Three surface blessings said in sentences — depth in rounds, no root skips, the path carrier

Minors ruled into 01 ▸ The decision surface and Skip: (1) depth reveals
in rounds — a defective lane index leaves its subtree unwalked, so
deeper defects surface on the round after its repair, the collect-all
rule meeting an unreadable container; (2) Skip never names the root —
the case-by-case foreclosures are one general rule the loader polices,
a root skip entry ignored and the defect collected anyway; (3) the
skip's carrier is the defect's root-relative path — the string the row
displays and Reveal resolves, exactly what the user consented about.

Claude-Session: https://claude.ai/code/session_014PtZdPwqZuqEDLc6wZMtEy

DESIGN/01-storage-format.md

@@ -136,9 +136,9 @@ Fail-fast is the **initial-load** contract. Once a board is open, a failed live
 - *Board root without `index.md`* — minted repair, the default: create a board index (folder-name title, `schema: 1`) — the user just opened this folder as a board, and the mint is content-lossless.
 - *Board root missing `schema`* — stamp `schema: 1`, the default: reliable exactly because the walk just validated the file against schema 1. (Below the root, missing `order`/`schema` never reach this surface — they default at read time, re-ruled 2026-07-31: Frontmatter and Ordering above.)
 
-**Skip is user-consented tolerance, loudly marked** (ruled 2026-07-31): a skipped item loads the board without it — the file stays on disk untouched, tolerated-invisible like strays — and the opened board carries a warning-tone notice naming the skipped items, each with Reveal in Finder. Skips are **per-open decisions, never persisted**: the next open of a still-broken board presents the surface again — the notice is the honest residue of this open, not a stored preference. **The consent rides the open's whole session** (ruled 2026-08-06, blessing the built reading): the store retains the skip set and every live reload's walk carries it, so a still-broken skipped file never re-trips the reload-breakage banner for a defect the user just consented to tolerate — re-warning would be the app relitigating a standing decision. The skip names a *defect at a path*, not the file: a reload that finds the path clean simply loads it — a fixed file rejoins mid-session on its own, no gesture needed — and a new defect at any unconsented path is ordinary reload breakage (02-architecture.md ▸ live-reload resilience); consent covers exactly what was consented to. The notice stays the open's one-time residue — reloads never repeat it. "Per-open" thus means the session shape precisely: consent holds while the board stays open, lapses when it closes, and the next open of a still-broken board meets the surface again.
+**Skip is user-consented tolerance, loudly marked** (ruled 2026-07-31): a skipped item loads the board without it — the file stays on disk untouched, tolerated-invisible like strays — and the opened board carries a warning-tone notice naming the skipped items, each with Reveal in Finder. Skips are **per-open decisions, never persisted**: the next open of a still-broken board presents the surface again — the notice is the honest residue of this open, not a stored preference. **The consent rides the open's whole session** (ruled 2026-08-06, blessing the built reading): the store retains the skip set and every live reload's walk carries it, so a still-broken skipped file never re-trips the reload-breakage banner for a defect the user just consented to tolerate — re-warning would be the app relitigating a standing decision. The skip names a *defect at a path*, not the file: a reload that finds the path clean simply loads it — a fixed file rejoins mid-session on its own, no gesture needed — and a new defect at any unconsented path is ordinary reload breakage (02-architecture.md ▸ live-reload resilience); consent covers exactly what was consented to. The notice stays the open's one-time residue — reloads never repeat it. "Per-open" thus means the session shape precisely: consent holds while the board stays open, lapses when it closes, and the next open of a still-broken board meets the surface again. **Skip never names the root** (blessed 2026-08-06): the case-by-case foreclosures above — newer-at-root's Cancel-only row, the two root repairs as defaults — are one general rule the loader itself polices: Skip is tolerance, the board loads without the item, and there is no board without its root, so a skip entry naming a root path is ignored and the defect collected anyway; a class whose only offer is Skip therefore offers nothing at the root. **The skip's carrier is the defect's root-relative path** (blessed 2026-08-06): the same string the surface's row displays and its Reveal resolves — an item-ID carrier could not name a defect whose folder is not UUID-shaped, and the path is exactly what the user consented about.
 
-Buttons: **Repair and Open** applies every chosen fix in one write bracket — each repaired `index.md` is an ordinary app write (stamps `modified`, clears `modified-by`); interrupted batches are accepted per the renumber precedent, every intermediate state valid, and a partial repair simply re-aggregates on the next walk. On Pro boards the repairs drop heal-marked receipts and commit separately as one repair commit, never folded into anyone else's work (Validation and healing below ▸ Healing mutations commit separately). **Cancel** aborts the open: the window retires and the board lands row-level on welcome, record-before-load unchanged. **Re-check** — and Repair and Open itself — re-runs the whole walk: a disk changed underneath re-aggregates into the *same* surface with the fresh defect list, never a chained second dialog; a clean walk proceeds to the first snapshot.
+Buttons: **Repair and Open** applies every chosen fix in one write bracket — each repaired `index.md` is an ordinary app write (stamps `modified`, clears `modified-by`); interrupted batches are accepted per the renumber precedent, every intermediate state valid, and a partial repair simply re-aggregates on the next walk. On Pro boards the repairs drop heal-marked receipts and commit separately as one repair commit, never folded into anyone else's work (Validation and healing below ▸ Healing mutations commit separately). **Cancel** aborts the open: the window retires and the board lands row-level on welcome, record-before-load unchanged. **Re-check** — and Repair and Open itself — re-runs the whole walk: a disk changed underneath re-aggregates into the *same* surface with the fresh defect list, never a chained second dialog; a clean walk proceeds to the first snapshot. **Depth reveals in rounds** (blessed 2026-08-06): a defective lane index leaves its subtree unwalked — the walk cannot enumerate below a container it cannot read — so defects deeper than a repaired container surface only on the round after its repair, in the same surface; the list growing across rounds is the collect-all rule meeting an unreadable container, not a missed collection.
 
 ## Validation and healing — the integrity taxonomy (settled 2026-07-29)