The stack comes out — Kanban/Git/ deleted wholesale, ten thousand lines into history

Step 5 of strategy/01-git-excision.md: the seventeen dead engine files and the five remaining git test suites go (InertGitTests stays — the naming footgun is a Storage keeper). Two rescues ride ahead of the delete: HarvestedReceipt relocates to EchoLedger (the harvest surface outlives its git consumer; foundation for the deferred journal), and commentTimestamps joins the narrator it always served. The provider-swap purge test re-expresses over a git-free fake; the duplicate-id ladder keeps every pure historyRank pin and loses only the two ranker-driven ones. Resurrection point: tag pre-git-excision. 2,707 tests green.

Claude-Session: https://claude.ai/code/session_014PtZdPwqZuqEDLc6wZMtEy

Kanban/LiveStore/EchoLedger.swift

@@ -2,6 +2,46 @@ import CryptoKit
 import Foundation
 import Synchronization
 
+// MARK: - Harvested receipts
+
+/// **One EchoLedger receipt, copied out for a provenance consumer** (02-architecture.md ▸
+/// Components ▸ EchoLedger; 06-history-undo.md ▸ Interaction with external writers).
+///
+/// Relocated 2026-08-08 from `CommitAttribution.swift` with the git excision — the harvest surface
+/// outlives its git consumer; it is foundation for the deferred foreign-change journal
+/// (`strategy/01-git-excision.md`).
+///
+/// ### Why a copy and not a read
+///
+/// The ledger's receipts are **consumed** by the landing reload that classifies them — "one write,
+/// one echo", which is what buys the announcer its silence. A consumer asking its question a
+/// debounce later finds every receipt for the user's own card edit already gone; reading the live
+/// ledger at that point would misattribute the user's own work to a foreign writer, which is the
+/// one misattribution this whole mechanism exists to prevent.
+///
+/// So a consumer harvests at the **close of each write bracket** — the moment a receipt describes
+/// a completed write and nothing has had a chance to consume it — and keeps its own copy for the
+/// life of the debounce window. Supersession still works: a later bracket's harvest overwrites the
+/// same key with the newer hash, exactly as the ledger's own `recordWrite` does.
+///
+/// The satisfaction check stays the ledger's rule, re-applied against disk at attribution time, so
+/// the two races 02 settles land the same way here: byte-identical foreign bytes over a fresh app
+/// write classify app-mediated, and a foreign edit that misses the hash classifies foreign.
+public struct HarvestedReceipt: Sendable, Equatable {
+
+    public let receipt: EchoLedger.Receipt
+
+    /// **Whether the write that dropped it was a heal** — the flag 06-history-undo.md (ruled
+    /// 2026-07-29) keys the third commit class on: "a debounce window holding a scheduled heal's
+    /// changes alongside anyone else's splits the heal's paths into their own commit".
+    public let isHeal: Bool
+
+    public init(receipt: EchoLedger.Receipt, isHeal: Bool) {
+        self.receipt = receipt
+        self.isHeal = isHeal
+    }
+}
+
 // MARK: - EchoLedger
 
 /// **What the app wrote, so a landing reload can tell its own echo from someone else's edit** —