Realign code with the 2026-07-31 findings-resolution rulings

The full bullet list from Implementation card bf080d9a — both ruling
batches, including the three appended mid-session by 16ef377:

- Restore subjects compose the inverse, never nest: crossing "Undo: S"
  emits "Redo: S" and vice versa; parity, not stack depth, reads a
  legacy double prefix (GitHistoryProvider.restoreSubject).
- Git-operation failures join the one-shot failure banner tier:
  BannerCenter.GitFailureBanner (undo/redo/branchSwitch/addGit), error
  tone at failure rank merged with write one-shots by recency; the
  postLoss compromise is retired at both AppModel wirings.
- order/schema optional below the board root: append-at-end reading
  (ordered siblings first, folder-name tie-break among the order-less),
  schema reads 1, both coerce-tier logged; the root keeps its
  requirements. Ranks.resolvedOrders materializes finite ranks so
  models and placement math stay untouched; first Writer rewrite
  stamps a real rank on touch, placement against an order-less sibling
  stamps that sibling inline in the same bracket. Agent guide v10
  teaches optional keys and zero-read filing. Hostile-YAML order
  shapes become coercion tests; Fixtures/Valid/optional-keys.kanban
  replaces the four retired Malformed boards.
- .gitignore is the relocation-heal noise gate: GitignoreRules pure
  matcher (standard semantics, board-root file only), loader consults
  it once per walk so matched loose files keep the stray posture;
  seeded (.DS_Store + .*.lanework-*) at board creation and template
  instantiation, healed in when missing at open — repo-nested
  included; empty file honored, existing files never edited; the
  committer's obedience via libgit2 status is pinned by test.
- Comments crash-residue sweep gates on step ownership: HistoryStep
  derives backing from its own undo expectations, backedContent unions
  both stacks, the sweep purges per-entry only what no live step owns.
- Skip-purge decoupled (16ef377): a stale-skipped coarse step strands
  whole in NativeHistoryProvider.strandedSteps — still backing, retired
  only at session end; clean exits purge as before.
- Coarse close step named "Changes to '<card>'"; the fine body-edit
  wording never leaks onto the board menu.
- Branch-switch settle clears every open card window's fine stack on
  Save All and Discard alike; the empty fold registers no coarse step.
- Close flush awaits its covering snapshot (quiesce + one generation
  bump, 1s bound), and an explicit flush now queues behind an
  in-flight one instead of skipping — the audit-caught interleaving
  could lose a close flush permanently when the debounce fired inside
  the close sequence; regression tests force both races.
- Commit comment bullets sort chronologically by created, not UUID.
- The production-unwired CardBodyEditSession.editSessionDidChange seam
  is deleted with its seam-only tests.
- Composition-root pins: beginSession composes the committer with the
  store's own EchoLedger and binds the announcer (the miswire class).
- Deliberate 06 conformance pass over every 2026-07-31-tagged
  sentence: fixed Change-custom-key subjects (the retired named
  generic was the only producer), the unbuilt Replace attachment
  vocabulary, heal commits now authored Lanework Integrity, the config
  reader scopes identity to plain [user] sections, add-git re-runs
  detection at create (a stale mode-none could initialize inside the
  user's repo), and add-git failures answer at the form or the banner.
  Structural residue filed on the Redesign board.

2554 tests / 439 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

KanbanTests/GitIdentityTests.swift

@@ -106,26 +106,57 @@ struct GitConfigFileTests {
         #expect(neither == derived, "a blank value is not a value")
     }
 
-    @Test("Comments, quoting and subsections are read the way git reads them")
+    @Test("Comments and quoting are read the way git reads them")
     func theParseHandlesTheFormatsEdges() {
         let text = """
         # a comment
         ; another
-        [user "work"]
-        \tname = Wrong Section
         [user]
         \tname = "Ada # Lovelace"
         \temail = [email protected] # trailing comment
         """
 
         let identity = GitConfigFile.identity(inConfigText: text)
-        // `[user "work"]` is a subsection but still the `user` section — git reads its keys as
-        // `user.name` under a subsection name, and this parse deliberately takes the last value it
-        // meets rather than inventing subsection scoping for a file that has none in practice.
         #expect(identity.name == "Ada # Lovelace", "a `#` inside quotes is content")
         #expect(identity.email == "[email protected]", "an unquoted trailing comment is not")
     }
 
+    @Test("Reads take the last plain-section value, and no subsection's")
+    func readsTakeTheLastPlainSectionValue() {
+        // **Writes append, reads take the last** (06 ▸ Interaction with external writers, blessed
+        // 2026-07-31): "the reader — like git itself — takes the last plain-section value, which is
+        // exactly what an append produces."
+        let appended = """
+        [user]
+        \tname = Old Ada
+        \temail = [email protected]
+        [user]
+        \tname = New Ada
+        \temail = [email protected]
+        """
+        #expect(GitConfigFile.identity(inConfigText: appended).name == "New Ada")
+        #expect(GitConfigFile.identity(inConfigText: appended).email == "[email protected]")
+
+        // A subsection is a *different key* in git's model — `user.work.name`, not `user.name` — so
+        // it is not an answer to this question however late in the file it sits. Signing the user's
+        // commits with an identity they filed under a name this app never asked about would be the
+        // worse error, and 06 says plain-section for exactly that reason.
+        let subsectioned = """
+        [user]
+        \tname = Ada
+        \temail = [email protected]
+        [user "work"]
+        \tname = Work Ada
+        \temail = [email protected]
+        """
+        #expect(GitConfigFile.identity(inConfigText: subsectioned).name == "Ada")
+        #expect(GitConfigFile.identity(inConfigText: subsectioned).email == "[email protected]")
+
+        // A file with *only* a subsection names nobody, and falls through to the derived default.
+        let onlySubsection = "[user \"work\"]\n\tname = Work Ada\n\temail = [email protected]\n"
+        #expect(GitConfigFile.identity(inConfigText: onlySubsection) == (nil, nil))
+    }
+
     @Test("A config with no `[user]` section, or no config at all, names nobody")
     func absentConfigNamesNobody() throws {
         let empty = GitConfigFile.identity(inConfigText: "[core]\n\tbare = false\n")