diff --git a/DESIGN/01-storage-format.md b/DESIGN/01-storage-format.md
index 3de6177..ec2cab5 100644
--- a/DESIGN/01-storage-format.md
+++ b/DESIGN/01-storage-format.md
@@ -131,6 +131,7 @@ Fail-fast is the **initial-load** contract. Once a board is open, a failed live
 **The decision surface (settled 2026-07-31).** Blocking means one aggregated surface hosted by the pre-snapshot loading window (02-architecture.md ▸ the loading state) — the loading content transforms in place, never a sheet over a spinner. It appears on **attended opens only** (welcome click, File ▸ Open…, Finder): restoration failures keep the retire-to-welcome-row landing, and the row's retry click is the attended open that then shows the surface — repair is an attended act, and launch never chains dialogs. The loader collects every fail-fast defect in the walk rather than stopping at the first. The surface groups defects **by class**: each class section states the defect once, lists the affected files (path + specifics, each with Reveal in Finder and Open in Editor), and carries one class-level choice preselected to its default, with per-item override behind a disclosure. The vocabulary offers only honest choices per class:
 
 - *Unparseable YAML* — no app-minted rewrite (the app would be guessing at content): Open in Editor + Re-check, or Skip.
+- *`schema` present but unreadable* (`schema: one`, a sequence where a scalar belongs — ruled 2026-08-06, the fifth class) — the YAML family's posture, no app-minted rewrite: a present-but-garbled value is evidence of intent, and stamping `1` over it would both guess and destroy the one clue about what was meant (the garble may be a newer schema's value mangled — precisely the file the app must never quietly claim as its own; the missing-schema mint's "the walk just validated against schema 1" argument does not transfer to a value that contradicts it). Open in Editor + Re-check, or Skip below the root. At the root there is no Skip — root `schema` is the this-really-is-a-board gate — but Editor + Re-check **is** offered, unlike newer-than-app's Cancel-only root row: that class has no honest fix short of updating the app, while this one is a typo-shaped, user-fixable defect and the repair loop is exactly the surface's answer to those; Cancel remains the surface's standing exit.
 - *`schema` newer than the app* — no honest fix (downgrading risks silent loss): an unfixable row ("made by a newer Lanework — update the app") offering only Skip; on the board root it blocks the whole board (Cancel is the only exit).
 - *Board root without `index.md`* — minted repair, the default: create a board index (folder-name title, `schema: 1`) — the user just opened this folder as a board, and the mint is content-lossless.
 - *Board root missing `schema`* — stamp `schema: 1`, the default: reliable exactly because the walk just validated the file against schema 1. (Below the root, missing `order`/`schema` never reach this surface — they default at read time, re-ruled 2026-07-31: Frontmatter and Ordering above.)