Realign code with the 2026-07-31 findings-resolution rulings

The full bullet list from Implementation card bf080d9a — both ruling
batches, including the three appended mid-session by 16ef377:

- Restore subjects compose the inverse, never nest: crossing "Undo: S"
  emits "Redo: S" and vice versa; parity, not stack depth, reads a
  legacy double prefix (GitHistoryProvider.restoreSubject).
- Git-operation failures join the one-shot failure banner tier:
  BannerCenter.GitFailureBanner (undo/redo/branchSwitch/addGit), error
  tone at failure rank merged with write one-shots by recency; the
  postLoss compromise is retired at both AppModel wirings.
- order/schema optional below the board root: append-at-end reading
  (ordered siblings first, folder-name tie-break among the order-less),
  schema reads 1, both coerce-tier logged; the root keeps its
  requirements. Ranks.resolvedOrders materializes finite ranks so
  models and placement math stay untouched; first Writer rewrite
  stamps a real rank on touch, placement against an order-less sibling
  stamps that sibling inline in the same bracket. Agent guide v10
  teaches optional keys and zero-read filing. Hostile-YAML order
  shapes become coercion tests; Fixtures/Valid/optional-keys.kanban
  replaces the four retired Malformed boards.
- .gitignore is the relocation-heal noise gate: GitignoreRules pure
  matcher (standard semantics, board-root file only), loader consults
  it once per walk so matched loose files keep the stray posture;
  seeded (.DS_Store + .*.lanework-*) at board creation and template
  instantiation, healed in when missing at open — repo-nested
  included; empty file honored, existing files never edited; the
  committer's obedience via libgit2 status is pinned by test.
- Comments crash-residue sweep gates on step ownership: HistoryStep
  derives backing from its own undo expectations, backedContent unions
  both stacks, the sweep purges per-entry only what no live step owns.
- Skip-purge decoupled (16ef377): a stale-skipped coarse step strands
  whole in NativeHistoryProvider.strandedSteps — still backing, retired
  only at session end; clean exits purge as before.
- Coarse close step named "Changes to '<card>'"; the fine body-edit
  wording never leaks onto the board menu.
- Branch-switch settle clears every open card window's fine stack on
  Save All and Discard alike; the empty fold registers no coarse step.
- Close flush awaits its covering snapshot (quiesce + one generation
  bump, 1s bound), and an explicit flush now queues behind an
  in-flight one instead of skipping — the audit-caught interleaving
  could lose a close flush permanently when the debounce fired inside
  the close sequence; regression tests force both races.
- Commit comment bullets sort chronologically by created, not UUID.
- The production-unwired CardBodyEditSession.editSessionDidChange seam
  is deleted with its seam-only tests.
- Composition-root pins: beginSession composes the committer with the
  store's own EchoLedger and binds the announcer (the miswire class).
- Deliberate 06 conformance pass over every 2026-07-31-tagged
  sentence: fixed Change-custom-key subjects (the retired named
  generic was the only producer), the unbuilt Replace attachment
  vocabulary, heal commits now authored Lanework Integrity, the config
  reader scopes identity to plain [user] sections, add-git re-runs
  detection at create (a stale mode-none could initialize inside the
  user's repo), and add-git failures answer at the form or the banner.
  Structural residue filed on the Redesign board.

2554 tests / 439 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Storage/Ranks.swift

@@ -119,11 +119,63 @@ enum Ranks: Sendable {
         return (1...count).map { Double($0) * gap }
     }
 
+    // MARK: - The append-at-end reading
+
+    /// **Every sibling's rank, with the order-less ones read as append-at-end** — the whole of the
+    /// optional-`order` ruling's read side (01-storage-format.md § Ordering, re-ruled 2026-07-31:
+    /// "Missing or unusable `order` reads as append-at-end … order-less items sort after every
+    /// ordered sibling, among themselves by the folder-name tie-break — deterministic with zero
+    /// sibling reads, which is what makes the minimum agent card legal").
+    ///
+    /// - Parameter stored: the `order` the file actually carries, or `nil` where it carries none the
+    ///   loader can use — missing, explicitly null, non-numeric, non-finite. The four shapes are one
+    ///   answer here on purpose: the reading is stated over *usability*, not over which way a value
+    ///   failed to be usable (`IntegrityRules.resolvedOrder` is where the four are told apart, for
+    ///   the coerce-tier record).
+    /// - Parameter name: the folder name — the tie-break the design states this ordering in.
+    /// - Returns: one rank per sibling, **positionally aligned with `siblings`** (never reordered:
+    ///   callers sort afterwards, through `sortedForDisplay`, exactly as they always did).
+    ///
+    /// **The materialized ranks are `append`'s own arithmetic**, and that is the load-bearing
+    /// property rather than a convenience: the k-th order-less sibling reads as `max + 1024·k` over
+    /// the ranks actually written down, which is exactly where `append(toVisible:)` would have put it
+    /// had it been filed by the app. So the reading a board *renders* is a rank ladder the Writer can
+    /// stamp verbatim — which is what the on-touch and inline stamps do
+    /// (`BoardWriter.stampAppendAtEndOrders`), and why stamping one changes nothing on screen.
+    ///
+    /// An empty ranked set bases at `0`, so a container of nothing but order-less items reads
+    /// `1024, 2048, …` — the same board convention `append` gives an empty container's first child.
+    ///
+    /// **Accepted cost, stated by the ruling**: two order-less siblings sort by folder name rather
+    /// than by intent until something touches them.
+    static func resolvedOrders<T>(
+        of siblings: [T],
+        stored: (T) -> Double?,
+        name: (T) -> String
+    ) -> [Double] {
+        let storedOrders = siblings.map(stored)
+        var resolved = storedOrders.map { $0 ?? 0 }
+        let orderless = storedOrders.indices.filter { storedOrders[$0] == nil }
+        guard !orderless.isEmpty else { return resolved }
+
+        let base = storedOrders.compactMap { $0 }.max() ?? 0
+        let queue = orderless.sorted { name(siblings[$0]) < name(siblings[$1]) }
+        for (step, index) in queue.enumerated() {
+            resolved[index] = base + gap * Double(step + 1)
+        }
+        return resolved
+    }
+
     // MARK: - Display order
 
     /// Ascending display order: primary key `order`, ties broken by folder
     /// name (lexicographic) for deterministic rendering. Shared by the
     /// loader and the writer so both apply the same tie-break rule.
+    ///
+    /// An order-less sibling reaches here already carrying its append-at-end
+    /// reading (`resolvedOrders(of:stored:name:)`), so this comparator needs no
+    /// case for one: "after every ordered sibling, then by folder name" *is*
+    /// this rule applied to the materialized ranks.
     static func isOrderedForDisplay<T>(
         _ lhs: T, before rhs: T,
         order: (T) -> Double, name: (T) -> String