feat(route,board): strike the advisor rule, add board.sh --row <repo>

Order 20260912T202210Z-7588027378-from-.claude, operator decision 2026-09-12 (helhetlig vurdering av arbeidssystemet, cut row 3 and the board.sh --row improvement row). One order, two parts, one version bump. THE ADVISOR RULE IS STRUCK. route.sh and board.sh --dispatch emit no --advisor at all. The rule fired per ROW on a need - always on the Sonnet rows (a capability lift, which is what made the quota fallback safe to take), and on the Opus rows at reversibility=costly|one-way - and it read well. It was killed by a MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried the flag, because sessions are started by hand from the model and effort rather than from the whole emitted line. A rule nothing honours is not a policy, and an emitted value nobody acts on is decoration in a field whose only job is to be evidence. The advisor is now what it already was in practice: an operator decision per session, said in one sentence in route.sh --help. The comments that rested on the rule were REWRITTEN, not left standing. board.sh --dispatch still refuses a --model/--effort pair, but the reason is no longer "the advisor is a property of the ROW": it is that the rubric has exactly one copy, and a dispatch taking the model directly would be a second, unscored way to reach the same decision - recording no traits, no rationale and no next-cost, so nothing afterwards could say whether the routing or the scoring was wrong. A comment defending a removed mechanism is how the next session restores it. Both skills carry the correction. Pinned as an ABSENCE over the whole trait space - 81 combinations, every line of output, with a known-positive control proving the sweep's grep can find a planted advisor - rather than on four sampled rows, because the claim is that no path emits it. board.sh --dispatch at reversibility=costly is pinned separately: that is the exact input a reintroduced rule would fire on. The literal string is absent from route.sh entirely, including the paragraph recording what was struck (it says "an opus advisor flag" in words), because a blunt grep cannot tell a description from a specification. Backward compatibility is pinned rather than assumed: a route line carrying a legacy advisor= field still parses and still yields a command - measured, 0 of 48 route lines in ~/repos carry one, but a reader that broke on an unknown field would turn last month's STATE.md into "that repo has no route line". The three CLI gates section 14 carried went with the rule; the suite no longer depends on the installed claude at all. board.sh --row <repo> IS THE SEVENTH RENDERING of the same scan, never a second scan, read-only like every other one. (The order calls it the sixth; by this file's own numbering --inbox-plan is the fourth and --dispatch the fifth. Corrected rather than carried wrong.) It exists because the columns WERE misread: on 11.09 the PM read FLY off the table by eye and got it wrong, while every other rendering a program consumes is already key=value. inn, ordre and fly are three separate fields because they are three separate facts; status is the bare token, never the table's blocked>target display, with blocked-on beside it; neste is last and uncut. An unknown repo exits 2 and writes NOTHING to stdout - an empty block would read as a repo whose every column is blank, which is a real and different state. upushet is the ONE field that is not a rendering of the scan, and it is named rather than blended in: nothing in the scan measures it, so it is read once, for the named repo only, and never enters the table, the plan or the briefing. It reads the remote-TRACKING ref, not the remote, so upushet=N honestly means "the local ref says N"; a repo with no upstream reports ?, never 0. The row fixture's three counts are three DIFFERENT integers (3/2/1), and that is the finding worth recording. Built first with 2/1/1, it was mutation-tested by making fly read the ORDRE field - the exact 11.09 misreading - and the check stayed GREEN, because the two fields held the same digit. A fixture that cannot tell two columns apart is the defect wearing a passing test, inside the section written to prevent it. Suites under /bin/bash 3.2, before -> after: coord 257 -> 257, board 393 -> 427, route 73 -> 73 (13 advisor checks and 3 CLI gates out, 15 absence/legacy checks in, and it no longer varies with claude being on PATH), orders 116 -> 116, state-line-guard 54 -> 54. Sum 893 -> 927, README badge updated to the measured sum. npm test 12/12, fail 0. Verified live against the real tree, not only fixtures: --row repo-mailbox reports fly=1 beside ordre=0 (the distinction that was misread), --row on the nested key from-ai-to-chitta/content-sadhguru resolves, and an unknown repo exits 2. No tag, no push, no catalog change - that is the operator's release-plugin.mjs run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(changelog): the 0.33.1 section that was never written
2026-09-12 23:45:47 +02:00 · 2026-09-05 20:34:06 +02:00 · 2026-09-05 20:33:55 +02:00 · 2026-09-05 07:33:36 +02:00 · 2026-09-05 06:49:15 +02:00 · 2026-09-04 21:35:55 +02:00
19 changed files with 2182 additions and 314 deletions
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.32.0",
+  "version": "0.34.0",
  "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
  "author": {
    "name": "Kjell Tore Guttormsen"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -5,6 +5,259 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 ## [Unreleased]
 ## [0.34.0] - 2026-09-12
 ### Changed
 - **The advisor rule is struck from the rubric: `route.sh` and `board.sh
  --dispatch` no longer emit `--advisor` at all.** It fired on two needs -
  always on the Sonnet rows, and on the Opus rows at `costly|one-way` stakes -
  and it read well. What killed it was a measurement, not a change of taste:
  of 54 dispatches the PM issued 08.-12.09, **zero** carried the flag, because
  sessions are started by hand from the model and effort rather than from the
  whole emitted line. A rule nothing honours is not a policy, and an emitted
  value nobody acts on is decoration in a field whose only job is to be
  evidence. The advisor is now what it already was in practice: an operator
  decision per session, said in one sentence in `route.sh --help`. The
  direction is the safe one for the single thing the old rule protected - the
  quota fallback is still exactly one row cheaper, it just no longer implies a
  capability lift nobody was taking.
 - **The comments that rested on it were rewritten, not left standing.**
  `board.sh --dispatch` still refuses a `--model`/`--effort` pair, but the
  reason is no longer "the advisor is a property of the ROW": it is that the
  rubric has exactly one copy, and a dispatch taking the model directly would
  be a second, unscored way to reach the same decision - one recording no
  traits, no rationale and no `next-cost`, so nothing afterwards could say
  whether the routing or the scoring was wrong. A comment defending a
  mechanism that has been removed is how the next session restores it.
  `skills/route/SKILL.md` and `skills/dispatch/SKILL.md` carry the same
  correction.
 - Pinned as an ABSENCE over the whole trait space rather than on sampled rows -
  81 trait combinations, every line of output, with a known-positive control
  proving the sweep's grep can find a planted advisor - plus `--dispatch` at
  `reversibility=costly`, the exact input a reintroduced rule would fire on.
  Backward compatibility is pinned too: a route line carrying a legacy
  `advisor=` field still parses and still yields a command (measured the same
  day: 0 of 48 `<!-- route:` lines anywhere in `~/repos` carry one, so nothing
  in circulation depends on it - but a reader that broke on an unknown field
  would turn last month's STATE.md into "that repo has no route line").
 ### Added
 - **`board.sh --row <repo>`: the table's row for one repo, as `field=value`
  lines.** A seventh rendering of the same scan, never a second scan, and
  read-only like every other one. The motivation is a measured misreading: on
  11.09 the PM read the FLY column off the table **by eye** and got it wrong.
  Every other rendering a program consumes (`--plan`, `--inbox-plan`,
  `--dispatch`) is already `key=value`; the default view was the one left out,
  and a 34-character repo key already shifts a row two characters right, which
  makes counting spaces worse than it looks. `inn`, `ordre` and `fly` are three
  separate fields because they are three separate facts, and confusing them is
  what this exists to close. `status` is the bare token, never the table's
  `blocked>target` display, with `blocked-on` beside it; `neste` is last and
  uncut, for the same reason it is last in the record. An unknown repo exits
  **2** and writes nothing to stdout - an empty block would read as a repo whose
  every column is blank, which is a real and different state.
 - `upushet=` is the one field that is **not** a rendering of the scan, and it is
  named rather than blended in: nothing in the scan measures it, so it is read
  once, for the named repo only, and never enters the table, the plan or the
  briefing. It reads the remote-TRACKING ref, not the remote, so `upushet=N`
  honestly means "the local ref says N"; a repo with no upstream reports `?`,
  never `0`, because "nothing is waiting to be pushed" and "nobody looked" are
  exactly the pair this engine refuses to render alike.
 ### Fixed
 - **README's selftest numbers were re-measured, not re-derived.** The badge said
  `selftest_checks-868` and the five `## Development` comments said
  220/360/73/99/40 = 792 - two different wrong sums on the same public surface,
  neither matching the other. The five suites were run under `/bin/bash` (3.2)
  on `b57a1ea` and reported `coord 257`, `board 393`, `route 73`, `orders 116`,
  `state-line-guard 54` = **893**, 0 failed in every summary. 0.33.0's entry
  below records 257+368+73+116+54 = 868 and was true when written; 0.33.1 added
  25 board checks (368 -> 393) without re-summing, and the comment block had been
  stale far longer. No code, no version bump: the number furthest from the meter
  rots first, and only the number moved.
 ## [0.33.1] - 2026-09-04
 ### Added
 - **A git repo nested under a depth-1 repo now enters the board, on a STATE.md
  and nothing wider.** Discovery adds a depth-1 repo and stops, and the
  else-branch container scan - the only place children are ever looked at - is
  unreachable for an entry that is itself a repo. Measured before anything was
  written: **12 nested repos across the real tree, exactly 1 with a STATE.md**
  (`from-ai-to-chitta/content-sadhguru`, which had been running work and
  reporting to nobody). The other 11 are vendored or experimental checkouts and
  stay invisible on purpose - they do not even reach the `UTEN STATE.md` bucket.
  `add_nested_repos()` sits beside `add_dot_repos()` rather than widening the
  `*` loops, for the same reason ordre `20260818T124828Z` gave for dot repos:
  routing a depth-1 repo into the container branch would admit every nested
  checkout. One level only; depth 3 is pinned as NOT admitted. A dot-prefixed
  depth-1 repo gets the same nested scan, since nothing in the criterion
  distinguishes it.
  A nested repo carries **two names**, and conflating them would have put a
  fabricated 0 in three columns. The board KEY is `<parent>/<child>`; the
  MAILBOX name is `basename(git toplevel)`, so `$COORD/<parent>/<child>/inbox`
  finds no directory and INN/ORDRE/FLY would read 0 for a repo that may have
  mail. The record loop carries `mbox` beside `name`, and `--voyage`'s order
  lookup takes `basename($vy_dir)`. Which directories are nested is RECORDED by
  discovery (`NESTED_LIST`), never re-derived from "is my parent a repo?".
 - **The scan reports its own denominator.** `undersoekt: N katalog(er) depth 1,
  M polyrepo-container(e), K nestede repo (J med STATE.md tatt med).` The header
  count answered how many repos were found and nothing about how many were
  looked at, so a criterion excluding 11 of 12 nested repos was invisible on the
  surface built to show it. Real tree 2026-09-04: `43 / 5 / 12 (1 tatt med)`. A
  non-repo dot-directory counts in N and never in M - the line is a denominator,
  not a partition.
 ### Fixed
 - The denominator line's own wording broke an existing check: `polyrepo
  container itself is not listed as a repo` grepped the whole output for
  `polyrepo` and matched the new footer's `polyrepo-container(e)` - the same
  class as a grep reading a comment that EXPLAINS a pattern as an instance of
  it. Now anchored at column 1, which is what it always meant.
 ### Known gaps, stated rather than closed
 - The mailbox-keyed JOINs (`$OWED`, `brief_orphans`, `--inbox-plan`) still key
  on the board name, so a nested repo owing a reply gets no debt tab and is
  listed under `UTENFOR REPO-SKANNEN`. Neither created nor worsened here: before
  this change the repo was absent from `RECORDS` entirely, so both readings were
  already exactly as wrong.
 - A 34-character key overflows the table's `%-32s` REPO column, shifting that
  row two characters right. Same class as `Fable 5.1/xhigh` in KOST; parsing is
  unaffected, and widening the column moves three `cut -c89-` selftest helpers.
 - A dot-prefixed NESTED repo is not looked for. The combination was neither
  measured nor ordered.
 ### Testing
 - `board-selftest.sh` 368 -> 393 checks.
 ## [0.33.0] - 2026-09-04
 ### Added
 - **The FYI sweep is scheduled. Invocation was the gap, not the mechanism.**
  `coord-sweep.sh` shipped in 0.10.0 and had never run once against the real
  mailbox. Measured 2026-09-03 with a denominator
  (`docs/2026-09-03-coordination-debt-measurement.md`): 55 mailbox directories,
  52 carrying an `inbox/`, 27 pending directed messages - of which **23 were
  pure notices**, re-injected at every session start in repos nobody had
  opened. The script was correct and unreachable.
  The order behind this (WP5, `20260902T113745Z-1254925290`) asked for a
  mechanism and named two candidates; the measurement chose neither, and the
  first session returned the order saying so. Bulk-ack for pure notices *was
  already built* - it is this script - so building the second candidate would
  have been two copies of one policy. The broadcast class converges on its own
  (reading sets `seen`), and 34 of 263 unread pairs belong to two mailboxes no
  session can hold, so a TTL would have **closed** those rather than reduced
  them. The operator then chose the window and authorized the schedule.
  `launchd/com.ktg.repo-mailbox-sweep.plist` runs `--write --days 14` daily at
  05:30. That is the entire behavioural change; no new mechanism was built.
 - **The 14-day window is written out in the plist, not inherited from the
  script's default.** It is a policy constant chosen on a measured distribution
  (30 days would have closed 0 messages, 14 closed 7, 7 would have closed 13),
  of the same class as the STATE.md line limit. Leaving it implicit would let a
  later change to `DAYS=14` silently change what an unattended job closes every
  night across every other mailbox on this machine.
  It runs at 05:30, clear of the 06:00 briefing agent, because the briefing
  scans the same mailbox this mutates and the two must not overlap. It does
  **not** change what the briefing reports as debt: since 0.22.0 that figure
  comes from `coord-count.sh`'s `owed` column, and this sweep closes only
  messages that owe nothing. What moves is the raw pending count — the table's
  `INN` column and the volume injected at every session start. Selftest section
  38 asserts the two agents never share an hour.
 - **coord-selftest.sh section 38 pins the launchd templates (+15 checks, 242 ->
  257).** A wrong program path in a plist is the one defect here that nothing
  catches at runtime: the agent loads cleanly and then silently never runs -
  no output to be wrong, no exit status to read, a failure indistinguishable
  from a quiet machine. `launchctl list` proves an agent is *loaded*, never
  that it is *right*.
  The section covers **every** plist in `launchd/`, not just the new one: the
  plist grammar gets one reader here rather than one per agent, which is the
  two-copies-of-one-policy defect this repo has named repeatedly.
  `board-selftest.sh` section 9 still owns `brief-nightly.sh`'s behaviour. Each
  plist must name a script that exists in this checkout, carry a `Label`
  matching its filename, keep its `__CHECKOUT__`/`__HOME__` placeholders (the
  repo is mirrored publicly, and a plist is the one file that would otherwise
  need an absolute home path), and never point into the version-pinned plugin
  cache.
  The cache assertion runs on the **extracted program path, never the whole
  file** - caught by the check itself on its first run: the brief plist's header
  explains in prose why it does *not* point at the cache, and a file-wide grep
  read that explanation as the defect it warns about. Same shape as the board
  line, where prose saying `status=done` must never trigger the done-guard.
  Four controls are mandatory here and present: the extractor really does read
  a path, a plist naming a missing script is judged missing, a `Label`
  disagreeing with its filename is caught, and a program path inside the plugin
  cache is caught. Mutation-verified against the real file: a one-letter typo
  (`coord-sweeep.sh`) turns exactly that check red.
  XML well-formedness is deliberately **not** checked. `plutil` is not
  coreutils, and malformed XML already fails loudly at `launchctl load` - the
  opposite of the silent failure this section exists for. Both files were
  linted by hand at 0.33.0.
 ### Fixed
 - **The README's selftest-checks badge had read 529 since 0.25.0; the real
  total is 868.** A stale count in the one place a reader takes as the
  headline number, corrected while adding to it: 257 + 368 + 73 + 116 + 54.
 ## [0.32.1] - 2026-09-03
 ### Fixed
 - **A pending order's age is read from the FILENAME, never the mtime.**
  `coord-order-done --return` rewrites the order file's mtime, and both age
  surfaces read mtime, so returning an order reset the very reading that says
  how long it has waited. An order returned three times could never look old.
  Found by reading the board immediately after this repo returned an order of
  its own: a file whose name says 2026-09-02 rendered `ORDRE 1:0d` and
  `pending, 0d old` minutes later. The filename is written once, at delivery,
  and nothing rewrites it - which is exactly the fact "how long has this sat
  with no owner" is asking about.
  Two questions, two sources, and the second one does not move: a CLAIMED
  order's age is "how long has it been in flight", which is the claim's own
  mtime and was already right. `board.sh` gains `oldest_pending_age()` beside
  `oldest_order_age()`; `coord-order-inbox.sh` gains `pending_age_of()` beside
  `age_of()`. Switching FLY to the filename would answer the delivery question
  in the column that asks the flight question.
  An unparseable filename yields `?` for the whole reading, never a fabricated
  `0` - the same fail-safe the mtime path already carried, and for the same
  reason: an unmeasured order could be the oldest one.
  Pinned by `orders-selftest.sh` section 11 (116 checks, up from 110) and
  `board-selftest.sh` section 30 (368, up from 360), each with its ground truth
  asserted before anything depends on it and with known-positive controls that
  a freshly delivered order still reads `0d` and that FLY did not move.
  Mutation-verified in both files: restoring the mtime read turns exactly the
  defect checks red and leaves every control green.
  Section 28's fixtures were rewritten as part of this, not incidentally: they
  encoded their intended ages in `touch -t` with fixed 2026-01/2026-08
  filenames, which a filename-based reading makes wrong and time-dependent.
  They now compute their stems from `date -v`, and the section asserts two
  ground truths - the filename for ORDRE, the mtime for FLY - because the two
  columns no longer read the same source.
 ## [0.32.0] - 2026-09-01
 Two commits, and the first of them was already written when this release
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -16,7 +16,7 @@ marketplace plugin. Three components, one boundary:
  `coord-done.sh` archives, `coord-count.sh` counts without delivering,
  `coord-sweep.sh` closes the aged FYI backlog machine-wide.
  Everything is pinned by `coord-selftest.sh`
-  (242 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
+  (257 checks, throwaway mailbox via `CLAUDE_COORD_DIR`).
  **`ktg-plugin-marketplace` is a RETIRED `--to` address (operator decision
  2026-08-15), rejected rather than redirected.** It is a polyrepo directory,
@ -94,6 +94,62 @@ marketplace plugin. Three components, one boundary:
  the class, defaulting to `--write`, or dropping the log each independently
  turn this from a bounded cleanup into silent data loss.
  **Order 20260902T113745Z-1254925290 (WP5, 2026-09-02, amended by the operator
  2026-09-03): the sweep was CORRECT AND UNREACHABLE, and the fix is a schedule,
  not a mechanism.** It shipped in 0.10.0 and had never run once against the
  real mailbox. Measured 2026-09-03 with a denominator
  (`docs/2026-09-03-coordination-debt-measurement.md`): 55 mailbox directories,
  52 with an `inbox/`, 27 pending directed messages, of which **23 were pure
  notices** being re-injected at every session start in repos nobody had opened.
  The order asked for a mechanism and named two candidates; the measurement
  chose neither, and the session returned it saying so. Bulk-ack for pure
  notices *was already built* - this script - so building the order's candidate
  B would have been two copies of one policy; and the broadcast class converges
  on its own (reading sets `seen`), with 34 of 263 unread pairs belonging to two
  mailboxes no session can hold, so a TTL would have **closed** those, not
  reduced them. `launchd/com.ktg.repo-mailbox-sweep.plist` is the entire
  0.33.0 change. **Invocation was the gap.**
  **The 14-day window is written OUT in the plist, never left to the script's
  default.** It is a policy constant the operator chose on a measured
  distribution (30d -> 0 messages, 14d -> 7, 7d -> 13), of the same class as the
  STATE.md line limit - so a later change to `DAYS=14` in the script must not
  silently change what an unattended nightly job closes across every other
  mailbox on this machine. (A hard count belongs in the dated measurement doc,
  not here: it was 52 with an `inbox/` on 2026-09-03 and 53 a day later.)
  The agent runs at **05:30**, clear of the 06:00 briefing agent, because the
  briefing scans the same mailbox this mutates; selftest section 38 asserts the
  two hours differ. It does **not** change the briefing's DEBT figure - since
  0.22.0 that is read from `coord-count.sh`'s `owed` column, and this sweep
  closes only messages that owe nothing, so the debt listing is byte-identical
  before and after. What moves is the raw pending count (the table's `INN`
  column, `--brief`'s FYI-only naming, and the volume injected at every session
  start). The first cut of this paragraph claimed the sweep made the briefing
  report "the debt that remains" - an overclaim, caught in review, and recorded
  here because it is the kind of plausible sentence that survives a reread.
  **`launchctl list` proves an agent is LOADED, never that it is RIGHT, and a
  wrong program path is the one defect in this repo that nothing catches at
  runtime** - the agent simply never runs, in silence, with no output to be
  wrong and no exit status to read. Two separate things close it, and neither
  substitutes for the other: `launchctl start <label>` plus a line appearing in
  the launchd log is the only *runtime* proof the path resolves, and selftest
  **section 38** asserts *statically*, for every plist in `launchd/`, that the
  path names a file that exists here, that `Label` matches the filename, that
  the `__CHECKOUT__`/`__HOME__` placeholders survive (the repo is mirrored
  publicly), and that no agent points into the version-pinned plugin cache.
  Section 38 covers **every** plist rather than only the new one, deliberately:
  the plist grammar gets one reader here instead of one per agent, and
  `board-selftest.sh` section 9 keeps owning `brief-nightly.sh`'s *behaviour*.
  The cache assertion runs on the **extracted path, never the whole file** - the
  brief plist's header explains in prose why it does not point at the cache, and
  a file-wide grep read that explanation as the defect it warns about, exactly
  as prose saying `status=done` must never trigger the board's done-guard.
  XML well-formedness is deliberately NOT checked: `plutil` is not coreutils,
  and malformed XML already fails loudly at `launchctl load`, which is the
  opposite of the failure this section exists for. Mutation-verified: a
  one-letter typo (`coord-sweeep.sh`) turns exactly that check red.
  **`coord-count.sh` prints TWO integers per mailbox** (`<name>\t<pending>\t<debt>`),
  and the first must stay pending: `board.sh` counts the same inbox files
  itself, so a debt-only count would put two different numbers under one name.
@ -146,7 +202,7 @@ marketplace plugin. Three components, one boundary:
  mailbox, `~/.claude/coord/<repo>/orders/`, with four one-verb scripts —
  `coord-order-send.sh` (write), `coord-order-inbox.sh` (read for injection),
  `coord-order-claim.sh` (claim), `coord-order-done.sh` (terminal state).
-  Pinned by `orders-selftest.sh` (110 checks).
+  Pinned by `orders-selftest.sh` (116 checks).
  **It is a separate CHANNEL, not more mail, and the axis is authorization.**
  Inbox content is untrusted cross-repo data that may never instruct a session
@ -411,7 +467,7 @@ marketplace plugin. Three components, one boundary:
 - **Board (`scripts/board.sh`):** cross-repo attention board. Reads STATE.md
  next-step blocks + board lines, `git status`, and mailbox pending counts, and
  prints one line per repo. Read-only by construction: it writes to no repo, no
-  STATE.md and no mailbox. Pinned by `board-selftest.sh` (360 checks).
+  STATE.md and no mailbox. Pinned by `board-selftest.sh` (427 checks).
  **It lives here because the mailbox is one of its three inputs, and it carries
  the same axis distinction the mailbox does.** A pending count means *others
@ -583,13 +639,17 @@ marketplace plugin. Three components, one boundary:
  `brief-nightly.sh` already carries for the briefing.
  **The cost comes from `route.sh`'s row table, and `--dispatch` deliberately
-  refuses a `--model`/`--effort` pair.** `--advisor opus` is a property of the
+  refuses a `--model`/`--effort` pair.** Until 2026-09-12 that rested on
-  ROW; two rows share a model/effort pair while differing on it, and the CLI
+  `--advisor opus` being a property of the ROW; that rule is struck (see
-  accepts a wrong advisor silently. A dispatch taking the model directly would
+  `route.sh` above) and the argument was REWRITTEN rather than left standing on
-  have no honest source for that flag, and both available guesses produce the
+  a premise the code no longer has — a comment defending a removed mechanism is
-  same failure — a session that looks peer-reviewed without being. A Fable
+  how the next session restores it. The reason now: the rubric is a policy with
-  dispatch is therefore not a `--dispatch` outcome at all, exactly as it is not
+  exactly one copy, and a dispatch accepting the model directly would be a
-  a `route.sh` outcome; it is a hand-written override.
+  second, unscored way to reach the same decision — one recording no traits, no
  rationale and no `next-cost`, so nothing afterwards could say whether the
  ROUTING was wrong or the SCORING was. A Fable dispatch is therefore not a
  `--dispatch` outcome at all, exactly as it is not a `route.sh` outcome; it is
  a hand-written override.
  **`--target-pane yes|no` is REQUIRED, with no default, and that is the same
  rule `--last-effort` carries.** It is a measurement of the world — does the
@ -846,6 +906,101 @@ marketplace plugin. Three components, one boundary:
  it was exactly the unmeasured side effect the order flagged, and nothing
  in `~/repos` currently needs it (`.claude` has no repo children today).
  **Ordre 20260903T190201Z-238406410 (2026-09-03, operator decision the same
  day): a git repo nested under a depth-1 REPO was invisible to the board, and
  the admission that closes it is criterion (a) - a STATE.md - never "all
  nested repos".** Discovery adds a depth-1 repo and stops; the else-branch
  container scan is the only place children are ever looked at, and it is
  unreachable for an entry that is itself a repo. Measured on the real tree
  before anything was written: **12 nested repos across the tree, exactly 1
  with a STATE.md** (`from-ai-to-chitta/content-sadhguru`, which had been
  running work and reporting to nobody). The other 11 are vendored or
  experimental checkouts under `claude-code-100x/`; the operator's decision is
  that they stay invisible ON PURPOSE - they do not even reach the `UTEN
  STATE.md` bucket, because that bucket is for repos someone opens. Verified
  after the fix with `board.sh`, not from memory:
  `from-ai-to-chitta/content-sadhguru in-progress ... Sonnet 5/high`, and
  `--plan` gives it a real tab with a `paste=` line.
  **`add_nested_repos()` beside `add_dot_repos()`, never a widening of the `*`
  loops - the same argument ordre 20260818T124828Z made for dot repos, and the
  order made it again before this repo wrote a line.** Routing a depth-1 repo
  into the container branch would admit every nested checkout, which is exactly
  what criterion (a) declines. One level only: a repo inside a nested repo is a
  checkout of a checkout, and the selftest pins that depth 3 is NOT admitted. A
  dot-prefixed depth-1 repo gets the same nested scan an ordinary one gets
  (`add_dot_repos` takes a `d1` flag for it) - the asymmetry would otherwise be
  arbitrary, and nothing in the criterion distinguishes them.
  **A nested repo now has TWO names, and conflating them would have put a
  fabricated 0 in three columns.** The board KEY is `<parent>/<child>` as the
  order specifies - a bare basename says nothing about where the checkout lives
  and would collide with a same-named depth-1 repo. The MAILBOX name is not
  that key: a mailbox is addressed by `basename(git toplevel)`, which is
  `coord-send.sh`'s own rule and the only name a session in that repo can hold,
  so `$COORD/<parent>/<child>/inbox` finds no directory and INN/ORDRE/FLY print
  0 for a repo that may have mail. That is the failed measurement wearing the
  reassuring value, in three columns at once. The record loop therefore carries
  `mbox` beside `name`, and `--voyage`'s order lookup takes `basename($vy_dir)`
  for the same reason. Mutation-verified: reverting the eight `$COORD/$mbox`
  reads to `$COORD/$name` turns exactly the three mailbox checks red with every
  other check in the section green.
  **Which nested dirs those are is RECORDED by discovery, not re-derived.** The
  obvious re-derivation ("is my parent directory a git repo?") answers a
  slightly different question and would prefix every depth-1 repo if a scan
  root ever happened to be a checkout; `NESTED_LIST` cannot drift from the
  criterion because discovery is what writes it.
  **The denominator line is independent of all of that and went in regardless,
  because the order said so and because it is ansikt 4 pointed at the board's
  own reading.** `undersoekt: N katalog(er) depth 1, M polyrepo-container(e),
  K nestede repo (J med STATE.md tatt med).` The header's repo count answers
  "how many were found"; nothing answered "how many were looked at", so a
  criterion excluding 11 of 12 nested repos was invisible at the surface built
  to show it. Real tree, 2026-09-04: `43 katalog(er) depth 1, 5
  polyrepo-container(e), 12 nestede repo (1 med STATE.md tatt med)`. A
  non-repo dot-dir counts in N (it WAS examined) and never in M (it is
  deliberately not a container - ordre 20260818's decision), so the line is a
  denominator, not a partition. Selftest section 32 pins each number against a
  fixture, then changes the tree and asserts the numbers move, so a hardcoded
  constant cannot pass.
  **The line's own wording broke an existing check, and that is the finding
  worth recording.** `check "polyrepo container itself is not listed as a
  repo"` grepped the WHOLE output for `polyrepo`, so the footer's
  `polyrepo-container(e)` matched and the check went red on a board that was
  behaving correctly - the same defect class as coord-selftest section 38's
  cache grep reading a comment that EXPLAINS a pattern as an instance of it,
  and as the done-guard's rule that prose saying `status=done` must not trigger
  it. The check is now anchored at column 1, which is what it always meant: a
  container has no ROW.
  **Bounded gap, stated rather than closed (1): the mailbox-keyed JOINS still
  key on the board name.** `--brief`/`--plan`'s `$OWED` join, `brief_orphans`
  and `--inbox-plan` match `coord-count.sh`'s mailbox names against RECORDS
  field 3, so a nested repo owing a reply would not get a debt tab and would be
  listed under `UTENFOR REPO-SKANNEN`. This change neither creates nor worsens
  that: before it, the repo was not in RECORDS at all, so both readings were
  already exactly as wrong. Closing it means threading a mailbox key through
  six awk programs, which was not ordered and is not a discovery change.
  Reported to `.claude` for its own order.
  **Bounded gap, stated rather than closed (2): a 34-character key overflows
  the table's `%-32s` REPO column**, shifting `from-ai-to-chitta/content-sadhguru`'s
  row two characters right. Same class as `Fable 5.1/xhigh` overflowing the
  `%-14s` KOST column, and handled the same way: parsing is unaffected (every
  rendering that a driver reads is `key=value`), widening the column moves every
  fixed offset including three `cut -c89-` selftest helpers, and it is a
  rendering change nobody ordered. Truncating instead would be worse - it would
  destroy the very identity the compound key exists to carry, and break
  copy-paste into `--dispatch --repo`.
  **Bounded gap, stated rather than closed (3):** a DOT-prefixed *nested* repo
  is not looked for. The `*` glob in `add_nested_repos()` has no dotglob, the
  combination was neither measured nor ordered, and `add_dot_repos` exists for
  the depth-1 and container cases only because those were.
  **Ordre 20260820T204409Z (2026-08-20): `route_cmd_for()`'s four trait
  extractions searched the WHOLE route line, and `.*trait=` is greedy, so a
  rationale that names a trait won the match over the field itself.**
@ -915,23 +1070,38 @@ marketplace plugin. Three components, one boundary:
  and belongs to the skill; turning scores into a row is a lookup and takes zero
  model calls.
-  **`--advisor opus` is emitted per ROW, on a need, never unconditionally.**
+  **NO `--advisor` is emitted, by this calculator or by `board.sh --dispatch`
-  Rows 1-2 always carry it (Sonnet main model, so opus is a capability lift —
+  (operator decision 2026-09-12, `~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md`
-  and since every fallback is one row cheaper and the cheap rows are Sonnet,
+  § 4, cut row 3).** The struck rule fired per ROW on a need — always on the
-  this is what makes the quota fallback safe to take); rows 3-4 only at
+  Sonnet rows (a capability lift, which is what made the quota fallback safe to
-  `reversibility=costly|one-way` (Opus main model, so it buys peer review where
+  take), and on the Opus rows at `reversibility=costly|one-way` (peer review
-  a mistake is not cheap to undo); rows 5-6 never, because the CLI rejects every
+  where a mistake is not cheap to undo). It read well and it was killed by a
-  advisor for a Fable main model. The alternative — the global `advisorModel`
+  MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.–12.09, **zero**
-  setting written by `/advisor` — is what this replaces: it applies to every
+  carried the flag, because sessions are started by hand from the model and
-  session in every repo, which is how it burned quota before. The two triggers
+  effort rather than from the whole emitted line. A rule nothing honours is not
-  are almost disjoint by construction, since `costly` forces row 3 and `one-way`
+  a policy, and an emitted value nobody acts on is decoration in a field whose
-  forces row 4, so a Sonnet row always has `reversibility=cheap`.
+  only job is to be evidence. The advisor is now what it already was in
-  `verification=none` is deliberately NOT a third trigger: beyond the stakes
+  practice: **an operator decision per session**, said in one sentence in
-  rule it would only add mistakes that are cheap to reverse, docs sessions
+  `route.sh --help`.
-  (`known/none/cheap/local`) among them. Section 14 pins the rule and gates the
+  The absence is pinned over the WHOLE trait space — 81 combinations, every
-  three CLI facts it rests on against the installed `claude` without spending a
+  line of output, with a known-positive control proving the sweep's grep can
-  token — advisor validation runs before the empty-prompt check, so `-p ""`
+  find a planted advisor — rather than on four sampled rows, because the claim
-  reaches the validator and stops there.
+  is that no path emits it. `--dispatch` at `reversibility=costly` is pinned
  separately: that is the exact input a reintroduced rule would fire on.
  The three CLI gates section 14 used to carry (does `claude` accept
  `--advisor`, does it accept opus advising sonnet, does it still reject opus
  advising fable) went with the rule — they existed to gate facts the rule
  rested on, and the suite no longer depends on the installed `claude` at all.
  **The literal string `--advisor opus` is absent from `route.sh` ENTIRELY,
  including the paragraph recording what was struck** (it says "an opus advisor
  flag" in words): a blunt grep cannot tell a description from a specification,
  the same reason coord-selftest's cache assertion runs on an extracted path
  rather than the whole file. Do not restore the quote.
  Backward compatibility is pinned rather than assumed: a route line carrying a
  legacy `advisor=` field still parses and still yields a command. Measured the
  same day — **0 of 48** `<!-- route:` lines anywhere in `~/repos` carry one, so
  nothing in circulation depends on it, but a reader that broke on an unknown
  field would turn last month's STATE.md into "that repo has no route line".
  **Rows 5-6 are never a `route.sh` outcome.** Until 2026-08-06 they fired
  only from an explicit `--opus-xhigh-failed` flag, mirroring a global
@ -1080,6 +1250,40 @@ marketplace plugin. Three components, one boundary:
  broken `touch -t` fails there rather than turning the section into a test of
  nothing.
  **Order 20260903T185736Z-1290610855 (2026-09-03): the PENDING age read the
  mtime, and `coord-order-done --return` rewrites it - so putting an order back
  reset the very reading that says how long it has waited.** An order returned
  three times could never look old, on the one surface that exists precisely so
  a repo nobody opens still shows something. Found by reading the board right
  after this repo returned an order of its own, not by looking for it: a file
  whose name says 2026-09-02 rendered `ORDRE 1:0d` minutes later. It is the
  same class as every other reading hardened here - a failed or reset
  measurement rendering as a reassuring value - with the twist that the reset
  was performed by the engine itself.
  **Two questions, two sources, and only one of them moved.** A PENDING order's
  age is "how long has this sat with no owner" = now - DELIVERY time, and only
  the filename carries that; it is written once and nothing rewrites it. A
  CLAIMED order's age is "how long has it been in flight", which is the claim's
  own mtime and was already right - so `oldest_pending_age()` sits BESIDE
  `oldest_order_age()` rather than replacing it, and `coord-order-inbox.sh`
  keeps `age_of` for the claim marker next to a new `pending_age_of`. Switching
  FLY to the filename would answer the delivery question in the column that
  asks the flight question. An unparseable filename yields `?` for the whole
  reading, never a fabricated `0`, because an unmeasured order could be the
  oldest one - the same rule the mtime path already carried.
  **Section 28's fixtures had to be rewritten, and that is the finding worth
  recording.** They encoded their intended ages in `touch -t` while their
  filenames held fixed 2026-01/2026-08 dates, which a filename-based reading
  makes both wrong and time-dependent - the checks would have started failing
  on their own as the wall clock moved past them. They now compute their stems
  from `date -v`, and the section asserts TWO ground truths, the filename for
  ORDRE and the mtime for FLY, because a fixture check guarding only one source
  leaves the other assertion resting on nothing. Mutation-verified in both
  files: restoring the mtime read turns exactly the defect checks red with
  every control green.
  **There is deliberately NO process inspection, and the selftest asserts it
  structurally** (no live `pgrep`/`pkill`/`lsof` in `board.sh`, with a
  known-positive control proving the grep can find a planted call). Four
@ -1213,6 +1417,43 @@ marketplace plugin. Three components, one boundary:
  phase and age and leaves the judgement to the reader, which is why 51
  projects are listed rather than some filtered subset.
 - **`--row <repo>` is the SEVENTH rendering: the table's row for ONE repo, as
  `field=value` lines** (order 20260912T202210Z-7588027378, operator decision
  2026-09-12). Same scan, never a second one, read-only like every other
  rendering. **The order calls it the sixth; by this file's own numbering
  `--inbox-plan` is the fourth and `--dispatch` the fifth, so it is the
  seventh** — corrected here rather than carried wrong.
  **It exists because the columns WERE misread.** On 2026-09-11 the PM read the
  FLY column off the table by eye and got it wrong. Every other rendering a
  program consumes (`--plan`, `--inbox-plan`, `--dispatch`) is already
  `key=value`; the default view was the one left out, and the 34-character
  nested-repo key already shifts a row two characters right (a stated, unclosed
  gap), which makes counting spaces worse than it looks. `inn`, `ordre` and
  `fly` are three separate fields because they are three separate facts, and
  confusing them is the whole reason this exists. `status` is the bare token,
  never the table's `blocked>target` display, with `blocked-on` beside it;
  `neste` is last and uncut, for the same reason it is last in the record. An
  unknown repo exits **2** and writes NOTHING to stdout — an empty block would
  read as a repo whose every column is blank, which is a real and different
  state (`?`).
  **`upushet` is the one field that is NOT a rendering of the scan, and it is
  named rather than blended in.** Nothing in the scan measures it, so it is
  read once, for the named repo only, and never enters the table, the plan or
  the briefing. It reads the remote-TRACKING ref, not the remote: `upushet=N`
  honestly means "the local ref says N", and `git ls-remote` is still what a
  claim ABOUT THE WORLD costs. A repo with no upstream reports `?`, never `0` —
  "nothing is waiting to be pushed" and "nobody looked" are exactly the pair
  this engine refuses to render alike.
  **The fixture's three counts are three DIFFERENT integers (3/2/1), and that
  is the finding worth recording.** Built first with 2/1/1, it was
  mutation-tested by making `fly` read the ORDRE field — the exact 11.09
  misreading — and the check stayed GREEN, because the two fields held the same
  digit. A fixture that cannot tell two columns apart is the defect wearing a
  passing test, inside the section written to prevent it.
 - **Skills (`skills/coord-send/`, `skills/board/`, `skills/route/`, `skills/dispatch/`):** natural-language front
  doors mapping user intent to engine invocations. No mailbox logic lives here
  either. `board` additionally owns the *ranking* — which repo wins and why —
@ -1260,10 +1501,10 @@ obligations in another repo.
 - Zero dependencies everywhere: bash + coreutils in the engine, `node:`
  builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
-  `bash scripts/coord-selftest.sh` must exit 0 (242/242),
+  `bash scripts/coord-selftest.sh` must exit 0 (257/257),
-  `bash scripts/board-selftest.sh` must exit 0 (360/360),
+  `bash scripts/board-selftest.sh` must exit 0 (427/427),
  `bash scripts/route-selftest.sh` must exit 0 (73/73),
-  `bash scripts/orders-selftest.sh` must exit 0 (110/110) and
+  `bash scripts/orders-selftest.sh` must exit 0 (116/116) and
  `bash scripts/state-line-guard-selftest.sh` must exit 0 (54/54).
 - English for all code, docs, and commit messages (public repo). Norwegian
  trigger aliases in the skill description are deliberate.
@ -1279,6 +1520,36 @@ obligations in another repo.
  and re-measured after: 11 of 11 now match. Only the Install block was
  converted; converting the other 39 indented blocks was not ordered and
  would bury a two-line fix in a whole-file diff.
 - **README's selftest numbers are pinned by `tests/selftest.test.mjs`, and the
  check lives there rather than in one of the five bash suites for a measured
  reason.** The badge and the five `## Development` comments rotted twice in a
  row - 529 carried from 0.25.0, then a badge saying 868 beside comments summing
  to 792, two different wrong sums of the same fact on the same screen - because
  nothing compared them to anything. The order behind the fix
  (`20260905T053602Z-6743615726`) suggested hosting it in whichever suite
  already pins README/catalog invariants; measured before choosing, **no such
  suite exists** (`grep -ln README scripts/*selftest*.sh` returns
  `board-selftest.sh` alone, on two incidental hits - a prose comment and a
  `research/README.md` fixture). This wrapper is the only place where all five
  numbers exist at once in a run that already happens: `runSuite()` captures
  each suite's own summary line, so the truth source is the line the suite
  prints, never a re-count. A check inside one suite could see its own total but
  would have to RE-RUN the other four (**212s sequentially**, measured
  2026-09-05 under `/bin/bash` 3.2) to see theirs, and grepping `check` calls out
  of the scripts is both the second copy of the counting and a wrong one, since
  those calls sit inside loops. The badge is compared against the MEASURED sum,
  not against the five README comments - a badge agreeing with five stale
  comments is the 868-beside-792 shape one layer down - and a suite that stops
  printing a summary FAILS the check rather than being skipped, because an
  absent measurement must not read as a matching one. It adds no bash check, so
  the five counts and the 893 badge are unchanged by its arrival.
  Mutation-verified in both directions: `73 -> 74` on the route comment gives
  "README says route-selftest has 74 checks; it reported 73", `893 -> 894` on
  the badge gives "README's badge says 894 selftest checks; the five suites
  reported 893", and the restored file is 12/12 green. **Bounded gap, stated
  rather than closed:** `CLAUDE.md`'s own copies of the five counts (in this
  section, above) are NOT checked - a second surface carrying the same numbers,
  measured and left alone because widening the check to it was not ordered.
 - Conventional Commits: `type(scope): description`.
 ## Commands
@ -1286,7 +1557,7 @@ obligations in another repo.
 - Test: `bash scripts/coord-selftest.sh`, `bash scripts/board-selftest.sh`,
  `bash scripts/route-selftest.sh`, `bash scripts/orders-selftest.sh` and
  `bash scripts/state-line-guard-selftest.sh` (or `npm test`, the Node wrapper
-  around all five plus the hook tests)
+  around all five plus the hook tests and the README-number check)
 - Order queue smoke test: `CLAUDE_COORD_DIR=$(mktemp -d) bash
  scripts/coord-order-send.sh --to smoke --from tester --subject s --message m`
  then `CLAUDE_COORD_DIR=<same> bash scripts/coord-order-inbox.sh --repo smoke`
@ -1315,6 +1586,13 @@ obligations in another repo.
 - Sweep smoke test: `bash scripts/coord-sweep.sh` (dry-run is the default, so
  this writes nothing; never add `--write` to a smoke test against the real
  mailbox)
 - launchd template check: `plutil -lint launchd/*.plist` (XML only). The paths,
  labels, placeholders and schedule are pinned by coord-selftest section 38 —
  run that, not `launchctl list`, to find a broken plist. Installing an agent
  is `sed` + `launchctl load` (see the header of either plist); proving it
  works is `launchctl start <label>` plus a new line in
  `~/Library/Logs/repo-mailbox-<brief|sweep>.log`, which is a DIFFERENT file
  from the sweep's own closure log at `$CLAUDE_COORD_DIR/_sweep.log`
 ## Release
--- a/README.md
+++ b/README.md
@ -10,11 +10,11 @@ Session A in repo X leaves a message for repo Y; the next session in repo Y gets
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
-![Version](https://img.shields.io/badge/version-0.32.0-blue)
+![Version](https://img.shields.io/badge/version-0.34.0-blue)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-4-orange)
 ![CLI scripts](https://img.shields.io/badge/CLI_scripts-8-blue)
-![Selftest checks](https://img.shields.io/badge/selftest_checks-529-blue)
+![Selftest checks](https://img.shields.io/badge/selftest_checks-927-blue)
 ---
@ -86,7 +86,7 @@ The plugin ships empty: your mailbox is created lazily on first send, on your ma
 Since v0.8.0 it closes with one aggregate line about mail pending in *other* mailboxes, so an empty inbox no longer reads as "all clear" while messages sit unanswered elsewhere. Two integers, never a roster: naming the other mailboxes would put their situation inside your repo's injection, and the line explicitly disclaims the obligation it sits beneath — those counts are not yours to handle, and counting them delivered nothing.
-**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked.
+**Choosing between repos (the `board` skill).** "What should I work on?", "who is waiting on me?", "what unblocks the most?" — `board.sh` scans every repo it can find and reads three sources per repo: the STATE.md next-step block and its optional board line, `git status`, and the pending count in that repo's mailbox. The skill runs it, ranks by leverage (what unblocks the most, cheapest first) and answers with one repo and the rule that fired, never the table. Read-only: it writes to no repo, no STATE.md, and no mailbox. The board is deliberately *not* wired into session start — it runs when asked. Discovery takes git repos at depth 1, the children of a polyrepo container, and — since 0.33.1 — a repo nested under a depth-1 repo **only when it carries a `STATE.md`**: measured on the real tree, 12 such checkouts existed and exactly 1 had one, so admitting all of them would have buried the board in vendored clones. Every run prints its own denominator (`undersoekt: N katalog(er) depth 1, M polyrepo-container(e), K nestede repo (J med STATE.md tatt med)`), because a repo count alone says how many were found and nothing about how many were looked at.
 The mailbox is one of its three inputs, which is why the board lives here. Note the axis: a repo's pending count means *others are waiting on it*, an obligation it owes outward. Who a repo waits *on* comes only from its own board line, because the message format has no reply-to field.
@ -115,6 +115,7 @@ Ownership is explicit rather than implied. An order is pending until a session *
    coord-sweep.sh [--write] [--days <n>] [--log <path>]                   # close aged notices machine-wide (dry-run by default)
    board.sh [--roots <dir>[,<dir>...]] [--brief|--plan] [--focus "<prose>"]  # cross-repo attention board (read-only)
    board.sh --voyage                                                        # Voyage briefs in flight (read-only)
    board.sh --row <repo>                                                    # one repo's row as field=value lines (read-only)
    board.sh --dispatch --repo <name> --order-id <id> \
             --target-pane <yes|no> --path <v> ... --rationale "<why>"     # startup command for a session in <name>
    coord-order-send.sh --to <repo> --subject "<s>" --prompt-file <abs path>  # deliver a work order into <repo>'s queue
@ -130,13 +131,28 @@ The reply/resolve hints the hook injects (`-> reply: coord-send --reply-to …
 **`coord-sweep.sh` is the only script that closes a message without a human in the loop**, and it is bounded to one mechanically decidable class: a directed message whose sender declared `reply-expected: no`, older than a grace window (default 14 days). A message that owes a reply is never touched, at any age, with any flag — answering it would mean deciding something on the receiving repo's behalf. Dry-run is the default, inverted from every other script here, because this is the one that destroys pending state. Every closure appends a line naming the sender and subject: a directed message has no seen-tracking, so the sweep cannot tell "seen and ignored" from "never delivered", and a notice to a repo left unopened for the whole window is closed *unread*. The log is what keeps that from being silent.
-**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` alone cannot produce the advisor flag. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
+**Since 0.33.0 that sweep is scheduled, and the schedule is the whole feature — invocation was the gap, not the mechanism.** `coord-sweep.sh` shipped in 0.10.0 and had then never run once: measured 2026-09-03 across 52 mailboxes, 27 pending directed messages, of which 23 were pure notices being re-injected at every session start in repos nobody had opened. The script was correct and unreachable, so nothing new was built — a second mechanism would have been two copies of a policy that already existed. `launchd/com.ktg.repo-mailbox-sweep.plist` runs `--write --days 14` daily at 05:30, half an hour *before* the briefing agent — not because it changes what the briefing reports, but because the briefing scans the same mailbox this mutates, and the two must not overlap. The briefing's *debt* figure is in fact unaffected: since 0.22.0 it is computed from `coord-count.sh`'s `owed` column, and this sweep closes only messages that owe nothing. What the sweep moves is the raw pending count — the table's `INN` column, and the volume every repo gets injected at session start. The window is written out in the plist rather than left to the script's default: it is a policy constant decided on a measured distribution (30 days would have closed 0 messages, 14 closed 7, 7 would have closed 13), and changing a default must never silently change what an unattended job closes every night.
-It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly; it points at a checkout, never at the version-pinned plugin cache.
+Both agents are **templates**, carrying `__CHECKOUT__`/`__HOME__` placeholders rather than absolute paths, because this repo is mirrored publicly. Substitute them at install time:
 ```bash
 sed -e "s|__CHECKOUT__|$PWD|g" -e "s|__HOME__|$HOME|g" \
    launchd/com.ktg.repo-mailbox-sweep.plist \
    > ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 ```
 **`launchctl list` proves an agent is *loaded*, never that it is *right*.** A plist naming a script that does not exist loads cleanly and then silently never runs — there is no output to be wrong and no exit status to read, so the failure looks exactly like a quiet machine. Two separate things close that: `launchctl start <label>` followed by a line appearing in `~/Library/Logs/repo-mailbox-sweep.log` is the only runtime proof the program path resolves, and `coord-selftest.sh` section 38 asserts statically, for *every* plist in `launchd/`, that the path it names is a file that exists in this repo, that the `Label` matches the filename, that the placeholders survive, and that no agent points into the version-pinned plugin cache. Note that the launchd log is not the closure log: `$CLAUDE_COORD_DIR/_sweep.log` is where the record of each closed notice lives.
 **`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` names the row rather than spelling the command and there must be exactly one spelling in circulation. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
 It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly at 06:00; like the sweep agent above it points at a checkout, never at the version-pinned plugin cache, and it is pinned by the same section 38 checks.
 **`board.sh --voyage` reports the Voyage briefs in flight**, a sixth rendering of the same scan. `board` reads STATE lines, which say nothing about a brief, so a programme running Voyage across several repos had no shared surface: nobody could answer which briefs were running, in what phase, and who was waiting on whom. Detection is by **property, never by directory name** — a directory holding `brief.md` or `brief.md.draft` under any of the three planning locations the convention recognises (`.claude/projects/`, `docs/`, `features/<n>-<name>/`) — and it walks the **filesystem, never the git index**: a repo that gitignores `.claude/projects/` would otherwise report zero briefs while actually running one. The phase ladder measures *artifacts*, not sessions: a plan executed in a single session leaves no file behind, so `plan` is the last thing the filesystem can prove, and nothing here claims a session is alive. `brief_quality` is read out of the brief's frontmatter and an absent field reads `-`, never `complete`; a research directory that exists and holds nothing reads `0`, distinct from the `-` that means no research step was ever started. The table carries a matching `VOY` column beside `ORDRE` and `FLY` — the same class of durable filesystem fact, and never summed with them.
-**`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and one deterministic score decides it: `40 ×` repos released transitively, `15 ×` unhandled inbox messages, plus small bonuses for live work and for a cheap `next-cost` row. Four hard buckets preceded it and could not express "this repo owes one message and releases two others" — which is how a blocked chain's root ended up ranked *below* the repos waiting on it. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the dominant term, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
+**`board.sh --row <repo>` renders one repo's row as `field=value` lines**, a seventh rendering of the same scan and the only one that answers about a single repo. It exists because the table's columns *were* misread: the fixed-width view is for a human, and reading a column off it by eye is how `FLY` was read as `ORDRE` on 2026-09-11 — while every other rendering a program consumes is already `key=value`. `inn`, `ordre` and `fly` are three separate fields because they are three separate facts; `status` is the bare token rather than the table's `blocked>target` display, with `blocked-on` beside it; `neste` is last and uncut. An unknown repo exits **2** and writes nothing, because an empty block would read as a repo whose every column is blank — a real and different state. One field is deliberately *not* a rendering of the scan and is named as such: `upushet` is measured once, for that repo only, from the remote-**tracking** ref rather than the remote, so a repo with no upstream reports `?` and never `0`.
 **`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and **five ordered groups** decide it, each a lookup over a field the scan already read rather than a weighted score: (1) **chain-root credit**, most repos released first; (2) **debt**, most-owed-first, whatever the status; (3) `planned`; (4) `in-progress`; (5) `?`/`MALFORMED` — undeclared, last and labelled. Within a group, ties break on a cheap Sonnet `next-cost` row, then oldest plan first. A 0.19.0 weighted score (`40 ×` repos released, `15 ×` unhandled inbox messages) briefly stood in this spot and *could* express "this repo owes one message and releases two others" as a single number — but re-tuning those two coefficients would have silently reordered a parser living in another repo, with no test here able to hold a ranking stable for a consumer it can't see; the operator replaced it with the group order in 0.20.0 for that reason. Groups 3 and 4 are `planned` above `in-progress`, inverted from every earlier version by the same decision: turning a decision into motion is the slow step, live work is already moving. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the group that placed the repo, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
 **`--focus "<prose>"` narrows that plan to one subject, and reports what it held back.** It is the only cutoff this format has, which is why the report is a condition of the feature rather than a refinement of it: `--plan` documents that it hides nothing and labels what it cannot rank, so a silent filter would break a property already written down. The same run prints the subjects the prose resolved to, how many blocks were removed, how many `STATE.md` were searched, and — named, not counted — the repos that *mention* a resolved subject without declaring a marker line. That last class is enumerated because it is where the misses live: a repo can be a heavy participant and never have written a marker, and no string measurement finds it until the held-back population is listed. Each surviving block carries the declaration it survived on. Prose matching nothing prints the *full* plan and says so, since the phrase arrives verbatim from a person and a typo must not empty the day. The subject vocabulary is read from the scanned `STATE.md` themselves, so the "reads `STATE.md` and no other file" invariant is untouched.
@ -182,12 +198,12 @@ Note that raising the inbox's priority (Rule 7) deliberately does **not** widen
 ## Development
-    bash scripts/coord-selftest.sh              # 220 checks against a throwaway mailbox
+    bash scripts/coord-selftest.sh              # 257 checks against a throwaway mailbox
-    bash scripts/board-selftest.sh              # 360 checks against a throwaway repo tree
+    bash scripts/board-selftest.sh              # 427 checks against a throwaway repo tree
    bash scripts/route-selftest.sh              # 73 checks, incl. the route->board round trip
-    bash scripts/orders-selftest.sh             # 99 checks, incl. the 20-way barriered claim race
+    bash scripts/orders-selftest.sh             # 116 checks, incl. the 20-way barriered claim race
-    bash scripts/state-line-guard-selftest.sh   # 40 checks, incl. the Edit replace_all projection and the ratchet
+    bash scripts/state-line-guard-selftest.sh   # 54 checks, incl. the Edit replace_all projection and the ratchet
-    npm test                                    # all five selftests plus the hook tests, via node --test
+    npm test                                    # all five selftests, the hook tests, and the README-number check
 TDD is the house rule: every behavior change lands with a failing selftest check first.
--- a/docs/2026-09-03-coordination-debt-measurement.md
+++ b/docs/2026-09-03-coordination-debt-measurement.md
@ -0,0 +1,152 @@
 # Coordination debt: what does not converge, and why building a second
 # mechanism would have been wrong
 Measured 2026-09-03 against the live mailbox, for order
 `20260902T113745Z-1254925290-from-.claude` (WP5). Every number below was
 produced by a command, and every negative result carries the control that
 proves the query could have found something.
 The order offered two candidate mechanisms and said to choose by measurement,
 not taste: a broadcast TTL, or a bulk-ack for pure notices. The measurement
 chose neither. One of them is already built and has never been run; the other
 addresses the class that converges on its own.
 ## Denominators
 | population | count |
 |---|---|
 | mailbox directories under the coord root | 55 |
 | of those, holding an `inbox/` | 52 |
 | pending directed messages across all inboxes | 27 |
 | broadcasts in `_broadcast/inbox/` | 17 |
 | (mailbox x broadcast) delivery pairs | 884 |
 The three directories with no `inbox/` are named rather than silently dropped:
 `jobbsok`, `mediemon`, `medieovervaaking`. 55 - 3 = 52 is the reconciliation,
 stated because an unreconciled pair of denominators in one report is the same
 positive-looking null this engine refuses everywhere else.
 ## The two classes behave in opposite directions
 **Directed messages do not converge.** They are re-injected at every session
 start until a session closes them by hand. Of the 27 pending, 4 owe a reply and
 23 are pure notices (`reply-expected: no`). By age:
 | class | <7d | 7-13d | 14-29d | >=30d |
 |---|---|---|---|---|
 | owes a reply | 0 | 3 | 1 | 0 |
 | pure notice | 10 | 6 | 7 | 0 |
 **Broadcasts converge on their own.** Reading one records it as seen, so a
 mailbox clears its whole backlog on its next session. 263 of the 884 pairs are
 unread (29.8%), and the distribution shows the self-clearing: 10 mailboxes are
 fully current, 26 sit at exactly 6 unread (the newest announcements), and the
 tail is short.
 ## The floor under the broadcast number, which strengthens the case
 Two mailboxes hold all 17 broadcasts unread, and neither can ever read them:
 - `ktg-plugin-marketplace` is a **retired `--to` address**. It is a polyrepo
  directory, not a git repo, so `basename(git toplevel)` can never resolve to
  it and no session can hold that identity. This is already documented as
  engine behaviour; the 17 unread are its permanent consequence.
 - `llm-ingestion-guard` has no checkout anywhere under `/Users/ktg`
  (`find -maxdepth 4`, with `llm-ingestion-okf` as the known-positive control
  proving the query finds a real one) and no `.origin`. It also holds the
  single oldest pending notice, 24 days.
 So **34 of 263 unread pairs (12.9%) are a permanent floor no TTL would reduce
 to zero** - it would close them, but it would be closing announcements for
 mailboxes that were never going to read anything. `.origin` absence alone is
 NOT a proxy for unholdable: `repos` also lacks one, yet sits at 2 unread of 17,
 which is only possible if something reads it.
 ## Why no second mechanism was built
 `coord-sweep.sh` already **is** the bulk-ack for pure notices: machine-wide,
 one mechanically decidable class (`reply-expected: no`, older than a grace
 window), dry-run by default, closing through `coord-done.sh`, logging sender
 and subject for every closure. Building the order's second candidate would have
 been a second copy of a shipped policy - the defect class this repo names
 repeatedly.
 Its own dry-run reports what it would close today, and the figures agree
 exactly with the independent classification above:
    --days 30  ->  0 messages
    --days 14  ->  7 messages
    --days  7  -> 13 messages
 **The gap is invocation, not mechanism.** No `_sweep.log` exists at the default
 path, and no sweep log exists anywhere under `~/.claude` (the one `*sweep*` hit
 is an unrelated plugin file) - stated that way because `--log` can override the
 default, so an absent default-path log alone would not prove it never ran.
 ## What remains, and why it is not this repo's call
 Making the notice class converge without opening each repo means running
 `coord-sweep.sh --write` unattended. That closes mail in 51 other repos'
 inboxes, unread, and the script's own design says so in as many words: a notice
 to a repo left unopened for the whole window is closed unread, and the log is
 the only thing standing between that and a silent disappearance.
 Deciding that on another repo's behalf is the one anti-pattern with no
 exception clause, and the grace window is a policy constant of the same class
 as the STATE.md line limit, which was an operator decision both times it moved.
 Dry-run is the default precisely because this is the script that destroys
 pending state; flipping that to a schedule is the operator's act, not a
 plugin's.
 The messages that owe a reply are untouched by any of this, at any age, with
 any flag. That is not a gap to close later - it is the rule that keeps a
 procedural duty from becoming a substantive one.
 ---
 ## Appendix: the before-state, captured 2026-09-04 08:0x UTC
 The operator authorized the sweep on 2026-09-03 (14-day window, scheduled via
 launchd). This is `coord-count.sh` immediately before the authorized
 `--write --days 14` run, recorded here because a before-state stops existing
 the moment the write happens, and the order asks for debt before/after with a
 denominator.
    mailbox                        pending  owed  origin-age
    app-creator                          1     1  -
    claude-playlist-corpus               1     0  -
    graceful-handoff                     3     0  -
    human-friendly-style                 1     0  -
    ki-produktivitetsmodell              1     0  -
    llm-ingestion-guard                  1     0  25
    llm-security                         2     0  -
    mcp-servere                          2     0  -
    okr                                  1     0  -
    org-ops                              5     2  -
    portfolio-optimiser-commons          3     0  -
    repo-standard                        1     1  -
    wiki-advise                          2     0  -
    .claude                              1     0  -
    .profile                             1     0  -
    ------------------------------------------------------
    15 mailboxes with pending mail      26     4
 `$CLAUDE_COORD_DIR/_sweep.log` did not exist: the sweep had still never run.
 **The control this file exists to make runnable:** after the write, the `owed`
 column must be BYTE-IDENTICAL (total 4), because the sweep spares every message
 that owes a reply at any age. A changed `owed` figure means the sweep closed
 something it must never touch, and is a defect, not a result.
 **The dry-run said 11, not the 7 this document measured a day earlier, and the
 gap is entirely the moving cutoff.** Verified two ways rather than assumed.
 Yesterday's 14-day cutoff was ~20260820T184902; today's is 20260821T055442.
 Four notices timestamped 2026-08-20 between those two instants
 (`human-friendly-style` T210113Z, `ki-produktivitetsmodell` T205611Z, `org-ops`
 T210955Z and T211358Z) crossed the boundary in one calendar day: 7 + 4 = 11.
 Independently, `--days 15` today yields 6, and those 6 plus
 `mcp-servere/20260820T104644Z` - which sits between the 15-day cutoff and
 yesterday's 14-day one - reconstruct yesterday's 7 exactly. The engine is
 consistent; the 7 was a measurement of a moment, never a constant, and reading
 it as one would have been face 3 of the verification law pointed at our own
 report.
--- a/launchd/com.ktg.repo-mailbox-sweep.plist
+++ b/launchd/com.ktg.repo-mailbox-sweep.plist
@ -0,0 +1,99 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
  Daily FYI sweep. Closes directed messages whose sender declared
  reply-expected: no and whose filename timestamp is older than 14 days, across
  every mailbox on this machine, through coord-done.sh.
  INVOCATION WAS THE GAP, NOT THE MECHANISM. coord-sweep.sh shipped in 0.10.0
  and had never run once against the real mailbox - measured 2026-09-03: 27
  pending directed messages, 23 of them pure notices nobody was ever going to
  act on, re-injected at every session start in repos nobody had opened. The
  script was correct and unreachable. This file is the whole fix; no new
  mechanism was built, and building a second one would have been two copies of
  a policy that already existed.
  THE 14-DAY WINDOW IS THE OPERATOR'S CONSTANT, NOT A DEFAULT WEARING A
  SCHEDULE (decided 2026-09-03, on a measured distribution: 30d -> 0 messages,
  14d -> 7, 7d -> 13). It is written out explicitly here rather than left to
  coord-sweep.sh's own default, so that changing the script's default can never
  silently change what this agent closes every night.
  WHAT IT CAN NEVER DO. A message that owes a reply is untouched at any age -
  the script's own rule, not this file's. This agent only supplies the
  invocation; every bound on what gets closed lives in coord-sweep.sh, and the
  closure log ($CLAUDE_COORD_DIR/_sweep.log, NOT the launchd log below) is the
  only record that a notice closed unread ever existed.
  THE TWO AGENTS MUST NEVER SHARE AN HOUR. com.ktg.repo-mailbox-brief renders
  at 06:00 from a scan of the same mailbox this mutates, so a briefing rendered
  mid-sweep reads a mailbox changing underneath it. This runs at 05:30, clear of
  it; coord-selftest.sh section 38 asserts the two hours differ.
  What it does NOT change is the briefing's DEBT figure. Since 0.22.0 that is
  computed from coord-count.sh's `owed` column, and this sweep closes only
  messages that owe nothing - so the debt listing is identical before and after.
  What moves is the raw pending count (the table's INN column, the FYI-only
  naming in --brief, and the volume every repo gets injected at session start).
  Claiming the briefing reports "the debt that remains" because of this agent
  would be an overclaim; the ordering exists for the read/write overlap alone.
  ZERO MODEL CALLS, same as the briefing and for the same reason: the operator
  authenticates by subscription, so a headless `claude -p` job would draw from
  the same quota pool as interactive work. This runs one shell script.
  PATH: every binary this touches (bash, date, grep, sed, basename, tr, cut)
  lives in /usr/bin or /bin, so launchd's minimal default PATH is sufficient
  and no EnvironmentVariables block is needed.
  The program path points at the SOURCE REPO, deliberately. The alternative is
  version-pinned (~/.claude/plugins/cache/.../repo-mailbox/<version>/...), so
  an agent pointing there would break silently on the next version bump - and a
  second copy of these scripts on disk is the exact defect class that produced
  the 0.12.1 stale-fallback bug.
  This file is a TEMPLATE. It carries no absolute home path on purpose: the
  repo is mirrored publicly, and a plist is the one file here that would need
  one. Substitute both placeholders at install time.
  Install:  sed -e "s|__CHECKOUT__|$PWD|g" -e "s|__HOME__|$HOME|g" \
                launchd/com.ktg.repo-mailbox-sweep.plist \
                > ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
            launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
  Verify:   launchctl list | grep com.ktg.repo-mailbox-sweep     # loaded only
            launchctl start com.ktg.repo-mailbox-sweep           # proves the path
            tail ~/Library/Logs/repo-mailbox-sweep.log           # the actual proof
  Remove:   launchctl unload ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
  `launchctl list` proves the agent is LOADED, never that it does anything
  right: a wrong program path produces a loaded agent that silently never runs.
  Only `launchctl start` plus a line in the log below proves the path resolves.
 -->
 <plist version="1.0">
 <dict>
    <key>Label</key>
    <string>com.ktg.repo-mailbox-sweep</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>__CHECKOUT__/scripts/coord-sweep.sh</string>
        <string>--write</string>
        <string>--days</string>
        <string>14</string>
    </array>
    <key>StandardErrorPath</key>
    <string>__HOME__/Library/Logs/repo-mailbox-sweep.log</string>
    <key>StandardOutPath</key>
    <string>__HOME__/Library/Logs/repo-mailbox-sweep.log</string>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>5</integer>
        <key>Minute</key>
        <integer>30</integer>
    </dict>
 </dict>
 </plist>
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "repo-mailbox",
-  "version": "0.32.0",
+  "version": "0.34.0",
  "private": true,
  "type": "module",
  "engines": {
--- a/scripts/board-selftest.sh
+++ b/scripts/board-selftest.sh
@ -244,8 +244,8 @@ for n in 1 2 3; do echo "msg" > "$CLAUDE_COORD_DIR/repo-a/inbox/2026-msg$n-from-
 echo "old" > "$CLAUDE_COORD_DIR/repo-a/archive/2026-old-from-x.md"
 # repo-owes: unhandled inbox AND a route line, so the briefing can derive the
-# EXACT startup command - advisor flag included - from the repo's own four
+# EXACT startup command from the repo's own four traits instead of guessing
-# traits instead of guessing from next-cost alone. Its NESTE runs deliberately
+# from next-cost alone. Its NESTE runs deliberately
 # past the table's 38-character column: carrying that line whole is the reason
 # the briefing exists at all.
 mkrepo "$ROOT/repo-owes"
@ -355,7 +355,13 @@ printf '%s' "$OUT" | grep -q 'repo-a'; check "discovers top-level git repo" $?
 printf '%s' "$OUT" | grep -q 'plug-x'; check "discovers nested polyrepo git repo (depth 2)" $?
 printf '%s' "$OUT" | grep -q 'repo-c'; check "lists git repo without STATE.md" $?
 printf '%s' "$OUT" | grep -q 'plain-dir'; [ $? -ne 0 ]; check "ignores non-git directory tree" $?
-printf '%s' "$OUT" | grep -q 'polyrepo'; [ $? -ne 0 ]; check "polyrepo container itself is not listed as a repo" $?
+# Anchored at column 1, and the anchor is load-bearing: the claim is "the
 # container has no ROW", and a row starts with the repo name. Unanchored, this
 # check now matches the denominator line's own word "polyrepo-container(e)" -
 # the same defect class as a file-wide grep reading a comment that EXPLAINS a
 # pattern as an instance of it (coord-selftest section 38's cache assertion,
 # and the done-guard's rule that prose saying status=done must not trigger it).
 printf '%s' "$OUT" | grep -q '^polyrepo'; [ $? -ne 0 ]; check "polyrepo container itself is not listed as a repo" $?
 # Guard the fixture itself: if git ever stops writing a .git FILE for
 # worktrees, the next two checks would pass for the wrong reason.
 [ -f "$ROOT/wt-feature/.git" ]; check "fixture: worktree .git is a FILE, not a dir" $?
@ -575,10 +581,15 @@ printf '%s' "$BRIEF" | grep -q 'check-versions'
 check "brief prints the full NESTE line, not the 38-char table excerpt" $?
 # Derived by CALLING route.sh with the repo's own four traits - deliberately
-# not spelled out in board.sh - so the rubric keeps exactly one copy. Row 1
+# not spelled out in board.sh - so the rubric keeps exactly one copy.
-# carries the advisor, which is what makes the quota fallback safe to take.
+printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high'
 printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high --advisor opus'
 check "brief derives the exact startup command from the repo's route line" $?
 # Anchored to end-of-line, because the loose grep above would pass just as
 # happily on a command that grew a flag back. The rubric emits no advisor
 # since 2026-09-12 and the briefing is a rendering of the rubric, not a
 # second policy.
 printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high$'
 check "brief's startup command ends at the effort - no advisor is appended" $?
 # The command must start its OWN line. `fold` copies its input's missing
 # trailing newline, which ran the command onto the tail of the NESTE prose and
@ -894,8 +905,8 @@ n_b="$(printf '%s\n' "$PLAN" | grep -n '^repo=repo-b$' | cut -d: -f1)"
 check "uavklart repos rank below every repo that declared a status" $?
 # The command comes from route.sh, same single copy of the rubric the briefing
-# uses - advisor flag included, since that is a property of the ROW.
+# uses.
-printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
+printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high$'
 check "plan derives the exact startup command from the repo's route line" $?
 # Both no-command causes must degrade to a marker. A bare `command=` would be
@ -926,7 +937,7 @@ check "plan prints the full NESTE line, not the 38-char table excerpt" $?
 # because they answer different questions: a driver cd's the pane itself and
 # would choke on a compound line, while the operator needs ONE thing to copy.
 # Assembling it by hand from two fields is where a tab lands in the wrong repo.
-printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high --advisor opus\$"
+printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high\$"
 check "paste= is the whole line: cd into the repo, then the startup command" $?
 printf '%s\n' "$PLAN" | grep -A7 '^repo=repo-typo$' | grep -q '^paste='; [ $? -ne 0 ]
@ -1524,7 +1535,7 @@ check "ip-repo-no-state reports 1 owed (no reply-expected: no declared)" $?
 # class=repo still derives the exact startup command from the repo's own
 # route line - same single copy of the rubric every other rendering uses.
 printf '%s\n' "$IPLAN" | grep -A8 '^repo=ip-repo-done-fyi$' \
-  | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
+  | grep -q '^command=claude --model sonnet --effort high$'
 check "class=repo block derives its command from the repo's own route line" $?
 # class=no-state and class=orphan-mailbox can never fabricate a command - ask
@ -1760,8 +1771,8 @@ d6="$("$BOARD" --roots "$ROOT" --dispatch --repo no-such-repo --prompt-file "$DS
 [ "$rc" -eq 2 ]; check "dispatch: refuses a repo the scan does not know" $?
 # Invalid traits must refuse, never degrade to a command without them: a
-# command missing --advisor reads exactly like a row that legitimately has no
+# command built on three scored traits and one silently dropped one reads
-# advisor.
+# exactly like a fully scored decision.
 d7="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path bogus --verification strong --reversibility cheap --scope local --rationale t 2>&1)"; rc=$?
 [ "$rc" -eq 2 ]; check "dispatch: refuses trait values route.sh rejects, rather than emitting a partial command" $?
@ -1783,18 +1794,27 @@ printf '%s\n' "$d8" | grep -q '^paste=cd '; check "dispatch: plan block carries
 printf '%s\n' "$d8" | grep -q "command=.*\"\$(cat $DSP)\""; check "dispatch: the command carries the prompt in argv, never bare model+effort" $?
 printf '%s\n' "$d8" | grep -q "^paste=cd $ROOT/repo-a && claude .*\"\$(cat $DSP)\""; check "dispatch: paste= is the complete one-string form, prompt included" $?
-# The cost comes from route.sh's row table and nowhere else, so --advisor is a
+# The cost comes from route.sh's row table and nowhere else. These two differ
-# property of the ROW. These two differ ONLY in reversibility: both land on
+# ONLY in reversibility, and both land on row 3 (Opus 5/high) - so since the
-# row 3 (Opus 5/high), and only the costly one carries the advisor. A dispatch
+# advisor rule was struck (2026-09-12) they must produce the IDENTICAL command.
-# that took --model/--effort directly would have no source for that flag at
+# costly is the case that used to add --advisor opus, which makes it the exact
-# all, and forwarding it blindly is how a session ends up looking peer-reviewed
+# input a reintroduced rule would fire on: this is the order's named red test,
-# without being.
+# not a sampled one.
 d9="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path known --verification strong --reversibility cheap --scope multi-file --rationale t 2>/dev/null)"
-printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3, no advisor at cheap)" $?
+printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3)" $?
 d10="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
      --path known --verification strong --reversibility costly --scope local --rationale t 2>/dev/null)"
-printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high --advisor opus "'; check "dispatch: the advisor flag follows the ROW (costly -> row 3 with advisor)" $?
+printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: reversibility=costly emits NO advisor (rule struck 2026-09-12)" $?
 if printf '%s\n' "$d10" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "dispatch: no advisor anywhere in the costly dispatch block" "$rc"
 if printf '%s\n' "$d10 claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
 check "control: that grep does find a planted advisor" "$rc"
 # The paste line is assembled separately from command=, so it is pinned
 # separately: a flag reintroduced in only one of the two is the shape that
 # sends the operator and the driver down different paths.
 if printf '%s\n' "$d10" | grep '^paste=' | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "dispatch: the paste line carries no advisor either" "$rc"
 printf '%s\n' "$d8" | grep -q '^next-cost=Sonnet 5/high$'; check "dispatch: the row's next-cost is reported alongside the command" $?
 # --no-go stops the Go MESSAGE, not the work: the startup command - prompt in
@ -1920,9 +1940,14 @@ for i in 1 2 3; do
  printf -- '---\nfrom: x\nto: ord-both\nsubject: m%s\n---\nbody\n' "$i" \
    > "$CLAUDE_COORD_DIR/ord-both/inbox/2026010${i}T000000Z-${i}-from-x.md"
 done
 # The PENDING filenames carry TODAY's stamp: since ORDRE 20260903T185736Z the
 # ORDRE age is read from the name, so a fixed 2026-01 name would render its real
 # delivery age here and this row asserts 2:0d. Claimed fixtures keep their fixed
 # names - FLY still reads the mtime.
 ORD_TODAY="$(date -u +%Y%m%dT%H%M%SZ)"
 for i in 1 2; do
  printf -- '---\nfrom: d\nto: ord-both\norder-id: o%s\nsubject: order %s\n---\nbody\n' "$i" "$i" \
-    > "$CLAUDE_COORD_DIR/ord-both/orders/2026010${i}T000000Z-${i}-from-d.md"
+    > "$CLAUDE_COORD_DIR/ord-both/orders/${ORD_TODAY}-${i}-from-d.md"
 done
 # A CLAIMED order is deliberately NOT counted: the column answers "what can a
 # session pick up here", and one already in flight cannot be. Counting it would
@ -2122,7 +2147,7 @@ mkrepo "$RG_ROOT/repo-rationale-overrides"
 } > "$RG_ROOT/repo-rationale-overrides/STATE.md"
 RG_PLAN="$("$BOARD" --roots "$RG_ROOT" --plan 2>/dev/null)"
-RG_CMD='^command=claude --model sonnet --effort high --advisor opus$'
+RG_CMD='^command=claude --model sonnet --effort high$'
 printf '%s\n' "$RG_PLAN" | grep -A6 '^repo=repo-greedy-rationale$' | grep -q "$RG_CMD"
 check "route line whose rationale names all four traits still yields a command" $?
@ -2192,8 +2217,9 @@ mkfly fly-inflight planned;  mkorder fly-inflight claimed 20260101T000000Z-1-fro
 mkfly fly-empty    planned
 # Both states at once, so the two counts are provably read from different dirs.
 mkfly fly-mixed    planned
-mkorder fly-mixed pending 20260102T000000Z-2-from-d
+FLY_TODAY="$(date -u +%Y%m%dT%H%M%SZ)"
-mkorder fly-mixed pending 20260103T000000Z-3-from-d
+mkorder fly-mixed pending "${FLY_TODAY}-2-from-d"
 mkorder fly-mixed pending "${FLY_TODAY}-3-from-d"
 mkorder fly-mixed claimed 20260104T000000Z-4-from-d
 FLY_OUT="$("$BOARD" --roots "$FLY_ROOT" 2>/dev/null)"
@ -2221,7 +2247,7 @@ check "the legend denies that FLY proves a session is alive" $?
 # deferred repos were NOT free (2 held a pending order, 1 owed a reply, 1 had
 # an uncommitted tree). All four conditions are required.
 mkfly fly-free       done
-mkfly fly-busy-order done;     mkorder fly-busy-order pending 20260105T000000Z-5-from-d
+mkfly fly-busy-order done;     mkorder fly-busy-order pending "${FLY_TODAY}-5-from-d"
 mkfly fly-busy-fly   done;     mkorder fly-busy-fly   claimed 20260106T000000Z-6-from-d
 mkfly fly-busy-mail  done
 mkdir -p "$CLAUDE_COORD_DIR/fly-busy-mail/inbox"
@ -2576,9 +2602,17 @@ check "exit3: a nonzero that is not 3 is caught too, and names its own status" $
 # problem, and the newest reading is precisely what would hide it. This is not
 # a new mechanism in the file - ALDER (STATE.md mtime) and SISTE (last commit)
 # already read a clock the same way.
 #
 # Since ORDRE 20260903T185736Z the PENDING age is read from the FILENAME, so
 # these fixtures carry their intended age in the NAME rather than only in a
 # `touch -t`. The stems are computed once - the timestamp embeds HHMMSS, so
 # recomputing one a second later names a different file. FLY still reads the
 # mtime, which is why the claimed fixture keeps its touch.
 AGROOT="$(mktemp -d)"
 AGCOORD="$(mktemp -d)"
 AG_OLD="$(date -v-10d +%Y%m%d%H%M)"
 AG_OLD_TS="$(date -u -v-10d +%Y%m%dT%H%M%SZ)"
 AG_NEW_TS="$(date -u +%Y%m%dT%H%M%SZ)"
 mk_ag_repo() {
  mkrepo "$AGROOT/$1"
@ -2599,15 +2633,15 @@ mk_ag_order() {  # $1=repo $2=subdir ("orders" or "orders/claimed") $3=file $4=t
 # ag-old: one fresh order AND one ten days old. The whole point of the section.
 mk_ag_repo ag-old
-mk_ag_order ag-old orders 20260829T000000Z-fresh -
+mk_ag_order ag-old orders "${AG_NEW_TS}-fresh" -
-mk_ag_order ag-old orders 20260818T000000Z-stale "$AG_OLD"
+mk_ag_order ag-old orders "${AG_OLD_TS}-stale" "$AG_OLD"
 # ag-fresh: KNOWN-POSITIVE CONTROL. Two orders, both fresh. If the assertion
 # below could not tell these two repos apart it would pass on anything - this
 # is the tree "where the age is wrong" that proves the check can fail.
 mk_ag_repo ag-fresh
-mk_ag_order ag-fresh orders 20260829T000001Z-a -
+mk_ag_order ag-fresh orders "${AG_NEW_TS}-a" -
-mk_ag_order ag-fresh orders 20260829T000002Z-b -
+mk_ag_order ag-fresh orders "${AG_NEW_TS}-b" -
 # ag-none: no orders at all. "0 days old" and "no orders" are two different
 # facts and must not render the same - the same reason FLY exists next to ORDRE.
@ -2617,7 +2651,7 @@ mk_ag_repo ag-none
 # that most needs this: nothing un-claims an order when the session dies, so a
 # claim with no age is the 117-hour claim with its only counter-evidence removed.
 mk_ag_repo ag-fly
-mk_ag_order ag-fly orders/claimed 20260818T000001Z-inflight "$AG_OLD"
+mk_ag_order ag-fly orders/claimed "${AG_OLD_TS}-inflight" "$AG_OLD"
 AGOUT="$(CLAUDE_COORD_DIR="$AGCOORD" "$BOARD" --roots "$AGROOT" 2>/dev/null)"
 ag_row() { printf '%s' "$AGOUT" | grep "^$1 "; }
@ -2625,9 +2659,15 @@ ag_row() { printf '%s' "$AGOUT" | grep "^$1 "; }
 # Ground truth for the fixture itself: the stale file really is ~10 days old.
 # Asserted before anything depends on it, so a broken `touch -t` fails here
 # rather than silently turning the checks below into a test of nothing.
-ag_gt="$(( ( $(date +%s) - $(stat -f %m "$AGCOORD/ag-old/orders/20260818T000000Z-stale.md") ) / 86400 ))"
+# Two ground truths, because the two columns now read two different sources.
 # ORDRE depends on the FILENAME, FLY on the mtime, and a fixture check that
 # guarded only one of them would leave the other assertion resting on nothing.
 ag_gt_name="$(( ( $(date -u +%s) - $(date -u -j -f %Y%m%d%H%M%S "$(printf '%s' "$AG_OLD_TS" | tr -dc '0-9')" +%s) ) / 86400 ))"
 [ "$ag_gt_name" -eq 10 ]
 check "orderage: ground truth - the stale fixture's FILENAME says 10 days" $?
 ag_gt="$(( ( $(date +%s) - $(stat -f %m "$AGCOORD/ag-fly/orders/claimed/${AG_OLD_TS}-inflight.md") ) / 86400 ))"
 [ "$ag_gt" -eq 10 ]
-check "orderage: ground truth - the fixture's stale order really is 10 days old" $?
+check "orderage: ground truth - the in-flight fixture's MTIME really is 10 days old" $?
 ag_cells() { ag_row "$1" | cut -c89- ; }
 [ "$(ag_cells ag-old | awk '{print $1}')" = "2:10d" ]
@ -2940,6 +2980,473 @@ vsum_after="$(find "$VROOT" -type f | sort | wc -l)"
 check "voyage: board wrote nothing to the scanned tree (read-only preserved)" $?
 /bin/rm -rf "$VROOT" "$VCOORD" 2>/dev/null
 # --- 30. ORDRE's pending age comes from the FILENAME, never the mtime -------
 # ORDRE 20260903T185736Z-1290610855 (.claude, 2026-09-03). Found by reading the
 # board right after this repo returned an order of its own: `--return` rewrites
 # the order file's mtime, and ORDRE read mtime, so a 1-day-old order rendered
 # `1:0d`. An order returned three times could never look old on the one surface
 # that exists so a repo nobody opens still shows something.
 #
 # PM decision - two questions, two sources. A PENDING order's age is "how long
 # has this sat with no owner" = now - DELIVERY time, which only the filename
 # carries and nothing rewrites. A CLAIMED order's age is "how long has it been
 # in flight", which is the claim's own mtime and is already right.
 PAROOT="$(mktemp -d)"
 PACOORD="$(mktemp -d)"
 pa_ts() { date -u -v-"$1"d +%Y%m%dT%H%M%SZ; }
 mk_pa_repo() {
  mkrepo "$PAROOT/$1"
  {
    echo "# STATE - $1"
    echo ""
    printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
    echo "<!-- board: status=in-progress; blocked-on=-; next-cost=Sonnet 5/high -->"
    echo "Et steg."
  } > "$PAROOT/$1/STATE.md"
 }
 mk_pa_order() {  # $1=repo $2=subdir $3=full filename stem (carries the timestamp)
  mkdir -p "$PACOORD/$1/$2"
  printf -- '---\nfrom: x\nto: %s\n---\nDo a thing.\n' "$1" > "$PACOORD/$1/$2/$3.md"
 }
 # The stems are computed ONCE and reused: pa_ts embeds HHMMSS, so recomputing
 # it a second later names a different file than the one that was created.
 pa_ret_stem="$(pa_ts 3)-1111111111-from-x"
 pa_fresh_stem="$(pa_ts 0)-2222222222-from-x"
 pa_fly_stem="$(pa_ts 9)-3333333333-from-x"
 # pa-returned: filename says 3 days ago, mtime is NOW - exactly what a return
 # leaves behind. This is the defect, reproduced in a fixture.
 mk_pa_repo pa-returned
 mk_pa_order pa-returned orders "$pa_ret_stem"
 # pa-fresh: KNOWN-POSITIVE CONTROL. Delivered today, so it must still read 0d -
 # without this, an assertion of "3d" would pass against a function that always
 # says 3.
 mk_pa_repo pa-fresh
 mk_pa_order pa-fresh orders "$pa_fresh_stem"
 # pa-fly: an OLD filename claimed just now. FLY must stay on the mtime and read
 # 0d, or the fix has quietly changed the other question's answer too.
 mk_pa_repo pa-fly
 mk_pa_order pa-fly orders/claimed "$pa_fly_stem"
 PAOUT="$(CLAUDE_COORD_DIR="$PACOORD" "$BOARD" --roots "$PAROOT" 2>/dev/null)"
 pa_cells() { printf '%s' "$PAOUT" | grep "^$1 " | cut -c89- ; }
 # Ground truth for the fixture first: the mtime really is fresh, so a green
 # 30b cannot come from the file secretly being 3 days old on disk.
 pa_gt="$(( ( $(date +%s) - $(stat -f %m "$PACOORD/pa-returned/orders/$pa_ret_stem.md") ) / 86400 ))"
 [ "$pa_gt" -eq 0 ]
 check "pendingage: ground truth - the returned fixture's mtime is TODAY" $?
 [ "$(pa_cells pa-returned | awk '{print $1}')" = "1:3d" ]
 check "pendingage: ORDRE reads the DELIVERY age from the filename, not the mtime" $?
 [ "$(pa_cells pa-returned | awk '{print $1}')" = "1:0d" ]; [ $? -ne 0 ]
 check "pendingage: a rewritten mtime can no longer reset a pending order's age" $?
 [ "$(pa_cells pa-fresh | awk '{print $1}')" = "1:0d" ]
 check "pendingage: control - an order delivered today still reads 0d" $?
 [ "$(pa_cells pa-fly | awk '{print $2}')" = "1:0d" ]
 check "pendingage: FLY still reads the claim's mtime - the other question is unchanged" $?
 [ "$(pa_cells pa-fly | awk '{print $2}')" = "1:9d" ]; [ $? -ne 0 ]
 check "pendingage: FLY did NOT switch to the filename with ORDRE" $?
 # A name the grammar does not produce has no readable delivery time. "?" is the
 # whole reading, never a skipped file: an unmeasured order could be the oldest,
 # which is the same rule the mtime path already carried.
 mk_pa_repo pa-bad
 mk_pa_order pa-bad orders "not-a-timestamp"
 PAOUT2="$(CLAUDE_COORD_DIR="$PACOORD" "$BOARD" --roots "$PAROOT" 2>/dev/null)"
 [ "$(printf '%s' "$PAOUT2" | grep "^pa-bad " | cut -c89- | awk '{print $1}')" = "1:?" ]
 check "pendingage: an unparseable filename reads ?, never a fabricated 0" $?
 /bin/rm -rf "$PAROOT" "$PACOORD" 2>/dev/null
 # --- 31. Nested git repos with a STATE.md (admission a) ---------------------
 # Operator decision 2026-09-03, order 20260903T190201Z-238406410-from-.claude:
 # a git repo nested at depth 2 UNDER a directory that is itself a git repo
 # (claude-code-100x/*, from-ai-to-chitta/*) was invisible to the board - the
 # discovery loop adds a depth-1 repo and never looks inside it, and the
 # else-branch container scan is reached only when the depth-1 entry is NOT a
 # repo. Admission is criterion (a) and nothing wider: such a repo enters the
 # board ONLY when it carries a STATE.md. A nested repo without one stays
 # invisible ON PURPOSE - it does not even reach the UTEN STATE.md bucket,
 # because that bucket is for repos the operator opens, and these are vendored
 # or experimental checkouts nobody has declared a next step for. Measured on
 # the real tree the day the order was written: 12 nested repos, exactly 1 with
 # a STATE.md (from-ai-to-chitta/content-sadhguru).
 #
 # A dedicated add_nested_repos() beside add_dot_repos(), never a widening of
 # the `*` loops: the same argument ordre 20260818T124828Z made for dot repos.
 # Turning the depth-1 repo branch into a container scan would admit every
 # nested checkout, which is precisely what criterion (a) declines.
 NEST_ROOT="$(mktemp -d)"
 NEST_COORD="$(mktemp -d)"
 mk_nest_state() {
  {
    echo "# STATE - $2"
    printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
    echo "<!-- board: status=$3; blocked-on=-; next-cost=Sonnet 5/high -->"
    echo "Next step for $2."
  } > "$1/STATE.md"
 }
 # A depth-1 repo holding THREE nested repos, exactly one with a STATE.md.
 mkrepo "$NEST_ROOT/parent-repo"
 mk_nest_state "$NEST_ROOT/parent-repo" parent-repo in-progress
 mkrepo "$NEST_ROOT/parent-repo/nest-with-state"
 mk_nest_state "$NEST_ROOT/parent-repo/nest-with-state" nest-with-state planned
 mkrepo "$NEST_ROOT/parent-repo/nest-no-state-1"
 mkrepo "$NEST_ROOT/parent-repo/nest-no-state-2"
 # Known-positive control: an ordinary depth-1 repo must still be found, so a
 # green section cannot come from a fix that broke the case that already worked.
 mkrepo "$NEST_ROOT/plain-repo"
 mk_nest_state "$NEST_ROOT/plain-repo" plain-repo planned
 # Known-negative control: a depth-1 repo whose nested repos carry NO STATE.md
 # must contribute exactly zero extra rows.
 mkrepo "$NEST_ROOT/barren-parent"
 mk_nest_state "$NEST_ROOT/barren-parent" barren-parent done
 mkrepo "$NEST_ROOT/barren-parent/nest-barren"
 NEST_OUT="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 # Ground truth for the fixture itself, before anything depends on it: the
 # nested checkout really is a git repo and really does carry a STATE.md.
 [ -e "$NEST_ROOT/parent-repo/nest-with-state/.git" ] && \
  [ -f "$NEST_ROOT/parent-repo/nest-with-state/STATE.md" ]
 check "nested: ground truth - the fixture nested repo has .git AND STATE.md" $?
 [ -e "$NEST_ROOT/parent-repo/nest-no-state-1/.git" ] && \
  [ ! -f "$NEST_ROOT/parent-repo/nest-no-state-1/STATE.md" ]
 check "nested: ground truth - the excluded fixture has .git and NO STATE.md" $?
 printf '%s' "$NEST_OUT" | grep -q 'parent-repo/nest-with-state'
 check "nested: a nested repo with STATE.md is on the board, keyed <parent>/<child>" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-no-state-1'; [ $? -ne 0 ]
 check "nested: a nested repo WITHOUT STATE.md stays invisible (criterion a)" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-no-state-2'; [ $? -ne 0 ]
 check "nested: the second STATE-less nested repo is invisible too" $?
 printf '%s' "$NEST_OUT" | grep -q 'nest-barren'; [ $? -ne 0 ]
 check "nested: known-negative - a parent with no STATE-carrying child adds 0 rows" $?
 printf '%s' "$NEST_OUT" | grep -q '^plain-repo '
 check "nested: known-positive - the ordinary depth-1 repo is still found" $?
 printf '%s' "$NEST_OUT" | grep -q '(4 repo'
 check "nested: exactly one row is added (4 = parent + plain + barren + nested)" $?
 # The nested row is a repo like any other: its status comes from its OWN
 # STATE.md, not the parent's.
 printf '%s' "$NEST_OUT" | grep '^parent-repo/nest-with-state ' | grep -q 'planned'
 check "nested: the nested row reads its own STATE.md board line" $?
 printf '%s' "$NEST_OUT" | grep '^parent-repo ' | grep -q 'in-progress'
 check "nested: the parent keeps its own status (known-positive)" $?
 # The display key is <parent>/<child>; the MAILBOX name is not. A mailbox is
 # addressed by basename(git toplevel) - coord-send.sh's own rule - so a repo
 # named parent-repo/nest-with-state on the board still counts its mail under
 # <coord>/nest-with-state. Reading the compound name against $COORD would find
 # no directory and print INN 0, which is a failed measurement wearing the
 # reassuring value - the one thing this file refuses everywhere.
 mkdir -p "$NEST_COORD/nest-with-state/inbox" "$NEST_COORD/nest-with-state/orders/claimed"
 : > "$NEST_COORD/nest-with-state/inbox/20260101T000000Z-1-from-x.md"
 : > "$NEST_COORD/nest-with-state/inbox/20260101T000000Z-2-from-x.md"
 : > "$NEST_COORD/nest-with-state/orders/$(date -u +%Y%m%dT%H%M%SZ)-3-from-x.md"
 : > "$NEST_COORD/nest-with-state/orders/claimed/20260101T000000Z-4-from-x.md"
 NEST_OUT2="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 nest_cells="$(printf '%s' "$NEST_OUT2" | grep '^parent-repo/nest-with-state ' | cut -c89-)"
 # Exact values, never "not 0": before the fix the row did not exist at all, so
 # `awk '{print $1}'` on an empty string is "" - which is not "0" and would have
 # passed these two checks while measuring nothing. That is state-line-guard
 # section 11's vacuously-green defect, and it was observed here on the red run.
 [ -n "$nest_cells" ]
 check "nested: ground truth - the nested row exists before its cells are read" $?
 # A today-stamped filename, because a PENDING order's age is read from the
 # FILENAME, not the mtime (0.32.1) - a fixed 2026-01 stem would date this cell
 # to whenever the suite happens to run.
 [ "$(printf '%s' "$nest_cells" | awk '{print $1}')" = "1:0d" ]
 check "nested: ORDRE is counted under the mailbox BASENAME, not the compound key" $?
 [ "$(printf '%s' "$nest_cells" | awk '{print $2}')" = "1:0d" ]
 check "nested: FLY likewise reads <coord>/<basename>" $?
 printf '%s' "$NEST_OUT2" | grep '^parent-repo/nest-with-state ' | grep -q ' 2 '
 check "nested: INN reads the basename mailbox, never a fabricated 0" $?
 # Depth 3 is NOT admitted: the order says depth 2 under a depth-1 repo, and a
 # repo nested inside a nested repo is a checkout of a checkout. Widening was
 # not ordered, and an unmeasured widening is the defect ordre 20260818 flagged.
 mkrepo "$NEST_ROOT/parent-repo/nest-with-state/deeper"
 mk_nest_state "$NEST_ROOT/parent-repo/nest-with-state/deeper" deeper planned
 NEST_OUT3="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT3" | grep -q 'deeper'; [ $? -ne 0 ]
 check "nested: depth 3 is not admitted (one level under a depth-1 repo only)" $?
 /bin/rm -rf "$NEST_ROOT/parent-repo/nest-with-state/deeper"
 # A polyrepo container's children are UNCHANGED - their parent is not a repo,
 # so they keep their bare basename and never grow a <parent>/ prefix.
 mkdir -p "$NEST_ROOT/container-dir"
 mkrepo "$NEST_ROOT/container-dir/child-repo"
 mk_nest_state "$NEST_ROOT/container-dir/child-repo" child-repo planned
 NEST_OUT4="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT4" | grep -q '^child-repo '
 check "nested: a polyrepo container's child keeps its bare name (known-positive)" $?
 printf '%s' "$NEST_OUT4" | grep -q 'container-dir/child-repo'; [ $? -ne 0 ]
 check "nested: container children are NOT renamed to <parent>/<child>" $?
 # Same rule under a dot-prefixed depth-1 repo: it is a depth-1 repo, so its
 # STATE-carrying nested repo is admitted on exactly the same criterion. The
 # asymmetry would otherwise be arbitrary - ordinary parents scanned, dot ones
 # not - and nothing in the order distinguishes them.
 mkrepo "$NEST_ROOT/.dotparent"
 mk_nest_state "$NEST_ROOT/.dotparent" .dotparent planned
 mkrepo "$NEST_ROOT/.dotparent/dotnest"
 mk_nest_state "$NEST_ROOT/.dotparent/dotnest" dotnest planned
 NEST_OUT5="$(CLAUDE_COORD_DIR="$NEST_COORD" "$BOARD" --roots "$NEST_ROOT" 2>/dev/null)"
 printf '%s' "$NEST_OUT5" | grep -q '\.dotparent/dotnest'
 check "nested: a dot-prefixed depth-1 repo's nested repo is admitted too" $?
 /bin/rm -rf "$NEST_ROOT" "$NEST_COORD" 2>/dev/null
 # --- 32. The scan reports its own denominator -------------------------------
 # Independent of section 31 and required regardless (the order says so in as
 # many words). Verifiseringsloven ansikt 4 applied to the board's own reading:
 # a repo count alone answers "how many were found" and says nothing about how
 # many directories were LOOKED AT, so a criterion that silently excludes 11 of
 # 12 nested repos is invisible at the surface that is supposed to show it.
 # The line names all four quantities, including the excluded ones.
 DEN_ROOT="$(mktemp -d)"
 DEN_COORD="$(mktemp -d)"
 mk_den_state() {
  {
    echo "# STATE - $2"
    printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
    echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
    echo "Next step for $2."
  } > "$1/STATE.md"
 }
 # Depth-1 directories: 4 (two repos, one polyrepo container, one plain dir).
 mkrepo "$DEN_ROOT/d1-repo-a"
 mk_den_state "$DEN_ROOT/d1-repo-a" d1-repo-a
 mkrepo "$DEN_ROOT/d1-repo-b"
 mk_den_state "$DEN_ROOT/d1-repo-b" d1-repo-b
 mkdir -p "$DEN_ROOT/d1-container"
 mkrepo "$DEN_ROOT/d1-container/contained"
 mk_den_state "$DEN_ROOT/d1-container/contained" contained
 mkdir -p "$DEN_ROOT/d1-emptydir"
 # Nested repos: 3 under d1-repo-a, of which 2 carry a STATE.md.
 mkrepo "$DEN_ROOT/d1-repo-a/n1"; mk_den_state "$DEN_ROOT/d1-repo-a/n1" n1
 mkrepo "$DEN_ROOT/d1-repo-a/n2"; mk_den_state "$DEN_ROOT/d1-repo-a/n2" n2
 mkrepo "$DEN_ROOT/d1-repo-a/n3"
 DEN_OUT="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT" 2>/dev/null)"
 DEN_LINE="$(printf '%s\n' "$DEN_OUT" | grep '^undersoekt:')"
 [ -n "$DEN_LINE" ]
 check "denominator: the board prints an 'undersoekt:' line" $?
 printf '%s' "$DEN_LINE" | grep -q '4 katalog(er) depth 1'
 check "denominator: depth-1 directory count matches the fixture (4)" $?
 printf '%s' "$DEN_LINE" | grep -q '2 polyrepo-container(e)'
 check "denominator: container count matches the fixture (2: one with a repo, one empty)" $?
 printf '%s' "$DEN_LINE" | grep -q '3 nestede repo'
 check "denominator: nested-repo count matches the fixture (3)" $?
 printf '%s' "$DEN_LINE" | grep -q '2 med STATE.md tatt med'
 check "denominator: admitted-nested count matches the fixture (2 of 3)" $?
 # The line must be a real reading, not a constant: change the tree and it moves.
 mkrepo "$DEN_ROOT/d1-repo-a/n4"; mk_den_state "$DEN_ROOT/d1-repo-a/n4" n4
 DEN_OUT2="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT" 2>/dev/null)"
 printf '%s\n' "$DEN_OUT2" | grep '^undersoekt:' | grep -q '4 nestede repo (3 med STATE.md tatt med)'
 check "denominator: the counts follow the tree, they are not hardcoded" $?
 # A root that does not exist contributes nothing and must not silently inflate
 # the denominator - F10's rule, applied to the new counters.
 DEN_OUT3="$(CLAUDE_COORD_DIR="$DEN_COORD" "$BOARD" --roots "$DEN_ROOT,/nonexistent-root-$$" 2>/dev/null)"
 printf '%s\n' "$DEN_OUT3" | grep '^undersoekt:' | grep -q '4 katalog(er) depth 1'
 check "denominator: a missing scan root adds nothing to the counts" $?
 /bin/rm -rf "$DEN_ROOT" "$DEN_COORD" 2>/dev/null
 # --- 33. --row <repo>: one machine-readable line per column -----------------
 # Order 20260912T202210Z-7588027378 (.claude, operator decision 2026-09-12).
 # The motivation is a measured misreading, not a convenience: on 11.09 the PM
 # read the FLY column off the table BY EYE and got it wrong. Every other
 # rendering that a program consumes emits `key=value` for exactly that reason -
 # the table's fixed-width columns are for a human, and a 34-character repo key
 # already shifts a row two characters right (a stated, unclosed gap). A repo
 # holding a value nobody can grep is a repo whose state is read by counting
 # spaces.
 #
 # It is a RENDERING of the scan every other view already ran, never a second
 # scan - the same rule --brief has carried since it shipped. Two numbers under
 # one name, computed twice, is the defect this file names most often.
 #
 # ONE DEPARTURE, stated rather than smuggled: `upushet=` is not a column the
 # scan computes, and it is measured here, once, for the named repo only. It is
 # in the order's field list, it is exactly the kind of fact that gets misread
 # ("nothing unpushed" vs "not measured"), and measuring it for one repo in a
 # one-repo rendering is not a scan. It never enters the table, the plan or the
 # briefing.
 ROW_ROOT="$(mktemp -d)"
 ROW_COORD="$(mktemp -d)"
 mkrepo "$ROW_ROOT/row-repo"
 {
  echo "# STATE - row-repo"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=blocked; blocked-on=other-repo; next-cost=Opus 5/high -->"
  echo "<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; rationale=x -->"
  echo "The whole next step, well past the 38 characters the table column cuts at."
 } > "$ROW_ROOT/row-repo/STATE.md"
 # Mailbox fixture: 3 pending messages, 2 pending orders, 1 claimed order. The
 # three counts are deliberately three DIFFERENT integers, and that is the whole
 # design of this fixture rather than an arbitrary choice. Built first with
 # 2/1/1, it was mutation-tested by making `fly` read the ORDRE field - the
 # exact 2026-09-11 misreading this rendering exists to close - and the check
 # stayed GREEN, because the two fields held the same digit. A fixture that
 # cannot tell two columns apart is the defect wearing a passing test, in the
 # section written to prevent it. With 3/2/1 that mutation turns it red.
 mkdir -p "$ROW_COORD/row-repo/inbox" "$ROW_COORD/row-repo/orders/claimed"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101010Z-1-from-x.md"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101011Z-2-from-x.md"
 echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101014Z-5-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/20260901T101012Z-3-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/20260901T101015Z-6-from-x.md"
 echo "o" > "$ROW_COORD/row-repo/orders/claimed/20260901T101013Z-4-from-x.md"
 ROW_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo 2>/dev/null)"; rc=$?
 [ "$rc" -eq 0 ]; check "row: a known repo exits 0" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^repo=row-repo$';        check "row: repo= is the board key" $?
 printf '%s\n' "$ROW_OUT" | grep -q "^dir=$ROW_ROOT/row-repo\$"; check "row: dir= is the checkout path" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^status=blocked$';       check "row: status= is the bare token, not the blocked>target display" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^blocked-on=other-repo$';check "row: blocked-on= is its own field" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^next-cost=Opus 5/high$';check "row: next-cost= survives the space and the slash" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^inn=3$';                check "row: inn= counts pending messages" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^ordre=2$';              check "row: ordre= counts pending orders" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^fly=1$';                check "row: fly= counts claimed orders" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^siste=';                check "row: siste= reports the last-commit reading" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^drt=';                  check "row: drt= reports the working-tree reading" $?
 printf '%s\n' "$ROW_OUT" | grep -q '^upushet=';              check "row: upushet= is present" $?
 # The three counts are the whole point: FLY was misread as ORDRE, so a rendering
 # that emitted the same digit under two names would reproduce the defect it
 # exists to close.
 [ "$(printf '%s\n' "$ROW_OUT" | grep -c '^\(inn\|ordre\|fly\)=')" -eq 3 ]
 check "row: inn, ordre and fly are three separate fields" $?
 # NESTE uncut, same argument --brief has: the 38-char cut is the TABLE column's
 # property, and cutting here would make the cut string the only copy.
 printf '%s\n' "$ROW_OUT" | grep -q '^neste=.*38 characters the table column cuts at'
 check "row: neste= carries the whole line, not the table excerpt" $?
 # `neste` is free prose and may contain anything the STATE.md author wrote, so
 # it is LAST - the same rule the RECORDS line itself obeys. A consumer reading
 # field N from the end depends on it.
 [ "$(printf '%s\n' "$ROW_OUT" | tail -1 | cut -d= -f1)" = "neste" ]
 check "row: neste= is the last line" $?
 # One line per field, every line a field: a value that wrapped would be read as
 # a field name by anything grepping ^name=.
 ROW_BAD="$(printf '%s\n' "$ROW_OUT" | grep -v '^[a-z][a-z-]*=' || true)"
 [ -z "$ROW_BAD" ]; check "row: every line is a field=value line:${ROW_BAD:- clean}" $?
 # ASCII, because the row is consumed by awk/sed/grep under bash 3.2 - the same
 # constraint every other emitted block in this file carries. Asserted on a
 # fixture whose own prose is ASCII, so this measures the renderer, not the
 # STATE.md it happened to read.
 if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]'; then rc=1; else rc=0; fi
 check "row: the output is ASCII" "$rc"
 if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]x'; then rc=1; else rc=0; fi
 check "control: that ASCII grep runs at all (no match on a clean string)" "$rc"
 # A repo whose NESTE is NOT ASCII still emits one line per field. The renderer
 # cannot make the operator's Norwegian prose ASCII and must never try - the
 # field NAMES are the machine surface, the value is whatever was written.
 mkrepo "$ROW_ROOT/row-utf8"
 {
  echo "# STATE - row-utf8"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
  printf 'M\xc3\x85LT i dag: ingenting gjenst\xc3\xa5r.\n'
 } > "$ROW_ROOT/row-utf8/STATE.md"
 ROW_U="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-utf8 2>/dev/null)"
 ROW_UBAD="$(printf '%s\n' "$ROW_U" | grep -v '^[a-z][a-z-]*=' || true)"
 [ -z "$ROW_UBAD" ]; check "row: non-ASCII NESTE still yields one field per line" $?
 printf '%s\n' "$ROW_U" | grep -q '^neste=.*ingenting'
 check "row: non-ASCII NESTE is carried through, never mangled or dropped" $?
 # An unknown repo must REFUSE. Emitting an empty block would be the same defect
 # as a bare `command=`: a consumer reading ^status= would get nothing back and
 # read it as a repo with no status, which is a real and different state ("?").
 ROW_ERR="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>&1)"; rc=$?
 [ "$rc" -eq 2 ]; check "row: an unknown repo exits 2" $?
 printf '%s\n' "$ROW_ERR" | grep -q 'no-such-repo'
 check "row: the refusal names the repo it could not find" $?
 ROW_ERR_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>/dev/null)"
 [ -z "$ROW_ERR_OUT" ]; check "row: a refusal writes nothing at all to stdout" $?
 # A missing value is a usage error, not a silently empty row.
 CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row >/dev/null 2>&1
 [ $? -eq 2 ]; check "row: --row with no value exits 2" $?
 # Read-only, asserted rather than assumed: this is the one property every
 # rendering in this file shares and the one a new rendering is most likely to
 # break.
 ROW_BEFORE="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
 CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo >/dev/null 2>&1
 ROW_AFTER="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
 [ "$ROW_BEFORE" = "$ROW_AFTER" ]; check "row: writes nothing - no file added, removed or touched" $?
 # upushet: the three states must stay distinguishable. This fixture has no
 # upstream at all, so the honest answer is "not measured", never 0 - the same
 # rule DRT's ? and coord-count's exit 3 carry. A 0 here would say "nothing is
 # waiting to be pushed" about a repo that has never had a remote.
 printf '%s\n' "$ROW_OUT" | grep -q '^upushet=?$'
 check "row: a repo with no upstream reports upushet=?, never 0" $?
 # Known-positive control, and the case the field exists for: a real upstream
 # with a real unpushed commit must report the count. Without this the ? above
 # would pass on a field that can only ever say ?.
 ROW_UP="$ROW_ROOT/row-upstream"
 mkrepo "$ROW_UP"
 {
  echo "# STATE - row-upstream"
  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
  echo "Next step."
 } > "$ROW_UP/STATE.md"
 git -C "$ROW_UP" add -A >/dev/null 2>&1
 git -C "$ROW_UP" commit -qm "state" >/dev/null 2>&1
 ROW_BARE="$(mktemp -d)/origin.git"
 git init -q --bare "$ROW_BARE" >/dev/null 2>&1
 git -C "$ROW_UP" remote add origin "$ROW_BARE" >/dev/null 2>&1
 git -C "$ROW_UP" push -q -u origin HEAD >/dev/null 2>&1
 ROW_U0="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
 printf '%s\n' "$ROW_U0" | grep -q '^upushet=0$'
 check "row: control - an upstream with everything pushed reports upushet=0" $?
 echo "more" > "$ROW_UP/extra.txt"
 git -C "$ROW_UP" add -A >/dev/null 2>&1
 git -C "$ROW_UP" commit -qm "unpushed work" >/dev/null 2>&1
 ROW_U1="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
 printf '%s\n' "$ROW_U1" | grep -q '^upushet=1$'
 check "row: one unpushed commit reports upushet=1" $?
 # The table is UNCHANGED by all of this. --row is a rendering, so a field that
 # only exists there must not leak into the view a human reads.
 ROW_TABLE="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" 2>/dev/null)"
 if printf '%s' "$ROW_TABLE" | grep -qi 'upushet'; then rc=1; else rc=0; fi
 check "row: upushet does not leak into the table" "$rc"
 # Structural, in the shape this file already uses for "no write path exists":
 # --row must not run its own repo discovery. A second scan is the defect the
 # rendering rule exists to prevent, and a behavioural test cannot see it.
 grep -q -- '--row' "$BOARD"; check "row: board.sh actually carries the --row flag" $?
 /bin/rm -rf "$ROW_ROOT" "$ROW_COORD" 2>/dev/null
 echo ""
 echo "board-selftest: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ] || exit 1
--- a/scripts/board.sh
+++ b/scripts/board.sh
@ -80,8 +80,9 @@
 # the exact command to start a session there. The 38-char cut is the table
 # column's property, not the record's, so the briefing prints NESTE uncut. Each
 # command is derived by CALLING route.sh with that repo's own four traits -
-# next-cost alone cannot yield it, since the advisor flag is a property of the
+# next-cost alone cannot yield it, since it names the row rather than spelling
-# ROW. A repo with no route line is told so rather than handed a guess.
+# the command, and there must be exactly one spelling in circulation. A repo
 # with no route line is told so rather than handed a guess.
 #
 # --brief is still read-only: it writes nothing. The file write lives in
 # brief-nightly.sh, which renders to a temp file and renames it into place, and
@ -200,14 +201,24 @@
 #            --path P --verification V --reversibility R --scope S
 #            --rationale "why"
 #
-# Model, effort and --advisor come from route.sh's row table, never from a
+# Model and effort come from route.sh's row table, never from a --model/--effort
-# --model/--effort pair: the advisor flag is a property of the ROW, and a
+# pair: the rubric has exactly one copy, and a dispatch that took the model
-# dispatch that took the model directly would have no honest source for it.
+# directly would be a second, unscored way to reach the same decision.
 # --target-pane is a MEASUREMENT (morning --probe-panes) and has no default -
 # see the dispatch() comment for what happens when it is guessed.
 #
 # --row <repo> is a SEVENTH rendering: the table's row for ONE repo, as
 # `field=value` lines a program can grep instead of columns a human counts
 # spaces in. It exists because the columns WERE misread - FLY read as ORDRE on
 # 2026-09-11 - and because every other rendering a program consumes is already
 # key=value. It takes no position: every field is a value the scan already
 # holds, under the name its column carries, with `neste` last and uncut.
 # One exception, stated rather than blended in: `upushet` is not a column, and
 # is measured once for the named repo only. See row_one() for what it can and
 # cannot claim.
 #
 # Usage: board.sh [--roots <dir>[,<dir>...]] [--plain]
-#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage ...]
+#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage|--row <repo>]
 #                 [--focus "<prose>"]
 # Env:   CLAUDE_COORD_DIR overrides the mailbox root.
 #        BOARD_ROOTS      overrides the default scan roots.
@ -224,6 +235,7 @@ INBOX_PLAN=0
 FOCUS=""
 DISPATCH=0
 VOYAGE=0
 ROW=0; ROW_REPO=""
 D_REPO=""; D_PROMPT=""; D_PANE=""; D_ORDER=""
 D_PATH=""; D_VER=""; D_REV=""; D_SCOPE=""; D_RAT=""
@ -238,10 +250,16 @@ while [ $# -gt 0 ]; do
    # bash 3.2: `shift 2` past the end of $# is a no-op -> would loop forever.
    --roots) [ $# -ge 2 ] || { echo "board: --roots requires a value" >&2; exit 2; }
             ROOTS="$2"; shift 2 ;;
-    # Four renderings of one scan, so exactly one may be selected: last wins.
+    # Renderings of one scan, so exactly one may be selected: last wins.
-    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; shift ;;
+    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; ROW=0; shift ;;
    # One repo, one field=value line per column. Same `shift 2` guard as every
    # other value flag, for the same bash 3.2 reason - and a MISSING value is a
    # usage error rather than an empty row, since an empty row reads exactly
    # like a repo whose every column is blank.
    --row) [ $# -ge 2 ] || { echo "board: --row requires a repo name" >&2; exit 2; }
           ROW=1; ROW_REPO="$2"; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; DISPATCH=0; shift 2 ;;
    # Raw operator prose, forwarded verbatim by the driver: it does not
    # tokenize, match or normalize, so every bit of that work is here. Same
    # `shift 2` guard as --roots, for the same bash 3.2 reason.
@ -249,8 +267,8 @@ while [ $# -gt 0 ]; do
             FOCUS="$2"; shift 2 ;;
    # Dispatch rendering: one repo, one prompt file, one startup command. Same
    # `shift 2` guard as every other value flag, for the same bash 3.2 reason.
-    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; shift ;;
+    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; ROW=0; shift ;;
    --repo) [ $# -ge 2 ] || { echo "board: --repo requires a value" >&2; exit 2; }
            D_REPO="$2"; shift 2 ;;
    --prompt-file) [ $# -ge 2 ] || { echo "board: --prompt-file requires a value" >&2; exit 2; }
@ -284,13 +302,67 @@ trunc() { printf '%s' "$1" | LC_ALL=en_US.UTF-8 cut -c1-"$2"; }
 # --- Discovery: git repos at depth 1, plus depth 2 under polyrepo dirs ------
 # A directory that is itself a git repo is one repo; a directory that is not
 # but contains git repos is a polyrepo container (the plugin marketplace) and
-# contributes its children, never itself.
+# contributes its children, never itself. A repo nested under a depth-1 REPO is
 # a third case, admitted on criterion (a) only - see add_nested_repos() below.
 #
 # "Is a repo" tests .git with -e, not -d: a worktree or submodule has .git as a
 # FILE. A plain `git worktree add <root>/feature-x` lands a depth-1 sibling that
 # can CARRY its own STATE.md - a -d test drops it silently. Kept identical in
 # the rollup builder (catalog) on purpose: two readers, one name.
 REPOS=""
 # Dirs admitted by add_nested_repos(), recorded rather than re-derived. The
 # record loop needs to know which entries are nested so it can build the
 # <parent>/<child> key, and the obvious re-derivation ("is my parent dir a git
 # repo?") answers a slightly different question: it would also fire for every
 # depth-1 repo if a SCAN ROOT ever happened to be a git checkout. Discovery
 # already knows the answer exactly; storing it cannot drift from the criterion.
 NESTED_LIST=""
 # --- Denominator counters (order 20260903T190201Z-238406410, .claude) -------
 # A repo COUNT alone answers "how many were found" and is silent about how many
 # directories were looked at, so an admission criterion that excludes 11 of 12
 # nested repos is invisible at the very surface meant to show it - ansikt 4
 # turned on the board's own reading. These four are printed as one line under
 # the table (see UNDERSOEKT below) and are independent of the nested-repo
 # admission itself: the line goes in whether or not anything is admitted.
 N_DEPTH1=0      # directories examined at depth 1, dot-entries included
 N_CONTAINER=0   # of those, entered as polyrepo containers (not themselves repos)
 N_NESTED=0      # git repos found one level under a depth-1 repo
 N_NESTED_IN=0   # of those, admitted because they carry a STATE.md
 # Admission criterion (a), operator decision 2026-09-03: a git repo nested
 # under a directory that is ITSELF a git repo enters the board only when it
 # carries a STATE.md. Measured on the real tree that day: 12 nested repos,
 # exactly 1 with a STATE.md (from-ai-to-chitta/content-sadhguru). The other 11
 # are vendored or experimental checkouts with no declared next step, and they
 # stay invisible ON PURPOSE - they do not even reach the UTEN STATE.md bucket,
 # which is for repos the operator opens.
 #
 # A dedicated function beside add_dot_repos(), never a widening of the `*`
 # loops below, for the identical reason ordre 20260818T124828Z gave for dot
 # repos: routing a depth-1 REPO into the else-branch container scan would admit
 # every nested checkout, which is exactly what criterion (a) declines. One
 # level only - a repo nested inside a nested repo is a checkout of a checkout,
 # and widening past what was ordered is the unmeasured scope creep that order
 # flagged.
 #
 # Bounded gap, stated rather than closed: a DOT-prefixed nested repo is not
 # looked for (the `*` glob here has no dotglob, same as everywhere else in this
 # file). The combination was not measured and not ordered; add_dot_repos exists
 # for the depth-1 and container cases because those were.
 add_nested_repos() {
  for nested in "$1"/*; do
    [ -d "$nested" ] || continue
    [ -e "$nested/.git" ] || continue
    N_NESTED=$((N_NESTED + 1))
    [ -f "$nested/STATE.md" ] || continue
    N_NESTED_IN=$((N_NESTED_IN + 1))
    REPOS="$REPOS
 $nested"
    NESTED_LIST="$NESTED_LIST
 $nested"
  done
 }
 # Picks up dot-prefixed git repos directly under $1 - the Forgejo/GitHub
 # `.profile` org-profile convention, measured invisible to the loops below
@ -304,16 +376,29 @@ REPOS=""
 # a bare `*` needs dotglob to see them), so no shopt toggle is needed here.
 # Only a dot-entry that IS itself a repo is ever added; one that is not is
 # silently skipped, never recursed into as a container.
 #
 # $2 = "d1" when this is the depth-1 scan of a root. A dot-prefixed depth-1
 # repo IS a depth-1 repo, so it gets the same nested scan an ordinary one gets
 # - the asymmetry would otherwise be arbitrary, and nothing in the admission
 # criterion distinguishes them. Under a polyrepo container the flag is absent:
 # those entries are already at depth 2, and their children would be depth 3.
 add_dot_repos() {
  for dotentry in "$1"/.*; do
    dotbase="$(basename "$dotentry")"
    [ "$dotbase" = "." ] && continue
    [ "$dotbase" = ".." ] && continue
    [ -d "$dotentry" ] || continue
    # Counted as a depth-1 directory that was LOOKED AT even when it is not a
    # repo: the denominator reports what was examined, not what was admitted.
    # It is deliberately never counted as a polyrepo container - a dot-dir that
    # is not a repo is skipped outright, which is ordre 20260818's decision.
    [ "${2:-}" = "d1" ] && N_DEPTH1=$((N_DEPTH1 + 1))
    [ -e "$dotentry/.git" ] || continue
    REPOS="$REPOS
 $dotentry"
    [ "${2:-}" = "d1" ] && add_nested_repos "$dotentry"
  done
  return 0
 }
 # Split on comma via IFS + `set --` rather than an unquoted $(...) expansion:
@ -336,13 +421,20 @@ for root in "$@"; do
    continue
  fi
  ROOTS_OK=$((ROOTS_OK + 1))
-  add_dot_repos "$root"
+  add_dot_repos "$root" d1
  for entry in "$root"/*; do
    [ -d "$entry" ] || continue
    N_DEPTH1=$((N_DEPTH1 + 1))
    if [ -e "$entry/.git" ]; then
      REPOS="$REPOS
 $entry"
      # A depth-1 repo used to end the walk here: the else-branch below is the
      # only place children are ever looked at, and it is unreachable for an
      # entry that is itself a repo. That is what made every nested repo
      # invisible.
      add_nested_repos "$entry"
    else
      N_CONTAINER=$((N_CONTAINER + 1))
      for child in "$entry"/*; do
        [ -e "$child/.git" ] || continue
        REPOS="$REPOS
@ -406,6 +498,49 @@ oldest_order_age() {
 }
 # The PENDING age is read from the FILENAME's timestamp, never the mtime.
 # ORDRE 20260903T185736Z-1290610855: `coord-order-done --return` rewrites the
 # order file's mtime, and this column read mtime, so an order returned three
 # times could never look old - on the one surface that exists precisely so a
 # repo nobody opens still shows something. Measured on the live queue the day
 # the order was written: a file whose name said 2026-09-02 rendered `1:0d`.
 #
 # The filename is written once, at delivery, and nothing rewrites it, which is
 # exactly the fact "how long has this sat with no owner" is asking about.
 #
 # FLY keeps oldest_order_age above, and that is not an oversight: a claimed
 # order's age is "how long has it been in flight", which is when the CLAIM
 # happened - the mtime - and switching it to the filename would answer the
 # delivery question in a column that asks the flight question.
 #
 # Same three outcomes as oldest_order_age, for the same reasons: "-" empty,
 # "?" unmeasured (a name the grammar does not produce has no readable delivery
 # time, and an unmeasured file could be the oldest one), "Nd" measured.
 oldest_pending_age() {
  opa_oldest=""; opa_seen=0; opa_unmeasured=0
  for opa_f in "$1"/*.md; do
    [ -f "$opa_f" ] || continue
    opa_seen=1
    opa_ts="$(basename "$opa_f")"; opa_ts="${opa_ts%%-*}"
    case "$opa_ts" in
      [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z)
        opa_n="$(printf '%s' "$opa_ts" | tr -dc '0-9')"
        opa_e="$(date -u -j -f %Y%m%d%H%M%S "$opa_n" +%s 2>/dev/null)"
        case "$opa_e" in
          ''|*[!0-9]*) opa_unmeasured=1 ;;
          *) if [ -z "$opa_oldest" ] || [ "$opa_e" -lt "$opa_oldest" ]; then
               opa_oldest="$opa_e"
             fi ;;
        esac ;;
      *) opa_unmeasured=1 ;;
    esac
  done
  if [ "$opa_seen" -eq 0 ]; then printf -- '-'; return 0; fi
  if [ "$opa_unmeasured" -eq 1 ] || [ -z "$opa_oldest" ]; then printf '?'; return 0; fi
  printf '%dd' $(( (NOW - opa_oldest) / 86400 ))
 }
 # --- Voyage project detection (ORDRE 20260831T135934Z-696228720) ------------
 # board read STATE lines and knew nothing about Voyage briefs, so a programme
 # running Voyage across several repos had no shared surface: nobody could
@ -570,7 +705,24 @@ VOYAGE_CELL_EOF
 printf '%s\n' "$REPOS" | while IFS= read -r d; do
  [ -n "$d" ] || continue
-  name="$(basename "$d")"
+  # Two names, deliberately: the KEY the board shows and the MAILBOX the coord
  # columns read. For every repo but a nested one they are the same string.
  #
  # A nested repo is keyed <parent>/<child> (operator decision 2026-09-03): the
  # bare basename would render a row that says nothing about where the checkout
  # lives, and two repos of the same name - one depth-1, one nested - would
  # collide into indistinguishable rows.
  #
  # The mailbox name is NOT that key. A mailbox is addressed by
  # basename(git toplevel), which is coord-send.sh's own rule and the only name
  # a session in that repo can hold; reading $COORD/<parent>/<child>/inbox would
  # find no directory and print INN 0 - a failed measurement wearing the
  # reassuring value, which is the one thing this file refuses everywhere.
  mbox="$(basename "$d")"
  name="$mbox"
  if printf '%s\n' "$NESTED_LIST" | grep -qxF "$d"; then
    name="$(basename "$(dirname "$d")")/$mbox"
  fi
  state="$d/STATE.md"
  # F6: `git status | wc -l` yields 0 lines whether the tree is CLEAN or git
@ -597,8 +749,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  fi
  inbox=0
-  if [ -d "$COORD/$name/inbox" ]; then
+  if [ -d "$COORD/$mbox/inbox" ]; then
-    inbox="$(ls "$COORD/$name/inbox"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    inbox="$(ls "$COORD/$mbox/inbox"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$inbox" ] || inbox=0
  fi
@ -614,8 +766,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # as mail to such a name is invisible in INN. coord-count.sh is the cross-
  # check for the mail half; there is deliberately no join built for orders.
  orders=0
-  if [ -d "$COORD/$name/orders" ]; then
+  if [ -d "$COORD/$mbox/orders" ]; then
-    orders="$(ls "$COORD/$name/orders"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    orders="$(ls "$COORD/$mbox/orders"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$orders" ] || orders=0
  fi
@ -638,8 +790,8 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # read as "a session is running here" would be the process axis smuggled in
  # as a file count.
  claimed=0
-  if [ -d "$COORD/$name/orders/claimed" ]; then
+  if [ -d "$COORD/$mbox/orders/claimed" ]; then
-    claimed="$(ls "$COORD/$name/orders/claimed"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+    claimed="$(ls "$COORD/$mbox/orders/claimed"/*.md 2>/dev/null | wc -l | tr -d ' ')"
    [ -n "$claimed" ] || claimed=0
  fi
@ -653,9 +805,9 @@ printf '%s\n' "$REPOS" | while IFS= read -r d; do
  # measured 2026-08-23), so a claim without an age is that non-claim with its
  # only counter-evidence removed.
  ordersage="-"
-  [ "$orders" -eq 0 ] || ordersage="$(oldest_order_age "$COORD/$name/orders")"
+  [ "$orders" -eq 0 ] || ordersage="$(oldest_pending_age "$COORD/$mbox/orders")"
  claimedage="-"
-  [ "$claimed" -eq 0 ] || claimedage="$(oldest_order_age "$COORD/$name/orders/claimed")"
+  [ "$claimed" -eq 0 ] || claimedage="$(oldest_order_age "$COORD/$mbox/orders/claimed")"
  # Read for EVERY repo, not just the STATE-less ones: a repo whose plan file
  # is fresh can still have been silent for a year, and that is precisely the
@ -945,9 +1097,9 @@ rows() {
 # --- Briefing rendering (--brief) ------------------------------------------
 # The startup command for one repo, derived from that repo's OWN route line by
-# calling route.sh. Deriving it from next-cost instead would not work even in
+# calling route.sh. Deriving it from next-cost instead would mean a second
-# principle: the advisor flag is a property of the ROW, and two rows can share
+# writer for the same command string, spelled from a rubric NAME rather than
-# a model/effort pair while differing on it. A repo with no route line gets its
+# from the row table itself. A repo with no route line gets its
 # next-cost printed and is told where the command comes from - a guessed
 # command would read as authoritative while being a guess, which is worse than
 # no command at all.
@ -1169,13 +1321,18 @@ fi
 # brief-nightly.sh already owns the briefing's write.
 #
 # THE COST COMES FROM route.sh's ROW TABLE, never from a --model/--effort pair
-# handed in. That is not tidiness: `--advisor opus` is a property of the ROW,
+# handed in. That is not tidiness: the rubric is a policy with exactly one copy,
-# two rows share a model/effort pair while differing on it, and the CLI accepts
+# and a dispatch accepting the model directly would be a second way to reach the
-# a wrong advisor silently (it drops it for a Fable main model without failing).
+# same decision - one that records no traits, no rationale and no next-cost, so
-# A dispatch that took the model directly would have no source for that flag,
+# nothing afterwards can say whether the ROUTING was wrong or the SCORING was.
-# and both available guesses are wrong in the same direction - a session that
+# Scoring the four traits is the caller's judgement; turning them into a command
-# looks peer-reviewed without being. Scoring the four traits is the caller's
+# is this lookup.
-# judgement; turning them into a command is this lookup.
+#
 # Until 2026-09-12 this paragraph rested on `--advisor opus` instead: the flag
 # was a property of the ROW, so a model/effort pair could not yield it. That
 # rule is struck (see route.sh), and the argument is rewritten rather than
 # quietly left standing on a premise the code no longer has - a comment
 # defending a mechanism that was removed is how the next session "restores" it.
 dispatch() {
  # --target-pane is REQUIRED and has no default, the same rule route.sh's
  # --last-effort carries: it is a MEASUREMENT of the world (does the target
@ -1253,8 +1410,8 @@ dispatch() {
  [ -d "$d_dir" ] || { echo "board: the directory for $D_REPO does not exist: $d_dir" >&2; exit 2; }
  # Rejected traits REFUSE. Degrading to a command without them is the worst
-  # available outcome: a command missing --advisor is indistinguishable from a
+  # available outcome: a command built on three scored traits and one silently
-  # row that legitimately has none.
+  # dropped one is indistinguishable from a fully scored decision.
  d_route="$(bash "$ROUTE" --path "$D_PATH" --verification "$D_VER" \
             --reversibility "$D_REV" --scope "$D_SCOPE" --rationale "$D_RAT" 2>&1)" || {
    echo "board: route.sh rejected the traits, so there is no command to give:" >&2
@ -1901,7 +2058,11 @@ voyage() {
    # Order coupling: the repo's PENDING orders (claimed ones are in flight and
    # are not what a reader is looking for when a brief has stopped moving).
    vy_ord=0; vy_ids=""
-    for vy_of in "$COORD/$vy_name/orders"/*.md; do
+    # basename($vy_dir), never $vy_name: a nested repo's board key is
    # <parent>/<child> while its mailbox is addressed by the bare basename
    # (see the record loop's own note). Reading the compound key here would
    # find no directory and report ordre=0 for a repo that has orders.
    for vy_of in "$COORD/$(basename "$vy_dir")/orders"/*.md; do
      [ -f "$vy_of" ] || continue
      vy_ord=$((vy_ord+1))
      vy_ids="$vy_ids$(basename "$vy_of" .md)
@ -1959,6 +2120,114 @@ if [ "$VOYAGE" -eq 1 ]; then
  exit 0
 fi
 # --- Row rendering (--row <repo>) -------------------------------------------
 # A SEVENTH rendering of the same scan, never a second scan, and read-only like
 # every other one. (Order 20260912T202210Z-7588027378 calls it the sixth; by
 # this file's own numbering --inbox-plan is the fourth and --dispatch the fifth,
 # so it is the seventh. The count is corrected here rather than carried wrong,
 # for the same reason every other number in this file is measured.)
 #
 # WHAT IT ANSWERS: the table's row for ONE repo, as `field=value` lines a
 # program can grep. The table is fixed-width and is for a human; reading a
 # column off it by eye is how FLY was misread as ORDRE on 2026-09-11, and a
 # 34-character repo key already shifts a row two characters right - a stated,
 # unclosed gap that makes counting spaces strictly worse than it looks. Every
 # other rendering a program consumes (--plan, --inbox-plan, --dispatch) is
 # key=value for exactly this reason; the default view was the one left out.
 #
 # It takes NO position and adds NO judgement: every field is a value $RECORDS
 # already holds, printed under the name its column carries. The three mailbox
 # counts are three separate fields because they are three separate facts - INN
 # is "others wait on you", ORDRE is "work waits on this repo", FLY is "someone
 # took an order" - and this rendering exists because they were confused.
 #
 # ONE FIELD IS NOT A RENDERING, and it is named rather than blended in:
 # `upushet` is not a column the scan computes. It is measured here, once, for
 # the named repo only, because the order asks for it and because "nothing is
 # waiting to be pushed" and "nobody looked" are exactly the pair this repo
 # refuses to render alike. One reading for one repo in a one-repo view is not a
 # scan; it never enters the table, the plan or the briefing.
 #
 # It reads the remote-TRACKING ref, not the remote. That is a real bound, not a
 # hedge: a stale ref under-reports after someone else pushed, and over-reports
 # after a push this checkout has not fetched. The honest reading of `upushet=N`
 # is "the local ref says N", and `git ls-remote` is still what a claim ABOUT
 # THE WORLD costs.
 row_unpushed() {
  ru_up="$(git -C "$1" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)" || return 1
  [ -n "$ru_up" ] || return 1
  ru_n="$(git -C "$1" rev-list --count "$ru_up..HEAD" 2>/dev/null)" || return 1
  case "$ru_n" in ''|*[!0-9]*) return 1 ;; esac
  printf '%s' "$ru_n"
 }
 row_one() {
  r_rec="$(awk -F'|' -v n="$ROW_REPO" '$3==n {print; exit}' "$RECORDS")"
  # REFUSE rather than emit an empty block. A consumer reading ^status= off an
  # empty output gets nothing back and reads it as a repo with no board line -
  # which is a real, different state this very rendering spells as `?`.
  if [ -z "$r_rec" ]; then
    echo "board: no repo named '$ROW_REPO' in the scanned roots" >&2
    return 2
  fi
  r_disp="$(printf '%s' "$r_rec" | cut -d'|' -f4)"
  r_cost="$(printf '%s' "$r_rec" | cut -d'|' -f5)"
  r_inn="$(printf '%s' "$r_rec" | cut -d'|' -f6)"
  r_drt="$(printf '%s' "$r_rec" | cut -d'|' -f7)"
  r_alder="$(printf '%s' "$r_rec" | cut -d'|' -f8)"
  r_siste="$(printf '%s' "$r_rec" | cut -d'|' -f9)"
  r_dir="$(printf '%s' "$r_rec" | cut -d'|' -f10)"
  r_blocked="$(printf '%s' "$r_rec" | cut -d'|' -f11)"
  r_ordre="$(printf '%s' "$r_rec" | cut -d'|' -f12)"
  r_ordreage="$(printf '%s' "$r_rec" | cut -d'|' -f13)"
  r_fly="$(printf '%s' "$r_rec" | cut -d'|' -f14)"
  r_flyage="$(printf '%s' "$r_rec" | cut -d'|' -f15)"
  r_voy="$(printf '%s' "$r_rec" | cut -d'|' -f16)"
  # `neste` is free prose and may contain a literal '|', which is why it is the
  # last field of the record - so it is taken as "everything from 17 on", never
  # as field 17.
  r_neste="$(printf '%s' "$r_rec" | cut -d'|' -f17-)"
  # The TOKEN, not the display string: the table renders a blocked repo as
  # `blocked>target` because one column has to carry both, and this rendering
  # has two fields and no such constraint. A consumer matching status=blocked
  # must not have to know about the arrow.
  case "$r_disp" in
    blocked\>*) r_status=blocked ;;
    *)          r_status="$r_disp" ;;
  esac
  r_unpushed="$(row_unpushed "$r_dir")" || r_unpushed="?"
  echo "repo=$ROW_REPO"
  echo "dir=$r_dir"
  echo "status=$r_status"
  echo "blocked-on=$r_blocked"
  echo "next-cost=$r_cost"
  echo "inn=$r_inn"
  echo "ordre=$r_ordre"
  echo "ordre-alder=$r_ordreage"
  echo "fly=$r_fly"
  echo "fly-alder=$r_flyage"
  echo "voy=$r_voy"
  echo "drt=$r_drt"
  echo "alder=$r_alder"
  echo "siste=$r_siste"
  echo "upushet=$r_unpushed"
  # LAST, and for the same reason it is last in the record: it is free prose
  # lifted out of a STATE.md, so anything placed after it would be unreachable
  # for a consumer reading from the end. Printed WHOLE - the 38-character cut
  # belongs to the table column, and cutting here would make the cut string the
  # only copy, which is the defect --brief was built to stop.
  echo "neste=$r_neste"
  return 0
 }
 if [ "$ROW" -eq 1 ]; then
  row_one
  exit $?
 fi
 count() { awk -F'|' -v b="$1" '$1==b' "$RECORDS" | wc -l | tr -d ' '; }
 echo "BOARD - tverr-repo oppmerksomhetstavle ($(awk 'END{print NR}' "$RECORDS") repo)"
@ -2007,6 +2276,13 @@ n_nofield="$(awk -F'|' '$4=="?"' "$RECORDS" | wc -l | tr -d ' ')"
 n_unmeas="$(awk -F'|' '$7=="?"' "$RECORDS" | wc -l | tr -d ' ')"
 printf '\nSUM: %s uhaandterte innboks-meldinger, %s ukommiterte filer.\n' "$tot_in" "$tot_dirty"
 # The scan's own denominator (order 20260903T190201Z-238406410, .claude). The
 # repo count in the header answers "how many were found"; this answers "how
 # many were looked at", which is the only way an admission criterion that
 # excludes most nested repos is visible at all. Verifiseringsloven ansikt 4:
 # a measurement without its nevner is read as a fact about the world.
 printf 'undersoekt: %s katalog(er) depth 1, %s polyrepo-container(e), %s nestede repo (%s med STATE.md tatt med).\n' \
  "$N_DEPTH1" "$N_CONTAINER" "$N_NESTED" "$N_NESTED_IN"
 [ "${n_mal:-0}" -gt 0 ] && printf 'ADVARSEL: %s repo har MALFORMED status-token (utenfor det lukkede settet).\n' "$n_mal"
 [ "${n_nofield:-0}" -gt 0 ] && printf 'MERK: %s repo mangler board-linje - status/kost er ukjent (?), NESTE-utdrag brukes.\n' "$n_nofield"
 [ "${n_unmeas:-0}" -gt 0 ] && printf 'MERK: %s repo har umaalbart arbeidstre - git svarte ikke, DRT er ? og IKKE med i summen over.\n' "$n_unmeas"
--- a/scripts/coord-order-inbox.sh
+++ b/scripts/coord-order-inbox.sh
@ -73,6 +73,31 @@ age_of() {
  if [ -n "$ao_m" ]; then echo $(( (NOW - ao_m) / 86400 )); else echo "?"; fi
 }
 # Delivery age in whole days, read from the FILENAME's timestamp and never from
 # the mtime. ORDRE 20260903T185736Z-1290610855: `--return` rewrites the order
 # file's mtime, so an order returned three times reported as brand new - the
 # reading that exists to say "this has sat here a long time" was reset by the
 # act of putting it back. The filename is written once, at delivery, and nothing
 # rewrites it, which is exactly the fact a PENDING age is asking about.
 #
 # This is NOT the claimed case. A claim's age is "how long has it been in
 # flight", which is the claim marker's mtime - a different question with a
 # different right answer, so age_of stays and stays used there.
 #
 # A name the grammar does not produce has no readable delivery time and yields
 # "?" - the same fail-safe age_of already used for an unreadable mtime, never a
 # fabricated 0, which would make an unmeasured order look new.
 pending_age_of() {
  pao_ts="$(basename "$1")"; pao_ts="${pao_ts%%-*}"
  case "$pao_ts" in
    [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]Z) ;;
    *) echo "?"; return 0 ;;
  esac
  pao_n="$(printf '%s' "$pao_ts" | tr -dc '0-9')"
  pao_e="$(date -u -j -f %Y%m%d%H%M%S "$pao_n" +%s 2>/dev/null)"
  if [ -n "$pao_e" ]; then echo $(( (NOW - pao_e) / 86400 )); else echo "?"; fi
 }
 field_of() {
  # Bounded to the frontmatter block: a body line must never be able to forge a
  # header field the reader is told to trust.
@ -92,7 +117,7 @@ for f in "$ORDERS"/*.md; do
  # next session the same dead premise with no warning that it is dead.
  ret="$(grep -m1 '^<!-- order-returned:' "$f" 2>/dev/null | sed -e 's/^<!-- order-returned:[[:space:]]*//' -e 's/[[:space:]]*-->$//')"
  OUT="${OUT}
--- order: ${id} (from ${from}, pending, $(age_of "$f")d old) ---
+--- order: ${id} (from ${from}, pending, $(pending_age_of "$f")d old) ---
 subject: ${subj}"
  [ -n "$ret" ] && OUT="${OUT}
 returned earlier: ${ret}"
--- a/scripts/coord-selftest.sh
+++ b/scripts/coord-selftest.sh
@ -1250,6 +1250,144 @@ check "F14: control - a correct call over a real root still exits 0" $?
 /bin/rm -rf "$F5DIR" 2>/dev/null
 # 38. The launchd templates. A wrong program path in a plist is the one defect
 # in this repo that NOTHING catches at runtime: the agent simply never runs, in
 # silence, and `launchctl list` confirms only that it is LOADED, never that it
 # does anything right. There is no output to be wrong, no exit status to read -
 # the failure looks exactly like a quiet machine. So the path is asserted here,
 # statically, against the file it actually names.
 #
 # This section covers EVERY plist in launchd/, not only the sweep agent that
 # 0.33.0 adds, and that is deliberate: the plist grammar has one reader here
 # rather than one per agent. Two half-checks in two suites would drift, which is
 # the two-copies-of-one-policy defect this repo names repeatedly. board-selftest
 # still owns brief-nightly.sh's BEHAVIOUR (section 9); this owns the templates.
 #
 # Deliberately NOT checked here: XML well-formedness. `plutil` is not coreutils,
 # and malformed XML is the one plist defect that already fails LOUDLY - launchctl
 # load rejects it on the spot. This section is for the defect that does not: a
 # path that is merely wrong. Both files were linted by hand at 0.33.0.
 LAUNCHD="$DIR/../launchd"
 REPOROOT="$(cd "$DIR/.." && pwd)"
 # One reader, shared by the real files below AND by the control at the end. A
 # control that runs different code from the case it certifies proves nothing
 # about it. The program path is the <string> carrying the checkout placeholder;
 # the install instructions in the header comment name __CHECKOUT__ too, which is
 # why <string> has to match first.
 plist_program_path() {
  grep '<string>' "$1" 2>/dev/null | grep '__CHECKOUT__' | head -1 \
    | sed -e 's/.*<string>//' -e 's|</string>.*||'
 }
 plist_label() {
  grep -A1 '<key>Label</key>' "$1" 2>/dev/null | grep '<string>' | head -1 \
    | sed -e 's/.*<string>//' -e 's|</string>.*||'
 }
 plist_hour() {
  grep -A1 '<key>Hour</key>' "$1" 2>/dev/null | grep '<integer>' | head -1 \
    | sed -e 's/.*<integer>//' -e 's|</integer>.*||'
 }
 plist_n=0
 for p in "$LAUNCHD"/*.plist; do
  [ -e "$p" ] || continue
  plist_n=$((plist_n + 1))
  pb="$(basename "$p")"
  # launchctl addresses an agent by Label, the operator by filename. When they
  # disagree, load/start/unload silently act on a different agent than the one
  # being edited.
  lbl="$(plist_label "$p")"
  [ -n "$lbl" ] && [ "$lbl" = "${pb%.plist}" ]
  check "launchd $pb: Label matches the filename" $?
  # The check this section exists for.
  prog="$(plist_program_path "$p")"
  [ -n "$prog" ] && [ -s "$REPOROOT/${prog#__CHECKOUT__/}" ]
  check "launchd $pb: ProgramArguments names a script that exists here" $?
  # The repo is mirrored publicly and a plist is the one file that would
  # otherwise carry an absolute home path. It stays a TEMPLATE.
  grep -q '__HOME__' "$p"
  check "launchd $pb: log paths stay a __HOME__ placeholder (public mirror)" $?
  # The cache path is version-pinned, so an agent pointing there breaks silently
  # on the next bump - and a second copy of these scripts on disk is the exact
  # defect class that produced the 0.12.1 stale-fallback bug. Asserted on the
  # EXTRACTED PATH, never on the whole file: the brief plist's header explains in
  # prose why it does not point at the cache, and a file-wide grep read that
  # explanation as the defect it warns about. Same shape as the board line, where
  # prose saying status=done must never trigger the done-guard.
  case "$prog" in *plugins/cache*) false ;; *) true ;; esac
  check "launchd $pb: the program path is not the version-pinned plugin cache" $?
 done
 [ "$plist_n" -ge 2 ]
 check "launchd: both agent templates are present (brief + sweep)" $?
 # The grace window is the OPERATOR's policy constant (14 days, decided
 # 2026-09-03), not the script's default wearing a schedule. An agent quietly
 # running a different window would close a different population every night with
 # nothing reporting the change.
 SWEEPPL="$LAUNCHD/com.ktg.repo-mailbox-sweep.plist"
 grep -q '<string>--write</string>' "$SWEEPPL" 2>/dev/null \
  && grep -q '<string>--days</string>' "$SWEEPPL" 2>/dev/null \
  && grep -q '<string>14</string>' "$SWEEPPL" 2>/dev/null
 check "launchd sweep: the agent runs --write --days 14, the authorized window" $?
 # The briefing READS the mailbox the sweep MUTATES, so the two must not fire in
 # the same minute: a briefing rendered mid-sweep counts messages that are being
 # closed underneath it.
 hb="$(plist_hour "$LAUNCHD/com.ktg.repo-mailbox-brief.plist")"
 hs="$(plist_hour "$SWEEPPL")"
 [ -n "$hb" ] && [ -n "$hs" ] && [ "$hb" != "$hs" ]
 check "launchd: the two agents run at different hours (the brief reads what the sweep mutates)" $?
 # Mandatory controls. A path check with no negative case is a check that cannot
 # go red, which this repo has shipped once already (section 11's vacuous first
 # cut) and will not ship again.
 BADPL="$CLAUDE_COORD_DIR/bad.plist"
 {
  echo '<plist version="1.0"><dict>'
  echo '<key>Label</key>'
  echo '<string>com.ktg.repo-mailbox-bad</string>'
  echo '<key>ProgramArguments</key>'
  echo '<array>'
  echo '<string>/bin/bash</string>'
  echo '<string>__CHECKOUT__/scripts/no-such-script.sh</string>'
  echo '</array>'
  echo '</dict></plist>'
 } > "$BADPL"
 [ "$(plist_program_path "$BADPL")" = "__CHECKOUT__/scripts/no-such-script.sh" ]
 check "launchd control: the extraction really does read a program path" $?
 badprog="$(plist_program_path "$BADPL")"
 [ -s "$REPOROOT/${badprog#__CHECKOUT__/}" ]; [ $? -ne 0 ]
 check "launchd control: a plist naming a missing script is judged missing" $?
 [ "$(plist_label "$BADPL")" = "bad" ]; [ $? -ne 0 ]
 check "launchd control: a Label disagreeing with the filename is caught" $?
 # The cache check needs its own control, because narrowing it from the whole file
 # to the extracted path is exactly the kind of narrowing that can quietly stop
 # catching anything.
 CACHEPL="$CLAUDE_COORD_DIR/cache.plist"
 {
  echo '<plist version="1.0"><dict>'
  echo '<key>ProgramArguments</key>'
  echo '<array>'
  echo '<string>/bin/bash</string>'
  echo '<string>__CHECKOUT__/.claude/plugins/cache/repo-mailbox/0.33.0/scripts/coord-sweep.sh</string>'
  echo '</array>'
  echo '</dict></plist>'
 } > "$CACHEPL"
 cprog="$(plist_program_path "$CACHEPL")"
 case "$cprog" in *plugins/cache*) true ;; *) false ;; esac
 check "launchd control: a program path INSIDE the plugin cache is caught" $?
 /bin/rm -f "$BADPL" "$CACHEPL" 2>/dev/null
 echo "----"
 echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]
--- a/scripts/orders-selftest.sh
+++ b/scripts/orders-selftest.sh
@ -408,6 +408,69 @@ CLAUDE_COORD_DIR="$O10DIR" "$SEND" --to .profile --from tester --subject s --mes
 check "10d: control - a dot-prefixed target name still receives its order" $?
 /bin/rm -rf "$O10DIR" 2>/dev/null
 # --- 11. Pending age comes from the FILENAME, never the mtime ---------------
 # ORDRE 20260903T185736Z-1290610855: `--return` rewrites the order file's
 # mtime, and both age surfaces read mtime, so an order returned three times can
 # never read as old. Measured on the live queue before the order was written: a
 # file whose name says 2026-09-02 reported "0d old" minutes after a return.
 #
 # PM decision, and it is two questions with two answers: a PENDING order's age
 # is "how long has this sat with no owner" = now - the DELIVERY time, which only
 # the filename carries; a CLAIMED order's age is "how long has it been in
 # flight" = the claim marker's mtime, which is already right and stays.
 O11DIR="$WORK/o11"; mkdir -p "$O11DIR"
 o11_old_ts="$(date -u -v-2d +%Y%m%dT%H%M%SZ 2>/dev/null)"
 CLAUDE_COORD_DIR="$O11DIR" "$SEND" --to o11repo --from dispatcher \
  --subject "aged order" --message "body" >/dev/null 2>&1
 o11_q="$O11DIR/o11repo/orders"
 o11_orig="$(ls -1 "$o11_q"/*.md 2>/dev/null | head -1)"
 o11_id="$(basename "$o11_orig" .md)"
 o11_aged_id="${o11_old_ts}-${o11_id#*-}"
 mv "$o11_orig" "$o11_q/$o11_aged_id.md" 2>/dev/null
 # Ground truth FIRST, so a broken `date -v` fails here instead of turning the
 # whole section into a test of nothing (the F13 section-11 lesson).
 [ -n "$o11_old_ts" ] && [ -f "$o11_q/$o11_aged_id.md" ]
 check "11a: ground truth - the fixture order's filename timestamp is 2 days old" $?
 # Drive the REAL defect: claim it, then return it. The return is what rewrites
 # the mtime, so this is the path that produced the live 0d reading.
 CLAUDE_COORD_DIR="$O11DIR" "$CLAIM" --repo o11repo "$o11_aged_id" >/dev/null 2>&1
 CLAUDE_COORD_DIR="$O11DIR" "$ODONE" --repo o11repo "$o11_aged_id" --return --reason "test" >/dev/null 2>&1
 o11_mtime="$(stat -f %m "$o11_q/$o11_aged_id.md" 2>/dev/null)"
 o11_now="$(date +%s)"
 [ -n "$o11_mtime" ] && [ $(( o11_now - o11_mtime )) -lt 300 ]
 check "11b: ground truth - the return really did rewrite the file's mtime to now" $?
 o11_out="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11repo 2>/dev/null)"
 printf '%s' "$o11_out" | grep -q 'pending, 2d old'
 check "11c: a returned order reports its DELIVERY age (2d), not 0d" $?
 # Known-positive control: the reading must still be able to say 0d, or 11c
 # would pass just as well against a function that always prints 2.
 CLAUDE_COORD_DIR="$O11DIR" "$SEND" --to o11fresh --from dispatcher \
  --subject "fresh order" --message "body" >/dev/null 2>&1
 o11_fresh="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11fresh 2>/dev/null)"
 printf '%s' "$o11_fresh" | grep -q 'pending, 0d old'
 check "11d: control - a freshly delivered order still reports 0d" $?
 # FLY is the OTHER question and must not move: the claim marker's mtime is when
 # the claim happened, and an order with an ancient filename claimed just now has
 # been in flight for 0 days.
 CLAUDE_COORD_DIR="$O11DIR" "$CLAIM" --repo o11repo "$o11_aged_id" >/dev/null 2>&1
 o11_fly="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11repo 2>/dev/null)"
 printf '%s' "$o11_fly" | grep -q 'CLAIMED 0d ago'
 check "11e: FLY age still comes from the claim marker's mtime, not the filename" $?
 # A name the grammar does not produce has no readable delivery time. It must
 # read "?" - the same fail-safe the mtime path already used, never a fabricated
 # 0, which would make an unmeasured order look brand new.
 mkdir -p "$O11DIR/o11bad/orders"
 printf -- '---\nfrom: x\nsubject: s\n---\nbody\n' > "$O11DIR/o11bad/orders/not-a-timestamp.md"
 o11_bad="$(CLAUDE_COORD_DIR="$O11DIR" "$READ" --repo o11bad 2>/dev/null)"
 printf '%s' "$o11_bad" | grep -q 'pending, ?d old'
 check "11f: an unparseable filename timestamp reads ?, never 0" $?
 echo
 echo "orders-selftest: $PASS passed, $FAIL failed, $SKIP skipped (of $((PASS+FAIL+SKIP)) checks)"
 [ "$FAIL" -eq 0 ] || exit 1
--- a/scripts/route-selftest.sh
+++ b/scripts/route-selftest.sh
@ -141,7 +141,8 @@ check "all 81 trait combinations emit one of the 4 calculator rows" $?
 # to show the same string back. Runs for all six rows.
 ROOT="$(mktemp -d)"
 MBOX="$(mktemp -d)"
-cleanup() { /bin/rm -rf "$ROOT" "$MBOX" 2>/dev/null; }
+RL_ROOT=""
 cleanup() { /bin/rm -rf "$ROOT" "$MBOX" ${RL_ROOT:+"$RL_ROOT"} 2>/dev/null; }
 trap cleanup EXIT
 rt_bad=0
@ -359,13 +360,14 @@ check "board + route + route-last stacked still yield prose in NESTE" $?
 # --- 9. Startup command and fallback --------------------------------------
 # Two spellings of ONE decision: the rubric name for the board line, the CLI
 # alias for the command the operator pastes. They must never disagree.
-# These assert the WHOLE string, advisor included, so section 14's rule cannot
+# These assert the WHOLE string, so no flag can be added back to the emitted
-# be widened without a deliberate edit here - the exact-match is the tripwire.
+# command without a deliberate edit here - the exact-match is the tripwire that
 # keeps section 14's absence rule from being widened around.
 cmd="$(field partial strong cheap local command)"
 [ "$cmd" = "claude --model opus --effort high" ]; check "command mirrors the row (opus/high)" $?
 cmd="$(field known strong cheap local command)"
-[ "$cmd" = "claude --model sonnet --effort high --advisor opus" ]; check "command mirrors the row (sonnet/high)" $?
+[ "$cmd" = "claude --model sonnet --effort high" ]; check "command mirrors the row (sonnet/high)" $?
 # The rubric requires ALWAYS naming one row cheaper as the quota fallback.
 fb="$(field partial strong cheap local fallback)"
@ -377,7 +379,7 @@ fb="$(field known strong cheap local fallback)"
 # The fallback needs its own pasteable command or the operator translates by
 # hand at exactly the moment they are under quota pressure.
 fbc="$(field partial strong cheap local fallback-command)"
-[ "$fbc" = "claude --model sonnet --effort xhigh --advisor opus" ]; check "fallback ships its own command" $?
+[ "$fbc" = "claude --model sonnet --effort xhigh" ]; check "fallback ships its own command" $?
 # --- 10. The command carries no 'cd' --------------------------------------
 # One repo per terminal tab: a startup command prefixed with cd is wrong by
@ -393,9 +395,9 @@ check "no emitted command contains a cd prefix" "$rc"
 # Model aliases are whatever the INSTALLED claude accepts - never hardcoded
 # without a gate, because an alias that stops resolving turns every emitted
 # command into a paste that fails.
-# Capture the effort TOKEN only. Anything may legitimately follow it on the
+# Capture the effort TOKEN only. The command ends at the effort today, but the
-# command line (--advisor does, since section 14), and a match that swallowed
+# pattern stays tail-tolerant: a match that swallowed whatever a later flag
-# the tail would report a valid effort as invalid.
+# added would report a valid effort as invalid.
 efforts="$(printf '%s' "$out" | sed -n 's/^command=claude --model [a-z]* --effort \([a-z]*\).*/\1/p')"
 case "|low|medium|high|xhigh|max|" in *"|$efforts|"*) rc=0 ;; *) rc=1 ;; esac
 check "emitted effort is in the verified effort set" "$rc"
@ -467,117 +469,129 @@ check "route.sh no longer claims effort is unobservable from inside" "$rc"
 grep -q 'CLAUDE_EFFORT' "$R"
 check "route.sh names the source the caller should measure from" $?
-# --- 14. The advisor: capability gap first, stakes second -----------------
+# --- 14. The advisor is NOT the rubric's to emit --------------------------
-# The advisor is a second, stronger model consulted mid-task, so a session
+# Struck by operator decision 2026-09-12
-# carrying one costs more than a session without. It must therefore fire where
+# (~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md, cut row 3).
-# there is a NEED and nowhere else, or it decays into the always-on
+# The rule it replaces fired on two needs - Sonnet rows always, Opus rows at
-# advisorModel setting it exists to replace. Two independent needs qualify,
+# costly|one-way stakes - and read well. What killed it was a measurement, not
-# and they turn out to be almost disjoint.
+# a change of taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried
 # --advisor opus, because the operator starts sessions by hand and pastes the
 # model and effort, not the whole line. A rule nothing honours is not a policy,
 # it is a claim about the world that the world disagrees with - and this repo's
 # own standing rule is that an emitted value must be evidence, never decoration.
 #
-# 1. THE MAIN MODEL IS SONNET (rows 1-2). Here opus is a genuine capability
+# So the calculator emits no advisor at all, and the advisor becomes what it
-#    lift, not a peer: opus judgement at sonnet cost. This is the load-bearing
+# already was in practice: an operator decision per session. That is a strictly
-#    half, because every fallback-command is one row cheaper and the cheapest
+# SAFER direction for the one thing the old rule protected - the quota fallback
-#    rows are Sonnet - so this is what makes the QUOTA FALLBACK safe to take.
+# is still one row cheaper, it just no longer implies a capability lift nobody
-#    Pinned below by the row-3-falls-back-to-row-2 case.
+# was taking.
 #
-# 2. A MISTAKE IS EXPENSIVE TO UNDO (reversibility costly|one-way). On an Opus
+# Pinned as an ABSENCE over the whole trait space rather than on four sampled
-#    row the advisor is a peer review rather than a lift, which is worth
+# rows, because the claim is that no path emits it - the same "no write path
-#    paying for when being wrong is not cheap to reverse.
+# exists" argument the channel split uses. An absence check is worthless
-#
+# without a known-positive control, so the sweep's own grep is proven able to
-# The two barely overlap: costly forces row 3 and one-way forces row 4, so a
+# find a planted advisor before it is trusted to report none.
 # Sonnet row ALWAYS has reversibility=cheap and trigger 2 can never reach it.
 # Rule 1 covers the Sonnet rows, rule 2 covers the Opus rows.
 #
 # What is deliberately NOT a trigger: verification=none on its own. The set it
 # would add beyond rule 2 is exactly {verification=none AND
 # reversibility=cheap} - mistakes that are cheap to reverse. It survives on the
 # Sonnet rows only via rule 1, which is about the model, not the trait.
 adv="$(field known strong cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 1 (Sonnet/high) always carries an advisor" $?
+check "row 1 (Sonnet/high) carries no advisor" "$rc"
 adv="$(field known weak cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 2 (Sonnet/xhigh) always carries an advisor" $?
+check "row 2 (Sonnet/xhigh) carries no advisor" "$rc"
 adv="$(field known strong costly local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "reversibility=costly carries an advisor onto an Opus row" $?
+check "reversibility=costly no longer pulls an advisor onto an Opus row" "$rc"
 adv="$(field known strong one-way local command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "reversibility=one-way carries an advisor onto an Opus row" $?
 # The Opus rows reached WITHOUT expensive stakes are the whole no-advisor set.
 adv="$(field partial strong cheap local command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 3 via path=partial at cheap stakes takes NO advisor" "$rc"
+check "reversibility=one-way no longer pulls an advisor onto an Opus row" "$rc"
 adv="$(field known strong cheap multi-file command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 3 via scope=multi-file at cheap stakes takes NO advisor" "$rc"
 adv="$(field known strong cheap cross-cutting command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "row 4 via scope=cross-cutting at cheap stakes takes NO advisor" "$rc"
 # Rows 5-6 (Fable) are unreachable through this calculator now - section 1
 # pins that directly, and section 3's closed vocabulary covers every command
 # this script can ever emit. There is nothing left here for "Fable takes no
 # advisor" to test: that fact still holds (gated against the installed claude
 # by the CLI check below), but row_advisor()'s branch for it can no longer be
 # exercised through the public interface.
 # The fallback is the half the old rule called load-bearing, so it is pinned
 # in its own right: dropping a row under quota pressure must not reintroduce
 # the flag by the back door.
 adv="$(field known strong one-way local fallback-command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "row 4 fallback to row 3 keeps the advisor at one-way stakes" $?
 # THE POINT OF RULE 1, pinned. Row 3 at cheap stakes takes no advisor, but its
 # quota fallback is row 2 - a Sonnet row - which does. Dropping a row under
 # quota pressure must not silently drop the safety net with it.
 adv="$(field partial strong cheap local fallback-command)"
 printf '%s' "$adv" | grep -q -- '--advisor opus'
 check "an Opus row with no advisor still falls back to an advised Sonnet row" $?
 adv="$(field known strong cheap cross-cutting fallback-command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 4 falling back to row 3 at cheap stakes stays unadvised" "$rc"
+check "the row-4 fallback carries no advisor either" "$rc"
-# Closed vocabulary, same reason as the row table: one spelling in circulation.
+adv="$(field partial strong cheap local fallback-command)"
-# fable is not merely weaker here, it is REJECTED as an advisor outright.
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-allout="$("$R" --path known --verification strong --reversibility one-way \
+check "an Opus row falling back to a Sonnet row carries no advisor" "$rc"
          --scope cross-cutting --rationale x 2>/dev/null)"
 bad="$(printf '%s' "$allout" | grep -o -- '--advisor [a-z0-9-]*' | grep -v -- '--advisor opus')"
 [ -z "$bad" ]; check "the only advisor value ever emitted is opus:${bad:- none other}" $?
-if command -v claude >/dev/null 2>&1; then
+# THE SWEEP: every trait combination the calculator accepts, every line of
-  # A real gate that spends NO tokens. Advisor validation runs BEFORE the
+# output. 81 combinations, so a rule surviving on one unsampled corner cannot
-  # empty-prompt check, so `-p ""` reaches the validator and then exits: a
+# hide. Accumulated into one string and grepped once - a per-combination check
-  # valid advisor fails on the missing prompt, an invalid one fails on itself.
+# would add 81 lines to the summary and drown the rest of the suite.
-  # --help cannot gate this - it short-circuits before option validation, so
+sweep=""
-  # even an unknown flag exits 0 and the gate would pass without testing.
+for s_path in known partial undetermined; do
-  # Row 1-2's trigger is "sonnet main + opus advisor" specifically, so the
+  for s_ver in strong weak none; do
-  # main model is pinned rather than left to the ambient default.
+    for s_rev in cheap costly one-way; do
-  ADVOUT="$(claude --model sonnet --advisor opus -p "" 2>&1 | head -3)"
+      for s_sc in local multi-file cross-cutting; do
-  if printf '%s' "$ADVOUT" | grep -q 'unknown option'; then rc=1; else rc=0; fi
+        sweep="$sweep
-  check "installed claude accepts the --advisor flag at all" "$rc"
+$("$R" --path "$s_path" --verification "$s_ver" --reversibility "$s_rev" \
      --scope "$s_sc" --rationale x 2>/dev/null)"
      done
    done
  done
 done
 if printf '%s' "$sweep" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "no advisor in any output over all 81 trait combinations" "$rc"
-  if printf '%s' "$ADVOUT" | grep -q 'cannot advise'; then rc=1; else rc=0; fi
+# Known-positive control: the grep above reports an absence, so it must be
-  check "installed claude accepts opus advising a sonnet main" "$rc"
+# shown able to report a presence. Without this the sweep would pass just as
 # happily against an empty string.
 if printf '%s' "$sweep claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
 check "control: the sweep's grep does find a planted advisor" "$rc"
 # The help text is the rubric's published form, so the rule has to leave there
 # too - a doc line nothing tests is a doc line that drifts, and a struck rule
 # still written down is worse than one never removed: it reads as current.
 # The literal flag string is absent from route.sh ENTIRELY, including the
 # paragraph that records what was struck - that paragraph names "an opus
 # advisor flag" in words on purpose. A blunt grep cannot tell a description
 # from a specification (the same reason the cache assertion in coord-selftest
 # runs on an extracted path rather than the whole file), and keeping the
 # string out is cheaper than teaching the check to read prose. Do not
 # "restore the quote" here.
 HELPOUT="$("$R" --help 2>/dev/null)"
 if printf '%s' "$HELPOUT" | grep -q -- '--advisor opus'; then rc=1; else rc=0; fi
 check "--help no longer documents emitting --advisor opus" "$rc"
 if printf '%s' "$HELPOUT" | grep -q 'THE ADVISOR is emitted'; then rc=1; else rc=0; fi
 check "--help no longer carries the advisor rule block" "$rc"
 # Removing the rule silently would leave a reader guessing whether the advisor
 # is forbidden, forgotten, or someone else's. It is the third, and the help
 # says which.
 printf '%s' "$HELPOUT" | grep -q 'advisor is an operator decision per session'
 check "--help states whose decision the advisor is instead" $?
 grep -q 'advisor is an operator decision per session' "$R"
 check "route.sh itself carries that sentence, not just its help output" $?
 # --- 14b. Old route lines still parse ------------------------------------
 # Backward compatibility, pinned rather than assumed. Measured on the real
 # tree the day the rule was struck: 0 of 48 `<!-- route:` lines anywhere in
 # ~/repos carry an advisor field at all, so nothing in circulation depends on
 # it - but board.sh's route_cmd_for() reads these lines by trait NAME, and a
 # reader that broke on an unknown field would turn a STATE.md written last
 # month into "that repo has no route line", which is the misreading this whole
 # file exists to prevent.
 RL_ROOT="$(mktemp -d)"; mkdir -p "$RL_ROOT/repo-legacy"
 ( cd "$RL_ROOT/repo-legacy" && git init -q . 2>/dev/null ) || true
 {
  printf '# STATE\n\n## NESTE - START HER\n'
  printf '<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->\n'
  printf '<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; advisor=opus; rationale=legacy line written before the rule was struck -->\n'
  printf 'legacy next step\n'
 } > "$RL_ROOT/repo-legacy/STATE.md"
 RL_OUT="$("$BOARD" --roots "$RL_ROOT" --plan 2>/dev/null)"
 printf '%s' "$RL_OUT" | grep -q '^command=claude --model sonnet --effort high$'
 check "a route line carrying a legacy advisor= field still yields a command" $?
 if printf '%s' "$RL_OUT" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
 check "and the command derived from it carries no advisor" "$rc"
  # row_advisor() never emits '--advisor fable' - it depends on the opposite
  # direction: whether opus can advise a FABLE main model. That is the fact
  # rows 5-6's suppression rests on, so that is what must be gated. (Measured
  # at CC 2.1.226: fable is now itself accepted as an advisor for opus/sonnet
  # mains - a capability-ordering change worth flagging to the operator, but
  # not what this check exists to pin.)
  FABOUT="$(claude --model fable --advisor opus -p "" 2>&1 | head -3)"
  printf '%s' "$FABOUT" | grep -q 'cannot advise'
  check "installed claude still rejects opus advising a fable main" $?
 else
  echo "  skip - claude not on PATH, advisor flag gate not run"
 fi
 echo ""
 echo "route-selftest: $PASS passed, $FAIL failed"
--- a/scripts/route.sh
+++ b/scripts/route.sh
@ -29,10 +29,7 @@
 # departure from it is recorded in STATE as an OVERRIDE, never produced here.
 # Write "Fable 5/high" or "Fable 5/xhigh" into the board line by hand when
 # that is the right call; board.sh still parses both (route-selftest.sh
-# section 6 pins that half). The one fact worth carrying: a Fable session
+# section 6 pins that half).
 # runs without an advisor (row_advisor() below, and gated against the
 # installed claude by route-selftest.sh section 14) - informational, never a
 # gate on reaching the row, since there is no longer a gate to reach.
 #
 # Cheapest first, so the rubric's "always name one row cheaper as the quota
 # fallback" is row minus one, floored at row 1, correct by construction.
@ -66,32 +63,14 @@
 # overkill costs quota every session - but a wrong architecture decision in a
 # published plugin costs more than either.
 #
-# THE ADVISOR is emitted into the command as '--advisor opus' - a second,
+# THE ADVISOR IS NOT EMITTED, and that is a decision rather than an omission:
-# stronger model consulted at key moments during the session. It is added on a
+# the advisor is an operator decision per session, never the rubric's. Until
-# NEED, never unconditionally: an always-on advisor is the global advisorModel
+# 2026-09-12 this calculator appended an opus advisor flag on a NEED - always on
-# setting, which burns quota on every session in every repo and is the thing
+# the Sonnet rows, and on the Opus rows at costly|one-way stakes. It was struck
-# this rule exists to replace. Two independent needs qualify:
+# on a measurement: of 54 dispatches issued 08.-12.09 not one carried the flag,
-#
+# because sessions are started by hand from the model and effort, not from the
-#   rows 1-2   ALWAYS. The main model is Sonnet, so opus is a capability LIFT
+# whole line. A rule nothing honours is not policy, and an emitted value that
-#              rather than a peer - opus judgement at sonnet cost. This is what
+# nobody acts on is decoration in a field whose only job is to be evidence.
 #              makes the FALLBACK safe to take: every fallback is one row
 #              cheaper, and the cheapest rows are the Sonnet ones.
 #   rows 3-4   only at reversibility=costly|one-way. The main model is already
 #              Opus, so the advisor buys peer review, worth paying for when a
 #              mistake is not cheap to undo.
 #
 # Rows 5-6 never reach this logic at all - the calculator cannot select them
 # (see above). Informational only: were the operator to hand-write a Fable
 # command, it would carry no advisor either way, since the CLI rejects every
 # advisor for a Fable main model.
 #
 # The two triggers barely overlap: costly forces row 3 and one-way forces row
 # 4, so a Sonnet row always has reversibility=cheap. verification=none is
 # deliberately not a third trigger - beyond the stakes rule it would only add
 # mistakes that are cheap to reverse, docs sessions among them.
 #
 # Applied per ROW, so 'fallback-command' carries its own correct answer rather
 # than the winning row's.
 #
 # WHERE IT DISAGREES WITH THE RUBRIC'S EXAMPLES. The rows are task-type labels;
 # the traits are a different classification over the same six outcomes. They
@ -288,41 +267,14 @@ row_base_cmd() {
  esac
 }
-# THE ADVISOR is a second, stronger model consulted mid-task. It costs real
+# No advisor is appended here or anywhere else - the advisor is an operator
-# tokens per session, so it fires on a NEED and nowhere else - an unconditional
+# decision per session, not a property this rubric computes (struck
-# advisor is just the global advisorModel setting, which is the thing this
+# 2026-09-12, see the header). row_cmd() is therefore the row's base command
-# replaces. Two independent needs qualify, and they are almost disjoint:
+# and nothing more; it stays a function rather than collapsing into
-#
+# row_base_cmd() because the emitted command and the row table are two
-#   rows 1-2 (Sonnet)  ALWAYS. opus is a capability LIFT here, not a peer:
+# separate things that happened to converge, and a later flag would attach
-#                      opus judgement at sonnet cost. This half is what makes
+# here, to one place, for both the winning row and its fallback.
-#                      the fallback-command safe, since every fallback is one
+row_cmd() { row_base_cmd "$1"; }
 #                      row cheaper and the cheapest rows are Sonnet.
 #   rows 3-4 (Opus)    only at costly|one-way stakes, where the advisor is a
 #                      peer review and being wrong is not cheap to undo.
 #
 # Rows 5-6 (Fable) never reach this function - $ROW can only be 1-4 (see
 # SELECTION above). Informational only: the only advisor this script ever
 # emits is opus (pinned by selftest 14's "the only advisor value ever emitted
 # is opus"), and opus is refused as under-capable for a fable main model -
 # measured against the installed claude, still true at CC 2.1.226 - so a
 # hand-written Fable command carries no advisor either way.
 #
 # costly forces row 3 and one-way forces row 4, so a Sonnet row always has
 # reversibility=cheap - the stakes rule can never reach rows 1-2, and the model
 # rule never reaches rows 3-4. verification=none is deliberately NOT a trigger:
 # beyond the stakes rule it would only add cheap-to-reverse mistakes, and it
 # would put an advisor on every docs session (known/none/cheap/local).
 #
 # Applied per ROW rather than once, because the fallback is a real command the
 # operator pastes under quota pressure and must carry its own correct answer.
 row_advisor() {
  case "$1" in
    1|2) echo " --advisor opus" ;;
    3|4) case "$2" in costly|one-way) echo " --advisor opus" ;; *) echo "" ;; esac ;;
    *)   echo "" ;;
  esac
 }
 row_cmd() { printf '%s%s\n' "$(row_base_cmd "$1")" "$(row_advisor "$1" "$REVERS")"; }
 FB=$((ROW - 1)); [ "$FB" -ge 1 ] || FB=1
--- a/skills/board/SKILL.md
+++ b/skills/board/SKILL.md
@ -23,7 +23,7 @@ description: >-
  user names no repo and no tool — choosing *between* repos is this skill. Not for
  "where were we" inside the current repo: that is this repo's own STATE.md,
  already injected at session start.
-version: "0.32.0"
+version: "0.34.0"
 ---
 # board — which repo deserves the next session
--- a/skills/coord-send/SKILL.md
+++ b/skills/coord-send/SKILL.md
@ -15,7 +15,7 @@ description: >-
  covers retiring a broadcast that has become wrong or obsolete: "retract that
  broadcast", "that announcement is outdated, pull it", "trekk tilbake kringkastingen",
  "den broadcasten er utdatert".
-version: "0.32.0"
+version: "0.34.0"
 ---
 # coord-send — natural-language front door for inter-repo messages
--- a/skills/dispatch/SKILL.md
+++ b/skills/dispatch/SKILL.md
@ -17,7 +17,7 @@ description: >-
  skill. Not for choosing WHICH repo deserves the next session (that is `board`),
  not for scoring model and effort alone (that is `route`), and not for sending a
  message to another repo (that is `coord-send`).
-version: "0.32.0"
+version: "0.34.0"
 ---
 # dispatch — hand a session a task it can actually start on
@ -124,8 +124,8 @@ Two facts about this measurement, both verified 2026-08-16 against the installed
 ### 4. Score the four traits and call `--dispatch`
-Scoring is judgement and it is yours; the model, effort and advisor flag are a
+Scoring is judgement and it is yours; the model and effort are a lookup and are
-lookup and are `route.sh`'s. Score the task **the dispatched session** will do,
+`route.sh`'s. Score the task **the dispatched session** will do,
 using the `route` skill's trait table.
 Pass `--order-id <id>`, not `--prompt-file`. The emitted command is then a thin
@ -140,13 +140,18 @@ empty prompt file, one level up.
 queue to write to. Passing both is refused: the session would be told two
 things.
-`--dispatch` deliberately takes no `--model`/`--effort`. `--advisor opus` is a
+`--dispatch` deliberately takes no `--model`/`--effort`. The rubric is a policy
-property of the rubric *row* — two rows share a model/effort pair while
+with exactly one copy, and a dispatch that took the model directly would be a
-differing on it, and the CLI accepts a wrong advisor silently — so a dispatch
+second, unscored way to reach the same decision — one that records no traits, no
-that took the model directly would have no honest source for that flag. If the
+rationale and no `next-cost`, so nothing afterwards could say whether the
-right call is a Fable row, the rubric cannot produce it: write that command by
+routing or the scoring was wrong. Score the traits and let the lookup spell the
-hand, and say in the handover that it is a recorded override, running without an
+command. If the right call is a Fable row, the rubric cannot produce it: write
-advisor.
+that command by hand and say in the handover that it is a recorded override.
 **No `--advisor` is emitted, by the rubric or by this skill.** That rule was
 struck 2026-09-12 on a measurement — 0 of 54 dispatches carried the flag. The
 advisor is an operator decision per session; do not add one to a dispatch
 command.
 ### 5. Verify, then hand it over
--- a/skills/route/SKILL.md
+++ b/skills/route/SKILL.md
@ -14,7 +14,7 @@ description: >-
  the operator names no model and no tool — choosing the model for the next
  session IS this skill. Not for choosing which REPO gets the next session:
  that is the `board` skill.
-version: "0.32.0"
+version: "0.34.0"
 ---
 # route — what the next session should run with
@ -104,8 +104,7 @@ in STATE as an **override**, never as something this skill produces. If Fable
 is the right call for the next step's *form* (big-picture, review, planning),
 write the board line and the `rule` by hand — `board.sh` still parses
 "Fable 5/high" and "Fable 5/xhigh" — and say so plainly in the rationale rather
-than scoring the four traits to land there. One fact worth carrying into that
+than scoring the four traits to land there.
 override: a Fable session runs without an advisor.
 ## The last-session record
@ -186,24 +185,26 @@ Give the operator the two closing-line items and nothing more:
  the working directory is already right. If the next step belongs in a
  different repo, say so in plain words — that is a different tab, not a `cd`.
-**Paste `command` verbatim, `--advisor opus` included.** The calculator decides
+**Paste `command` verbatim.** It is the row's whole spelling: model and effort,
-the advisor per row, and it is not decoration: on a Sonnet row it is what lifts
+and nothing else. Do not add flags the calculator did not emit.
-the session to Opus judgement at Sonnet cost, which is what makes the cheaper
+
-`fallback-command` safe to take under quota pressure. Dropping it because it
+**The advisor is not this skill's to decide.** Until 2026-09-12 the rubric
-looks like noise silently removes that. Equally, never *add* it to a command
+appended an opus advisor on some rows; that rule is struck, on a measurement —
-that came back without one — an unconditional advisor is the global
+of 54 dispatches issued 08.–12.09 not one carried it, because sessions are
-`advisorModel` setting, which costs quota in every session in every repo and is
+started by hand from the model and effort. The advisor is now an operator
-the failure mode this rule replaces. `route.sh --help` carries the full rule.
+decision per session. Never add `--advisor` to an emitted command on your own
 initiative; if the operator asks for one, that is their call and it belongs in
 the handover as what it is — an operator choice, not a rubric outcome.
 If `command` and `fallback-command` are the same as the current session's model,
 say `/clear` is enough instead — but only if no newly installed plugin or skill
 needs a fresh process to be picked up.
-**`--advisor` is part of that comparison, not an afterthought.** It is a launch
+**An advisor the operator asked for is part of that comparison.** It is a
-flag, so `/clear` reuses the process and keeps whatever advisor the session
+launch flag, so `/clear` reuses the process and keeps whatever advisor the
-started with. If `command` carries `--advisor opus` and this session was not
+session started with — a session that is to gain or lose one needs `/exit` and
-launched with it, `/clear` is *not* enough — the operator needs `/exit` and the
+a full command, never `/clear`. The rubric never puts it there; the operator
-full command, or the advisor silently never appears.
+does.
 Do not paste the whole output block. One row, the rule that produced it, the
 command.
--- a/tests/selftest.test.mjs
+++ b/tests/selftest.test.mjs
@ -4,7 +4,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@ -12,8 +12,31 @@ import { fileURLToPath } from 'node:url';
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 const hook = join(root, 'hooks', 'scripts', 'session-start.mjs');
 // Every bash suite already prints its own total on its last line, and this
 // wrapper already runs all five. Capturing that line here is what makes the
 // README's numbers testable without a SECOND copy of the counting: nothing
 // re-counts `check` calls (loops make that undecidable anyway) and nothing
 // re-runs a suite to read a number the run in progress is already printing.
 // The five suites cost 212s sequentially, measured 2026-09-05 under /bin/bash
 // 3.2 - the marginal cost of the README check is zero because it consumes a
 // run that happens regardless.
 const summaries = new Map();
 function runSuite(name) {
  const script = join(root, 'scripts', `${name}-selftest.sh`);
  try {
    summaries.set(name, execFileSync('bash', [script], { encoding: 'utf8' }));
  } catch (err) {
    // Record what the suite managed to print before failing, then let the
    // failure through: a red suite must stay red here, and the README check
    // below still gets a number to compare rather than a silent absence.
    if (typeof err.stdout === 'string') summaries.set(name, err.stdout);
    throw err;
  }
 }
 test('coord bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'coord-selftest.sh')], { encoding: 'utf8' });
+  runSuite('coord');
 });
 // board.sh reads this plugin's mailbox for its INN column, so the board ships
@ -22,7 +45,7 @@ test('coord bash selftest passes', () => {
 // through CLAUDE_PLUGIN_ROOT, so a board.sh that exists only in
 // ~/.claude/scripts/ would be missing on exactly the path production uses.
 test('board bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'board-selftest.sh')], { encoding: 'utf8' });
+  runSuite('board');
 });
 // route.sh is the WRITER for the next-cost field board.sh already reads, so its
@ -31,7 +54,7 @@ test('board bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a calculator proven only elsewhere is unproven on the
 // one path production uses.
 test('route bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'route-selftest.sh')], { encoding: 'utf8' });
+  runSuite('route');
 });
 // pre-state-line-guard.mjs is a PreToolUse hook, so like session-start.mjs it
@ -39,7 +62,7 @@ test('route bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a guard proven only elsewhere is unproven on the
 // path production actually runs.
 test('state-line-guard bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'state-line-guard-selftest.sh')], { encoding: 'utf8' });
+  runSuite('state-line-guard');
 });
 // The order queue is the second channel beside the mailbox, with the opposite
@ -48,7 +71,7 @@ test('state-line-guard bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, so a queue proven only elsewhere is unproven where it
 // runs.
 test('orders bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'orders-selftest.sh')], { encoding: 'utf8' });
+  runSuite('orders');
 });
 // The engine refuses to invent an identity from the cwd, but the hook is the
@ -188,3 +211,69 @@ test('hook keeps mail and orders in separate blocks, mail first', () => {
  assert.ok(ctx.includes('UNTRUSTED DATA'), 'the mail block lost its authorization framing');
  assert.ok(ctx.includes('OPERATOR-AUTHORIZED'), 'the order block lost its authorization framing');
 });
 // --- README's selftest numbers must rot loudly ------------------------------
 //
 // The badge and the five `## Development` comments are the only public claim
 // about how much this engine is pinned by, and they are the number furthest
 // from the meter: they rotted twice in a row (529 from 0.25.0; then a badge
 // saying 868 beside comments summing to 792 - two different wrong sums of the
 // same fact, neither matching the other, on the same screen). Nothing caught
 // either, because nothing compared them to anything.
 //
 // It lives HERE rather than in one of the five bash suites, and the choice is
 // not arbitrary. The order's parenthetical suggested the suite that already
 // pins README/catalog invariants; measured before choosing, no such suite
 // exists - `grep -ln README scripts/*selftest*.sh` returns board-selftest.sh
 // alone, on two incidental hits (a prose comment and a `research/README.md`
 // fixture). Of the places that could host it, this wrapper is the only one
 // where all five numbers exist at once in a run that already happens: a check
 // inside a suite could see its own count but would have to RE-RUN the other
 // four (212s, measured 2026-09-05) to see theirs, and reading counters out of
 // the scripts is the second copy of the counting this check was asked not to
 // be. `check` calls sit inside loops, so a static count is not merely a second
 // copy - it is a wrong one.
 //
 // The truth source is each suite's own summary line, verbatim, and a suite
 // that stops printing one FAILS here rather than being skipped: an absent
 // measurement must not read as a matching one.
 function suiteTotal(name) {
  const out = summaries.get(name);
  assert.ok(out !== undefined,
    `${name}-selftest produced no captured output: its total was never measured, ` +
    'so the README comparison below would be resting on nothing');
  // Two summary grammars, both already in the tree: coord prints
  // `PASS=N FAIL=M`, the other four print `<name>-selftest: N passed, M failed`
  // and orders adds `, S skipped (of T checks)`. README documents the TOTAL
  // number of checks, so skipped ones count.
  let m = out.match(/^\S+-selftest: (\d+) passed, (\d+) failed(?:, (\d+) skipped)?/m);
  if (m) return Number(m[1]) + Number(m[2]) + Number(m[3] ?? 0);
  m = out.match(/^PASS=(\d+) FAIL=(\d+)/m);
  assert.ok(m, `${name}-selftest printed no summary line this parser recognises`);
  return Number(m[1]) + Number(m[2]);
 }
 test('README states the selftest counts the suites actually reported', () => {
  const readme = readFileSync(join(root, 'README.md'), 'utf8');
  const suites = ['coord', 'board', 'route', 'orders', 'state-line-guard'];
  let sum = 0;
  for (const name of suites) {
    const measured = suiteTotal(name);
    sum += measured;
    const line = readme.match(
      new RegExp(`^\\s*bash scripts/${name}-selftest\\.sh\\s+#\\s+(\\d+) checks`, 'm'));
    assert.ok(line,
      `README's ## Development block has no "N checks" comment for ${name}-selftest.sh`);
    assert.equal(Number(line[1]), measured,
      `README says ${name}-selftest has ${line[1]} checks; it reported ${measured}`);
  }
  // The badge is the sum, and it is compared against the MEASURED total rather
  // than against the five README comments: a badge agreeing with five stale
  // comments is exactly the 868-beside-792 shape, one layer down.
  const badge = readme.match(/badge\/selftest_checks-(\d+)-/);
  assert.ok(badge, 'README has no selftest_checks badge to check');
  assert.equal(Number(badge[1]), sum,
    `README's badge says ${badge[1]} selftest checks; the five suites reported ${sum}`);
 });