Build the integrity service - IntegrityRules and the HealScheduler

The 2026-07-29 integrity design pass, consolidated (DESIGN/01 -
Validation and healing; DESIGN/02 - Components): IntegrityRules
(Storage, pure) is the one home for the identity predicate and
canonical form (BoardWriter.canonicalIdentity deleted, ItemID and the
loader forward to it), the per-field rulebook, uneditable shapes,
per-kind index validation, the reserved-name tables, and the trash
kind discriminator (values trusted - kind: lane/card explicit,
unrecognized falls to shape). LoadResult's ad-hoc channels fold into
one typed Defect stream (looseCardFiles / legacyTombstone /
claimedNameSquatted, per-defect heal signatures); the old accessors
survive as computed views.

HealScheduler (LiveStore) states the six-step heal pattern once -
resting-clear, lock gate, isWritableFile gate (now covering all four
heals), signature memo armed-before-attempt with explicit
clear-on-success, disk re-verify in each write half, one banner-posture
table (BannerCenter keeps all phrasing). The three hand-rolled healers
run on it with behavior preserved - including the
relocation-notice-despite-partial-failure quirk, deliberately. Heals
run at the reload tail AND at registry acquire, closing the
migration-never-fires-at-open asymmetry. Displacement runs first: a
squatted .trash would otherwise fail the migration and arm its memo
against an unchanged picture.

Claimed-name squatters (ruled today, 62c47a2) displace by the shared
Finder-style rename ladder - preserved verbatim, symlinks moved as
links, nothing stamped; AgentGuide's untouchable-skip upgrades to
displace-then-write, the CLAUDE.user.md-taken skip stands. kind stamps
on every create and backfills on any index rewrite via the on-touch
seam (placement resolver stamps nothing when the parent is unknown -
a guessed kind is worse than an absent one; board-root writers declare
theirs). Heal writes mark their EchoLedger receipts (inert in base;
pro-m1's committer will split them into their own commits). The
renumber ask-renumber-ask-again two-step is one shared helper, adopted
at all nine call sites.

69 tests added. 1738 green on both schemes.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/Storage/FrontmatterFields.swift

@@ -96,6 +96,16 @@ extension FrontmatterDocument {
     /// Schema-owned, not an unknown key: the app clears it on every app-mediated write.
     public var modifiedBy: FieldValue<String> { read(FrontmatterKeys.modifiedBy, Self.string) }
 
+    /// The object's kind as written — `board`, `lane`, `card` (01-storage-format.md § Frontmatter,
+    /// re-ruled 2026-07-29). Lenient like every other string field: any scalar coerces to the text
+    /// the author typed, and **the value is never policed** — a reading outside the schema's three
+    /// is a perfectly good `.valid` here, and the one consumer that acts on it (the trash's
+    /// discriminator, `IntegrityRules.trashKind`) falls through to shape for anything it does not
+    /// recognize rather than correcting the file.
+    ///
+    /// `.missing` — no key, or an explicit null — is what the on-touch backfill answers to.
+    public var kind: FieldValue<String> { read(FrontmatterKeys.kind, Self.string) }
+
     // MARK: -
 
     private func read<Value>(_ key: String, _ transform: (YAMLValue, String) -> Value?) -> FieldValue<Value> {