Realign undo with the evening rulings — repo-nested and identity anchors

Repo-nested boards bind native undo in every tier (25d2513): the
no-undo case is gone, makeHistoryProvider answers git or native, and
the native path provably never touches the enclosing repository's
.git. Session undo steps anchor by card identity, never by path
(9119aa1): HistoryAnchor carries the card UUID (plus comment/draft
vocabulary) and apply-time validation resolves the current folder via
the same both-container walk writeCardBody uses — a board-side lane or
trash move no longer stales the coarse close step, while a genuine
field collision still skips it whole.

2448 tests in 423 suites green.

Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97

Kanban/Git/BoardGitMode.swift

@@ -14,8 +14,10 @@ import Foundation
 ///
 /// `repoNested` is not "git mode with the repository somewhere else". A board inside a user's
 /// existing repository gets **no app-managed git at all** — "no nested repo, no commits into the
-/// user's repo, no undo" (06 ▸ Rules) — which makes it as distinct from `git` as `none` is, and the
-/// reason it is a case rather than a flag on `git`.
+/// user's repo" (06 ▸ Rules) — which makes it as distinct from `git` as `none` is, and the reason it
+/// is a case rather than a flag on `git`. What it no longer costs is ⌘Z: the native stack binds here
+/// too (re-ruled 2026-07-31 — 13-native-undo.md's header; `AppModel.makeHistoryProvider`), because
+/// that stack is memory-only and touches no repository, anybody's.
 ///
 /// ### The remote half is deliberately absent
 ///

Kanban/Git/GitAutoCommitter.swift

@@ -161,8 +161,8 @@ public final class GitAutoCommitter {
     ///
     /// `nil` wherever no `GitHistoryProvider` is listening — which in practice is nowhere a committer
     /// exists at all: a committer's existence is exactly mode `git`, and mode `git` is exactly where
-    /// the composition root binds the git provider (`AppModel.makeHistoryProvider`). Mode-none boards
-    /// have a native stack and no committer; repo-nested boards have neither.
+    /// the composition root binds the git provider (`AppModel.makeHistoryProvider`). Mode-none and
+    /// repo-nested boards alike have a native stack and no committer.
     @ObservationIgnored
     public var reportLanded: (@MainActor (GitLandedWindow) -> Void)?
 

Kanban/Git/HistoryStore.swift

@@ -20,11 +20,12 @@ import os
 ///
 /// This is the foundation card of pro-m1: mode, a repository, add-git, and the loader's path-history
 /// ranker. **The provider binding reads `mode` and nothing else about a tier** — the composition
-/// root binds the git provider on mode `git`, the native stack on mode `none`, and nothing on a
-/// repo-nested board (`AppModel.makeHistoryProvider`, re-ruled 2026-07-31: the provider follows the
-/// board). Auto-commit, commit messages, branch controls, the identity fields, the
-/// `.gitignore` seed and its periodic housekeeping each arrived as their own card and are composed
-/// here now; remotes are pro-m2's and deliberately still absent.
+/// root binds the git provider on mode `git` and the native stack on modes `none` and `repoNested`
+/// alike (`AppModel.makeHistoryProvider`, re-ruled 2026-07-31: the provider follows the board, and
+/// what a repo-nested board denies is app-managed history, never ⌘Z). Auto-commit, commit messages,
+/// branch controls, the identity fields, the `.gitignore` seed and its periodic housekeeping each
+/// arrived as their own card and are composed here now; remotes are pro-m2's and deliberately still
+/// absent.
 @MainActor
 @Observable
 public final class HistoryStore {