Build the integrity service - IntegrityRules and the HealScheduler

The 2026-07-29 integrity design pass, consolidated (DESIGN/01 -
Validation and healing; DESIGN/02 - Components): IntegrityRules
(Storage, pure) is the one home for the identity predicate and
canonical form (BoardWriter.canonicalIdentity deleted, ItemID and the
loader forward to it), the per-field rulebook, uneditable shapes,
per-kind index validation, the reserved-name tables, and the trash
kind discriminator (values trusted - kind: lane/card explicit,
unrecognized falls to shape). LoadResult's ad-hoc channels fold into
one typed Defect stream (looseCardFiles / legacyTombstone /
claimedNameSquatted, per-defect heal signatures); the old accessors
survive as computed views.

HealScheduler (LiveStore) states the six-step heal pattern once -
resting-clear, lock gate, isWritableFile gate (now covering all four
heals), signature memo armed-before-attempt with explicit
clear-on-success, disk re-verify in each write half, one banner-posture
table (BannerCenter keeps all phrasing). The three hand-rolled healers
run on it with behavior preserved - including the
relocation-notice-despite-partial-failure quirk, deliberately. Heals
run at the reload tail AND at registry acquire, closing the
migration-never-fires-at-open asymmetry. Displacement runs first: a
squatted .trash would otherwise fail the migration and arm its memo
against an unchanged picture.

Claimed-name squatters (ruled today, 62c47a2) displace by the shared
Finder-style rename ladder - preserved verbatim, symlinks moved as
links, nothing stamped; AgentGuide's untouchable-skip upgrades to
displace-then-write, the CLAUDE.user.md-taken skip stands. kind stamps
on every create and backfills on any index rewrite via the on-touch
seam (placement resolver stamps nothing when the parent is unknown -
a guessed kind is worse than an absent one; board-root writers declare
theirs). Heal writes mark their EchoLedger receipts (inert in base;
pro-m1's committer will split them into their own commits). The
renumber ask-renumber-ask-again two-step is one shared helper, adopted
at all nine call sites.

69 tests added. 1738 green on both schemes.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/TemplateEngine.swift

@@ -394,7 +394,10 @@ enum TemplateEngine {
             // One `Date` for the whole tree, so the board and every item in it are born at the same
             // instant rather than merely close (`BoardWriter.newDocumentText`'s convention).
             let now = Date()
-            try BoardWriter.updateIndex(inItemFolder: root, operation: operation) { document in
+            // `kind: .board` — an instantiated board's root is the one file whose kind position
+            // cannot answer, and this write is where a template's kind-less root gains it
+            // (`BoardWriter.updateIndex`'s on-touch backfill; no template migration, by design).
+            try BoardWriter.updateIndex(inItemFolder: root, kind: .board, operation: operation) { document in
                 document.set(FrontmatterKeys.created, to: .date(now))
                 document.set(FrontmatterKeys.title, to: .string(title))
             }
@@ -591,7 +594,7 @@ enum TemplateEngine {
         operation: WriteOperation
     ) throws(Failure) {
         do throws(BoardWriteError) {
-            try BoardWriter.updateIndex(inItemFolder: root, operation: operation) { document in
+            try BoardWriter.updateIndex(inItemFolder: root, kind: .board, operation: operation) { document in
                 document.set(BoardLoader.templateKey, to: .raw("{order: \(orderText(order))}"))
             }
         } catch {