Bind the undo provider to the board, not the tier

The 2026-07-31 re-ruling: gitless boards bind the native stack in every
tier — a Pro upgrade no longer removes undo from mode-none boards — and
Pro git boards bind the git provider; repo-nested stays the no-undo
case under Pro, while the free tier (which never runs detection) binds
native there too, per 12's inert posture. Add-git now swaps a live
native substrate mid-session: the in-flight stack is cleared with the
discarded provider, the git trail seeds from the root commit, and the
same BoardUndoManager instance keeps nil-target menu validation fresh.

2405 tests in 413 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Git/GitAutoCommitter.swift

@@ -159,8 +159,10 @@ public final class GitAutoCommitter {
     /// this engine clears the instant a window commits — so the moment of landing is the only moment
     /// at which "that commit was the heal" is knowable at all.
     ///
-    /// `nil` on every board with no undo provider bound (the free tier's committer does not exist;
-    /// a Pro board's does, and a provider is bound beside it).
+    /// `nil` wherever no `GitHistoryProvider` is listening — which in practice is nowhere a committer
+    /// exists at all: a committer's existence is exactly mode `git`, and mode `git` is exactly where
+    /// the composition root binds the git provider (`AppModel.makeHistoryProvider`). Mode-none boards
+    /// have a native stack and no committer; repo-nested boards have neither.
     @ObservationIgnored
     public var reportLanded: (@MainActor (GitLandedWindow) -> Void)?
 

Kanban/Git/HistoryStore.swift

@@ -19,10 +19,10 @@ import os
 /// ### What it does not do yet
 ///
 /// This is the foundation card of pro-m1: mode, a repository, add-git, and the loader's path-history
-/// ranker. **The provider binding is not part of it** — both tiers still bind
-/// `NativeHistoryProvider` (`AppModel.makeHistoryProvider`), and the consumer of `mode` is the
-/// undo/redo card two cards later, which builds the git `HistoryProviding` implementation over
-/// exactly this object. Auto-commit, commit messages, branch controls, the identity fields, the
+/// ranker. **The provider binding reads `mode` and nothing else about a tier** — the composition
+/// root binds the git provider on mode `git`, the native stack on mode `none`, and nothing on a
+/// repo-nested board (`AppModel.makeHistoryProvider`, re-ruled 2026-07-31: the provider follows the
+/// board). Auto-commit, commit messages, branch controls, the identity fields, the
 /// `.gitignore` seed and its periodic housekeeping each arrived as their own card and are composed
 /// here now; remotes are pro-m2's and deliberately still absent.
 @MainActor
@@ -141,9 +141,11 @@ public final class HistoryStore {
     /// never on any other path.
     ///
     /// It exists because the flip has a second consumer beyond the committer: the board's **undo
-    /// substrate**. A session that composed on a mode-none board bound no provider at all
+    /// substrate**. A session that composed on a mode-none board bound the native stack
     /// (`AppModel.makeHistoryProvider`), and 06 ▸ Rules ▸ Detection's one sanctioned commanded flip
-    /// means the board now has a trail to be an undo stack over. What binding it means is
+    /// means the board now has a trail to be an undo stack over instead — "add-git swaps the
+    /// substrate mid-session … discards the in-session native stack and seeds the git trail from the
+    /// root commit" (13-native-undo.md). What that swap means is
     /// `AppModel.bindHistoryProvider(for:)`'s to decide and to justify; what this property does is
     /// keep that decision out of a git state that has no business knowing what a provider is.
     @ObservationIgnored