A picture off the pasteboard becomes a card's file, its hero, or the board's backdrop

⌘V grows an image-data branch, below the app's own clipboard format and refused
outright while a file URL is on the pasteboard: a screenshot or a browser's Copy
Image lands as "Pasted Image.png" in the anchor card's attachments/, through the
very import path Finder file drops and ⇧⌘A take — one bracket, one Finder-style
collision ladder, one set of banners, and the same silence a drop's arrival has.
A card window's ⌘V pastes onto its own card; a focused text field still wins the
selector natively. A file-shaped flavor travels byte for byte, PNG preferred when
several are offered; TIFF and BMP are re-encoded to PNG, being interchange
encodings rather than files anyone wants in a folder.

The hero key gets the setter it was born owing: "Set as Hero" on any image row of
the attachment list, "Remove Hero" on the row that holds it, with menu-bar twins
so the context entry is nobody's only home. It writes as a restyle — one key, one
bracket, one invertible step on the window's own stack — and replaces rather than
refusing, because a card has one hero and the row that has it says Remove instead.

Edit ▸ Paste as Board Background is the same payload's other destination, taking
the existing background.image convention at its word: the picture into the board
folder as "Pasted Background.png", the colour subkey untouched, the generator's
overwrite-our-own-name rule inherited and its echo memo taught to tell the two
producers apart.

Claude-Session: https://claude.ai/code/session_014PtZdPwqZuqEDLc6wZMtEy

Kanban/Storage/FrontmatterDocument.swift

@@ -585,9 +585,12 @@ public enum FrontmatterKeys {
     /// carrying a separator is not a hero image spelled awkwardly, it is a value with no reading at
     /// all (`FrontmatterDocument.hero`).
     ///
-    /// **Opt-in, and hand-written**: there is no in-app setter this version (ruled 2026-08-09), so
-    /// the key is written by an author or an agent and the app only ever reads it. It joins
-    /// `schemaOwned` all the same — it is Lanework's to interpret, not an unknown key riding along.
+    /// **Opt-in, and written from exactly one control**: the card window attachment row's "Set as
+    /// Hero" / "Remove Hero" (re-ruled 2026-08-09, promoting the key's own "future work" note the day
+    /// it landed; `BoardStore.setHero(_:onCard:on:)`). The row can only name a file the card already
+    /// has, which is the key's grammar enforced by the surface rather than validated after the fact;
+    /// hand-writing and agent-writing stay exactly as legal as they were. It joins `schemaOwned` for
+    /// the reason it always did — it is Lanework's to interpret, not an unknown key riding along.
     public static let hero = "hero"
 
     public static let created = "created"