Materialize the trash — faces, menus, and grammar

Phase 3 finishes the pivot at the surface. One card face serves two
containers: CardFaceView extracted with a role — board or trash — so
stripe, tint, chip, selection stroke, cut dim, marquee registration,
and drag are shared by construction, the trash side differing only in
its absences: no Open, no rename, no Style, no file-hover highlight,
and a Delete that goes through the confirmation host. The column
rewrote around the lanes' own single-column masonry so drag reflow
reads as positional slides; chrome stays the hatched header, symbol,
and count — 11 gives Empty Trash to the File menu alone. Two real
grammar bugs die here: plain Backspace on a trash selection purged
without the confirmation the menu raises, and the context menu's
Delete resolved against the standing selection, so right-clicking a
trash card under a board selection silently did nothing — it now
stages the clicked set explicitly. Open, Rename, Style, and Empty
Trash validation became testable store seams; the column is one named
accessibility container of ordinary card elements. The tombstone era
is swept: deleteItem, restoreItem, stripTombstonedChildren — dead
since lane copies stopped nesting trash — the restore verb, the
unreachable put-back banner row, and every quasi-lane doc comment.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/AppModel.swift

@@ -626,19 +626,15 @@ public final class AppModel {
     /// The lane and card counts stamped into the registry at close — **live items only** (02
     /// § Per-board app state, settled).
     ///
-    /// > tombstoned lanes and cards — and cards hidden beneath a tombstoned lane — don't count; the
-    /// > row advertises the board's working size, and the trash is an errand, not inventory.
-    ///
-    /// The nesting is the ancestor walk: a tombstoned lane is skipped whole, so its cards are never
-    /// reached whatever their own flags say. `Lane.isDeleted`/`Card.isDeleted` are presence-of-key,
-    /// not validity, so a malformed `deleted:` counts as deleted here exactly as it does everywhere
-    /// else.
+    /// > deleted lanes and cards don't count; the row advertises the board's working size, and the
+    /// > trash is an errand, not inventory.
     ///
     /// **`.trash/` is excluded by construction** (02-architecture.md § Per-board app state,
     /// re-grounded 2026-07-28 for the materialized trash): this walks `snapshot.lanes`, and the
     /// trash is `snapshot.trash` — a sibling container, never a lane — so no filter is needed and
-    /// none could be forgotten. The flag walk above is the retiring half of the same rule, kept
-    /// while boards written by older versions still carry `deleted:` keys.
+    /// none could be forgotten. The tombstone era's ancestor walk over `deleted:` flags is gone with
+    /// the flag; a board an older version wrote counts its unmigrated cards until the migration moves
+    /// them, which is the safe direction and lasts exactly one write.
     ///
     /// Static and pure: it is a fact about a snapshot, and the close flush is the wrong place to
     /// discover a counting bug.