Realign code with the 2026-07-31 findings-resolution rulings

The full bullet list from Implementation card bf080d9a — both ruling
batches, including the three appended mid-session by 16ef377:

- Restore subjects compose the inverse, never nest: crossing "Undo: S"
  emits "Redo: S" and vice versa; parity, not stack depth, reads a
  legacy double prefix (GitHistoryProvider.restoreSubject).
- Git-operation failures join the one-shot failure banner tier:
  BannerCenter.GitFailureBanner (undo/redo/branchSwitch/addGit), error
  tone at failure rank merged with write one-shots by recency; the
  postLoss compromise is retired at both AppModel wirings.
- order/schema optional below the board root: append-at-end reading
  (ordered siblings first, folder-name tie-break among the order-less),
  schema reads 1, both coerce-tier logged; the root keeps its
  requirements. Ranks.resolvedOrders materializes finite ranks so
  models and placement math stay untouched; first Writer rewrite
  stamps a real rank on touch, placement against an order-less sibling
  stamps that sibling inline in the same bracket. Agent guide v10
  teaches optional keys and zero-read filing. Hostile-YAML order
  shapes become coercion tests; Fixtures/Valid/optional-keys.kanban
  replaces the four retired Malformed boards.
- .gitignore is the relocation-heal noise gate: GitignoreRules pure
  matcher (standard semantics, board-root file only), loader consults
  it once per walk so matched loose files keep the stray posture;
  seeded (.DS_Store + .*.lanework-*) at board creation and template
  instantiation, healed in when missing at open — repo-nested
  included; empty file honored, existing files never edited; the
  committer's obedience via libgit2 status is pinned by test.
- Comments crash-residue sweep gates on step ownership: HistoryStep
  derives backing from its own undo expectations, backedContent unions
  both stacks, the sweep purges per-entry only what no live step owns.
- Skip-purge decoupled (16ef377): a stale-skipped coarse step strands
  whole in NativeHistoryProvider.strandedSteps — still backing, retired
  only at session end; clean exits purge as before.
- Coarse close step named "Changes to '<card>'"; the fine body-edit
  wording never leaks onto the board menu.
- Branch-switch settle clears every open card window's fine stack on
  Save All and Discard alike; the empty fold registers no coarse step.
- Close flush awaits its covering snapshot (quiesce + one generation
  bump, 1s bound), and an explicit flush now queues behind an
  in-flight one instead of skipping — the audit-caught interleaving
  could lose a close flush permanently when the debounce fired inside
  the close sequence; regression tests force both races.
- Commit comment bullets sort chronologically by created, not UUID.
- The production-unwired CardBodyEditSession.editSessionDidChange seam
  is deleted with its seam-only tests.
- Composition-root pins: beginSession composes the committer with the
  store's own EchoLedger and binds the announcer (the miswire class).
- Deliberate 06 conformance pass over every 2026-07-31-tagged
  sentence: fixed Change-custom-key subjects (the retired named
  generic was the only producer), the unbuilt Replace attachment
  vocabulary, heal commits now authored Lanework Integrity, the config
  reader scopes identity to plain [user] sections, add-git re-runs
  detection at create (a stale mode-none could initialize inside the
  user's repo), and add-git failures answer at the form or the banner.
  Structural residue filed on the Redesign board.

2554 tests / 439 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Git/HistoryStore.swift

@@ -58,14 +58,26 @@ public final class HistoryStore {
     /// click from running `git_repository_init` twice.
     public private(set) var isAddingGit = false
 
-    /// The last add-git failure, or `nil` if the last attempt succeeded (or there hasn't been one).
+    /// The last add-git failure while the form that asked is still on screen, or `nil`.
     ///
-    /// Surfaced inline in the popover rather than as a banner: the popover is where the operation
-    /// was asked for and is still open when it answers, and 02-architecture.md's one-shot banner
-    /// vocabulary is for failures of writes the user made *elsewhere*. DESIGN does not settle
-    /// add-git's failure surface either way.
+    /// **Form-anchored operations answer at the form first** (06 ▸ Interaction with external writers,
+    /// ruled 2026-07-31): "add-git — and later sheet-asked operations like verify-remote — fail into
+    /// an inline caption in the sheet's relevant section while the sheet is up … if the sheet has been
+    /// dismissed before the answer arrives, the failure falls back to the one-shot banner above —
+    /// inline is the primary surface, never a silence trap."
+    ///
+    /// So this property is exactly the *inline* half: it is set only while `isFormVisible`, and
+    /// dismissing the form clears it ("dismissing the sheet dismisses the stale error"). The other
+    /// half is `reportFailure`, which posts the banner when the answer arrives to an empty room.
+    ///
+    /// The form is the popover's git section today and the board settings sheet once that exists —
+    /// the ruling's container moved in the 2026-07-31 popover/sheet split, its substance did not, and
+    /// `noteFormVisible(_:)` is the one line the sheet will re-point.
     public private(set) var lastFailure: GitOperationFailure?
 
+    /// Whether the form add-git was asked from is on screen right now (`noteFormVisible(_:)`).
+    public private(set) var isFormVisible = false
+
     /// **The auto-commit engine** (06-history-undo.md ▸ Rules ▸ Auto-commit), or `nil` on a board
     /// there is no repository to commit into.
     ///
@@ -152,6 +164,22 @@ public final class HistoryStore {
     @ObservationIgnored
     public var didAddGit: (@MainActor () -> Void)?
 
+    /// **The banner half of the form-anchored posture** — where a form-asked failure goes when the
+    /// form is gone (`BannerCenter.postGitFailure`). `nil` on a storeless `HistoryStore`, which has no
+    /// strip to post to; the inline half still works there.
+    @ObservationIgnored
+    public var reportFailure: (@MainActor (GitOperationFailure) -> Void)?
+
+    /// **The form appeared or was dismissed.** Dismissal clears the stale inline error, which is the
+    /// ruling's own sentence ("dismissing the sheet dismisses the stale error, retry is right there").
+    ///
+    /// A `Bool` rather than a count because there is one such form per board at a time: the popover is
+    /// built fresh on each open and the settings sheet is modal to its board window.
+    public func noteFormVisible(_ visible: Bool) {
+        isFormVisible = visible
+        if !visible { lastFailure = nil }
+    }
+
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "git")
 
     init(boardRoot: URL, mode: BoardGitMode, ledger: EchoLedger) {
@@ -283,7 +311,15 @@ public final class HistoryStore {
             Self.logger.notice("add-git initialized a repository at \(root.path, privacy: .public)")
             return true
         case .failure(let failure):
-            lastFailure = failure
+            // **Inline while the form is up, the banner when it is not** (06, ruled 2026-07-31) — the
+            // answer can outlive the surface that asked for it, and a failure with nowhere to land
+            // would be the silence trap the ruling names.
+            if isFormVisible {
+                lastFailure = failure
+            } else {
+                lastFailure = nil
+                reportFailure?(failure)
+            }
             Self.logger.error("add-git failed: \(failure.description, privacy: .public)")
             return false
         }