The decision surface — a refused open becomes a live repair, in place

Phase 3 of the decision surface, completing the card (01 ▸ Malformed
input, settled 2026-07-31). An attended open's fail-fast walk transforms
the loading window's content into one aggregated surface — never a
sheet, never a chain: defects grouped by class, each class stated once
with its files listed (Reveal in Finder + Open in Editor per row), a
class-level default preselected, per-item override behind a disclosure.
Only honest choices: YAML and malformed-schema get Editor + Re-check
(Skip below the root); newer-than-app gets Skip alone and blocks the
board at the root; the two root repairs — minted index, schema: 1 stamp
— are defaults. Repair and Open applies fixes in one store-less write
bracket and re-walks: clean proceeds, remainder re-aggregates into the
same surface. Cancel and ⌘W retire to welcome's row; restored opens
never see the surface at all (OpenOrigin rides the PendingOpen carrier).

Skips are per-open consent that rides the session — the store retains
the skip set and every reload passes it — and the opened board posts a
warning-tone notice naming what was left out, each item's Reveal riding
the banner strip's new reveal control. On Pro boards the repair bracket
binds its own EchoLedger, heal-marks everything, and the store adopts it
before the committer starts, so repairs land as one separate commit
authored Lanework Integrity — pinned end to end. Also fixed en route: a
retired loading window left its close interception installed and
returned false from windowShouldClose forever, blocking quit.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/App/RestoreBootstrapView.swift

@@ -88,7 +88,12 @@ struct RestoreBootstrapView: View {
         for board in appModel.boardRegistry.restorables() {
             switch board {
             case let .available(_, url):
-                appModel.openBoard(at: url)
+                // **The one restored open in the app** (01-storage-format.md § Malformed input, the
+                // decision surface): a board that fails here keeps today's retire-to-welcome-row
+                // landing — "launch never chains dialogs", and nobody is sitting in front of a
+                // restoration waiting to repair four boards at once. The row's retry click is the
+                // attended open that then shows the surface.
+                appModel.openBoard(at: url, origin: .restored)
                 attempted += 1
             case let .unavailable(record):
                 Self.logger.error("a flagged board could not be restored — its bookmark no longer resolves")
@@ -109,9 +114,11 @@ struct RestoreBootstrapView: View {
     ///
     /// **Which board is the launch arguments' to say** (`UITestLaunch.variant`), and this method does
     /// not care: the malformed variant is built and opened exactly like the other two, and its
-    /// failure arrives one layer down as the *loader's* — a board window that records fail-fast's own
-    /// sentence and dismisses itself (`BoardWindowHost.start`). Special-casing it here would replace
-    /// the sentence under test with a sentence about the fixture.
+    /// failure arrives one layer down as the *loader's*. It opens **attended**, like every other
+    /// board a person asks for, so its refusal transforms the loading window into the decision surface
+    /// (`BoardWindowHost.handleWalkFailure`) rather than retiring — which is precisely what the
+    /// fail-fast UI pass is there to see. Special-casing it here would replace the behaviour under
+    /// test with a behaviour about the fixture.
     ///
     /// **A failure to *build* lands on welcome as an ordinary launch failure**, with the fixture's own
     /// path on it. That is deliberate: a suite whose fixture failed to build would otherwise audit an