The decision surface — a refused open becomes a live repair, in place

Phase 3 of the decision surface, completing the card (01 ▸ Malformed
input, settled 2026-07-31). An attended open's fail-fast walk transforms
the loading window's content into one aggregated surface — never a
sheet, never a chain: defects grouped by class, each class stated once
with its files listed (Reveal in Finder + Open in Editor per row), a
class-level default preselected, per-item override behind a disclosure.
Only honest choices: YAML and malformed-schema get Editor + Re-check
(Skip below the root); newer-than-app gets Skip alone and blocks the
board at the root; the two root repairs — minted index, schema: 1 stamp
— are defaults. Repair and Open applies fixes in one store-less write
bracket and re-walks: clean proceeds, remainder re-aggregates into the
same surface. Cancel and ⌘W retire to welcome's row; restored opens
never see the surface at all (OpenOrigin rides the PendingOpen carrier).

Skips are per-open consent that rides the session — the store retains
the skip set and every reload passes it — and the opened board posts a
warning-tone notice naming what was left out, each item's Reveal riding
the banner strip's new reveal control. On Pro boards the repair bracket
binds its own EchoLedger, heal-marks everything, and the store adopts it
before the committer starts, so repairs land as one separate commit
authored Lanework Integrity — pinned end to end. Also fixed en route: a
retired loading window left its close interception installed and
returned false from windowShouldClose forever, blocking quit.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Git/GitAutoCommitter.swift

@@ -300,6 +300,18 @@ public final class GitAutoCommitter {
     /// which is not a shortcut but the doctrine: the ledger is empty because the app was not running,
     /// and "the app never vouches for changes it didn't witness".
     public func start() {
+        // **The ledger may already hold something, and exactly once it does.** An ordinary board's
+        // ledger is empty here — the app has not written to it, which is the whole of the
+        // launch-catch-up doctrine — so this harvest costs a dictionary copy of nothing.
+        //
+        // The exception is a board the **decision surface repaired** (01-storage-format.md
+        // § Malformed input): those writes happened before this board had a store at all, and their
+        // heal-marked receipts were adopted into the store's ledger a moment ago
+        // (`EchoLedger.adopt`, `BoardWindowHost`). Without this line the only harvest is at a write
+        // bracket's close, and no bracket has closed — so the debounce this arms would find the
+        // repaired files unvouched-for and author the app's own repair `Lanework External`, which is
+        // the one misattribution the mechanism exists to prevent.
+        harvest()
         arm()
     }