gives them over the mailbox root.
 #
 # The override is not a bypass claim: this guard has always been escapable by
 # writing the file some other way (Bash, an editor), exactly as the sibling
 # pathguard is. What it must never do is silently NOT take effect.
 # Control first, at the DEFAULT: with no override set, the shipped limit still
 # governs. This is what proves the denials below come from the override rather
 # than from the guard having become stricter for everyone.
 unset CLAUDE_STATE_MAX_LINES
 P="$(payload '
 const content = "x\n".repeat(6);
 process.stdout.write(JSON.stringify({
  tool_name: "Write",
  tool_input: { file_path: "/tmp/f13/STATE.md", content }
 }));
 ')"
 run_hook "$P"
 [ "$HOOK_EXIT" -eq 0 ]
 check "F13: control - a 6-line new STATE.md is allowed at the default limit" $?
 # The override takes effect, in BOTH directions. One assertion alone would not
 # do: a broken parse that clamped everything to 0 would deny the 6-line file
 # and look like a working override.
 CLAUDE_STATE_MAX_LINES=5
 export CLAUDE_STATE_MAX_LINES
 run_hook "$P"
 [ "$HOOK_EXIT" -eq 2 ]
 check "F13: an override of 5 denies a 6-line new STATE.md" $?
 printf '%s' "$HOOK_STDERR" | grep -q 'max 5'
 check "F13: the denial message quotes the OVERRIDDEN limit, not the default" $?
 P5="$(payload '
 const content = "x\n".repeat(5);
 process.stdout.write(JSON.stringify({
  tool_name: "Write",
  tool_input: { file_path: "/tmp/f13/STATE.md", content }
 }));
 ')"
 run_hook "$P5"
 [ "$HOOK_EXIT" -eq 0 ]
 check "F13: exactly-at-the-override is still allowed (boundary, not off by one)" $?
 # The ratchet is a property of the guard, not of the constant, so it must
 # survive the override: an already-oversized file can still be edited toward
 # compliance. Same rule section 8 pins at the default.
 # The file must be named exactly STATE.md and the variable must be exported
 # BEFORE node reads it. Both were wrong in this section's first cut, and the
 # check went GREEN anyway - the basename gate let the write through without
 # measuring a thing, and the fixture file was never created. A vacuous pass
 # is the very defect this order is closing, so the fixture asserts its own
 # ground truth before the check that depends on it.
 mkdir -p "$TMPDIR/f13-ratchet"
 export SG_BIG="$TMPDIR/f13-ratchet/STATE.md"
 node -e 'require("fs").writeFileSync(process.env.SG_BIG, "y\n".repeat(40))'
 [ "$(wc -l < "$SG_BIG" | tr -d ' ')" = "40" ]
 check "F13: fixture ground truth - the oversized STATE.md really is 40 lines" $?
 P="$(payload '
 process.stdout.write(JSON.stringify({
  tool_name: "Write",
  tool_input: { file_path: process.env.SG_BIG, content: "y\n".repeat(20) }
 }));
 ')"
 run_hook "$P"
 [ "$HOOK_EXIT" -eq 0 ]
 check "F13: the ratchet survives the override (40 -> 20, still over 5, allowed)" $?
 # The inverse, so the check above cannot pass by the guard simply never firing
 # on this path: GROWING the same oversized file is still denied at 5.
 P="$(payload '
 process.stdout.write(JSON.stringify({
  tool_name: "Write",
  tool_input: { file_path: process.env.SG_BIG, content: "y\n".repeat(60) }
 }));
 ')"
 run_hook "$P"
 [ "$HOOK_EXIT" -eq 2 ]
 check "F13: growing that same oversized file is still denied under the override" $?
 # An override that cannot be used is DENIED, never silently ignored. A silent
 # fallback to 120 is the exact defect class this whole order is closing: the
 # caller would believe a limit was in force that never was, and a selftest
 # would go green having measured the default while claiming to measure 5.
 # Failing here is recoverable in one action (unset the variable) and the
 # message says which one.
 for bad in "0" "-3" "abc" "" "12.5" "1e3"; do
  CLAUDE_STATE_MAX_LINES="$bad"
  export CLAUDE_STATE_MAX_LINES
  run_hook "$P5"
  [ "$HOOK_EXIT" -eq 2 ] && printf '%s' "$HOOK_STDERR" | grep -q 'CLAUDE_STATE_MAX_LINES'
  check "F13: an unusable override ('$bad') is refused by name, not ignored" $?
 done
 # ...and an UNSET variable is not an unusable one. Without this the check above
 # would pass against a guard that refused every write on the planet.
 unset CLAUDE_STATE_MAX_LINES
 run_hook "$P5"
 [ "$HOOK_EXIT" -eq 0 ]
 check "F13: control - an UNSET override is the normal case, not a refusal" $?
 unset SG_BIG
 echo ""
 echo "state-line-guard-selftest: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ] || exit 1
--- a/skills/board/SKILL.md
+++ b/skills/board/SKILL.md
@ -16,11 +16,14 @@ description: >-
  "hva er billigst å flytte", "hvor bør jeg begynne", "status på tvers av repo",
  "hva er blokkert", "lag en dagsplan", "planlegg dagen", "hvilke repo skal jeg
  åpne i dag", "fokusdag på X", "i dag jobber jeg bare med X", "hvilke repo
-  gjelder X". Trigger even when the
+  gjelder X". Also covers Voyage briefs in flight across repos: "which briefs are
  running", "what phase is that brief in", "which brief is blocked on a decision",
  "show the voyage board", "hvilke briefer er i gang", "hvilken fase ligger den i",
  "hvilke briefer venter paa en beslutning", "vis Voyage-oversikten". Trigger even when the
  user names no repo and no tool — choosing *between* repos is this skill. Not for
  "where were we" inside the current repo: that is this repo's own STATE.md,
  already injected at session start.
-version: "0.28.0"
+version: "0.34.0"
 ---
 # board — which repo deserves the next session
@ -55,7 +58,9 @@ malformed argument — read stderr and fix it rather than retrying.
 in the session, from a number quoted in a document, or from memory. Inbox counts,
 uncommitted files and board lines all change between turns, and a recommendation
 built on a stale count is the exact defect the operator's premise-verification
-rule exists to stop. The run costs about three seconds.
+rule exists to stop. The run costs about eight seconds over ~50 repos (measured 2026-08-31; the
 older "about three seconds" figure predates both the current tree size and
 the `VOY` column).
 ## What the columns mean
@ -64,11 +69,57 @@ rule exists to stop. The run costs about three seconds.
 | `STATUS` | `planned` / `in-progress` / `blocked` / `deferred` / `done`, or `blocked>X` naming the repo it waits on. `?` means the STATE.md has no board line. |
 | `KOST` | Model/effort for the next step, from the rubric row table in `route.sh` (the `route` skill writes it; this one only reads it). |
 | `INN` | Unhandled inbox: **other repos are waiting on THIS one**. An obligation it owes outward. |
 | `ORDRE` | Pending orders: **authorized work is waiting on this repo**, unclaimed and pickable. |
 | `FLY` | Orders in flight (claimed). Someone TOOK the order — never proof a session is still alive. |
 | `VOY` | Voyage projects (briefs in flight). `N:Md` = how many, and how long since the **stalest** one's newest artifact. A bare `0` means none. Per-project detail lives in `--voyage`. |
 | `DRT` | Uncommitted files. |
 | `ALDER` | Days since STATE.md last changed — the age of the *plan*. `-` where the repo has none. |
 | `SISTE` | Days since the last commit — the age of the *work*. `-` where the repo has no commits yet. |
 | `NESTE` | First line of the STATE.md next-step block, truncated. |
 ## Briefs in flight — `--voyage`
    "$BOARD" --voyage
 Answers what no single `STATE.md` can: **which Voyage briefs are running, in what
 phase, and who is waiting on whom.** One `key=value` block per project.
 `fase` is the only field here that cannot be derived from a STATE.md at all, and
 it is why the view exists: `brief-draft` (the `/trekbrief` review gate has not
 cleared) → `brief` → `research` → `plan` → `execute` → `review`.
 Read these three the way the engine means them, and never soften them:
 - **`fase` measures ARTIFACTS, not sessions.** A plan executed in one session
  leaves no file, so `plan` is the last thing the filesystem can prove. Nothing
  here says a session is alive — the same refusal `FLY` carries.
 - **`kvalitet=-` means the `brief_quality` field is ABSENT, never that the brief
  is complete.** Only 8 of ~40 briefs on the real tree carry it. `partial` vs
  `complete` is exactly what three presence-greps cannot tell apart.
 - **`research=-` and `research=0` are different facts.** `-` is no research
  directory (never started); `0` is a directory that exists and holds nothing —
  a research step with null output.
 `venter=operatoerbeslutning` means the brief declares an open
 `[BLOCKING DECISION, before S<n>]`, and `blokkerende_gate` names the step it
 gates. That is the one form of "who waits on whom" the files can prove; the
 `ordre_id=` lines beside it carry the repo's pending orders, which is what lets a
 reader go from "this brief is standing still" to "this order is pending".
 Report what the blocks say. Do **not** infer that a brief is abandoned, that a
 decision has since been resolved, or that a session is running — the view
 reports and refuses the inference, and so should you.
 **`ORDRE` and `FLY` are never summed, and `FLY` is never read as "busy."** They
 are the same queue in two states. Before `FLY` existed, a repo with one order in
 flight and a repo with no orders at all both printed `ORDRE 0` — the same digit
 for two opposite facts, which is how two tabs sat idle for 45 hours holding
 finished orders with nothing on the board reporting it. What `FLY` still cannot
 tell you is whether a session is *running*: nothing un-claims an order when the
 session that claimed it dies (one order on the live mailbox had been claimed for
 117 hours). Say "an order is claimed here", never "a session is working here".
 The board inspects no processes and will not start.
 **`INN` never means "this repo is waiting on someone."** It means the opposite:
 messages arrived and were not handled. The mailbox format carries no reply-to or
 thread field, so outbound waiting is not derivable from it at all — `blocked>X` is
@ -178,6 +229,18 @@ Two things to say out loud when you hand it over:
  command to paste. Name those repos rather than letting the operator discover it
  per tab. Fixing them is the `route` skill's job, in *that* repo — never a side
  quest here.
 - **`ledig_antall=N` and the `ledig=` lines are free capacity, not tabs.** They
  name the repos that can take NEW work: nothing owed, nothing queued, nothing in
  flight, clean tree, at `done` or `deferred`. They carry no `tab=` and no
  command on purpose — there is no next step to start, so the operator decides
  what to send there. Read them out when the ask is about capacity ("hvem kan ta
  mer arbeid", "hvor har jeg ledig kapasitet") and whenever the plan is short.
  `status=done` alone is **not** the same set: on the real tree 4 of 17
  done/deferred repos were not free. Never derive this list yourself from the
  table — the engine joins four fields you would have to join by hand.
 - **`fly=N` on a tab block means that repo already holds a claimed order.** Say
  so before the operator opens the pane. It is not proof a session is live, and
  it is not a reason to drop the tab — it is a reason to look first.
 ### When the day has a subject ("fokusdag")
--- a/skills/coord-send/SKILL.md
+++ b/skills/coord-send/SKILL.md
@ -15,7 +15,7 @@ description: >-
  covers retiring a broadcast that has become wrong or obsolete: "retract that
  broadcast", "that announcement is outdated, pull it", "trekk tilbake kringkastingen",
  "den broadcasten er utdatert".
-version: "0.28.0"
+version: "0.34.0"
 ---
 # coord-send — natural-language front door for inter-repo messages
--- a/skills/dispatch/SKILL.md
+++ b/skills/dispatch/SKILL.md
@ -17,7 +17,7 @@ description: >-
  skill. Not for choosing WHICH repo deserves the next session (that is `board`),
  not for scoring model and effort alone (that is `route`), and not for sending a
  message to another repo (that is `coord-send`).
-version: "0.28.0"
+version: "0.34.0"
 ---
 # dispatch — hand a session a task it can actually start on
@ -124,8 +124,8 @@ Two facts about this measurement, both verified 2026-08-16 against the installed
 ### 4. Score the four traits and call `--dispatch`
-Scoring is judgement and it is yours; the model, effort and advisor flag are a
+Scoring is judgement and it is yours; the model and effort are a lookup and are
-lookup and are `route.sh`'s. Score the task **the dispatched session** will do,
+`route.sh`'s. Score the task **the dispatched session** will do,
 using the `route` skill's trait table.
 Pass `--order-id <id>`, not `--prompt-file`. The emitted command is then a thin
@ -140,13 +140,18 @@ empty prompt file, one level up.
 queue to write to. Passing both is refused: the session would be told two
 things.
-`--dispatch` deliberately takes no `--model`/`--effort`. `--advisor opus` is a
+`--dispatch` deliberately takes no `--model`/`--effort`. The rubric is a policy
-property of the rubric *row* — two rows share a model/effort pair while
+with exactly one copy, and a dispatch that took the model directly would be a
-differing on it, and the CLI accepts a wrong advisor silently — so a dispatch
+second, unscored way to reach the same decision — one that records no traits, no
-that took the model directly would have no honest source for that flag. If the
+rationale and no `next-cost`, so nothing afterwards could say whether the
-right call is a Fable row, the rubric cannot produce it: write that command by
+routing or the scoring was wrong. Score the traits and let the lookup spell the
-hand, and say in the handover that it is a recorded override, running without an
+command. If the right call is a Fable row, the rubric cannot produce it: write
-advisor.
+that command by hand and say in the handover that it is a recorded override.
 **No `--advisor` is emitted, by the rubric or by this skill.** That rule was
 struck 2026-09-12 on a measurement — 0 of 54 dispatches carried the flag. The
 advisor is an operator decision per session; do not add one to a dispatch
 command.
 ### 5. Verify, then hand it over
--- a/skills/route/SKILL.md
+++ b/skills/route/SKILL.md
@ -14,7 +14,7 @@ description: >-
  the operator names no model and no tool — choosing the model for the next
  session IS this skill. Not for choosing which REPO gets the next session:
  that is the `board` skill.
-version: "0.28.0"
+version: "0.34.0"
 ---
 # route — what the next session should run with
@ -104,8 +104,7 @@ in STATE as an **override**, never as something this skill produces. If Fable
 is the right call for the next step's *form* (big-picture, review, planning),
 write the board line and the `rule` by hand — `board.sh` still parses
 "Fable 5/high" and "Fable 5/xhigh" — and say so plainly in the rationale rather
-than scoring the four traits to land there. One fact worth carrying into that
+than scoring the four traits to land there.
 override: a Fable session runs without an advisor.
 ## The last-session record
@ -186,24 +185,26 @@ Give the operator the two closing-line items and nothing more:
  the working directory is already right. If the next step belongs in a
  different repo, say so in plain words — that is a different tab, not a `cd`.
-**Paste `command` verbatim, `--advisor opus` included.** The calculator decides
+**Paste `command` verbatim.** It is the row's whole spelling: model and effort,
-the advisor per row, and it is not decoration: on a Sonnet row it is what lifts
+and nothing else. Do not add flags the calculator did not emit.
-the session to Opus judgement at Sonnet cost, which is what makes the cheaper
+
-`fallback-command` safe to take under quota pressure. Dropping it because it
+**The advisor is not this skill's to decide.** Until 2026-09-12 the rubric
-looks like noise silently removes that. Equally, never *add* it to a command
+appended an opus advisor on some rows; that rule is struck, on a measurement —
-that came back without one — an unconditional advisor is the global
+of 54 dispatches issued 08.–12.09 not one carried it, because sessions are
-`advisorModel` setting, which costs quota in every session in every repo and is
+started by hand from the model and effort. The advisor is now an operator
-the failure mode this rule replaces. `route.sh --help` carries the full rule.
+decision per session. Never add `--advisor` to an emitted command on your own
 initiative; if the operator asks for one, that is their call and it belongs in
 the handover as what it is — an operator choice, not a rubric outcome.
 If `command` and `fallback-command` are the same as the current session's model,
 say `/clear` is enough instead — but only if no newly installed plugin or skill
 needs a fresh process to be picked up.
-**`--advisor` is part of that comparison, not an afterthought.** It is a launch
+**An advisor the operator asked for is part of that comparison.** It is a
-flag, so `/clear` reuses the process and keeps whatever advisor the session
+launch flag, so `/clear` reuses the process and keeps whatever advisor the
-started with. If `command` carries `--advisor opus` and this session was not
+session started with — a session that is to gain or lose one needs `/exit` and
-launched with it, `/clear` is *not* enough — the operator needs `/exit` and the
+a full command, never `/clear`. The rubric never puts it there; the operator
-full command, or the advisor silently never appears.
+does.
 Do not paste the whole output block. One row, the rule that produced it, the
 command.
--- a/tests/selftest.test.mjs
+++ b/tests/selftest.test.mjs
@ -4,7 +4,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@ -12,8 +12,31 @@ import { fileURLToPath } from 'node:url';
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 const hook = join(root, 'hooks', 'scripts', 'session-start.mjs');
 // Every bash suite already prints its own total on its last line, and this
 // wrapper already runs all five. Capturing that line here is what makes the
 // README's numbers testable without a SECOND copy of the counting: nothing
 // re-counts `check` calls (loops make that undecidable anyway) and nothing
 // re-runs a suite to read a number the run in progress is already printing.
 // The five suites cost 212s sequentially, measured 2026-09-05 under /bin/bash
 // 3.2 - the marginal cost of the README check is zero because it consumes a
 // run that happens regardless.
 const summaries = new Map();
 function runSuite(name) {
  const script = join(root, 'scripts', `${name}-selftest.sh`);
  try {
    summaries.set(name, execFileSync('bash', [script], { encoding: 'utf8' }));
  } catch (err) {
    // Record what the suite managed to print before failing, then let the
    // failure through: a red suite must stay red here, and the README check
    // below still gets a number to compare rather than a silent absence.
    if (typeof err.stdout === 'string') summaries.set(name, err.stdout);
    throw err;
  }
 }
 test('coord bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'coord-selftest.sh')], { encoding: 'utf8' });
+  runSuite('coord');
 });
 // board.sh reads this plugin's mailbox for its INN column, so the board ships
@ -22,7 +45,7 @@ test('coord bash selftest passes', () => {
 // through CLAUDE_PLUGIN_ROOT, so a board.sh that exists only in
 // ~/.claude/scripts/ would be missing on exactly the path production uses.
 test('board bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'board-selftest.sh')], { encoding: 'utf8' });
+  runSuite('board');
 });
 // route.sh is the WRITER for the next-cost field board.sh already reads, so its
@ -31,7 +54,7 @@ test('board bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a calculator proven only elsewhere is unproven on the
 // one path production uses.
 test('route bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'route-selftest.sh')], { encoding: 'utf8' });
+  runSuite('route');
 });
 // pre-state-line-guard.mjs is a PreToolUse hook, so like session-start.mjs it
@ -39,7 +62,7 @@ test('route bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a guard proven only elsewhere is unproven on the
 // path production actually runs.
 test('state-line-guard bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'state-line-guard-selftest.sh')], { encoding: 'utf8' });
+  runSuite('state-line-guard');
 });
 // The order queue is the second channel beside the mailbox, with the opposite
@ -48,7 +71,7 @@ test('state-line-guard bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, so a queue proven only elsewhere is unproven where it
 // runs.
 test('orders bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'orders-selftest.sh')], { encoding: 'utf8' });
+  runSuite('orders');
 });
 // The engine refuses to invent an identity from the cwd, but the hook is the
@ -188,3 +211,69 @@ test('hook keeps mail and orders in separate blocks, mail first', () => {
  assert.ok(ctx.includes('UNTRUSTED DATA'), 'the mail block lost its authorization framing');
  assert.ok(ctx.includes('OPERATOR-AUTHORIZED'), 'the order block lost its authorization framing');
 });
 // --- README's selftest numbers must rot loudly ------------------------------
 //
 // The badge and the five `## Development` comments are the only public claim
 // about how much this engine is pinned by, and they are the number furthest
 // from the meter: they rotted twice in a row (529 from 0.25.0; then a badge
 // saying 868 beside comments summing to 792 - two different wrong sums of the
 // same fact, neither matching the other, on the same screen). Nothing caught
 // either, because nothing compared them to anything.
 //
 // It lives HERE rather than in one of the five bash suites, and the choice is
 // not arbitrary. The order's parenthetical suggested the suite that already
 // pins README/catalog invariants; measured before choosing, no such suite
 // exists - `grep -ln README scripts/*selftest*.sh` returns board-selftest.sh
 // alone, on two incidental hits (a prose comment and a `research/README.md`
 // fixture). Of the places that could host it, this wrapper is the only one
 // where all five numbers exist at once in a run that already happens: a check
 // inside a suite could see its own count but would have to RE-RUN the other
 // four (212s, measured 2026-09-05) to see theirs, and reading counters out of
 // the scripts is the second copy of the counting this check was asked not to
 // be. `check` calls sit inside loops, so a static count is not merely a second
 // copy - it is a wrong one.
 //
 // The truth source is each suite's own summary line, verbatim, and a suite
 // that stops printing one FAILS here rather than being skipped: an absent
 // measurement must not read as a matching one.
 function suiteTotal(name) {
  const out = summaries.get(name);
  assert.ok(out !== undefined,
    `${name}-selftest produced no captured output: its total was never measured, ` +
    'so the README comparison below would be resting on nothing');
  // Two summary grammars, both already in the tree: coord prints
  // `PASS=N FAIL=M`, the other four print `<name>-selftest: N passed, M failed`
  // and orders adds `, S skipped (of T checks)`. README documents the TOTAL
  // number of checks, so skipped ones count.
  let m = out.match(/^\S+-selftest: (\d+) passed, (\d+) failed(?:, (\d+) skipped)?/m);
  if (m) return Number(m[1]) + Number(m[2]) + Number(m[3] ?? 0);
  m = out.match(/^PASS=(\d+) FAIL=(\d+)/m);
  assert.ok(m, `${name}-selftest printed no summary line this parser recognises`);
  return Number(m[1]) + Number(m[2]);
 }
 test('README states the selftest counts the suites actually reported', () => {
  const readme = readFileSync(join(root, 'README.md'), 'utf8');
  const suites = ['coord', 'board', 'route', 'orders', 'state-line-guard'];
  let sum = 0;
  for (const name of suites) {
    const measured = suiteTotal(name);
    sum += measured;
    const line = readme.match(
      new RegExp(`^\\s*bash scripts/${name}-selftest\\.sh\\s+#\\s+(\\d+) checks`, 'm'));
    assert.ok(line,
      `README's ## Development block has no "N checks" comment for ${name}-selftest.sh`);
    assert.equal(Number(line[1]), measured,
      `README says ${name}-selftest has ${line[1]} checks; it reported ${measured}`);
  }
  // The badge is the sum, and it is compared against the MEASURED total rather
  // than against the five README comments: a badge agreeing with five stale
  // comments is exactly the 868-beside-792 shape, one layer down.
  const badge = readme.match(/badge\/selftest_checks-(\d+)-/);
  assert.ok(badge, 'README has no selftest_checks badge to check');
  assert.equal(Number(badge[1]), sum,
    `README's badge says ${badge[1]} selftest checks; the five suites reported ${sum}`);
 });