Render the dropped card at release, and pin the hold's timeout

03's sharpened settle rule: rendering the arrangement means rendering
the card — at release the shadow swaps for the dropped card(s) drawn in
place immediately, the appear never waiting for the echo reload. The
committed hold now carries the landing (ids, payload titles, operation)
and surfaces read one DropLanding seam: within-board moves draw the
real faces at their proposed slots under the arriving card's own key,
so the echo is an invisible content swap; cross-board card arrivals
draw payload-titled faces keyed positionally, so the echo reads as an
ordinary arrival. Cross-board lane arrivals deliberately keep their
shadow until the echo — a lane's face is a whole column with no honest
payload equivalent. The 1500 ms failed-write timeout is now seamed
(injectable duration, extracted expire) and pinned by tests.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/UI/Board/DragSession.swift

@@ -57,8 +57,61 @@ struct FileDropTarget: Equatable, Sendable {
 
 // MARK: - The committed-overlay hold
 
-/// The hand-off condition for **the committed-overlay hold** (DRAG-REORDER.md § The
-/// committed-overlay hold), as a value so the state machine is testable without a filesystem.
+/// One item the hold is drawing: the identity it travelled under, and the title it wore on the way.
+///
+/// The title is not a convenience. A **cross-board arrival** has no presence in the board it just
+/// landed on — the write is in flight and the destination has never seen that folder — so the
+/// payload's title is the whole of what its face can say until the echo brings the real card. A
+/// within-board landing finds itself in the snapshot and draws its real face instead (`LaneView`).
+struct DroppedItem: Equatable, Sendable {
+    var id: ItemID
+    var title: String?
+}
+
+/// What a container draws at the drop proposal — **one value for both phases of a release**, because
+/// the slot is the same slot throughout and only its content changes.
+///
+/// 03-board-ui.md § Motion (sharpened 2026-07-28): "at release the shadow is replaced by the dropped
+/// card(s) drawn in place immediately, the appear never waiting for the echo — a lingering shadow
+/// over a hidden card is the hold failing its one job". Keeping the *index* outside the phase split
+/// is what lets the reflow's animation key stay put across the release: the settle renders, it does
+/// not move, so nothing about it may key motion.
+struct DropLanding: Equatable, Sendable {
+
+    /// The dropped run, as the settled overlay draws it.
+    struct Dropped: Equatable, Sendable {
+        /// The items that landed, in landing order.
+        var items: [DroppedItem]
+
+        /// Whether the arriving items keep the identities they travelled under, so the overlay's
+        /// slots may wear the arriving cards' own keys and the echo becomes a content swap inside
+        /// one element — the new-card placeholder's handoff exactly (`LaneSlot`). True for a
+        /// **within-board move** and nothing else: a copy mints fresh GUIDs, and a cross-board
+        /// arrival may be reminted at the import boundary, so neither can promise a key.
+        var keepsIdentity: Bool
+
+        /// Whether this board already holds these items — a rearrangement of its own, whose faces it
+        /// can therefore draw straight from its snapshot. False for an arrival from another board,
+        /// which has only `DroppedItem.title` to go on.
+        var isLocal: Bool
+    }
+
+    enum Run: Equatable, Sendable {
+        /// The drag is in flight: N hit-transparent shadows hold the space open (`DragShadow`).
+        case shadows
+        /// The release has settled: the dropped items themselves, drawn at the slot the shadows were
+        /// holding.
+        case dropped(Dropped)
+    }
+
+    /// Where the run opens, in the container's own order.
+    var index: Int
+    var run: Run
+}
+
+/// **The committed-overlay hold** (DRAG-REORDER.md § The committed-overlay hold; 03-board-ui.md §
+/// Motion) — the drop proposal, and the run that landed under it, kept as overlay state past the
+/// release. A value, so the state machine is testable without a filesystem.
 ///
 /// At release the write goes to disk and the *snapshot does not change* — the one-way flow means the
 /// board only shows the new order once the watcher's reload lands (02-architecture.md). Dropping the
@@ -68,7 +121,18 @@ struct FileDropTarget: Equatable, Sendable {
 /// app-mediated echo is normally next, and a foreign one that lands first re-grounds everything
 /// anyway.
 ///
-/// The `deadline` is the same guarantee the drag session's watchdog gives the drag itself: a write
+/// ### Rendering the arrangement means rendering the card
+///
+/// The hold carries *what* landed and not only *where*, because the arrangement is not an outline:
+/// "at release the shadow is replaced by the dropped card(s) drawn in place immediately" — the
+/// system drag image's fade then dissolves over a card that is already there, which is the whole
+/// promise of the settle. `landing` is that run, in the order it lands.
+///
+/// `operation` is the other half of what the overlay draws, and it settles two questions at once
+/// because a move and a copy differ in exactly those two ways — see `removesOriginals` and
+/// `keepsIdentity`.
+///
+/// The `timeout` is the same guarantee the drag session's watchdog gives the drag itself: a write
 /// that was refused outright (a read-only board) produces no reload at all, and an overlay with no
 /// hand-off coming must still dissolve and let the snapshot be the authority again.
 struct CommittedHold: Equatable, Sendable {
@@ -79,6 +143,23 @@ struct CommittedHold: Equatable, Sendable {
     /// That board's `snapshotGeneration` at the moment of the commit.
     var generation: Int
 
+    /// The run that landed, in landing order — the dropped cards the overlay draws in place.
+    /// Defaulted so the hand-off condition above can still be stated on its own.
+    var landing: [DroppedItem] = []
+
+    /// The effective operation the release committed, re-resolved at the drop.
+    var operation: TransferOperation = .move
+
+    /// Whether the source board keeps its originals lifted out of the resting layout. A move took
+    /// them away, so it does; a **copy left them exactly where they were**, so they come back the
+    /// instant the write is issued — the arrangement the hold renders has the originals *and* the
+    /// arrivals in it, which is what the echo will show.
+    var removesOriginals: Bool { operation == .move }
+
+    /// Whether the arriving items keep the identities they travelled under (`Dropped.keepsIdentity`
+    /// is this, narrowed to a within-board landing).
+    var keepsIdentity: Bool { operation == .move }
+
     /// How long the hold may stand with no snapshot arriving. Comfortably longer than a write plus
     /// a watcher round trip, short enough that a refused write does not leave the board drawing an
     /// arrangement it never got.
@@ -198,6 +279,11 @@ final class DragSession {
     /// The dragged items' folders, aligned 1:1 with `members` — what the cross-board commits take.
     @ObservationIgnored private(set) var folders: [URL] = []
 
+    /// The dragged items' titles, aligned 1:1 with `members` — captured at pickup off the very
+    /// payload the pasteboard carries, and read again at the drop so the committed hold can draw a
+    /// **cross-board arrival**'s face before that board has ever heard of it (`DroppedItem`).
+    @ObservationIgnored private(set) var titles: [String?] = []
+
     /// The board the drag started in. Root and store are kept separately because the store may go
     /// away with its window mid-drag while the root — the left-hand side of the locality
     /// comparison — stays perfectly usable.
@@ -243,7 +329,13 @@ final class DragSession {
 
     @ObservationIgnored private var watchdog: Task<Void, Never>?
     @ObservationIgnored private var fileWatchdog: Task<Void, Never>?
-    @ObservationIgnored private var holdTimeout: Task<Void, Never>?
+    @ObservationIgnored private var holdTimeoutTask: Task<Void, Never>?
+
+    /// How long this session's holds may stand with no snapshot arriving — `CommittedHold.timeout`,
+    /// and a `var` for one reason only: the discard path is a `Task` sleeping on the main actor, and
+    /// a test that had to wait the real figure out would be a 1.5 s wall clock in the suite
+    /// (`DragSessionTests`). Nothing in the app writes it.
+    @ObservationIgnored var holdTimeout: Duration = CommittedHold.timeout
 
     init() {}
 
@@ -253,6 +345,11 @@ final class DragSession {
     var isDraggingCards: Bool { kind == .cards }
     var isDraggingLanes: Bool { kind == .lanes }
 
+    /// Whether the release has **settled**: the write is issued, the proposal is being held as
+    /// overlay state, and every surface that was drawing shadows is now drawing the dropped items
+    /// (`CommittedHold`).
+    var isSettled: Bool { hold != nil }
+
     /// N — the number of contiguous shadows the proposal draws.
     var shadowCount: Int { members.count }
 
@@ -265,14 +362,23 @@ final class DragSession {
     /// carries items that render in the quasi-lane, not in any lane's masonry, so no lane loses a
     /// card to it.
     ///
-    /// **The dragged run is lifted out whatever the effective operation is** (DRAG-REORDER.md §
-    /// Resting-layout zones): ⌥ can be pressed and released mid-drag, and a layout that re-admitted
-    /// the originals on every modifier flip would flap the whole board under the cursor. The copy's
-    /// originals reappear when the write lands.
+    /// **The dragged run is lifted out whatever the effective operation is** *while the drag is in
+    /// flight* (DRAG-REORDER.md § Resting-layout zones): ⌥ can be pressed and released mid-drag, and
+    /// a layout that re-admitted the originals on every modifier flip would flap the whole board
+    /// under the cursor.
+    ///
+    /// **At release the operation stops being a guess**, and a settled copy's originals come back at
+    /// once (`CommittedHold.removesOriginals`): the copy left them exactly where they were, so the
+    /// arrangement the hold is drawing has both them and the arrivals in it, and hiding them a round
+    /// trip longer would be the same lie the lingering shadow was. A settled *move* keeps hiding
+    /// them, because the write really did take them away — the overlay draws them at their landing
+    /// slot instead, which is the whole of "rendering the arrangement means rendering the card"
+    /// (03-board-ui.md § Motion).
     func hiddenMembers(onBoardRooted root: URL) -> Set<ItemID> {
         guard isActive, side == .live, let sourceRoot,
               DragLocality.isSameBoard(root, sourceRoot)
         else { return [] }
+        if let hold, !hold.removesOriginals { return [] }
         return memberSet
     }
 
@@ -294,6 +400,41 @@ final class DragSession {
         return proposal.index
     }
 
+    /// **What `laneID`'s masonry draws at the proposal** — the shadow run while the drag is in
+    /// flight, the dropped cards themselves once the release has settled (`DropLanding`), and `nil`
+    /// when no proposal names this lane.
+    ///
+    /// The index is the same index in both phases, deliberately: the settle changes what the slot
+    /// *contains*, never where it is, so a view can key its reflow on the index and be sure the
+    /// release itself animates nothing (03-board-ui.md § Motion — the un-hide is rendering).
+    func cardLanding(onBoardRooted root: URL, laneID: ItemID) -> DropLanding? {
+        guard let index = laneProposal(onBoardRooted: root, laneID: laneID) else { return nil }
+        return DropLanding(index: index, run: landingRun)
+    }
+
+    /// The lane strip's twin of `cardLanding` — the shadow run, or the dropped lanes drawn at the
+    /// slot they landed in.
+    func laneLanding(onBoardRooted root: URL) -> DropLanding? {
+        guard let index = stripProposal(onBoardRooted: root) else { return nil }
+        return DropLanding(index: index, run: landingRun)
+    }
+
+    /// The phase, as the two accessors above read it.
+    ///
+    /// `isLocal` is what keeps a **colliding cross-board arrival** from being drawn twice: only a
+    /// board that already holds the dragged items may resolve their faces (and their identities)
+    /// against its own snapshot, and an arrival's payload title is the honest answer everywhere
+    /// else.
+    private var landingRun: DropLanding.Run {
+        guard let hold else { return .shadows }
+        let isLocal = sourceRoot.map { DragLocality.isSameBoard($0, hold.boardRoot) } ?? false
+        return .dropped(DropLanding.Dropped(
+            items: hold.landing,
+            keepsIdentity: hold.keepsIdentity && isLocal,
+            isLocal: isLocal
+        ))
+    }
+
     /// The members that are still there — **rule 3 of the re-grounding trio**: drag membership is a
     /// UUID set that vanished items leave silently (`TransientBoardState.dragMembers`), and when the
     /// last one goes the drag has emptied itself. Partial vanishing drops the survivors, matching
@@ -362,18 +503,19 @@ final class DragSession {
     func beginCards(
         _ members: [ItemID],
         folders: [URL],
+        titles: [String?],
         heights: [CGFloat],
         side: Liveness,
         source: BoardStore
     ) {
-        begin(kind: .cards, members: members, folders: folders, side: side, source: source)
+        begin(kind: .cards, members: members, folders: folders, titles: titles, side: side, source: source)
         cardHeights = heights
         laneUnits = []
     }
 
     /// Begins a lane session.
-    func beginLanes(_ members: [ItemID], folders: [URL], units: [Int], source: BoardStore) {
-        begin(kind: .lanes, members: members, folders: folders, side: .live, source: source)
+    func beginLanes(_ members: [ItemID], folders: [URL], titles: [String?], units: [Int], source: BoardStore) {
+        begin(kind: .lanes, members: members, folders: folders, titles: titles, side: .live, source: source)
         laneUnits = units
         cardHeights = []
     }
@@ -382,6 +524,7 @@ final class DragSession {
         kind: DragKind,
         members: [ItemID],
         folders: [URL],
+        titles: [String?],
         side: Liveness,
         source: BoardStore
     ) {
@@ -390,6 +533,7 @@ final class DragSession {
         self.members = members
         self.memberSet = Set(members)
         self.folders = folders
+        self.titles = titles
         self.side = side
         self.sourceStore = source
         self.sourceRoot = source.rootURL
@@ -402,8 +546,12 @@ final class DragSession {
     }
 
     /// Records a new proposal. `nil` withdraws it — rule 2's "the shadow withdraws".
+    ///
+    /// **A settled release is past retargeting**: the write naming that slot is already on its way,
+    /// so a late callback arriving after the commit — a stray `dropUpdated`, a revalidation — must
+    /// not move or withdraw the arrangement the hold is drawing.
     func propose(_ target: DropTarget?) {
-        guard isActive, proposal != target else { return }
+        guard isActive, hold == nil, proposal != target else { return }
         proposal = target
     }
 
@@ -429,6 +577,7 @@ final class DragSession {
         members = []
         memberSet = []
         folders = []
+        titles = []
         cardHeights = []
         laneUnits = []
         proposal = nil
@@ -443,25 +592,55 @@ final class DragSession {
     /// Enters the committed phase: the arrangement the session was showing stays on screen until
     /// `store` applies its next snapshot (`CommittedHold`).
     ///
-    /// Everything that drives the rendering — the members, the proposal, the source root — is kept
+    /// Everything that drives the rendering — the proposal, the members, the source root — is kept
     /// exactly as it was, so "keeps rendering the arrangement it was showing" needs no second
-    /// mechanism: the shadows stay at the landing slots and the originals stay lifted out until the
-    /// snapshot carrying the write arrives and the real faces take their place.
-    func commit(into store: BoardStore) {
+    /// mechanism. What *changes* at this instant is what the proposal's slot draws: the shadows are
+    /// over, and `survivors` — the run this drop actually wrote, vanished members already dropped —
+    /// becomes the hold's `landing`, drawn there as ordinary card faces (`DropLanding`). A copy's
+    /// originals come back in the same render pass (`hiddenMembers`); a move's stay lifted, because
+    /// the overlay is now drawing them at their landing slot.
+    ///
+    /// - Parameters:
+    ///   - survivors: indices into `members` — what `BoardDropContext.commitDrop` is writing, which
+    ///     is exactly what the overlay must show.
+    ///   - operation: the effective operation, re-resolved at the drop. It decides both halves of
+    ///     the overlay's grammar (`CommittedHold.removesOriginals`, `.keepsIdentity`).
+    func commit(into store: BoardStore, survivors: [Int], operation: TransferOperation) {
         guard isActive else { return }
         sourceStore?.transient.dragMembers = .empty
         watchdog?.cancel()
         watchdog = nil
-        let hold = CommittedHold(boardRoot: store.rootURL, generation: store.snapshotGeneration)
+        let hold = CommittedHold(
+            boardRoot: store.rootURL,
+            generation: store.snapshotGeneration,
+            landing: survivors.map {
+                DroppedItem(id: members[$0], title: titles.indices.contains($0) ? titles[$0] : nil)
+            },
+            operation: operation
+        )
         self.hold = hold
-        holdTimeout?.cancel()
-        holdTimeout = Task { @MainActor [weak self] in
-            try? await Task.sleep(for: CommittedHold.timeout)
-            guard !Task.isCancelled, let self, self.hold == hold else { return }
-            withAnimation(Motion.dragReflow(reduced: Motion.prefersReducedMotion)) { self.end() }
+        let timeout = holdTimeout
+        holdTimeoutTask?.cancel()
+        holdTimeoutTask = Task { @MainActor [weak self] in
+            try? await Task.sleep(for: timeout)
+            guard !Task.isCancelled, let self else { return }
+            self.expire(hold)
         }
     }
 
+    /// **The failed write's path**: no echo is coming, so the hold discards and the board animates
+    /// back to snapshot order (03-board-ui.md § Motion — "the width-drag rollback posture: the
+    /// action visibly doesn't happen"). The one path in the settle that *is* motion, and the reason
+    /// it wears `Motion.dragReflow`: what moves is the arrangement un-happening.
+    ///
+    /// The timeout's own body, spelled as a method rather than inlined in the `Task`, so the discard
+    /// can be pinned directly as well as through the clock (`DragSessionTests`). A hold that has
+    /// already been handed off — or replaced by a second drag's — is not this one's to end.
+    func expire(_ hold: CommittedHold) {
+        guard self.hold == hold else { return }
+        withAnimation(Motion.dragReflow(reduced: Motion.prefersReducedMotion)) { end() }
+    }
+
     /// The hand-off: a snapshot landed on `root`, so an overlay standing in for it dissolves.
     ///
     /// Called from every board window's own snapshot-generation watch, which is why the hold names
@@ -473,8 +652,8 @@ final class DragSession {
 
     private func endHold() {
         hold = nil
-        holdTimeout?.cancel()
-        holdTimeout = nil
+        holdTimeoutTask?.cancel()
+        holdTimeoutTask = nil
     }
 
     /// Cleanup for a session-phase event SwiftUI reports.