Realign code with the 2026-07-31 findings-resolution rulings

The full bullet list from Implementation card bf080d9a — both ruling
batches, including the three appended mid-session by 16ef377:

- Restore subjects compose the inverse, never nest: crossing "Undo: S"
  emits "Redo: S" and vice versa; parity, not stack depth, reads a
  legacy double prefix (GitHistoryProvider.restoreSubject).
- Git-operation failures join the one-shot failure banner tier:
  BannerCenter.GitFailureBanner (undo/redo/branchSwitch/addGit), error
  tone at failure rank merged with write one-shots by recency; the
  postLoss compromise is retired at both AppModel wirings.
- order/schema optional below the board root: append-at-end reading
  (ordered siblings first, folder-name tie-break among the order-less),
  schema reads 1, both coerce-tier logged; the root keeps its
  requirements. Ranks.resolvedOrders materializes finite ranks so
  models and placement math stay untouched; first Writer rewrite
  stamps a real rank on touch, placement against an order-less sibling
  stamps that sibling inline in the same bracket. Agent guide v10
  teaches optional keys and zero-read filing. Hostile-YAML order
  shapes become coercion tests; Fixtures/Valid/optional-keys.kanban
  replaces the four retired Malformed boards.
- .gitignore is the relocation-heal noise gate: GitignoreRules pure
  matcher (standard semantics, board-root file only), loader consults
  it once per walk so matched loose files keep the stray posture;
  seeded (.DS_Store + .*.lanework-*) at board creation and template
  instantiation, healed in when missing at open — repo-nested
  included; empty file honored, existing files never edited; the
  committer's obedience via libgit2 status is pinned by test.
- Comments crash-residue sweep gates on step ownership: HistoryStep
  derives backing from its own undo expectations, backedContent unions
  both stacks, the sweep purges per-entry only what no live step owns.
- Skip-purge decoupled (16ef377): a stale-skipped coarse step strands
  whole in NativeHistoryProvider.strandedSteps — still backing, retired
  only at session end; clean exits purge as before.
- Coarse close step named "Changes to '<card>'"; the fine body-edit
  wording never leaks onto the board menu.
- Branch-switch settle clears every open card window's fine stack on
  Save All and Discard alike; the empty fold registers no coarse step.
- Close flush awaits its covering snapshot (quiesce + one generation
  bump, 1s bound), and an explicit flush now queues behind an
  in-flight one instead of skipping — the audit-caught interleaving
  could lose a close flush permanently when the debounce fired inside
  the close sequence; regression tests force both races.
- Commit comment bullets sort chronologically by created, not UUID.
- The production-unwired CardBodyEditSession.editSessionDidChange seam
  is deleted with its seam-only tests.
- Composition-root pins: beginSession composes the committer with the
  store's own EchoLedger and binds the announcer (the miswire class).
- Deliberate 06 conformance pass over every 2026-07-31-tagged
  sentence: fixed Change-custom-key subjects (the retired named
  generic was the only producer), the unbuilt Replace attachment
  vocabulary, heal commits now authored Lanework Integrity, the config
  reader scopes identity to plain [user] sections, add-git re-runs
  detection at create (a stale mode-none could initialize inside the
  user's repo), and add-git failures answer at the form or the banner.
  Structural residue filed on the Redesign board.

2554 tests / 439 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

KanbanTests/HistoryStoreTests.swift

@@ -295,6 +295,65 @@ struct HistoryStoreAddGitTests {
         #expect(reason.operation == "Adding git to this board")
         #expect(!reason.message.isEmpty)
     }
+
+    @Test("Create re-runs full detection and refuses a board that became repo-nested")
+    func createRefusesAStaleModeNone() async throws {
+        // **The hardening** (06 ▸ Rules ▸ Detection, ruled 2026-07-31): "add-git's create re-runs full
+        // detection and refuses unless it reads clean none, so the forbidden nested init is impossible
+        // even on a raced or stale read."
+        let outer = try WriterFixture()
+        defer { outer.tearDown() }
+        let boardRoot = outer.root.appendingPathComponent("board", isDirectory: true)
+        try FileManager.default.createDirectory(at: boardRoot, withIntermediateDirectories: true)
+        try Data(Item.board.utf8).write(to: boardRoot.appendingPathComponent("index.md"))
+
+        // Composed while the enclosing folder is still a plain one: the store's mode is `none`, and
+        // that is the reading that goes stale.
+        let git = try #require(HistoryStore.compose(boardRoot: boardRoot, tier: .pro))
+        #expect(git.mode == .none)
+
+        // A terminal `git init` one level up, after the detection the store is holding.
+        try plantGitDirectory(in: outer)
+
+        #expect(await git.addGit() == false, "a root-only check would have let this through")
+        #expect(
+            !FileManager.default.fileExists(atPath: boardRoot.appendingPathComponent(".git").path),
+            "no nested repository, ever"
+        )
+        #expect(git.mode == .none, "a refused add-git changes nothing, mode included")
+    }
+
+    @Test("A failure answers at the form when it is up, and at the banner when it is not")
+    @MainActor
+    func aFailureAnswersAtTheFormOrTheBanner() async throws {
+        // **Form-anchored operations answer at the form first** (06 ▸ Interaction with external
+        // writers, ruled 2026-07-31) — "inline is the primary surface, never a silence trap".
+        let fixture = try makeBoard()
+        defer { fixture.tearDown() }
+
+        // Mode is read once, at composition — so a store composed before a `.git` appeared still says
+        // `none` and reaches `create`, which is the layer that refuses. Any refusal will do here; the
+        // question is where the answer lands.
+        let git = try #require(HistoryStore.compose(boardRoot: fixture.root, tier: .pro))
+        try plantGitDirectory(in: fixture)
+        var banners: [String] = []
+        git.reportFailure = { banners.append($0.message) }
+
+        // The form is up: inline, and nothing on the strip.
+        git.noteFormVisible(true)
+        #expect(await git.addGit() == false)
+        #expect(git.lastFailure != nil)
+        #expect(banners.isEmpty, "the user is looking at the form the answer belongs in")
+
+        // Dismissing it dismisses the stale error.
+        git.noteFormVisible(false)
+        #expect(git.lastFailure == nil)
+
+        // Asked again with no form on screen, the answer takes the banner instead of nobody.
+        #expect(await git.addGit() == false)
+        #expect(git.lastFailure == nil)
+        #expect(banners.count == 1)
+    }
 }
 
 // MARK: - The loader's history ranker