Wire Finder open as a standard document open

application(_:open:) forwards every Finder-delivered URL to
AppModel.openBoard(at:) — the exact path welcome and File > Open use, so
a Finder open gets the same registry record-before-load, recents stamp,
already-open-focuses-its-window dedup, and row-level failure surfacing
on welcome (DESIGN/02 > Launch). A cold Finder launch can arrive before
any scene has captured the window opener; openBoard now buffers such
URLs and captureWindowActions replays them once opening is possible.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

Kanban/App/AppModel.swift

@@ -251,11 +251,25 @@ public final class AppModel {
     @ObservationIgnored
     public var windowDismisser: DismissWindowAction?
 
+    /// URLs handed to `openBoard(at:)` before `windowOpener` existed to open them — a cold launch's
+    /// Finder-open (`AppDelegate.application(_:open:)`) can arrive ahead of the first scene's
+    /// `onAppear`. Held in order, replayed the moment `captureWindowActions` gives the app somewhere
+    /// to open them, then discarded — the buffer is a doorway, not a second registry of intent.
+    @ObservationIgnored
+    private var pendingOpenURLs: [URL] = []
+
     /// What `CaptureOpenWindow` calls. A method rather than two assignments so the launch flow, which
     /// needs the actions before any `onAppear` has run, has one thing to call.
     func captureWindowActions(open: OpenWindowAction, dismiss: DismissWindowAction) {
         windowOpener = open
         windowDismisser = dismiss
+
+        guard !pendingOpenURLs.isEmpty else { return }
+        let urls = pendingOpenURLs
+        pendingOpenURLs.removeAll()
+        for url in urls {
+            openBoard(at: url)
+        }
     }
 
     // MARK: Recents
@@ -403,9 +417,13 @@ public final class AppModel {
     ///
     /// Security-scoped access starts here, *before* the window exists, because the host's very first
     /// act is a tree walk: a scope started after the load would be too late.
+    ///
+    /// **Called before any scene has appeared, and that's fine.** A cold launch's Finder-open can
+    /// reach here before `windowOpener` is captured; the URL joins `pendingOpenURLs` and this same
+    /// method runs again for it once `captureWindowActions` has something to open it with.
     public func openBoard(at url: URL) {
         guard let windowOpener else {
-            Self.logger.error("openBoard with no window opener captured yet — ignored")
+            pendingOpenURLs.append(url)
             return
         }