Realign code with the 2026-07-31 findings-resolution rulings

The full bullet list from Implementation card bf080d9a — both ruling
batches, including the three appended mid-session by 16ef377:

- Restore subjects compose the inverse, never nest: crossing "Undo: S"
  emits "Redo: S" and vice versa; parity, not stack depth, reads a
  legacy double prefix (GitHistoryProvider.restoreSubject).
- Git-operation failures join the one-shot failure banner tier:
  BannerCenter.GitFailureBanner (undo/redo/branchSwitch/addGit), error
  tone at failure rank merged with write one-shots by recency; the
  postLoss compromise is retired at both AppModel wirings.
- order/schema optional below the board root: append-at-end reading
  (ordered siblings first, folder-name tie-break among the order-less),
  schema reads 1, both coerce-tier logged; the root keeps its
  requirements. Ranks.resolvedOrders materializes finite ranks so
  models and placement math stay untouched; first Writer rewrite
  stamps a real rank on touch, placement against an order-less sibling
  stamps that sibling inline in the same bracket. Agent guide v10
  teaches optional keys and zero-read filing. Hostile-YAML order
  shapes become coercion tests; Fixtures/Valid/optional-keys.kanban
  replaces the four retired Malformed boards.
- .gitignore is the relocation-heal noise gate: GitignoreRules pure
  matcher (standard semantics, board-root file only), loader consults
  it once per walk so matched loose files keep the stray posture;
  seeded (.DS_Store + .*.lanework-*) at board creation and template
  instantiation, healed in when missing at open — repo-nested
  included; empty file honored, existing files never edited; the
  committer's obedience via libgit2 status is pinned by test.
- Comments crash-residue sweep gates on step ownership: HistoryStep
  derives backing from its own undo expectations, backedContent unions
  both stacks, the sweep purges per-entry only what no live step owns.
- Skip-purge decoupled (16ef377): a stale-skipped coarse step strands
  whole in NativeHistoryProvider.strandedSteps — still backing, retired
  only at session end; clean exits purge as before.
- Coarse close step named "Changes to '<card>'"; the fine body-edit
  wording never leaks onto the board menu.
- Branch-switch settle clears every open card window's fine stack on
  Save All and Discard alike; the empty fold registers no coarse step.
- Close flush awaits its covering snapshot (quiesce + one generation
  bump, 1s bound), and an explicit flush now queues behind an
  in-flight one instead of skipping — the audit-caught interleaving
  could lose a close flush permanently when the debounce fired inside
  the close sequence; regression tests force both races.
- Commit comment bullets sort chronologically by created, not UUID.
- The production-unwired CardBodyEditSession.editSessionDidChange seam
  is deleted with its seam-only tests.
- Composition-root pins: beginSession composes the committer with the
  store's own EchoLedger and binds the announcer (the miswire class).
- Deliberate 06 conformance pass over every 2026-07-31-tagged
  sentence: fixed Change-custom-key subjects (the retired named
  generic was the only producer), the unbuilt Replace attachment
  vocabulary, heal commits now authored Lanework Integrity, the config
  reader scopes identity to plain [user] sections, add-git re-runs
  detection at create (a stale mode-none could initialize inside the
  user's repo), and add-git failures answer at the form or the banner.
  Structural residue filed on the Redesign board.

2554 tests / 439 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Storage/BoardModel.swift

@@ -169,11 +169,19 @@ public struct Lane: Identifiable, Sendable, Equatable {
     public let icon: FieldValue<String>
     public let iconColor: FieldValue<String>
 
-    /// Rank among lanes, ascending = left-to-right. Strict, per the frontmatter table's
-    /// required field: `BoardLoader` fails the whole load (`missingOrder`/`malformedOrder`)
-    /// rather than construct a `Lane` with a bad `order` — by the time one exists here it is
-    /// always valid. Validity is the loader's job, not this type's; that is why it is a plain
-    /// `Double` and not `FieldValue<Double>`.
+    /// Rank among lanes, ascending = left-to-right — **the reading, not necessarily the key**
+    /// (01-storage-format.md § Ordering, re-ruled 2026-07-31: `order` is optional below the board
+    /// root, and "missing or unusable reads as append-at-end").
+    ///
+    /// A lane whose `index.md` carries a usable `order` reads as that number. One that carries none
+    /// — no key, an explicit null, a non-numeric or non-finite value — reads as a rank past every
+    /// ordered sibling, materialized by `Ranks.resolvedOrders(of:stored:name:)` and tie-broken among
+    /// the other order-less lanes by folder name. Either way this is a plain, finite `Double` by the
+    /// time a `Lane` exists, which is why it is not a `FieldValue<Double>`: resolving the reading is
+    /// the loader's job, and the snapshot carries answers rather than shapes.
+    ///
+    /// The value is real enough to write down, and the Writer does exactly that on the file's first
+    /// touch (`IntegrityRules.OnTouchHeal.rankStamped`) — so the stamp changes nothing on screen.
     public let order: Double
 
     /// Width multiplier ≥ 1 (default 1 when missing or malformed). Lenient — it styles layout,
@@ -222,8 +230,10 @@ public struct Card: Identifiable, Sendable, Equatable {
     public let icon: FieldValue<String>
     public let iconColor: FieldValue<String>
 
-    /// Rank within its lane, ascending = top-to-bottom. Strict — see `Lane.order`'s doc
-    /// comment; the same reasoning applies here.
+    /// Rank within its lane, ascending = top-to-bottom — the reading, not necessarily the key. See
+    /// `Lane.order`'s doc comment; the same reasoning applies here, and a card is where it matters
+    /// most: the minimum legal agent card is a `mkdir` plus one `index.md` with no `order` at all
+    /// (08-agent-integration.md), and it lands at the bottom of its lane.
     public let order: Double
 
     /// The card's attachment file names — **flat: top-level regular files only, in Finder
@@ -291,8 +301,10 @@ public struct TrashedLane: Identifiable, Sendable, Equatable {
     /// The lane's rank **among the board's lanes**, riding along untouched — the trash move rewrites
     /// no `order` at all, so this is still the strip position a restore would want and the value the
     /// undo of a restore puts back. It is deliberately *not* what orders this row in the column
-    /// (`modified` is), and the same required, strictly validated field a live lane carries
-    /// (`Lane.order`).
+    /// (`modified` is), and it is the same optional-but-always-read field a live lane carries
+    /// (`Lane.order`): an entry that reaches the trash without one reads as append-at-end over the
+    /// container's own entries, which is inert here by construction — a restore computes a fresh
+    /// rank at its destination.
     public let order: Double
 
     /// **How many cards the lane is holding** — the row's whole other half ("Doing — 5 cards").