feat(route,board): strike the advisor rule, add board.sh --row <repo>

Order 20260912T202210Z-7588027378-from-.claude, operator decision
2026-09-12 (helhetlig vurdering av arbeidssystemet, cut row 3 and the
board.sh --row improvement row). One order, two parts, one version bump.

THE ADVISOR RULE IS STRUCK. route.sh and board.sh --dispatch emit no
--advisor at all. The rule fired per ROW on a need - always on the Sonnet
rows (a capability lift, which is what made the quota fallback safe to
take), and on the Opus rows at reversibility=costly|one-way - and it read
well. It was killed by a MEASUREMENT, not by taste: of 54 dispatches the
PM issued 08.-12.09, ZERO carried the flag, because sessions are started
by hand from the model and effort rather than from the whole emitted
line. A rule nothing honours is not a policy, and an emitted value nobody
acts on is decoration in a field whose only job is to be evidence. The
advisor is now what it already was in practice: an operator decision per
session, said in one sentence in route.sh --help.

The comments that rested on the rule were REWRITTEN, not left standing.
board.sh --dispatch still refuses a --model/--effort pair, but the reason
is no longer "the advisor is a property of the ROW": it is that the rubric
has exactly one copy, and a dispatch taking the model directly would be a
second, unscored way to reach the same decision - recording no traits, no
rationale and no next-cost, so nothing afterwards could say whether the
routing or the scoring was wrong. A comment defending a removed mechanism
is how the next session restores it. Both skills carry the correction.

Pinned as an ABSENCE over the whole trait space - 81 combinations, every
line of output, with a known-positive control proving the sweep's grep
can find a planted advisor - rather than on four sampled rows, because
the claim is that no path emits it. board.sh --dispatch at
reversibility=costly is pinned separately: that is the exact input a
reintroduced rule would fire on. The literal string is absent from
route.sh entirely, including the paragraph recording what was struck (it
says "an opus advisor flag" in words), because a blunt grep cannot tell a
description from a specification. Backward compatibility is pinned rather
than assumed: a route line carrying a legacy advisor= field still parses
and still yields a command - measured, 0 of 48 route lines in ~/repos
carry one, but a reader that broke on an unknown field would turn last
month's STATE.md into "that repo has no route line". The three CLI gates
section 14 carried went with the rule; the suite no longer depends on the
installed claude at all.

board.sh --row <repo> IS THE SEVENTH RENDERING of the same scan, never a
second scan, read-only like every other one. (The order calls it the
sixth; by this file's own numbering --inbox-plan is the fourth and
--dispatch the fifth. Corrected rather than carried wrong.) It exists
because the columns WERE misread: on 11.09 the PM read FLY off the table
by eye and got it wrong, while every other rendering a program consumes
is already key=value. inn, ordre and fly are three separate fields
because they are three separate facts; status is the bare token, never
the table's blocked>target display, with blocked-on beside it; neste is
last and uncut. An unknown repo exits 2 and writes NOTHING to stdout - an
empty block would read as a repo whose every column is blank, which is a
real and different state.

upushet is the ONE field that is not a rendering of the scan, and it is
named rather than blended in: nothing in the scan measures it, so it is
read once, for the named repo only, and never enters the table, the plan
or the briefing. It reads the remote-TRACKING ref, not the remote, so
upushet=N honestly means "the local ref says N"; a repo with no upstream
reports ?, never 0.

The row fixture's three counts are three DIFFERENT integers (3/2/1), and
that is the finding worth recording. Built first with 2/1/1, it was
mutation-tested by making fly read the ORDRE field - the exact 11.09
misreading - and the check stayed GREEN, because the two fields held the
same digit. A fixture that cannot tell two columns apart is the defect
wearing a passing test, inside the section written to prevent it.

Suites under /bin/bash 3.2, before -> after: coord 257 -> 257, board
393 -> 427, route 73 -> 73 (13 advisor checks and 3 CLI gates out, 15
absence/legacy checks in, and it no longer varies with claude being on
PATH), orders 116 -> 116, state-line-guard 54 -> 54. Sum 893 -> 927,
README badge updated to the measured sum. npm test 12/12, fail 0.

Verified live against the real tree, not only fixtures: --row
repo-mailbox reports fly=1 beside ordre=0 (the distinction that was
misread), --row on the nested key from-ai-to-chitta/content-sadhguru
resolves, and an unknown repo exits 2.

No tag, no push, no catalog change - that is the operator's
release-plugin.mjs run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-mailbox",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
   "author": {
     "name": "Kjell Tore Guttormsen"

CHANGELOG.md

@@ -5,6 +5,142 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.34.0] - 2026-09-12
+
+### Changed
+
+- **The advisor rule is struck from the rubric: `route.sh` and `board.sh
+  --dispatch` no longer emit `--advisor` at all.** It fired on two needs -
+  always on the Sonnet rows, and on the Opus rows at `costly|one-way` stakes -
+  and it read well. What killed it was a measurement, not a change of taste:
+  of 54 dispatches the PM issued 08.-12.09, **zero** carried the flag, because
+  sessions are started by hand from the model and effort rather than from the
+  whole emitted line. A rule nothing honours is not a policy, and an emitted
+  value nobody acts on is decoration in a field whose only job is to be
+  evidence. The advisor is now what it already was in practice: an operator
+  decision per session, said in one sentence in `route.sh --help`. The
+  direction is the safe one for the single thing the old rule protected - the
+  quota fallback is still exactly one row cheaper, it just no longer implies a
+  capability lift nobody was taking.
+- **The comments that rested on it were rewritten, not left standing.**
+  `board.sh --dispatch` still refuses a `--model`/`--effort` pair, but the
+  reason is no longer "the advisor is a property of the ROW": it is that the
+  rubric has exactly one copy, and a dispatch taking the model directly would
+  be a second, unscored way to reach the same decision - one recording no
+  traits, no rationale and no `next-cost`, so nothing afterwards could say
+  whether the routing or the scoring was wrong. A comment defending a
+  mechanism that has been removed is how the next session restores it.
+  `skills/route/SKILL.md` and `skills/dispatch/SKILL.md` carry the same
+  correction.
+- Pinned as an ABSENCE over the whole trait space rather than on sampled rows -
+  81 trait combinations, every line of output, with a known-positive control
+  proving the sweep's grep can find a planted advisor - plus `--dispatch` at
+  `reversibility=costly`, the exact input a reintroduced rule would fire on.
+  Backward compatibility is pinned too: a route line carrying a legacy
+  `advisor=` field still parses and still yields a command (measured the same
+  day: 0 of 48 `<!-- route:` lines anywhere in `~/repos` carry one, so nothing
+  in circulation depends on it - but a reader that broke on an unknown field
+  would turn last month's STATE.md into "that repo has no route line").
+
+### Added
+
+- **`board.sh --row <repo>`: the table's row for one repo, as `field=value`
+  lines.** A seventh rendering of the same scan, never a second scan, and
+  read-only like every other one. The motivation is a measured misreading: on
+  11.09 the PM read the FLY column off the table **by eye** and got it wrong.
+  Every other rendering a program consumes (`--plan`, `--inbox-plan`,
+  `--dispatch`) is already `key=value`; the default view was the one left out,
+  and a 34-character repo key already shifts a row two characters right, which
+  makes counting spaces worse than it looks. `inn`, `ordre` and `fly` are three
+  separate fields because they are three separate facts, and confusing them is
+  what this exists to close. `status` is the bare token, never the table's
+  `blocked>target` display, with `blocked-on` beside it; `neste` is last and
+  uncut, for the same reason it is last in the record. An unknown repo exits
+  **2** and writes nothing to stdout - an empty block would read as a repo whose
+  every column is blank, which is a real and different state.
+- `upushet=` is the one field that is **not** a rendering of the scan, and it is
+  named rather than blended in: nothing in the scan measures it, so it is read
+  once, for the named repo only, and never enters the table, the plan or the
+  briefing. It reads the remote-TRACKING ref, not the remote, so `upushet=N`
+  honestly means "the local ref says N"; a repo with no upstream reports `?`,
+  never `0`, because "nothing is waiting to be pushed" and "nobody looked" are
+  exactly the pair this engine refuses to render alike.
+
+### Fixed
+
+- **README's selftest numbers were re-measured, not re-derived.** The badge said
+  `selftest_checks-868` and the five `## Development` comments said
+  220/360/73/99/40 = 792 - two different wrong sums on the same public surface,
+  neither matching the other. The five suites were run under `/bin/bash` (3.2)
+  on `b57a1ea` and reported `coord 257`, `board 393`, `route 73`, `orders 116`,
+  `state-line-guard 54` = **893**, 0 failed in every summary. 0.33.0's entry
+  below records 257+368+73+116+54 = 868 and was true when written; 0.33.1 added
+  25 board checks (368 -> 393) without re-summing, and the comment block had been
+  stale far longer. No code, no version bump: the number furthest from the meter
+  rots first, and only the number moved.
+
+## [0.33.1] - 2026-09-04
+
+### Added
+
+- **A git repo nested under a depth-1 repo now enters the board, on a STATE.md
+  and nothing wider.** Discovery adds a depth-1 repo and stops, and the
+  else-branch container scan - the only place children are ever looked at - is
+  unreachable for an entry that is itself a repo. Measured before anything was
+  written: **12 nested repos across the real tree, exactly 1 with a STATE.md**
+  (`from-ai-to-chitta/content-sadhguru`, which had been running work and
+  reporting to nobody). The other 11 are vendored or experimental checkouts and
+  stay invisible on purpose - they do not even reach the `UTEN STATE.md` bucket.
+  `add_nested_repos()` sits beside `add_dot_repos()` rather than widening the
+  `*` loops, for the same reason ordre `20260818T124828Z` gave for dot repos:
+  routing a depth-1 repo into the container branch would admit every nested
+  checkout. One level only; depth 3 is pinned as NOT admitted. A dot-prefixed
+  depth-1 repo gets the same nested scan, since nothing in the criterion
+  distinguishes it.
+
+  A nested repo carries **two names**, and conflating them would have put a
+  fabricated 0 in three columns. The board KEY is `<parent>/<child>`; the
+  MAILBOX name is `basename(git toplevel)`, so `$COORD/<parent>/<child>/inbox`
+  finds no directory and INN/ORDRE/FLY would read 0 for a repo that may have
+  mail. The record loop carries `mbox` beside `name`, and `--voyage`'s order
+  lookup takes `basename($vy_dir)`. Which directories are nested is RECORDED by
+  discovery (`NESTED_LIST`), never re-derived from "is my parent a repo?".
+
+- **The scan reports its own denominator.** `undersoekt: N katalog(er) depth 1,
+  M polyrepo-container(e), K nestede repo (J med STATE.md tatt med).` The header
+  count answered how many repos were found and nothing about how many were
+  looked at, so a criterion excluding 11 of 12 nested repos was invisible on the
+  surface built to show it. Real tree 2026-09-04: `43 / 5 / 12 (1 tatt med)`. A
+  non-repo dot-directory counts in N and never in M - the line is a denominator,
+  not a partition.
+
+### Fixed
+
+- The denominator line's own wording broke an existing check: `polyrepo
+  container itself is not listed as a repo` grepped the whole output for
+  `polyrepo` and matched the new footer's `polyrepo-container(e)` - the same
+  class as a grep reading a comment that EXPLAINS a pattern as an instance of
+  it. Now anchored at column 1, which is what it always meant.
+
+### Known gaps, stated rather than closed
+
+- The mailbox-keyed JOINs (`$OWED`, `brief_orphans`, `--inbox-plan`) still key
+  on the board name, so a nested repo owing a reply gets no debt tab and is
+  listed under `UTENFOR REPO-SKANNEN`. Neither created nor worsened here: before
+  this change the repo was absent from `RECORDS` entirely, so both readings were
+  already exactly as wrong.
+- A 34-character key overflows the table's `%-32s` REPO column, shifting that
+  row two characters right. Same class as `Fable 5.1/xhigh` in KOST; parsing is
+  unaffected, and widening the column moves three `cut -c89-` selftest helpers.
+- A dot-prefixed NESTED repo is not looked for. The combination was neither
+  measured nor ordered.
+
+### Testing
+
+- `board-selftest.sh` 368 -> 393 checks.
+
 ## [0.33.0] - 2026-09-04
 
 ### Added

CLAUDE.md

@@ -467,7 +467,7 @@ marketplace plugin. Three components, one boundary:
 - **Board (`scripts/board.sh`):** cross-repo attention board. Reads STATE.md
   next-step blocks + board lines, `git status`, and mailbox pending counts, and
   prints one line per repo. Read-only by construction: it writes to no repo, no
-  STATE.md and no mailbox. Pinned by `board-selftest.sh` (393 checks).
+  STATE.md and no mailbox. Pinned by `board-selftest.sh` (427 checks).
 
   **It lives here because the mailbox is one of its three inputs, and it carries
   the same axis distinction the mailbox does.** A pending count means *others
@@ -639,13 +639,17 @@ marketplace plugin. Three components, one boundary:
   `brief-nightly.sh` already carries for the briefing.
 
   **The cost comes from `route.sh`'s row table, and `--dispatch` deliberately
-  refuses a `--model`/`--effort` pair.** `--advisor opus` is a property of the
+  refuses a `--model`/`--effort` pair.** Until 2026-09-12 that rested on
-  ROW; two rows share a model/effort pair while differing on it, and the CLI
+  `--advisor opus` being a property of the ROW; that rule is struck (see
-  accepts a wrong advisor silently. A dispatch taking the model directly would
+  `route.sh` above) and the argument was REWRITTEN rather than left standing on
-  have no honest source for that flag, and both available guesses produce the
+  a premise the code no longer has — a comment defending a removed mechanism is
-  same failure — a session that looks peer-reviewed without being. A Fable
+  how the next session restores it. The reason now: the rubric is a policy with
-  dispatch is therefore not a `--dispatch` outcome at all, exactly as it is not
+  exactly one copy, and a dispatch accepting the model directly would be a
-  a `route.sh` outcome; it is a hand-written override.
+  second, unscored way to reach the same decision — one recording no traits, no
+  rationale and no `next-cost`, so nothing afterwards could say whether the
+  ROUTING was wrong or the SCORING was. A Fable dispatch is therefore not a
+  `--dispatch` outcome at all, exactly as it is not a `route.sh` outcome; it is
+  a hand-written override.
 
   **`--target-pane yes|no` is REQUIRED, with no default, and that is the same
   rule `--last-effort` carries.** It is a measurement of the world — does the
@@ -1066,23 +1070,38 @@ marketplace plugin. Three components, one boundary:
   and belongs to the skill; turning scores into a row is a lookup and takes zero
   model calls.
 
-  **`--advisor opus` is emitted per ROW, on a need, never unconditionally.**
+  **NO `--advisor` is emitted, by this calculator or by `board.sh --dispatch`
-  Rows 1-2 always carry it (Sonnet main model, so opus is a capability lift —
+  (operator decision 2026-09-12, `~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md`
-  and since every fallback is one row cheaper and the cheap rows are Sonnet,
+  § 4, cut row 3).** The struck rule fired per ROW on a need — always on the
-  this is what makes the quota fallback safe to take); rows 3-4 only at
+  Sonnet rows (a capability lift, which is what made the quota fallback safe to
-  `reversibility=costly|one-way` (Opus main model, so it buys peer review where
+  take), and on the Opus rows at `reversibility=costly|one-way` (peer review
-  a mistake is not cheap to undo); rows 5-6 never, because the CLI rejects every
+  where a mistake is not cheap to undo). It read well and it was killed by a
-  advisor for a Fable main model. The alternative — the global `advisorModel`
+  MEASUREMENT, not by taste: of 54 dispatches the PM issued 08.–12.09, **zero**
-  setting written by `/advisor` — is what this replaces: it applies to every
+  carried the flag, because sessions are started by hand from the model and
-  session in every repo, which is how it burned quota before. The two triggers
+  effort rather than from the whole emitted line. A rule nothing honours is not
-  are almost disjoint by construction, since `costly` forces row 3 and `one-way`
+  a policy, and an emitted value nobody acts on is decoration in a field whose
-  forces row 4, so a Sonnet row always has `reversibility=cheap`.
+  only job is to be evidence. The advisor is now what it already was in
-  `verification=none` is deliberately NOT a third trigger: beyond the stakes
+  practice: **an operator decision per session**, said in one sentence in
-  rule it would only add mistakes that are cheap to reverse, docs sessions
+  `route.sh --help`.
-  (`known/none/cheap/local`) among them. Section 14 pins the rule and gates the
+  The absence is pinned over the WHOLE trait space — 81 combinations, every
-  three CLI facts it rests on against the installed `claude` without spending a
+  line of output, with a known-positive control proving the sweep's grep can
-  token — advisor validation runs before the empty-prompt check, so `-p ""`
+  find a planted advisor — rather than on four sampled rows, because the claim
-  reaches the validator and stops there.
+  is that no path emits it. `--dispatch` at `reversibility=costly` is pinned
+  separately: that is the exact input a reintroduced rule would fire on.
+  The three CLI gates section 14 used to carry (does `claude` accept
+  `--advisor`, does it accept opus advising sonnet, does it still reject opus
+  advising fable) went with the rule — they existed to gate facts the rule
+  rested on, and the suite no longer depends on the installed `claude` at all.
+  **The literal string `--advisor opus` is absent from `route.sh` ENTIRELY,
+  including the paragraph recording what was struck** (it says "an opus advisor
+  flag" in words): a blunt grep cannot tell a description from a specification,
+  the same reason coord-selftest's cache assertion runs on an extracted path
+  rather than the whole file. Do not restore the quote.
+  Backward compatibility is pinned rather than assumed: a route line carrying a
+  legacy `advisor=` field still parses and still yields a command. Measured the
+  same day — **0 of 48** `<!-- route:` lines anywhere in `~/repos` carry one, so
+  nothing in circulation depends on it, but a reader that broke on an unknown
+  field would turn last month's STATE.md into "that repo has no route line".
 
   **Rows 5-6 are never a `route.sh` outcome.** Until 2026-08-06 they fired
   only from an explicit `--opus-xhigh-failed` flag, mirroring a global
@@ -1398,6 +1417,43 @@ marketplace plugin. Three components, one boundary:
   phase and age and leaves the judgement to the reader, which is why 51
   projects are listed rather than some filtered subset.
 
+- **`--row <repo>` is the SEVENTH rendering: the table's row for ONE repo, as
+  `field=value` lines** (order 20260912T202210Z-7588027378, operator decision
+  2026-09-12). Same scan, never a second one, read-only like every other
+  rendering. **The order calls it the sixth; by this file's own numbering
+  `--inbox-plan` is the fourth and `--dispatch` the fifth, so it is the
+  seventh** — corrected here rather than carried wrong.
+
+  **It exists because the columns WERE misread.** On 2026-09-11 the PM read the
+  FLY column off the table by eye and got it wrong. Every other rendering a
+  program consumes (`--plan`, `--inbox-plan`, `--dispatch`) is already
+  `key=value`; the default view was the one left out, and the 34-character
+  nested-repo key already shifts a row two characters right (a stated, unclosed
+  gap), which makes counting spaces worse than it looks. `inn`, `ordre` and
+  `fly` are three separate fields because they are three separate facts, and
+  confusing them is the whole reason this exists. `status` is the bare token,
+  never the table's `blocked>target` display, with `blocked-on` beside it;
+  `neste` is last and uncut, for the same reason it is last in the record. An
+  unknown repo exits **2** and writes NOTHING to stdout — an empty block would
+  read as a repo whose every column is blank, which is a real and different
+  state (`?`).
+
+  **`upushet` is the one field that is NOT a rendering of the scan, and it is
+  named rather than blended in.** Nothing in the scan measures it, so it is
+  read once, for the named repo only, and never enters the table, the plan or
+  the briefing. It reads the remote-TRACKING ref, not the remote: `upushet=N`
+  honestly means "the local ref says N", and `git ls-remote` is still what a
+  claim ABOUT THE WORLD costs. A repo with no upstream reports `?`, never `0` —
+  "nothing is waiting to be pushed" and "nobody looked" are exactly the pair
+  this engine refuses to render alike.
+
+  **The fixture's three counts are three DIFFERENT integers (3/2/1), and that
+  is the finding worth recording.** Built first with 2/1/1, it was
+  mutation-tested by making `fly` read the ORDRE field — the exact 11.09
+  misreading — and the check stayed GREEN, because the two fields held the same
+  digit. A fixture that cannot tell two columns apart is the defect wearing a
+  passing test, inside the section written to prevent it.
+
 - **Skills (`skills/coord-send/`, `skills/board/`, `skills/route/`, `skills/dispatch/`):** natural-language front
   doors mapping user intent to engine invocations. No mailbox logic lives here
   either. `board` additionally owns the *ranking* — which repo wins and why —
@@ -1446,7 +1502,7 @@ obligations in another repo.
   builtins only in hook and tests.
 - TDD: no behavior change without a failing selftest check first.
   `bash scripts/coord-selftest.sh` must exit 0 (257/257),
-  `bash scripts/board-selftest.sh` must exit 0 (393/393),
+  `bash scripts/board-selftest.sh` must exit 0 (427/427),
   `bash scripts/route-selftest.sh` must exit 0 (73/73),
   `bash scripts/orders-selftest.sh` must exit 0 (116/116) and
   `bash scripts/state-line-guard-selftest.sh` must exit 0 (54/54).
@@ -1464,6 +1520,36 @@ obligations in another repo.
   and re-measured after: 11 of 11 now match. Only the Install block was
   converted; converting the other 39 indented blocks was not ordered and
   would bury a two-line fix in a whole-file diff.
+- **README's selftest numbers are pinned by `tests/selftest.test.mjs`, and the
+  check lives there rather than in one of the five bash suites for a measured
+  reason.** The badge and the five `## Development` comments rotted twice in a
+  row - 529 carried from 0.25.0, then a badge saying 868 beside comments summing
+  to 792, two different wrong sums of the same fact on the same screen - because
+  nothing compared them to anything. The order behind the fix
+  (`20260905T053602Z-6743615726`) suggested hosting it in whichever suite
+  already pins README/catalog invariants; measured before choosing, **no such
+  suite exists** (`grep -ln README scripts/*selftest*.sh` returns
+  `board-selftest.sh` alone, on two incidental hits - a prose comment and a
+  `research/README.md` fixture). This wrapper is the only place where all five
+  numbers exist at once in a run that already happens: `runSuite()` captures
+  each suite's own summary line, so the truth source is the line the suite
+  prints, never a re-count. A check inside one suite could see its own total but
+  would have to RE-RUN the other four (**212s sequentially**, measured
+  2026-09-05 under `/bin/bash` 3.2) to see theirs, and grepping `check` calls out
+  of the scripts is both the second copy of the counting and a wrong one, since
+  those calls sit inside loops. The badge is compared against the MEASURED sum,
+  not against the five README comments - a badge agreeing with five stale
+  comments is the 868-beside-792 shape one layer down - and a suite that stops
+  printing a summary FAILS the check rather than being skipped, because an
+  absent measurement must not read as a matching one. It adds no bash check, so
+  the five counts and the 893 badge are unchanged by its arrival.
+  Mutation-verified in both directions: `73 -> 74` on the route comment gives
+  "README says route-selftest has 74 checks; it reported 73", `893 -> 894` on
+  the badge gives "README's badge says 894 selftest checks; the five suites
+  reported 893", and the restored file is 12/12 green. **Bounded gap, stated
+  rather than closed:** `CLAUDE.md`'s own copies of the five counts (in this
+  section, above) are NOT checked - a second surface carrying the same numbers,
+  measured and left alone because widening the check to it was not ordered.
 - Conventional Commits: `type(scope): description`.
 
 ## Commands
@@ -1471,7 +1557,7 @@ obligations in another repo.
 - Test: `bash scripts/coord-selftest.sh`, `bash scripts/board-selftest.sh`,
   `bash scripts/route-selftest.sh`, `bash scripts/orders-selftest.sh` and
   `bash scripts/state-line-guard-selftest.sh` (or `npm test`, the Node wrapper
-  around all five plus the hook tests)
+  around all five plus the hook tests and the README-number check)
 - Order queue smoke test: `CLAUDE_COORD_DIR=$(mktemp -d) bash
   scripts/coord-order-send.sh --to smoke --from tester --subject s --message m`
   then `CLAUDE_COORD_DIR=<same> bash scripts/coord-order-inbox.sh --repo smoke`

README.md

@@ -10,11 +10,11 @@ Session A in repo X leaves a message for repo Y; the next session in repo Y gets
 
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
 
-![Version](https://img.shields.io/badge/version-0.33.1-blue)
+![Version](https://img.shields.io/badge/version-0.34.0-blue)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-4-orange)
 ![CLI scripts](https://img.shields.io/badge/CLI_scripts-8-blue)
-![Selftest checks](https://img.shields.io/badge/selftest_checks-868-blue)
+![Selftest checks](https://img.shields.io/badge/selftest_checks-927-blue)
 
 ---
 
@@ -115,6 +115,7 @@ Ownership is explicit rather than implied. An order is pending until a session *
     coord-sweep.sh [--write] [--days <n>] [--log <path>]                   # close aged notices machine-wide (dry-run by default)
     board.sh [--roots <dir>[,<dir>...]] [--brief|--plan] [--focus "<prose>"]  # cross-repo attention board (read-only)
     board.sh --voyage                                                        # Voyage briefs in flight (read-only)
+    board.sh --row <repo>                                                    # one repo's row as field=value lines (read-only)
     board.sh --dispatch --repo <name> --order-id <id> \
              --target-pane <yes|no> --path <v> ... --rationale "<why>"     # startup command for a session in <name>
     coord-order-send.sh --to <repo> --subject "<s>" --prompt-file <abs path>  # deliver a work order into <repo>'s queue
@@ -143,13 +144,15 @@ launchctl load ~/Library/LaunchAgents/com.ktg.repo-mailbox-sweep.plist
 
 **`launchctl list` proves an agent is *loaded*, never that it is *right*.** A plist naming a script that does not exist loads cleanly and then silently never runs — there is no output to be wrong and no exit status to read, so the failure looks exactly like a quiet machine. Two separate things close that: `launchctl start <label>` followed by a line appearing in `~/Library/Logs/repo-mailbox-sweep.log` is the only runtime proof the program path resolves, and `coord-selftest.sh` section 38 asserts statically, for *every* plist in `launchd/`, that the path it names is a file that exists in this repo, that the `Label` matches the filename, that the placeholders survive, and that no agent points into the version-pinned plugin cache. Note that the launchd log is not the closure log: `$CLAUDE_COORD_DIR/_sweep.log` is where the record of each closed notice lives.
 
-**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` alone cannot produce the advisor flag. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
+**`board.sh --brief` renders the nightly briefing**, a second rendering of the scan the board already does rather than a second scan: the repos with an unhandled inbox, each one's next step *in full* (the 38-character cut belongs to the table column, not to the record), and the exact command to start a session there — derived by calling `route.sh` with that repo's own four traits, since `next-cost` names the row rather than spelling the command and there must be exactly one spelling in circulation. A repo with no route line is told so rather than handed a guessed command. It also cross-checks itself against `coord-count.sh`, because the repo scan and the mailbox are different populations: a mailbox can carry a name no scan will ever produce, such as a declared non-git surface (`CLAUDE_COORD_REPO`) or a checkout outside the roots, and a briefing that only walked the scan would answer "who is waiting on you" with a number it quietly knew was short.
 
 It makes **zero model calls**, which is the point rather than a detail. Under subscription auth a headless session draws from the same quota pool as interactive work, and `--max-budget-usd` is a runaway brake rather than a pre-flight gate — measured against 2.1.220, it aborts *after* the first turn, never before it. `board.sh --brief` writes nothing; the file write lives in `brief-nightly.sh`, which renders to a temp file and renames it into place, and refuses to replace a good briefing with an empty render. `launchd/` holds a sample agent that runs it nightly at 06:00; like the sweep agent above it points at a checkout, never at the version-pinned plugin cache, and it is pinned by the same section 38 checks.
 
 **`board.sh --voyage` reports the Voyage briefs in flight**, a sixth rendering of the same scan. `board` reads STATE lines, which say nothing about a brief, so a programme running Voyage across several repos had no shared surface: nobody could answer which briefs were running, in what phase, and who was waiting on whom. Detection is by **property, never by directory name** — a directory holding `brief.md` or `brief.md.draft` under any of the three planning locations the convention recognises (`.claude/projects/`, `docs/`, `features/<n>-<name>/`) — and it walks the **filesystem, never the git index**: a repo that gitignores `.claude/projects/` would otherwise report zero briefs while actually running one. The phase ladder measures *artifacts*, not sessions: a plan executed in a single session leaves no file behind, so `plan` is the last thing the filesystem can prove, and nothing here claims a session is alive. `brief_quality` is read out of the brief's frontmatter and an absent field reads `-`, never `complete`; a research directory that exists and holds nothing reads `0`, distinct from the `-` that means no research step was ever started. The table carries a matching `VOY` column beside `ORDRE` and `FLY` — the same class of durable filesystem fact, and never summed with them.
 
-**`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and one deterministic score decides it: `40 ×` repos released transitively, `15 ×` unhandled inbox messages, plus small bonuses for live work and for a cheap `next-cost` row. Four hard buckets preceded it and could not express "this repo owes one message and releases two others" — which is how a blocked chain's root ended up ranked *below* the repos waiting on it. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the dominant term, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
+**`board.sh --row <repo>` renders one repo's row as `field=value` lines**, a seventh rendering of the same scan and the only one that answers about a single repo. It exists because the table's columns *were* misread: the fixed-width view is for a human, and reading a column off it by eye is how `FLY` was read as `ORDRE` on 2026-09-11 — while every other rendering a program consumes is already `key=value`. `inn`, `ordre` and `fly` are three separate fields because they are three separate facts; `status` is the bare token rather than the table's `blocked>target` display, with `blocked-on` beside it; `neste` is last and uncut. An unknown repo exits **2** and writes nothing, because an empty block would read as a repo whose every column is blank — a real and different state. One field is deliberately *not* a rendering of the scan and is named as such: `upushet` is measured once, for that repo only, from the remote-**tracking** ref rather than the remote, so a repo with no upstream reports `?` and never `0`.
+
+**`board.sh --plan` renders the day plan**, a *third* rendering of that same scan and the only one that takes a position: which repos to open a tab for today, in what order, and the command to start each. The order is the position, and there is no cutoff — nothing is hidden, and **five ordered groups** decide it, each a lookup over a field the scan already read rather than a weighted score: (1) **chain-root credit**, most repos released first; (2) **debt**, most-owed-first, whatever the status; (3) `planned`; (4) `in-progress`; (5) `?`/`MALFORMED` — undeclared, last and labelled. Within a group, ties break on a cheap Sonnet `next-cost` row, then oldest plan first. A 0.19.0 weighted score (`40 ×` repos released, `15 ×` unhandled inbox messages) briefly stood in this spot and *could* express "this repo owes one message and releases two others" as a single number — but re-tuning those two coefficients would have silently reordered a parser living in another repo, with no test here able to hold a ranking stable for a consumer it can't see; the operator replaced it with the group order in 0.20.0 for that reason. Groups 3 and 4 are `planned` above `in-progress`, inverted from every earlier version by the same decision: turning a decision into motion is the slow step, live work is already moving. **Chain-root credit** follows `blocked-on` transitively to the first repo that is not itself blocked and credits only that root: opening a blocked repo releases nobody, since its own next step is by definition waiting. A cycle, or a `blocked-on` naming a repo the scan never produced, credits nobody rather than inventing a root — a plan that looks correct while sending you to the wrong repo is worse than one that says nothing. Repos owing mail still rank high *whatever their status*, and debt is deliberately **uncapped**: excluding `blocked` or `done` is a statement about a repo's own next step, which cannot be moved, while owing an answer is a different axis and answering is often what unblocks it. Repos with no board line come last and labelled — the table already prints a note about those, so a plan that dropped them silently would repeat exactly that defect. `why=` names the group that placed the repo, so a block reads `unblocks:2` rather than the `inbox:N` every block used to repeat. Still zero model calls, still read-only, and still cross-checked against `coord-count.sh`.
 
 **`--focus "<prose>"` narrows that plan to one subject, and reports what it held back.** It is the only cutoff this format has, which is why the report is a condition of the feature rather than a refinement of it: `--plan` documents that it hides nothing and labels what it cannot rank, so a silent filter would break a property already written down. The same run prints the subjects the prose resolved to, how many blocks were removed, how many `STATE.md` were searched, and — named, not counted — the repos that *mention* a resolved subject without declaring a marker line. That last class is enumerated because it is where the misses live: a repo can be a heavy participant and never have written a marker, and no string measurement finds it until the held-back population is listed. Each surviving block carries the declaration it survived on. Prose matching nothing prints the *full* plan and says so, since the phrase arrives verbatim from a person and a typo must not empty the day. The subject vocabulary is read from the scanned `STATE.md` themselves, so the "reads `STATE.md` and no other file" invariant is untouched.
 
@@ -195,12 +198,12 @@ Note that raising the inbox's priority (Rule 7) deliberately does **not** widen
 
 ## Development
 
-    bash scripts/coord-selftest.sh              # 220 checks against a throwaway mailbox
+    bash scripts/coord-selftest.sh              # 257 checks against a throwaway mailbox
-    bash scripts/board-selftest.sh              # 360 checks against a throwaway repo tree
+    bash scripts/board-selftest.sh              # 427 checks against a throwaway repo tree
     bash scripts/route-selftest.sh              # 73 checks, incl. the route->board round trip
-    bash scripts/orders-selftest.sh             # 99 checks, incl. the 20-way barriered claim race
+    bash scripts/orders-selftest.sh             # 116 checks, incl. the 20-way barriered claim race
-    bash scripts/state-line-guard-selftest.sh   # 40 checks, incl. the Edit replace_all projection and the ratchet
+    bash scripts/state-line-guard-selftest.sh   # 54 checks, incl. the Edit replace_all projection and the ratchet
-    npm test                                    # all five selftests plus the hook tests, via node --test
+    npm test                                    # all five selftests, the hook tests, and the README-number check
 
 TDD is the house rule: every behavior change lands with a failing selftest check first.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-mailbox",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "private": true,
   "type": "module",
   "engines": {

scripts/board-selftest.sh

@@ -244,8 +244,8 @@ for n in 1 2 3; do echo "msg" > "$CLAUDE_COORD_DIR/repo-a/inbox/2026-msg$n-from-
 echo "old" > "$CLAUDE_COORD_DIR/repo-a/archive/2026-old-from-x.md"
 
 # repo-owes: unhandled inbox AND a route line, so the briefing can derive the
-# EXACT startup command - advisor flag included - from the repo's own four
+# EXACT startup command from the repo's own four traits instead of guessing
-# traits instead of guessing from next-cost alone. Its NESTE runs deliberately
+# from next-cost alone. Its NESTE runs deliberately
 # past the table's 38-character column: carrying that line whole is the reason
 # the briefing exists at all.
 mkrepo "$ROOT/repo-owes"
@@ -581,10 +581,15 @@ printf '%s' "$BRIEF" | grep -q 'check-versions'
 check "brief prints the full NESTE line, not the 38-char table excerpt" $?
 
 # Derived by CALLING route.sh with the repo's own four traits - deliberately
-# not spelled out in board.sh - so the rubric keeps exactly one copy. Row 1
+# not spelled out in board.sh - so the rubric keeps exactly one copy.
-# carries the advisor, which is what makes the quota fallback safe to take.
+printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high'
-printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high --advisor opus'
 check "brief derives the exact startup command from the repo's route line" $?
+# Anchored to end-of-line, because the loose grep above would pass just as
+# happily on a command that grew a flag back. The rubric emits no advisor
+# since 2026-09-12 and the briefing is a rendering of the rubric, not a
+# second policy.
+printf '%s' "$BRIEF" | grep -q 'claude --model sonnet --effort high$'
+check "brief's startup command ends at the effort - no advisor is appended" $?
 
 # The command must start its OWN line. `fold` copies its input's missing
 # trailing newline, which ran the command onto the tail of the NESTE prose and
@@ -900,8 +905,8 @@ n_b="$(printf '%s\n' "$PLAN" | grep -n '^repo=repo-b$' | cut -d: -f1)"
 check "uavklart repos rank below every repo that declared a status" $?
 
 # The command comes from route.sh, same single copy of the rubric the briefing
-# uses - advisor flag included, since that is a property of the ROW.
+# uses.
-printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
+printf '%s' "$PLAN" | grep -q '^command=claude --model sonnet --effort high$'
 check "plan derives the exact startup command from the repo's route line" $?
 
 # Both no-command causes must degrade to a marker. A bare `command=` would be
@@ -932,7 +937,7 @@ check "plan prints the full NESTE line, not the 38-char table excerpt" $?
 # because they answer different questions: a driver cd's the pane itself and
 # would choke on a compound line, while the operator needs ONE thing to copy.
 # Assembling it by hand from two fields is where a tab lands in the wrong repo.
-printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high --advisor opus\$"
+printf '%s' "$PLAN" | grep -q "^paste=cd $ROOT/repo-owes && claude --model sonnet --effort high\$"
 check "paste= is the whole line: cd into the repo, then the startup command" $?
 
 printf '%s\n' "$PLAN" | grep -A7 '^repo=repo-typo$' | grep -q '^paste='; [ $? -ne 0 ]
@@ -1530,7 +1535,7 @@ check "ip-repo-no-state reports 1 owed (no reply-expected: no declared)" $?
 # class=repo still derives the exact startup command from the repo's own
 # route line - same single copy of the rubric every other rendering uses.
 printf '%s\n' "$IPLAN" | grep -A8 '^repo=ip-repo-done-fyi$' \
-  | grep -q '^command=claude --model sonnet --effort high --advisor opus$'
+  | grep -q '^command=claude --model sonnet --effort high$'
 check "class=repo block derives its command from the repo's own route line" $?
 
 # class=no-state and class=orphan-mailbox can never fabricate a command - ask
@@ -1766,8 +1771,8 @@ d6="$("$BOARD" --roots "$ROOT" --dispatch --repo no-such-repo --prompt-file "$DS
 [ "$rc" -eq 2 ]; check "dispatch: refuses a repo the scan does not know" $?
 
 # Invalid traits must refuse, never degrade to a command without them: a
-# command missing --advisor reads exactly like a row that legitimately has no
+# command built on three scored traits and one silently dropped one reads
-# advisor.
+# exactly like a fully scored decision.
 d7="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
       --path bogus --verification strong --reversibility cheap --scope local --rationale t 2>&1)"; rc=$?
 [ "$rc" -eq 2 ]; check "dispatch: refuses trait values route.sh rejects, rather than emitting a partial command" $?
@@ -1789,18 +1794,27 @@ printf '%s\n' "$d8" | grep -q '^paste=cd '; check "dispatch: plan block carries
 printf '%s\n' "$d8" | grep -q "command=.*\"\$(cat $DSP)\""; check "dispatch: the command carries the prompt in argv, never bare model+effort" $?
 printf '%s\n' "$d8" | grep -q "^paste=cd $ROOT/repo-a && claude .*\"\$(cat $DSP)\""; check "dispatch: paste= is the complete one-string form, prompt included" $?
 
-# The cost comes from route.sh's row table and nowhere else, so --advisor is a
+# The cost comes from route.sh's row table and nowhere else. These two differ
-# property of the ROW. These two differ ONLY in reversibility: both land on
+# ONLY in reversibility, and both land on row 3 (Opus 5/high) - so since the
-# row 3 (Opus 5/high), and only the costly one carries the advisor. A dispatch
+# advisor rule was struck (2026-09-12) they must produce the IDENTICAL command.
-# that took --model/--effort directly would have no source for that flag at
+# costly is the case that used to add --advisor opus, which makes it the exact
-# all, and forwarding it blindly is how a session ends up looking peer-reviewed
+# input a reintroduced rule would fire on: this is the order's named red test,
-# without being.
+# not a sampled one.
 d9="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
       --path known --verification strong --reversibility cheap --scope multi-file --rationale t 2>/dev/null)"
-printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3, no advisor at cheap)" $?
+printf '%s\n' "$d9" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: model+effort come from the route row (row 3)" $?
 d10="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --prompt-file "$DSP" --target-pane no \
       --path known --verification strong --reversibility costly --scope local --rationale t 2>/dev/null)"
-printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high --advisor opus "'; check "dispatch: the advisor flag follows the ROW (costly -> row 3 with advisor)" $?
+printf '%s\n' "$d10" | grep -q '^command=claude --model opus --effort high "'; check "dispatch: reversibility=costly emits NO advisor (rule struck 2026-09-12)" $?
+if printf '%s\n' "$d10" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+check "dispatch: no advisor anywhere in the costly dispatch block" "$rc"
+if printf '%s\n' "$d10 claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
+check "control: that grep does find a planted advisor" "$rc"
+# The paste line is assembled separately from command=, so it is pinned
+# separately: a flag reintroduced in only one of the two is the shape that
+# sends the operator and the driver down different paths.
+if printf '%s\n' "$d10" | grep '^paste=' | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+check "dispatch: the paste line carries no advisor either" "$rc"
 printf '%s\n' "$d8" | grep -q '^next-cost=Sonnet 5/high$'; check "dispatch: the row's next-cost is reported alongside the command" $?
 
 # --no-go stops the Go MESSAGE, not the work: the startup command - prompt in
@@ -2133,7 +2147,7 @@ mkrepo "$RG_ROOT/repo-rationale-overrides"
 } > "$RG_ROOT/repo-rationale-overrides/STATE.md"
 
 RG_PLAN="$("$BOARD" --roots "$RG_ROOT" --plan 2>/dev/null)"
-RG_CMD='^command=claude --model sonnet --effort high --advisor opus$'
+RG_CMD='^command=claude --model sonnet --effort high$'
 
 printf '%s\n' "$RG_PLAN" | grep -A6 '^repo=repo-greedy-rationale$' | grep -q "$RG_CMD"
 check "route line whose rationale names all four traits still yields a command" $?
@@ -3252,6 +3266,187 @@ check "denominator: a missing scan root adds nothing to the counts" $?
 
 /bin/rm -rf "$DEN_ROOT" "$DEN_COORD" 2>/dev/null
 
+
+# --- 33. --row <repo>: one machine-readable line per column -----------------
+# Order 20260912T202210Z-7588027378 (.claude, operator decision 2026-09-12).
+# The motivation is a measured misreading, not a convenience: on 11.09 the PM
+# read the FLY column off the table BY EYE and got it wrong. Every other
+# rendering that a program consumes emits `key=value` for exactly that reason -
+# the table's fixed-width columns are for a human, and a 34-character repo key
+# already shifts a row two characters right (a stated, unclosed gap). A repo
+# holding a value nobody can grep is a repo whose state is read by counting
+# spaces.
+#
+# It is a RENDERING of the scan every other view already ran, never a second
+# scan - the same rule --brief has carried since it shipped. Two numbers under
+# one name, computed twice, is the defect this file names most often.
+#
+# ONE DEPARTURE, stated rather than smuggled: `upushet=` is not a column the
+# scan computes, and it is measured here, once, for the named repo only. It is
+# in the order's field list, it is exactly the kind of fact that gets misread
+# ("nothing unpushed" vs "not measured"), and measuring it for one repo in a
+# one-repo rendering is not a scan. It never enters the table, the plan or the
+# briefing.
+ROW_ROOT="$(mktemp -d)"
+ROW_COORD="$(mktemp -d)"
+
+mkrepo "$ROW_ROOT/row-repo"
+{
+  echo "# STATE - row-repo"
+  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
+  echo "<!-- board: status=blocked; blocked-on=other-repo; next-cost=Opus 5/high -->"
+  echo "<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; rationale=x -->"
+  echo "The whole next step, well past the 38 characters the table column cuts at."
+} > "$ROW_ROOT/row-repo/STATE.md"
+
+# Mailbox fixture: 3 pending messages, 2 pending orders, 1 claimed order. The
+# three counts are deliberately three DIFFERENT integers, and that is the whole
+# design of this fixture rather than an arbitrary choice. Built first with
+# 2/1/1, it was mutation-tested by making `fly` read the ORDRE field - the
+# exact 2026-09-11 misreading this rendering exists to close - and the check
+# stayed GREEN, because the two fields held the same digit. A fixture that
+# cannot tell two columns apart is the defect wearing a passing test, in the
+# section written to prevent it. With 3/2/1 that mutation turns it red.
+mkdir -p "$ROW_COORD/row-repo/inbox" "$ROW_COORD/row-repo/orders/claimed"
+echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101010Z-1-from-x.md"
+echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101011Z-2-from-x.md"
+echo "m" > "$ROW_COORD/row-repo/inbox/20260901T101014Z-5-from-x.md"
+echo "o" > "$ROW_COORD/row-repo/orders/20260901T101012Z-3-from-x.md"
+echo "o" > "$ROW_COORD/row-repo/orders/20260901T101015Z-6-from-x.md"
+echo "o" > "$ROW_COORD/row-repo/orders/claimed/20260901T101013Z-4-from-x.md"
+
+ROW_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo 2>/dev/null)"; rc=$?
+[ "$rc" -eq 0 ]; check "row: a known repo exits 0" $?
+
+printf '%s\n' "$ROW_OUT" | grep -q '^repo=row-repo$';        check "row: repo= is the board key" $?
+printf '%s\n' "$ROW_OUT" | grep -q "^dir=$ROW_ROOT/row-repo\$"; check "row: dir= is the checkout path" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^status=blocked$';       check "row: status= is the bare token, not the blocked>target display" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^blocked-on=other-repo$';check "row: blocked-on= is its own field" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^next-cost=Opus 5/high$';check "row: next-cost= survives the space and the slash" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^inn=3$';                check "row: inn= counts pending messages" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^ordre=2$';              check "row: ordre= counts pending orders" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^fly=1$';                check "row: fly= counts claimed orders" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^siste=';                check "row: siste= reports the last-commit reading" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^drt=';                  check "row: drt= reports the working-tree reading" $?
+printf '%s\n' "$ROW_OUT" | grep -q '^upushet=';              check "row: upushet= is present" $?
+
+# The three counts are the whole point: FLY was misread as ORDRE, so a rendering
+# that emitted the same digit under two names would reproduce the defect it
+# exists to close.
+[ "$(printf '%s\n' "$ROW_OUT" | grep -c '^\(inn\|ordre\|fly\)=')" -eq 3 ]
+check "row: inn, ordre and fly are three separate fields" $?
+
+# NESTE uncut, same argument --brief has: the 38-char cut is the TABLE column's
+# property, and cutting here would make the cut string the only copy.
+printf '%s\n' "$ROW_OUT" | grep -q '^neste=.*38 characters the table column cuts at'
+check "row: neste= carries the whole line, not the table excerpt" $?
+
+# `neste` is free prose and may contain anything the STATE.md author wrote, so
+# it is LAST - the same rule the RECORDS line itself obeys. A consumer reading
+# field N from the end depends on it.
+[ "$(printf '%s\n' "$ROW_OUT" | tail -1 | cut -d= -f1)" = "neste" ]
+check "row: neste= is the last line" $?
+
+# One line per field, every line a field: a value that wrapped would be read as
+# a field name by anything grepping ^name=.
+ROW_BAD="$(printf '%s\n' "$ROW_OUT" | grep -v '^[a-z][a-z-]*=' || true)"
+[ -z "$ROW_BAD" ]; check "row: every line is a field=value line:${ROW_BAD:- clean}" $?
+
+# ASCII, because the row is consumed by awk/sed/grep under bash 3.2 - the same
+# constraint every other emitted block in this file carries. Asserted on a
+# fixture whose own prose is ASCII, so this measures the renderer, not the
+# STATE.md it happened to read.
+if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]'; then rc=1; else rc=0; fi
+check "row: the output is ASCII" "$rc"
+if printf '%s' "$ROW_OUT" | LC_ALL=C grep -q '[^ -~]x'; then rc=1; else rc=0; fi
+check "control: that ASCII grep runs at all (no match on a clean string)" "$rc"
+
+# A repo whose NESTE is NOT ASCII still emits one line per field. The renderer
+# cannot make the operator's Norwegian prose ASCII and must never try - the
+# field NAMES are the machine surface, the value is whatever was written.
+mkrepo "$ROW_ROOT/row-utf8"
+{
+  echo "# STATE - row-utf8"
+  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
+  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
+  printf 'M\xc3\x85LT i dag: ingenting gjenst\xc3\xa5r.\n'
+} > "$ROW_ROOT/row-utf8/STATE.md"
+ROW_U="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-utf8 2>/dev/null)"
+ROW_UBAD="$(printf '%s\n' "$ROW_U" | grep -v '^[a-z][a-z-]*=' || true)"
+[ -z "$ROW_UBAD" ]; check "row: non-ASCII NESTE still yields one field per line" $?
+printf '%s\n' "$ROW_U" | grep -q '^neste=.*ingenting'
+check "row: non-ASCII NESTE is carried through, never mangled or dropped" $?
+
+# An unknown repo must REFUSE. Emitting an empty block would be the same defect
+# as a bare `command=`: a consumer reading ^status= would get nothing back and
+# read it as a repo with no status, which is a real and different state ("?").
+ROW_ERR="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>&1)"; rc=$?
+[ "$rc" -eq 2 ]; check "row: an unknown repo exits 2" $?
+printf '%s\n' "$ROW_ERR" | grep -q 'no-such-repo'
+check "row: the refusal names the repo it could not find" $?
+ROW_ERR_OUT="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row no-such-repo 2>/dev/null)"
+[ -z "$ROW_ERR_OUT" ]; check "row: a refusal writes nothing at all to stdout" $?
+
+# A missing value is a usage error, not a silently empty row.
+CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row >/dev/null 2>&1
+[ $? -eq 2 ]; check "row: --row with no value exits 2" $?
+
+# Read-only, asserted rather than assumed: this is the one property every
+# rendering in this file shares and the one a new rendering is most likely to
+# break.
+ROW_BEFORE="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
+CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-repo >/dev/null 2>&1
+ROW_AFTER="$(find "$ROW_ROOT" "$ROW_COORD" -type f | sort | while read -r f; do printf '%s %s\n' "$f" "$(stat -f %m "$f")"; done)"
+[ "$ROW_BEFORE" = "$ROW_AFTER" ]; check "row: writes nothing - no file added, removed or touched" $?
+
+# upushet: the three states must stay distinguishable. This fixture has no
+# upstream at all, so the honest answer is "not measured", never 0 - the same
+# rule DRT's ? and coord-count's exit 3 carry. A 0 here would say "nothing is
+# waiting to be pushed" about a repo that has never had a remote.
+printf '%s\n' "$ROW_OUT" | grep -q '^upushet=?$'
+check "row: a repo with no upstream reports upushet=?, never 0" $?
+
+# Known-positive control, and the case the field exists for: a real upstream
+# with a real unpushed commit must report the count. Without this the ? above
+# would pass on a field that can only ever say ?.
+ROW_UP="$ROW_ROOT/row-upstream"
+mkrepo "$ROW_UP"
+{
+  echo "# STATE - row-upstream"
+  printf '## %s NESTE %s START HER\n' "$HAND" "$EMDASH"
+  echo "<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->"
+  echo "Next step."
+} > "$ROW_UP/STATE.md"
+git -C "$ROW_UP" add -A >/dev/null 2>&1
+git -C "$ROW_UP" commit -qm "state" >/dev/null 2>&1
+ROW_BARE="$(mktemp -d)/origin.git"
+git init -q --bare "$ROW_BARE" >/dev/null 2>&1
+git -C "$ROW_UP" remote add origin "$ROW_BARE" >/dev/null 2>&1
+git -C "$ROW_UP" push -q -u origin HEAD >/dev/null 2>&1
+ROW_U0="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
+printf '%s\n' "$ROW_U0" | grep -q '^upushet=0$'
+check "row: control - an upstream with everything pushed reports upushet=0" $?
+echo "more" > "$ROW_UP/extra.txt"
+git -C "$ROW_UP" add -A >/dev/null 2>&1
+git -C "$ROW_UP" commit -qm "unpushed work" >/dev/null 2>&1
+ROW_U1="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" --row row-upstream 2>/dev/null)"
+printf '%s\n' "$ROW_U1" | grep -q '^upushet=1$'
+check "row: one unpushed commit reports upushet=1" $?
+
+# The table is UNCHANGED by all of this. --row is a rendering, so a field that
+# only exists there must not leak into the view a human reads.
+ROW_TABLE="$(CLAUDE_COORD_DIR="$ROW_COORD" "$BOARD" --roots "$ROW_ROOT" 2>/dev/null)"
+if printf '%s' "$ROW_TABLE" | grep -qi 'upushet'; then rc=1; else rc=0; fi
+check "row: upushet does not leak into the table" "$rc"
+
+# Structural, in the shape this file already uses for "no write path exists":
+# --row must not run its own repo discovery. A second scan is the defect the
+# rendering rule exists to prevent, and a behavioural test cannot see it.
+grep -q -- '--row' "$BOARD"; check "row: board.sh actually carries the --row flag" $?
+
+/bin/rm -rf "$ROW_ROOT" "$ROW_COORD" 2>/dev/null
+
+
 echo ""
 echo "board-selftest: $PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ] || exit 1

scripts/board.sh

@@ -80,8 +80,9 @@
 # the exact command to start a session there. The 38-char cut is the table
 # column's property, not the record's, so the briefing prints NESTE uncut. Each
 # command is derived by CALLING route.sh with that repo's own four traits -
-# next-cost alone cannot yield it, since the advisor flag is a property of the
+# next-cost alone cannot yield it, since it names the row rather than spelling
-# ROW. A repo with no route line is told so rather than handed a guess.
+# the command, and there must be exactly one spelling in circulation. A repo
+# with no route line is told so rather than handed a guess.
 #
 # --brief is still read-only: it writes nothing. The file write lives in
 # brief-nightly.sh, which renders to a temp file and renames it into place, and
@@ -200,14 +201,24 @@
 #            --path P --verification V --reversibility R --scope S
 #            --rationale "why"
 #
-# Model, effort and --advisor come from route.sh's row table, never from a
+# Model and effort come from route.sh's row table, never from a --model/--effort
-# --model/--effort pair: the advisor flag is a property of the ROW, and a
+# pair: the rubric has exactly one copy, and a dispatch that took the model
-# dispatch that took the model directly would have no honest source for it.
+# directly would be a second, unscored way to reach the same decision.
 # --target-pane is a MEASUREMENT (morning --probe-panes) and has no default -
 # see the dispatch() comment for what happens when it is guessed.
 #
+# --row <repo> is a SEVENTH rendering: the table's row for ONE repo, as
+# `field=value` lines a program can grep instead of columns a human counts
+# spaces in. It exists because the columns WERE misread - FLY read as ORDRE on
+# 2026-09-11 - and because every other rendering a program consumes is already
+# key=value. It takes no position: every field is a value the scan already
+# holds, under the name its column carries, with `neste` last and uncut.
+# One exception, stated rather than blended in: `upushet` is not a column, and
+# is measured once for the named repo only. See row_one() for what it can and
+# cannot claim.
+#
 # Usage: board.sh [--roots <dir>[,<dir>...]] [--plain]
-#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage ...]
+#                 [--brief|--plan|--inbox-plan|--dispatch|--voyage|--row <repo>]
 #                 [--focus "<prose>"]
 # Env:   CLAUDE_COORD_DIR overrides the mailbox root.
 #        BOARD_ROOTS      overrides the default scan roots.
@@ -224,6 +235,7 @@ INBOX_PLAN=0
 FOCUS=""
 DISPATCH=0
 VOYAGE=0
+ROW=0; ROW_REPO=""
 D_REPO=""; D_PROMPT=""; D_PANE=""; D_ORDER=""
 D_PATH=""; D_VER=""; D_REV=""; D_SCOPE=""; D_RAT=""
 
@@ -238,10 +250,16 @@ while [ $# -gt 0 ]; do
     # bash 3.2: `shift 2` past the end of $# is a no-op -> would loop forever.
     --roots) [ $# -ge 2 ] || { echo "board: --roots requires a value" >&2; exit 2; }
              ROOTS="$2"; shift 2 ;;
-    # Four renderings of one scan, so exactly one may be selected: last wins.
+    # Renderings of one scan, so exactly one may be selected: last wins.
-    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --brief) BRIEF=1; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --plan)  PLAN=1; BRIEF=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; shift ;;
+    --inbox-plan) INBOX_PLAN=1; BRIEF=0; PLAN=0; VOYAGE=0; ROW=0; shift ;;
+    # One repo, one field=value line per column. Same `shift 2` guard as every
+    # other value flag, for the same bash 3.2 reason - and a MISSING value is a
+    # usage error rather than an empty row, since an empty row reads exactly
+    # like a repo whose every column is blank.
+    --row) [ $# -ge 2 ] || { echo "board: --row requires a repo name" >&2; exit 2; }
+           ROW=1; ROW_REPO="$2"; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; DISPATCH=0; shift 2 ;;
     # Raw operator prose, forwarded verbatim by the driver: it does not
     # tokenize, match or normalize, so every bit of that work is here. Same
     # `shift 2` guard as --roots, for the same bash 3.2 reason.
@@ -249,8 +267,8 @@ while [ $# -gt 0 ]; do
              FOCUS="$2"; shift 2 ;;
     # Dispatch rendering: one repo, one prompt file, one startup command. Same
     # `shift 2` guard as every other value flag, for the same bash 3.2 reason.
-    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; shift ;;
+    --dispatch) DISPATCH=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; VOYAGE=0; ROW=0; shift ;;
-    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; shift ;;
+    --voyage) VOYAGE=1; BRIEF=0; PLAN=0; INBOX_PLAN=0; DISPATCH=0; ROW=0; shift ;;
     --repo) [ $# -ge 2 ] || { echo "board: --repo requires a value" >&2; exit 2; }
             D_REPO="$2"; shift 2 ;;
     --prompt-file) [ $# -ge 2 ] || { echo "board: --prompt-file requires a value" >&2; exit 2; }
@@ -1079,9 +1097,9 @@ rows() {
 
 # --- Briefing rendering (--brief) ------------------------------------------
 # The startup command for one repo, derived from that repo's OWN route line by
-# calling route.sh. Deriving it from next-cost instead would not work even in
+# calling route.sh. Deriving it from next-cost instead would mean a second
-# principle: the advisor flag is a property of the ROW, and two rows can share
+# writer for the same command string, spelled from a rubric NAME rather than
-# a model/effort pair while differing on it. A repo with no route line gets its
+# from the row table itself. A repo with no route line gets its
 # next-cost printed and is told where the command comes from - a guessed
 # command would read as authoritative while being a guess, which is worse than
 # no command at all.
@@ -1303,13 +1321,18 @@ fi
 # brief-nightly.sh already owns the briefing's write.
 #
 # THE COST COMES FROM route.sh's ROW TABLE, never from a --model/--effort pair
-# handed in. That is not tidiness: `--advisor opus` is a property of the ROW,
+# handed in. That is not tidiness: the rubric is a policy with exactly one copy,
-# two rows share a model/effort pair while differing on it, and the CLI accepts
+# and a dispatch accepting the model directly would be a second way to reach the
-# a wrong advisor silently (it drops it for a Fable main model without failing).
+# same decision - one that records no traits, no rationale and no next-cost, so
-# A dispatch that took the model directly would have no source for that flag,
+# nothing afterwards can say whether the ROUTING was wrong or the SCORING was.
-# and both available guesses are wrong in the same direction - a session that
+# Scoring the four traits is the caller's judgement; turning them into a command
-# looks peer-reviewed without being. Scoring the four traits is the caller's
+# is this lookup.
-# judgement; turning them into a command is this lookup.
+#
+# Until 2026-09-12 this paragraph rested on `--advisor opus` instead: the flag
+# was a property of the ROW, so a model/effort pair could not yield it. That
+# rule is struck (see route.sh), and the argument is rewritten rather than
+# quietly left standing on a premise the code no longer has - a comment
+# defending a mechanism that was removed is how the next session "restores" it.
 dispatch() {
   # --target-pane is REQUIRED and has no default, the same rule route.sh's
   # --last-effort carries: it is a MEASUREMENT of the world (does the target
@@ -1387,8 +1410,8 @@ dispatch() {
   [ -d "$d_dir" ] || { echo "board: the directory for $D_REPO does not exist: $d_dir" >&2; exit 2; }
 
   # Rejected traits REFUSE. Degrading to a command without them is the worst
-  # available outcome: a command missing --advisor is indistinguishable from a
+  # available outcome: a command built on three scored traits and one silently
-  # row that legitimately has none.
+  # dropped one is indistinguishable from a fully scored decision.
   d_route="$(bash "$ROUTE" --path "$D_PATH" --verification "$D_VER" \
              --reversibility "$D_REV" --scope "$D_SCOPE" --rationale "$D_RAT" 2>&1)" || {
     echo "board: route.sh rejected the traits, so there is no command to give:" >&2
@@ -2097,6 +2120,114 @@ if [ "$VOYAGE" -eq 1 ]; then
   exit 0
 fi
 
+# --- Row rendering (--row <repo>) -------------------------------------------
+# A SEVENTH rendering of the same scan, never a second scan, and read-only like
+# every other one. (Order 20260912T202210Z-7588027378 calls it the sixth; by
+# this file's own numbering --inbox-plan is the fourth and --dispatch the fifth,
+# so it is the seventh. The count is corrected here rather than carried wrong,
+# for the same reason every other number in this file is measured.)
+#
+# WHAT IT ANSWERS: the table's row for ONE repo, as `field=value` lines a
+# program can grep. The table is fixed-width and is for a human; reading a
+# column off it by eye is how FLY was misread as ORDRE on 2026-09-11, and a
+# 34-character repo key already shifts a row two characters right - a stated,
+# unclosed gap that makes counting spaces strictly worse than it looks. Every
+# other rendering a program consumes (--plan, --inbox-plan, --dispatch) is
+# key=value for exactly this reason; the default view was the one left out.
+#
+# It takes NO position and adds NO judgement: every field is a value $RECORDS
+# already holds, printed under the name its column carries. The three mailbox
+# counts are three separate fields because they are three separate facts - INN
+# is "others wait on you", ORDRE is "work waits on this repo", FLY is "someone
+# took an order" - and this rendering exists because they were confused.
+#
+# ONE FIELD IS NOT A RENDERING, and it is named rather than blended in:
+# `upushet` is not a column the scan computes. It is measured here, once, for
+# the named repo only, because the order asks for it and because "nothing is
+# waiting to be pushed" and "nobody looked" are exactly the pair this repo
+# refuses to render alike. One reading for one repo in a one-repo view is not a
+# scan; it never enters the table, the plan or the briefing.
+#
+# It reads the remote-TRACKING ref, not the remote. That is a real bound, not a
+# hedge: a stale ref under-reports after someone else pushed, and over-reports
+# after a push this checkout has not fetched. The honest reading of `upushet=N`
+# is "the local ref says N", and `git ls-remote` is still what a claim ABOUT
+# THE WORLD costs.
+row_unpushed() {
+  ru_up="$(git -C "$1" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)" || return 1
+  [ -n "$ru_up" ] || return 1
+  ru_n="$(git -C "$1" rev-list --count "$ru_up..HEAD" 2>/dev/null)" || return 1
+  case "$ru_n" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s' "$ru_n"
+}
+
+row_one() {
+  r_rec="$(awk -F'|' -v n="$ROW_REPO" '$3==n {print; exit}' "$RECORDS")"
+  # REFUSE rather than emit an empty block. A consumer reading ^status= off an
+  # empty output gets nothing back and reads it as a repo with no board line -
+  # which is a real, different state this very rendering spells as `?`.
+  if [ -z "$r_rec" ]; then
+    echo "board: no repo named '$ROW_REPO' in the scanned roots" >&2
+    return 2
+  fi
+  r_disp="$(printf '%s' "$r_rec" | cut -d'|' -f4)"
+  r_cost="$(printf '%s' "$r_rec" | cut -d'|' -f5)"
+  r_inn="$(printf '%s' "$r_rec" | cut -d'|' -f6)"
+  r_drt="$(printf '%s' "$r_rec" | cut -d'|' -f7)"
+  r_alder="$(printf '%s' "$r_rec" | cut -d'|' -f8)"
+  r_siste="$(printf '%s' "$r_rec" | cut -d'|' -f9)"
+  r_dir="$(printf '%s' "$r_rec" | cut -d'|' -f10)"
+  r_blocked="$(printf '%s' "$r_rec" | cut -d'|' -f11)"
+  r_ordre="$(printf '%s' "$r_rec" | cut -d'|' -f12)"
+  r_ordreage="$(printf '%s' "$r_rec" | cut -d'|' -f13)"
+  r_fly="$(printf '%s' "$r_rec" | cut -d'|' -f14)"
+  r_flyage="$(printf '%s' "$r_rec" | cut -d'|' -f15)"
+  r_voy="$(printf '%s' "$r_rec" | cut -d'|' -f16)"
+  # `neste` is free prose and may contain a literal '|', which is why it is the
+  # last field of the record - so it is taken as "everything from 17 on", never
+  # as field 17.
+  r_neste="$(printf '%s' "$r_rec" | cut -d'|' -f17-)"
+
+  # The TOKEN, not the display string: the table renders a blocked repo as
+  # `blocked>target` because one column has to carry both, and this rendering
+  # has two fields and no such constraint. A consumer matching status=blocked
+  # must not have to know about the arrow.
+  case "$r_disp" in
+    blocked\>*) r_status=blocked ;;
+    *)          r_status="$r_disp" ;;
+  esac
+
+  r_unpushed="$(row_unpushed "$r_dir")" || r_unpushed="?"
+
+  echo "repo=$ROW_REPO"
+  echo "dir=$r_dir"
+  echo "status=$r_status"
+  echo "blocked-on=$r_blocked"
+  echo "next-cost=$r_cost"
+  echo "inn=$r_inn"
+  echo "ordre=$r_ordre"
+  echo "ordre-alder=$r_ordreage"
+  echo "fly=$r_fly"
+  echo "fly-alder=$r_flyage"
+  echo "voy=$r_voy"
+  echo "drt=$r_drt"
+  echo "alder=$r_alder"
+  echo "siste=$r_siste"
+  echo "upushet=$r_unpushed"
+  # LAST, and for the same reason it is last in the record: it is free prose
+  # lifted out of a STATE.md, so anything placed after it would be unreachable
+  # for a consumer reading from the end. Printed WHOLE - the 38-character cut
+  # belongs to the table column, and cutting here would make the cut string the
+  # only copy, which is the defect --brief was built to stop.
+  echo "neste=$r_neste"
+  return 0
+}
+
+if [ "$ROW" -eq 1 ]; then
+  row_one
+  exit $?
+fi
+
 count() { awk -F'|' -v b="$1" '$1==b' "$RECORDS" | wc -l | tr -d ' '; }
 
 echo "BOARD - tverr-repo oppmerksomhetstavle ($(awk 'END{print NR}' "$RECORDS") repo)"

scripts/route-selftest.sh

@@ -141,7 +141,8 @@ check "all 81 trait combinations emit one of the 4 calculator rows" $?
 # to show the same string back. Runs for all six rows.
 ROOT="$(mktemp -d)"
 MBOX="$(mktemp -d)"
-cleanup() { /bin/rm -rf "$ROOT" "$MBOX" 2>/dev/null; }
+RL_ROOT=""
+cleanup() { /bin/rm -rf "$ROOT" "$MBOX" ${RL_ROOT:+"$RL_ROOT"} 2>/dev/null; }
 trap cleanup EXIT
 
 rt_bad=0
@@ -359,13 +360,14 @@ check "board + route + route-last stacked still yield prose in NESTE" $?
 # --- 9. Startup command and fallback --------------------------------------
 # Two spellings of ONE decision: the rubric name for the board line, the CLI
 # alias for the command the operator pastes. They must never disagree.
-# These assert the WHOLE string, advisor included, so section 14's rule cannot
+# These assert the WHOLE string, so no flag can be added back to the emitted
-# be widened without a deliberate edit here - the exact-match is the tripwire.
+# command without a deliberate edit here - the exact-match is the tripwire that
+# keeps section 14's absence rule from being widened around.
 cmd="$(field partial strong cheap local command)"
 [ "$cmd" = "claude --model opus --effort high" ]; check "command mirrors the row (opus/high)" $?
 
 cmd="$(field known strong cheap local command)"
-[ "$cmd" = "claude --model sonnet --effort high --advisor opus" ]; check "command mirrors the row (sonnet/high)" $?
+[ "$cmd" = "claude --model sonnet --effort high" ]; check "command mirrors the row (sonnet/high)" $?
 
 # The rubric requires ALWAYS naming one row cheaper as the quota fallback.
 fb="$(field partial strong cheap local fallback)"
@@ -377,7 +379,7 @@ fb="$(field known strong cheap local fallback)"
 # The fallback needs its own pasteable command or the operator translates by
 # hand at exactly the moment they are under quota pressure.
 fbc="$(field partial strong cheap local fallback-command)"
-[ "$fbc" = "claude --model sonnet --effort xhigh --advisor opus" ]; check "fallback ships its own command" $?
+[ "$fbc" = "claude --model sonnet --effort xhigh" ]; check "fallback ships its own command" $?
 
 # --- 10. The command carries no 'cd' --------------------------------------
 # One repo per terminal tab: a startup command prefixed with cd is wrong by
@@ -393,9 +395,9 @@ check "no emitted command contains a cd prefix" "$rc"
 # Model aliases are whatever the INSTALLED claude accepts - never hardcoded
 # without a gate, because an alias that stops resolving turns every emitted
 # command into a paste that fails.
-# Capture the effort TOKEN only. Anything may legitimately follow it on the
+# Capture the effort TOKEN only. The command ends at the effort today, but the
-# command line (--advisor does, since section 14), and a match that swallowed
+# pattern stays tail-tolerant: a match that swallowed whatever a later flag
-# the tail would report a valid effort as invalid.
+# added would report a valid effort as invalid.
 efforts="$(printf '%s' "$out" | sed -n 's/^command=claude --model [a-z]* --effort \([a-z]*\).*/\1/p')"
 case "|low|medium|high|xhigh|max|" in *"|$efforts|"*) rc=0 ;; *) rc=1 ;; esac
 check "emitted effort is in the verified effort set" "$rc"
@@ -467,117 +469,129 @@ check "route.sh no longer claims effort is unobservable from inside" "$rc"
 grep -q 'CLAUDE_EFFORT' "$R"
 check "route.sh names the source the caller should measure from" $?
 
-# --- 14. The advisor: capability gap first, stakes second -----------------
+# --- 14. The advisor is NOT the rubric's to emit --------------------------
-# The advisor is a second, stronger model consulted mid-task, so a session
+# Struck by operator decision 2026-09-12
-# carrying one costs more than a session without. It must therefore fire where
+# (~/.claude/docs/2026-09-12-helhetlig-vurdering-arbeidssystemet.md, cut row 3).
-# there is a NEED and nowhere else, or it decays into the always-on
+# The rule it replaces fired on two needs - Sonnet rows always, Opus rows at
-# advisorModel setting it exists to replace. Two independent needs qualify,
+# costly|one-way stakes - and read well. What killed it was a measurement, not
-# and they turn out to be almost disjoint.
+# a change of taste: of 54 dispatches the PM issued 08.-12.09, ZERO carried
+# --advisor opus, because the operator starts sessions by hand and pastes the
+# model and effort, not the whole line. A rule nothing honours is not a policy,
+# it is a claim about the world that the world disagrees with - and this repo's
+# own standing rule is that an emitted value must be evidence, never decoration.
 #
-# 1. THE MAIN MODEL IS SONNET (rows 1-2). Here opus is a genuine capability
+# So the calculator emits no advisor at all, and the advisor becomes what it
-#    lift, not a peer: opus judgement at sonnet cost. This is the load-bearing
+# already was in practice: an operator decision per session. That is a strictly
-#    half, because every fallback-command is one row cheaper and the cheapest
+# SAFER direction for the one thing the old rule protected - the quota fallback
-#    rows are Sonnet - so this is what makes the QUOTA FALLBACK safe to take.
+# is still one row cheaper, it just no longer implies a capability lift nobody
-#    Pinned below by the row-3-falls-back-to-row-2 case.
+# was taking.
 #
-# 2. A MISTAKE IS EXPENSIVE TO UNDO (reversibility costly|one-way). On an Opus
+# Pinned as an ABSENCE over the whole trait space rather than on four sampled
-#    row the advisor is a peer review rather than a lift, which is worth
+# rows, because the claim is that no path emits it - the same "no write path
-#    paying for when being wrong is not cheap to reverse.
+# exists" argument the channel split uses. An absence check is worthless
-#
+# without a known-positive control, so the sweep's own grep is proven able to
-# The two barely overlap: costly forces row 3 and one-way forces row 4, so a
+# find a planted advisor before it is trusted to report none.
-# Sonnet row ALWAYS has reversibility=cheap and trigger 2 can never reach it.
-# Rule 1 covers the Sonnet rows, rule 2 covers the Opus rows.
-#
-# What is deliberately NOT a trigger: verification=none on its own. The set it
-# would add beyond rule 2 is exactly {verification=none AND
-# reversibility=cheap} - mistakes that are cheap to reverse. It survives on the
-# Sonnet rows only via rule 1, which is about the model, not the trait.
 
 adv="$(field known strong cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 1 (Sonnet/high) always carries an advisor" $?
+check "row 1 (Sonnet/high) carries no advisor" "$rc"
 
 adv="$(field known weak cheap local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 2 (Sonnet/xhigh) always carries an advisor" $?
+check "row 2 (Sonnet/xhigh) carries no advisor" "$rc"
 
 adv="$(field known strong costly local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "reversibility=costly carries an advisor onto an Opus row" $?
+check "reversibility=costly no longer pulls an advisor onto an Opus row" "$rc"
 
 adv="$(field known strong one-way local command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "reversibility=one-way carries an advisor onto an Opus row" $?
-
-# The Opus rows reached WITHOUT expensive stakes are the whole no-advisor set.
-adv="$(field partial strong cheap local command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 3 via path=partial at cheap stakes takes NO advisor" "$rc"
+check "reversibility=one-way no longer pulls an advisor onto an Opus row" "$rc"
-
-adv="$(field known strong cheap multi-file command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 3 via scope=multi-file at cheap stakes takes NO advisor" "$rc"
-
-adv="$(field known strong cheap cross-cutting command)"
-if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 4 via scope=cross-cutting at cheap stakes takes NO advisor" "$rc"
-
-# Rows 5-6 (Fable) are unreachable through this calculator now - section 1
-# pins that directly, and section 3's closed vocabulary covers every command
-# this script can ever emit. There is nothing left here for "Fable takes no
-# advisor" to test: that fact still holds (gated against the installed claude
-# by the CLI check below), but row_advisor()'s branch for it can no longer be
-# exercised through the public interface.
 
+# The fallback is the half the old rule called load-bearing, so it is pinned
+# in its own right: dropping a row under quota pressure must not reintroduce
+# the flag by the back door.
 adv="$(field known strong one-way local fallback-command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "row 4 fallback to row 3 keeps the advisor at one-way stakes" $?
-
-# THE POINT OF RULE 1, pinned. Row 3 at cheap stakes takes no advisor, but its
-# quota fallback is row 2 - a Sonnet row - which does. Dropping a row under
-# quota pressure must not silently drop the safety net with it.
-adv="$(field partial strong cheap local fallback-command)"
-printf '%s' "$adv" | grep -q -- '--advisor opus'
-check "an Opus row with no advisor still falls back to an advised Sonnet row" $?
-
-adv="$(field known strong cheap cross-cutting fallback-command)"
 if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-check "row 4 falling back to row 3 at cheap stakes stays unadvised" "$rc"
+check "the row-4 fallback carries no advisor either" "$rc"
 
-# Closed vocabulary, same reason as the row table: one spelling in circulation.
+adv="$(field partial strong cheap local fallback-command)"
-# fable is not merely weaker here, it is REJECTED as an advisor outright.
+if printf '%s' "$adv" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
-allout="$("$R" --path known --verification strong --reversibility one-way \
+check "an Opus row falling back to a Sonnet row carries no advisor" "$rc"
-          --scope cross-cutting --rationale x 2>/dev/null)"
-bad="$(printf '%s' "$allout" | grep -o -- '--advisor [a-z0-9-]*' | grep -v -- '--advisor opus')"
-[ -z "$bad" ]; check "the only advisor value ever emitted is opus:${bad:- none other}" $?
 
-if command -v claude >/dev/null 2>&1; then
+# THE SWEEP: every trait combination the calculator accepts, every line of
-  # A real gate that spends NO tokens. Advisor validation runs BEFORE the
+# output. 81 combinations, so a rule surviving on one unsampled corner cannot
-  # empty-prompt check, so `-p ""` reaches the validator and then exits: a
+# hide. Accumulated into one string and grepped once - a per-combination check
-  # valid advisor fails on the missing prompt, an invalid one fails on itself.
+# would add 81 lines to the summary and drown the rest of the suite.
-  # --help cannot gate this - it short-circuits before option validation, so
+sweep=""
-  # even an unknown flag exits 0 and the gate would pass without testing.
+for s_path in known partial undetermined; do
-  # Row 1-2's trigger is "sonnet main + opus advisor" specifically, so the
+  for s_ver in strong weak none; do
-  # main model is pinned rather than left to the ambient default.
+    for s_rev in cheap costly one-way; do
-  ADVOUT="$(claude --model sonnet --advisor opus -p "" 2>&1 | head -3)"
+      for s_sc in local multi-file cross-cutting; do
-  if printf '%s' "$ADVOUT" | grep -q 'unknown option'; then rc=1; else rc=0; fi
+        sweep="$sweep
-  check "installed claude accepts the --advisor flag at all" "$rc"
+$("$R" --path "$s_path" --verification "$s_ver" --reversibility "$s_rev" \
+      --scope "$s_sc" --rationale x 2>/dev/null)"
+      done
+    done
+  done
+done
+if printf '%s' "$sweep" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+check "no advisor in any output over all 81 trait combinations" "$rc"
 
-  if printf '%s' "$ADVOUT" | grep -q 'cannot advise'; then rc=1; else rc=0; fi
+# Known-positive control: the grep above reports an absence, so it must be
-  check "installed claude accepts opus advising a sonnet main" "$rc"
+# shown able to report a presence. Without this the sweep would pass just as
+# happily against an empty string.
+if printf '%s' "$sweep claude --advisor opus" | grep -q -- '--advisor'; then rc=0; else rc=1; fi
+check "control: the sweep's grep does find a planted advisor" "$rc"
+
+# The help text is the rubric's published form, so the rule has to leave there
+# too - a doc line nothing tests is a doc line that drifts, and a struck rule
+# still written down is worse than one never removed: it reads as current.
+# The literal flag string is absent from route.sh ENTIRELY, including the
+# paragraph that records what was struck - that paragraph names "an opus
+# advisor flag" in words on purpose. A blunt grep cannot tell a description
+# from a specification (the same reason the cache assertion in coord-selftest
+# runs on an extracted path rather than the whole file), and keeping the
+# string out is cheaper than teaching the check to read prose. Do not
+# "restore the quote" here.
+HELPOUT="$("$R" --help 2>/dev/null)"
+if printf '%s' "$HELPOUT" | grep -q -- '--advisor opus'; then rc=1; else rc=0; fi
+check "--help no longer documents emitting --advisor opus" "$rc"
+
+if printf '%s' "$HELPOUT" | grep -q 'THE ADVISOR is emitted'; then rc=1; else rc=0; fi
+check "--help no longer carries the advisor rule block" "$rc"
+
+# Removing the rule silently would leave a reader guessing whether the advisor
+# is forbidden, forgotten, or someone else's. It is the third, and the help
+# says which.
+printf '%s' "$HELPOUT" | grep -q 'advisor is an operator decision per session'
+check "--help states whose decision the advisor is instead" $?
+
+grep -q 'advisor is an operator decision per session' "$R"
+check "route.sh itself carries that sentence, not just its help output" $?
+
+# --- 14b. Old route lines still parse ------------------------------------
+# Backward compatibility, pinned rather than assumed. Measured on the real
+# tree the day the rule was struck: 0 of 48 `<!-- route:` lines anywhere in
+# ~/repos carry an advisor field at all, so nothing in circulation depends on
+# it - but board.sh's route_cmd_for() reads these lines by trait NAME, and a
+# reader that broke on an unknown field would turn a STATE.md written last
+# month into "that repo has no route line", which is the misreading this whole
+# file exists to prevent.
+RL_ROOT="$(mktemp -d)"; mkdir -p "$RL_ROOT/repo-legacy"
+( cd "$RL_ROOT/repo-legacy" && git init -q . 2>/dev/null ) || true
+{
+  printf '# STATE\n\n## NESTE - START HER\n'
+  printf '<!-- board: status=planned; blocked-on=-; next-cost=Sonnet 5/high -->\n'
+  printf '<!-- route: path=known; verification=strong; reversibility=cheap; scope=local; advisor=opus; rationale=legacy line written before the rule was struck -->\n'
+  printf 'legacy next step\n'
+} > "$RL_ROOT/repo-legacy/STATE.md"
+RL_OUT="$("$BOARD" --roots "$RL_ROOT" --plan 2>/dev/null)"
+printf '%s' "$RL_OUT" | grep -q '^command=claude --model sonnet --effort high$'
+check "a route line carrying a legacy advisor= field still yields a command" $?
+if printf '%s' "$RL_OUT" | grep -q -- '--advisor'; then rc=1; else rc=0; fi
+check "and the command derived from it carries no advisor" "$rc"
 
-  # row_advisor() never emits '--advisor fable' - it depends on the opposite
-  # direction: whether opus can advise a FABLE main model. That is the fact
-  # rows 5-6's suppression rests on, so that is what must be gated. (Measured
-  # at CC 2.1.226: fable is now itself accepted as an advisor for opus/sonnet
-  # mains - a capability-ordering change worth flagging to the operator, but
-  # not what this check exists to pin.)
-  FABOUT="$(claude --model fable --advisor opus -p "" 2>&1 | head -3)"
-  printf '%s' "$FABOUT" | grep -q 'cannot advise'
-  check "installed claude still rejects opus advising a fable main" $?
-else
-  echo "  skip - claude not on PATH, advisor flag gate not run"
-fi
 
 echo ""
 echo "route-selftest: $PASS passed, $FAIL failed"

scripts/route.sh

@@ -29,10 +29,7 @@
 # departure from it is recorded in STATE as an OVERRIDE, never produced here.
 # Write "Fable 5/high" or "Fable 5/xhigh" into the board line by hand when
 # that is the right call; board.sh still parses both (route-selftest.sh
-# section 6 pins that half). The one fact worth carrying: a Fable session
+# section 6 pins that half).
-# runs without an advisor (row_advisor() below, and gated against the
-# installed claude by route-selftest.sh section 14) - informational, never a
-# gate on reaching the row, since there is no longer a gate to reach.
 #
 # Cheapest first, so the rubric's "always name one row cheaper as the quota
 # fallback" is row minus one, floored at row 1, correct by construction.
@@ -66,32 +63,14 @@
 # overkill costs quota every session - but a wrong architecture decision in a
 # published plugin costs more than either.
 #
-# THE ADVISOR is emitted into the command as '--advisor opus' - a second,
+# THE ADVISOR IS NOT EMITTED, and that is a decision rather than an omission:
-# stronger model consulted at key moments during the session. It is added on a
+# the advisor is an operator decision per session, never the rubric's. Until
-# NEED, never unconditionally: an always-on advisor is the global advisorModel
+# 2026-09-12 this calculator appended an opus advisor flag on a NEED - always on
-# setting, which burns quota on every session in every repo and is the thing
+# the Sonnet rows, and on the Opus rows at costly|one-way stakes. It was struck
-# this rule exists to replace. Two independent needs qualify:
+# on a measurement: of 54 dispatches issued 08.-12.09 not one carried the flag,
-#
+# because sessions are started by hand from the model and effort, not from the
-#   rows 1-2   ALWAYS. The main model is Sonnet, so opus is a capability LIFT
+# whole line. A rule nothing honours is not policy, and an emitted value that
-#              rather than a peer - opus judgement at sonnet cost. This is what
+# nobody acts on is decoration in a field whose only job is to be evidence.
-#              makes the FALLBACK safe to take: every fallback is one row
-#              cheaper, and the cheapest rows are the Sonnet ones.
-#   rows 3-4   only at reversibility=costly|one-way. The main model is already
-#              Opus, so the advisor buys peer review, worth paying for when a
-#              mistake is not cheap to undo.
-#
-# Rows 5-6 never reach this logic at all - the calculator cannot select them
-# (see above). Informational only: were the operator to hand-write a Fable
-# command, it would carry no advisor either way, since the CLI rejects every
-# advisor for a Fable main model.
-#
-# The two triggers barely overlap: costly forces row 3 and one-way forces row
-# 4, so a Sonnet row always has reversibility=cheap. verification=none is
-# deliberately not a third trigger - beyond the stakes rule it would only add
-# mistakes that are cheap to reverse, docs sessions among them.
-#
-# Applied per ROW, so 'fallback-command' carries its own correct answer rather
-# than the winning row's.
 #
 # WHERE IT DISAGREES WITH THE RUBRIC'S EXAMPLES. The rows are task-type labels;
 # the traits are a different classification over the same six outcomes. They
@@ -288,41 +267,14 @@ row_base_cmd() {
   esac
 }
 
-# THE ADVISOR is a second, stronger model consulted mid-task. It costs real
+# No advisor is appended here or anywhere else - the advisor is an operator
-# tokens per session, so it fires on a NEED and nowhere else - an unconditional
+# decision per session, not a property this rubric computes (struck
-# advisor is just the global advisorModel setting, which is the thing this
+# 2026-09-12, see the header). row_cmd() is therefore the row's base command
-# replaces. Two independent needs qualify, and they are almost disjoint:
+# and nothing more; it stays a function rather than collapsing into
-#
+# row_base_cmd() because the emitted command and the row table are two
-#   rows 1-2 (Sonnet)  ALWAYS. opus is a capability LIFT here, not a peer:
+# separate things that happened to converge, and a later flag would attach
-#                      opus judgement at sonnet cost. This half is what makes
+# here, to one place, for both the winning row and its fallback.
-#                      the fallback-command safe, since every fallback is one
+row_cmd() { row_base_cmd "$1"; }
-#                      row cheaper and the cheapest rows are Sonnet.
-#   rows 3-4 (Opus)    only at costly|one-way stakes, where the advisor is a
-#                      peer review and being wrong is not cheap to undo.
-#
-# Rows 5-6 (Fable) never reach this function - $ROW can only be 1-4 (see
-# SELECTION above). Informational only: the only advisor this script ever
-# emits is opus (pinned by selftest 14's "the only advisor value ever emitted
-# is opus"), and opus is refused as under-capable for a fable main model -
-# measured against the installed claude, still true at CC 2.1.226 - so a
-# hand-written Fable command carries no advisor either way.
-#
-# costly forces row 3 and one-way forces row 4, so a Sonnet row always has
-# reversibility=cheap - the stakes rule can never reach rows 1-2, and the model
-# rule never reaches rows 3-4. verification=none is deliberately NOT a trigger:
-# beyond the stakes rule it would only add cheap-to-reverse mistakes, and it
-# would put an advisor on every docs session (known/none/cheap/local).
-#
-# Applied per ROW rather than once, because the fallback is a real command the
-# operator pastes under quota pressure and must carry its own correct answer.
-row_advisor() {
-  case "$1" in
-    1|2) echo " --advisor opus" ;;
-    3|4) case "$2" in costly|one-way) echo " --advisor opus" ;; *) echo "" ;; esac ;;
-    *)   echo "" ;;
-  esac
-}
-row_cmd() { printf '%s%s\n' "$(row_base_cmd "$1")" "$(row_advisor "$1" "$REVERS")"; }
 
 FB=$((ROW - 1)); [ "$FB" -ge 1 ] || FB=1
 

skills/board/SKILL.md

@@ -23,7 +23,7 @@ description: >-
   user names no repo and no tool — choosing *between* repos is this skill. Not for
   "where were we" inside the current repo: that is this repo's own STATE.md,
   already injected at session start.
-version: "0.33.1"
+version: "0.34.0"
 ---
 
 # board — which repo deserves the next session

skills/coord-send/SKILL.md

@@ -15,7 +15,7 @@ description: >-
   covers retiring a broadcast that has become wrong or obsolete: "retract that
   broadcast", "that announcement is outdated, pull it", "trekk tilbake kringkastingen",
   "den broadcasten er utdatert".
-version: "0.33.1"
+version: "0.34.0"
 ---
 
 # coord-send — natural-language front door for inter-repo messages

skills/dispatch/SKILL.md

@@ -17,7 +17,7 @@ description: >-
   skill. Not for choosing WHICH repo deserves the next session (that is `board`),
   not for scoring model and effort alone (that is `route`), and not for sending a
   message to another repo (that is `coord-send`).
-version: "0.33.1"
+version: "0.34.0"
 ---
 
 # dispatch — hand a session a task it can actually start on
@@ -124,8 +124,8 @@ Two facts about this measurement, both verified 2026-08-16 against the installed
 
 ### 4. Score the four traits and call `--dispatch`
 
-Scoring is judgement and it is yours; the model, effort and advisor flag are a
+Scoring is judgement and it is yours; the model and effort are a lookup and are
-lookup and are `route.sh`'s. Score the task **the dispatched session** will do,
+`route.sh`'s. Score the task **the dispatched session** will do,
 using the `route` skill's trait table.
 
 Pass `--order-id <id>`, not `--prompt-file`. The emitted command is then a thin
@@ -140,13 +140,18 @@ empty prompt file, one level up.
 queue to write to. Passing both is refused: the session would be told two
 things.
 
-`--dispatch` deliberately takes no `--model`/`--effort`. `--advisor opus` is a
+`--dispatch` deliberately takes no `--model`/`--effort`. The rubric is a policy
-property of the rubric *row* — two rows share a model/effort pair while
+with exactly one copy, and a dispatch that took the model directly would be a
-differing on it, and the CLI accepts a wrong advisor silently — so a dispatch
+second, unscored way to reach the same decision — one that records no traits, no
-that took the model directly would have no honest source for that flag. If the
+rationale and no `next-cost`, so nothing afterwards could say whether the
-right call is a Fable row, the rubric cannot produce it: write that command by
+routing or the scoring was wrong. Score the traits and let the lookup spell the
-hand, and say in the handover that it is a recorded override, running without an
+command. If the right call is a Fable row, the rubric cannot produce it: write
-advisor.
+that command by hand and say in the handover that it is a recorded override.
+
+**No `--advisor` is emitted, by the rubric or by this skill.** That rule was
+struck 2026-09-12 on a measurement — 0 of 54 dispatches carried the flag. The
+advisor is an operator decision per session; do not add one to a dispatch
+command.
 
 ### 5. Verify, then hand it over
 

skills/route/SKILL.md

@@ -14,7 +14,7 @@ description: >-
   the operator names no model and no tool — choosing the model for the next
   session IS this skill. Not for choosing which REPO gets the next session:
   that is the `board` skill.
-version: "0.33.1"
+version: "0.34.0"
 ---
 
 # route — what the next session should run with
@@ -104,8 +104,7 @@ in STATE as an **override**, never as something this skill produces. If Fable
 is the right call for the next step's *form* (big-picture, review, planning),
 write the board line and the `rule` by hand — `board.sh` still parses
 "Fable 5/high" and "Fable 5/xhigh" — and say so plainly in the rationale rather
-than scoring the four traits to land there. One fact worth carrying into that
+than scoring the four traits to land there.
-override: a Fable session runs without an advisor.
 
 ## The last-session record
 
@@ -186,24 +185,26 @@ Give the operator the two closing-line items and nothing more:
   the working directory is already right. If the next step belongs in a
   different repo, say so in plain words — that is a different tab, not a `cd`.
 
-**Paste `command` verbatim, `--advisor opus` included.** The calculator decides
+**Paste `command` verbatim.** It is the row's whole spelling: model and effort,
-the advisor per row, and it is not decoration: on a Sonnet row it is what lifts
+and nothing else. Do not add flags the calculator did not emit.
-the session to Opus judgement at Sonnet cost, which is what makes the cheaper
+
-`fallback-command` safe to take under quota pressure. Dropping it because it
+**The advisor is not this skill's to decide.** Until 2026-09-12 the rubric
-looks like noise silently removes that. Equally, never *add* it to a command
+appended an opus advisor on some rows; that rule is struck, on a measurement —
-that came back without one — an unconditional advisor is the global
+of 54 dispatches issued 08.–12.09 not one carried it, because sessions are
-`advisorModel` setting, which costs quota in every session in every repo and is
+started by hand from the model and effort. The advisor is now an operator
-the failure mode this rule replaces. `route.sh --help` carries the full rule.
+decision per session. Never add `--advisor` to an emitted command on your own
+initiative; if the operator asks for one, that is their call and it belongs in
+the handover as what it is — an operator choice, not a rubric outcome.
 
 If `command` and `fallback-command` are the same as the current session's model,
 say `/clear` is enough instead — but only if no newly installed plugin or skill
 needs a fresh process to be picked up.
 
-**`--advisor` is part of that comparison, not an afterthought.** It is a launch
+**An advisor the operator asked for is part of that comparison.** It is a
-flag, so `/clear` reuses the process and keeps whatever advisor the session
+launch flag, so `/clear` reuses the process and keeps whatever advisor the
-started with. If `command` carries `--advisor opus` and this session was not
+session started with — a session that is to gain or lose one needs `/exit` and
-launched with it, `/clear` is *not* enough — the operator needs `/exit` and the
+a full command, never `/clear`. The rubric never puts it there; the operator
-full command, or the advisor silently never appears.
+does.
 
 Do not paste the whole output block. One row, the rule that produced it, the
 command.

tests/selftest.test.mjs

@@ -4,7 +4,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -12,8 +12,31 @@ import { fileURLToPath } from 'node:url';
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 const hook = join(root, 'hooks', 'scripts', 'session-start.mjs');
 
+// Every bash suite already prints its own total on its last line, and this
+// wrapper already runs all five. Capturing that line here is what makes the
+// README's numbers testable without a SECOND copy of the counting: nothing
+// re-counts `check` calls (loops make that undecidable anyway) and nothing
+// re-runs a suite to read a number the run in progress is already printing.
+// The five suites cost 212s sequentially, measured 2026-09-05 under /bin/bash
+// 3.2 - the marginal cost of the README check is zero because it consumes a
+// run that happens regardless.
+const summaries = new Map();
+
+function runSuite(name) {
+  const script = join(root, 'scripts', `${name}-selftest.sh`);
+  try {
+    summaries.set(name, execFileSync('bash', [script], { encoding: 'utf8' }));
+  } catch (err) {
+    // Record what the suite managed to print before failing, then let the
+    // failure through: a red suite must stay red here, and the README check
+    // below still gets a number to compare rather than a silent absence.
+    if (typeof err.stdout === 'string') summaries.set(name, err.stdout);
+    throw err;
+  }
+}
+
 test('coord bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'coord-selftest.sh')], { encoding: 'utf8' });
+  runSuite('coord');
 });
 
 // board.sh reads this plugin's mailbox for its INN column, so the board ships
@@ -22,7 +45,7 @@ test('coord bash selftest passes', () => {
 // through CLAUDE_PLUGIN_ROOT, so a board.sh that exists only in
 // ~/.claude/scripts/ would be missing on exactly the path production uses.
 test('board bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'board-selftest.sh')], { encoding: 'utf8' });
+  runSuite('board');
 });
 
 // route.sh is the WRITER for the next-cost field board.sh already reads, so its
@@ -31,7 +54,7 @@ test('board bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a calculator proven only elsewhere is unproven on the
 // one path production uses.
 test('route bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'route-selftest.sh')], { encoding: 'utf8' });
+  runSuite('route');
 });
 
 // pre-state-line-guard.mjs is a PreToolUse hook, so like session-start.mjs it
@@ -39,7 +62,7 @@ test('route bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, and a guard proven only elsewhere is unproven on the
 // path production actually runs.
 test('state-line-guard bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'state-line-guard-selftest.sh')], { encoding: 'utf8' });
+  runSuite('state-line-guard');
 });
 
 // The order queue is the second channel beside the mailbox, with the opposite
@@ -48,7 +71,7 @@ test('state-line-guard bash selftest passes', () => {
 // CLAUDE_PLUGIN_ROOT, so a queue proven only elsewhere is unproven where it
 // runs.
 test('orders bash selftest passes', () => {
-  execFileSync('bash', [join(root, 'scripts', 'orders-selftest.sh')], { encoding: 'utf8' });
+  runSuite('orders');
 });
 
 // The engine refuses to invent an identity from the cwd, but the hook is the
@@ -188,3 +211,69 @@ test('hook keeps mail and orders in separate blocks, mail first', () => {
   assert.ok(ctx.includes('UNTRUSTED DATA'), 'the mail block lost its authorization framing');
   assert.ok(ctx.includes('OPERATOR-AUTHORIZED'), 'the order block lost its authorization framing');
 });
+
+// --- README's selftest numbers must rot loudly ------------------------------
+//
+// The badge and the five `## Development` comments are the only public claim
+// about how much this engine is pinned by, and they are the number furthest
+// from the meter: they rotted twice in a row (529 from 0.25.0; then a badge
+// saying 868 beside comments summing to 792 - two different wrong sums of the
+// same fact, neither matching the other, on the same screen). Nothing caught
+// either, because nothing compared them to anything.
+//
+// It lives HERE rather than in one of the five bash suites, and the choice is
+// not arbitrary. The order's parenthetical suggested the suite that already
+// pins README/catalog invariants; measured before choosing, no such suite
+// exists - `grep -ln README scripts/*selftest*.sh` returns board-selftest.sh
+// alone, on two incidental hits (a prose comment and a `research/README.md`
+// fixture). Of the places that could host it, this wrapper is the only one
+// where all five numbers exist at once in a run that already happens: a check
+// inside a suite could see its own count but would have to RE-RUN the other
+// four (212s, measured 2026-09-05) to see theirs, and reading counters out of
+// the scripts is the second copy of the counting this check was asked not to
+// be. `check` calls sit inside loops, so a static count is not merely a second
+// copy - it is a wrong one.
+//
+// The truth source is each suite's own summary line, verbatim, and a suite
+// that stops printing one FAILS here rather than being skipped: an absent
+// measurement must not read as a matching one.
+function suiteTotal(name) {
+  const out = summaries.get(name);
+  assert.ok(out !== undefined,
+    `${name}-selftest produced no captured output: its total was never measured, ` +
+    'so the README comparison below would be resting on nothing');
+  // Two summary grammars, both already in the tree: coord prints
+  // `PASS=N FAIL=M`, the other four print `<name>-selftest: N passed, M failed`
+  // and orders adds `, S skipped (of T checks)`. README documents the TOTAL
+  // number of checks, so skipped ones count.
+  let m = out.match(/^\S+-selftest: (\d+) passed, (\d+) failed(?:, (\d+) skipped)?/m);
+  if (m) return Number(m[1]) + Number(m[2]) + Number(m[3] ?? 0);
+  m = out.match(/^PASS=(\d+) FAIL=(\d+)/m);
+  assert.ok(m, `${name}-selftest printed no summary line this parser recognises`);
+  return Number(m[1]) + Number(m[2]);
+}
+
+test('README states the selftest counts the suites actually reported', () => {
+  const readme = readFileSync(join(root, 'README.md'), 'utf8');
+  const suites = ['coord', 'board', 'route', 'orders', 'state-line-guard'];
+
+  let sum = 0;
+  for (const name of suites) {
+    const measured = suiteTotal(name);
+    sum += measured;
+    const line = readme.match(
+      new RegExp(`^\\s*bash scripts/${name}-selftest\\.sh\\s+#\\s+(\\d+) checks`, 'm'));
+    assert.ok(line,
+      `README's ## Development block has no "N checks" comment for ${name}-selftest.sh`);
+    assert.equal(Number(line[1]), measured,
+      `README says ${name}-selftest has ${line[1]} checks; it reported ${measured}`);
+  }
+
+  // The badge is the sum, and it is compared against the MEASURED total rather
+  // than against the five README comments: a badge agreeing with five stale
+  // comments is exactly the 868-beside-792 shape, one layer down.
+  const badge = readme.match(/badge\/selftest_checks-(\d+)-/);
+  assert.ok(badge, 'README has no selftest_checks badge to check');
+  assert.equal(Number(badge[1]), sum,
+    `README's badge says ${badge[1]} selftest checks; the five suites reported ${sum}`);
+});