diff --git a/DESIGN/01-storage-format.md b/DESIGN/01-storage-format.md
index dd0c3c3..70e06fe 100644
--- a/DESIGN/01-storage-format.md
+++ b/DESIGN/01-storage-format.md
@@ -136,7 +136,7 @@ Fail-fast is the **initial-load** contract. Once a board is open, a failed live
 - *Board root without `index.md`* — minted repair, the default: create a board index (folder-name title, `schema: 1`) — the user just opened this folder as a board, and the mint is content-lossless.
 - *Board root missing `schema`* — stamp `schema: 1`, the default: reliable exactly because the walk just validated the file against schema 1. (Below the root, missing `order`/`schema` never reach this surface — they default at read time, re-ruled 2026-07-31: Frontmatter and Ordering above.)
 
-**Skip is user-consented tolerance, loudly marked** (ruled 2026-07-31): a skipped item loads the board without it — the file stays on disk untouched, tolerated-invisible like strays — and the opened board carries a warning-tone notice naming the skipped items, each with Reveal in Finder. Skips are **per-open decisions, never persisted**: the next open of a still-broken board presents the surface again — the notice is the honest residue of this open, not a stored preference.
+**Skip is user-consented tolerance, loudly marked** (ruled 2026-07-31): a skipped item loads the board without it — the file stays on disk untouched, tolerated-invisible like strays — and the opened board carries a warning-tone notice naming the skipped items, each with Reveal in Finder. Skips are **per-open decisions, never persisted**: the next open of a still-broken board presents the surface again — the notice is the honest residue of this open, not a stored preference. **The consent rides the open's whole session** (ruled 2026-08-06, blessing the built reading): the store retains the skip set and every live reload's walk carries it, so a still-broken skipped file never re-trips the reload-breakage banner for a defect the user just consented to tolerate — re-warning would be the app relitigating a standing decision. The skip names a *defect at a path*, not the file: a reload that finds the path clean simply loads it — a fixed file rejoins mid-session on its own, no gesture needed — and a new defect at any unconsented path is ordinary reload breakage (02-architecture.md ▸ live-reload resilience); consent covers exactly what was consented to. The notice stays the open's one-time residue — reloads never repeat it. "Per-open" thus means the session shape precisely: consent holds while the board stays open, lapses when it closes, and the next open of a still-broken board meets the surface again.
 
 Buttons: **Repair and Open** applies every chosen fix in one write bracket — each repaired `index.md` is an ordinary app write (stamps `modified`, clears `modified-by`); interrupted batches are accepted per the renumber precedent, every intermediate state valid, and a partial repair simply re-aggregates on the next walk. On Pro boards the repairs drop heal-marked receipts and commit separately as one repair commit, never folded into anyone else's work (Validation and healing below ▸ Healing mutations commit separately). **Cancel** aborts the open: the window retires and the board lands row-level on welcome, record-before-load unchanged. **Re-check** — and Repair and Open itself — re-runs the whole walk: a disk changed underneath re-aggregates into the *same* surface with the fresh defect list, never a chained second dialog; a clean walk proceeds to the first snapshot.