The phone joins the format — KanbanMobile MVP: shared storage verbatim over an iCloud container

A second product, not a second edition: dev.rzen.indie.KanbanMobile (iOS 26,
iPhone-only) compiles Kanban/Storage as source files, so a format change that
breaks the phone breaks this build the day it's made. Boards live in
iCloud.dev.rzen.indie.Kanban — named after the Mac bundle id so the Mac app can
adopt the container later without a migration; until then the folder is
"Lanework" in iCloud Drive and the Mac opens boards there through the open
panel.

EchoLedger grows #if os(macOS) gates around its three consumer surfaces
(verdicts/BoardDiff, harvest/HarvestedReceipt, comment retirement/CommentPath)
— the recording side BoardWriter stamps compiles on every platform, and the
gates are the seam a future phone verdict surface lands behind. AgentGuide
stays Mac-only.

The phone's watcher is NSMetadataQuery: BoardIndexStore (one query, package
UTI export makes a .kanban directory one item, equality-gated rescans,
download kicks per pass), BoardSession (materialization sweep before every
fail-fast walk, NSFileCoordinator brackets, perform{} = coordinated write then
awaited reload, ParseMemo threaded), CloudHome (off-main container resolution,
LANEWORK_LOCAL_ROOT DEBUG override for simulator work without an account).

Screens: Boards -> lanes -> cards -> card editor, value-routed by ItemID with
every screen re-reading the live snapshot; leading swipe moves a card via
confirmationDialog, trailing swipe sends it to .trash/; the editor commits
title through the Mac's canonical rename path and body through writeBody, with
drafts that survive reloads; attributes are the three typed style fields
(icon, iconColor, background) — labels is a reserved unknown-field key and
deliberately has no editor. Settings carries IndieBackup (backup root = the
container's Documents, restore rebuild = an index rescan, controller
constructed only once the home resolves).

Arbiter: KanbanMobile green for iOS Simulator, Kanban green for macOS, 3006
unit tests / 517 suites passed (PointerLatencyTests excluded — mid-rework
uncommitted in a parallel session).

Claude-Session: https://claude.ai/code/session_014PtZdPwqZuqEDLc6wZMtEy

.claude/agents/opus48.md

@@ -0,0 +1,7 @@
+---
+name: opus48
+description: General-purpose implementation agent pinned to Claude Opus 4.8 (capacity fallback when Opus 5 is overloaded). Use for complex coding tasks dispatched from the main session.
+model: claude-opus-4-8
+---
+
+You are a senior software engineer implementing well-specified tasks in this repository. Follow the task brief you are given exactly: read the referenced design docs and existing code patterns before writing, match surrounding idiom, keep pure logic in testable seams, and verify with the build/test commands specified in the brief. Report results as raw data in your final message per the brief's report format.

.env.release.example

@@ -0,0 +1,16 @@
+# Copy to .env.release (gitignored) in the app's repo root and fill in.
+# Used by Scripts/release.sh and the asc-*.swift scripts.
+#
+# These are account-level — the same Apple developer account and API key
+# serve every indie project, so copy this file (as .env.release) from an
+# existing sibling project rather than filling it out from scratch.
+#
+# Apple Developer team that signs the build (same as DEVELOPMENT_TEAM).
+APPLE_TEAM_ID=C32Z8JNLG6
+
+# App Store Connect API key (App Store Connect > Users and Access > Integrations > App Store Connect API).
+# Create a key with "App Manager" access, download the .p8 ONCE, and store it somewhere safe.
+ASC_KEY_ID=XXXXXXXXXX
+ASC_ISSUER_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+# Absolute path to the downloaded AuthKey_XXXXXXXXXX.p8 file.
+ASC_KEY_PATH=/Users/rzen/.appstoreconnect/private_keys/AuthKey_XXXXXXXXXX.p8

.gitignore

@@ -9,3 +9,10 @@ xcuserdata/
 
 # macOS
 .DS_Store
+
+# App Store credentials (appstore-publish skill)
+.env.release
+
+# Claude Code — personal permission grants stay local
+.claude/settings.local.json
+.claude/worktrees/

CHANGELOG.md

@@ -1,3 +1,97 @@
+**August 2026**
+
+The board's symbol now appears in the title bar beside the board's name, in its chosen tint.
+
+The board's symbol can now wear a color: the symbol picker carries a row of tints below the glyphs, with None to clear it.
+
+The board popover's new Theme tab dresses the board in a solid color or a generated pattern: filter by light or dark, colors and saturation, then pick from eight hues.
+
+The board popover is now organized into three tabs — Info with the board's vital statistics, Theme for backgrounds, and Git.
+
+The rubber band now highlights cards the moment it touches them, instead of lagging behind on large boards.
+
+The app's appearance can now be set to Light, Dark, or Auto from the View menu or the toolbar's new Appearance item.
+
+A board can now wear a background image, painted across the whole window with a frosted strip keeping the title bar legible.
+
+The background field is now written as a mapping — *{color: green}* instead of a bare *green* — and a board's may name an image beside the color.
+
+Clicking a card or lane now selects it immediately, instead of pausing for about half a second.
+
 **July 2026**
 
-Development begins — nothing user-facing yet.
+Version 2.0: Lanework's first release — a kanban app whose boards are ordinary folders of Markdown files on your Mac.
+
+Edit a board from any other app, script, or AI agent and the open window updates live; outside edits are first-class, never overwritten.
+
+Cards open in their own window with a formatted preview, a Markdown editor with checkable task lists, and a raw-source view.
+
+Attach files to a card by dropping them onto its face or into its card window.
+
+Drag cards and lanes to rearrange them, move or copy them between boards, or drop files from Finder to create new cards.
+
+Cut, copy, and paste cards and lanes — within a board, across boards, or as plain text into other apps.
+
+Deleted cards land in a trash lane you can show beside your lanes; drag a card out (or cut and paste it) to restore it.
+
+Undo and redo cover every board action, including bringing back a deleted lane with all its cards.
+
+A card window keeps its own undo trail while open; closing it folds everything you did there into one board-level undo step.
+
+Start new boards from ten bundled templates, or save any board as a template of your own.
+
+Search filters the board as you type, and new cards you create clear the filter so they never vanish under it.
+
+Style cards and lanes from a twelve-color palette, tint lanes with a band, and give each board its own background.
+
+The whole app works from the keyboard — arrow-key navigation, drag-free card moves, and Full Keyboard Access on every control.
+
+VoiceOver reads boards as lanes of cards, announces outside changes in one polite digest, and names a focused card that was deleted externally.
+
+Every board gets a guide file teaching AI agents the folder format, kept up to date automatically.
+
+A hand-made card file no longer needs an order or schema line — the card simply lands at the end of its lane until you place it.
+
+Every board carries a .gitignore naming which files count as noise, so system files like .DS_Store stay put instead of being gathered into a card's attachments.
+
+Boards open into their own window right away, with a quiet spinner while a large one is read, and ⌘W cancels an open in progress.
+
+A board that won't open now explains itself in that window, listing every problem file by file and grouped by what's wrong.
+
+Each listed file offers Reveal in Finder and Open in Editor, so you can fix it yourself and press Re-check.
+
+Repair and Open makes the fixes that are safe to make — a folder missing its board file, a board missing its format line — and opens the board.
+
+You can skip a file Lanework can't fix and open the board without it; the board then names what was left out, and asks again next time.
+
+Every card can carry a comment thread, shown beside or below the card's text in its window.
+
+The comment composer keeps its draft inside the board itself, so a half-written comment is waiting whenever and wherever you reopen the card.
+
+Comments render Markdown like the card body, take file drops of their own, and note when they've been edited.
+
+Board search now matches comment text, and ⌘F in a card window steps through matches across the whole thread.
+
+Deleting a comment takes effect immediately, stays undoable in the card's window, and board-level undo can still bring it back after the window closes.
+
+Every board can now gain git-backed history — commits, undo and redo as history entries, and branches — with remote sync still to come.
+
+The board popover can now add git version history to any board, with no git installation needed.
+
+A board that's already a git repository opens with its history live automatically — cloning a shared board just works.
+
+Every settled change on a git board becomes a history entry with a plain-language description, like *Move card 'Fix login' to Doing*.
+
+Edits from agents and other apps are recorded under their own authorship, so a git board's history always says who changed what.
+
+Undo and redo on git boards restore earlier states as new history entries — nothing is ever erased — and the undo trail survives relaunching the app.
+
+Every card window on a git board gains a History section listing the changes that touched that card, newest first.
+
+On git boards, everything done in a card window becomes a single history entry when the window closes.
+
+Switch or create branches from the board popover, with an explicit save-or-discard step protecting unsaved card edits.
+
+The name and email on a board's history entries are editable in the board popover and stored in the board's own repository.
+
+Zoom the board in and out from the View menu (⌘+ and ⌘−, ⌘0 for actual size), and the size you settle on is remembered across launches.

Configuration.storekit

@@ -0,0 +1,63 @@
+{
+  "identifier" : "A9F1C4E2-7B30-4D6A-9E51-1C7D2B8F0A34",
+  "nonRenewingSubscriptions" : [
+
+  ],
+  "products" : [
+
+  ],
+  "settings" : {
+    "_askToBuyEnabled" : false,
+    "_billingIssuesEnabled" : false,
+    "_disableDialogs" : false,
+    "_failTransactionsEnabled" : false,
+    "_locale" : "en_US",
+    "_storefront" : "USA",
+    "_storeKitErrors" : [
+
+    ]
+  },
+  "subscriptionGroups" : [
+    {
+      "id" : "20250730",
+      "localizations" : [
+
+      ],
+      "name" : "Lanework Pro",
+      "subscriptions" : [
+        {
+          "adHocOffers" : [
+
+          ],
+          "codeOffers" : [
+
+          ],
+          "displayPrice" : "2.99",
+          "familyShareable" : false,
+          "groupNumber" : 1,
+          "internalID" : "2025073001",
+          "introductoryOffer" : null,
+          "localizations" : [
+            {
+              "description" : "Git-backed board history and sync.",
+              "displayName" : "Lanework Pro",
+              "locale" : "en_US"
+            }
+          ],
+          "productID" : "dev.rzen.indie.kanban.pro.monthly",
+          "recurringSubscriptionPeriod" : "P1M",
+          "referenceName" : "Lanework Pro Monthly",
+          "subscriptionGroupID" : "20250730",
+          "type" : "RecurringSubscription",
+          "winbackOffers" : [
+
+          ]
+        }
+      ]
+    }
+  ],
+  "version" : {
+    "major" : 4,
+    "minor" : 0
+  }
+}

DESIGN/00-vision.md

@@ -20,9 +20,9 @@ The defining consequence: **anything that can read and write files is a first-cl
 4. **Native to the bone.** SwiftUI, macOS conventions (Finder-style rename, ⌥-drag copy, package documents, real windows), no web tech, no JS runtime.
 5. **Agents are users, not integrations.** The schema, the agent guide, and the tolerance rules are designed for programmatic writers from day one.
 
-## Editions
+## Tiers
 
-Lanework ships as three editions from one codebase and one format (12-editions.md): **Lanework** (no git; macOS-native undo — 13-native-undo.md), **Lanework Pro** (git-backed history, branches, remote sync — 06/07), and **Lanework Teams** (Pro plus tracker integration over the reserved enhanced schema; deferred). Separate Mac App Store apps sharing the `.kanban` UTI — any board opens in any edition. The deeper reason for the split: history and sync live behind a provider seam, so Teams' sync can be backend-agnostic (git *and* trackers) instead of git being load-bearing everywhere.
+Lanework ships as **one free Mac App Store app** with tiers from one codebase and one format (12-editions.md, re-ruled 2026-07-30): **Lanework** (free — no git; macOS-native undo — 13-native-undo.md), **Lanework Pro** (an auto-renewable subscription unlocking git-backed history, branches, remote sync — 06/07), and **Lanework Teams** (tracker integration over the reserved enhanced schema; deferred, probably a separate app). The deeper reason for the tier seam: history and sync live behind a provider boundary, so Teams' sync can be backend-agnostic (git *and* trackers) instead of git being load-bearing everywhere.
 
 ## App identity
 

DESIGN/02-architecture.md

@@ -20,7 +20,7 @@ BoardStore (one per open board, @Observable, MainActor)
 SwiftUI views (board window + card windows share the store)
 ```
 
-One-way flow: **files → watcher → loader → store → views**. User actions go through a Writer that mutates files; the change comes back around through the watcher like any external edit. The app trusts its own writes no more than anyone else's — **for rendering** (settled scope): the snapshot is only ever built from disk, never from memory of what the app meant to write — this is what makes external editors and agents first-class. Provenance is a separate, downstream concern: the **EchoLedger** (Components below) remembers what the app wrote so commit attribution (06-history-undo.md) and VoiceOver announcements (10-accessibility.md) can tell the app's own echo from a foreign change — without the render path ever trusting memory over disk.
+One-way flow: **files → watcher → loader → store → views**. User actions go through a Writer that mutates files; the change comes back around through the watcher like any external edit. The app trusts its own writes no more than anyone else's — **for rendering** (settled scope): the snapshot is only ever built from disk, never from memory of what the app meant to write — this is what makes external editors and agents first-class. Provenance is a separate, downstream concern: the **EchoLedger** (Components below) remembers what the app wrote so commit attribution (06-history-undo.md) and VoiceOver announcements (10-accessibility.md) can tell the app's own echo from a foreign change — without the render path ever trusting memory over disk. **The write path's do-nothing guards read the pending truth** (ruled 2026-08-06): never-trust-memory is the *render* path's scope, and it does not extend to a guard deciding whether a write would change disk. Between a write's bracket and its echo the snapshot describes the past — a guard comparing an asked-for value against it answers the wrong question, and a fast gesture pair silently loses its second half (the found case: two lane resizes released within one echo, A→B→A — the second compares A against the stale snapshot's A, writes nothing, and the first's echo settles the board at B, the width the user last dragged away from). So a do-nothing guard's baseline is the snapshot **as amended by this store's own in-flight writes** — the value it last wrote to that field and has not yet seen echo (a small pending-value record of the write path's own, *not* the EchoLedger, whose feeds-attribution-only charter stands); a gesture whose meaning is relative (step one width unit) resolves its base against the same amended truth, or a fast double-step loses its second press to the same staleness; and the undo step's recorded prior reads it too, or its inverse restores a state that never was. The amendment dies with its echo — a landed snapshot agreeing with the write clears it — and a failed or refused write never enters it (no echo is coming; the snapshot is still the truth). Per-gesture coalescing was weighed and set aside: one gesture is one write, one echo, one commit (the style batch's rule), and merging two gestures' writes would merge their commits.
 
 The **one named exception** is transient UI state rendering things that don't exist on disk — concretely the **new-card placeholder** (04-interactions.md): the inline editor for a card being created renders as a pseudo-card overlaid on the snapshot, with no disk presence and no UUID until the title commits. Commit creates the folder through the Writer and round-trips through the watcher like any write — the placeholder stays visible until the real card arrives, then hands off. **The handoff must read as one arrival** (settled): the placeholder renders at the arriving card's exact geometry — same slot, same size, same chrome — so the identity swap's cross-fade is imperceptible; two view identities are fine, two visible objects are not (no matched-geometry machinery across the overlay/snapshot boundary, just matched rendering). Abandoning (Escape, empty commit, click-away) discards it; disk was never touched. **A failed create discards it too** (settled): if the Writer create throws after the title commits, the create flow discards the placeholder — the failure surfaces as the ordinary one-shot banner (Write-failure surfacing below), and the overlay never waits for a card that cannot arrive. **Starting a new creation while a placeholder is open is a click-away for the draft** (settled): the open draft discards per its rule and the new placeholder begins — and ⌘N can't even reach this case (board commands disable while the editor is focused, 04-interactions.md), so only pointer paths do. Watcher reloads swap the snapshot *underneath* the overlay (like selection surviving a reload); if the placeholder's lane vanished in the reload, it is discarded — consistent with card windows dismissing when their card is deleted. Everything durable still round-trips through files.
 
@@ -28,31 +28,33 @@ The **one named exception** is transient UI state rendering things that don't ex
 
 - **Frontmatter** — YAML value model: parse, serialize, atomic write, unknown-key preservation with key order. Owns the byte-identical round-trip guarantee. Pure, heavily unit-tested.
 - **BoardLoader** — walks the folder tree, applies the fail-fast/skip rules, produces an immutable `BoardModel` snapshot. Pure function of the tree.
-- **BoardWriter** — every mutation (create, move, reorder, tombstone, style) as an explicit filesystem operation. No hidden state; a write is done when the file is on disk. (The EchoLedger's receipts are not this bullet's "hidden state": a receipt describes a *completed* write, and the ledger lives beside the Writer, not in it — no write is ever pending in memory.)
+- **BoardWriter** — every mutation (create, move, reorder, delete, style) as an explicit filesystem operation. No hidden state; a write is done when the file is on disk. (The EchoLedger's receipts are not this bullet's "hidden state": a receipt describes a *completed* write, and the ledger lives beside the Writer, not in it — no write is ever pending in memory.)
 - **EchoLedger** — the write-provenance ledger (the "Writer/echo machinery" that 06-history-undo.md ▸ Interaction with external writers — its Commit attribution rule — and 10-accessibility.md ▸ Live board announcements consume; settled). Every BoardWriter operation drops a receipt of its expected on-disk outcome before returning: path → content hash for writes (attachment imports hash during the copy — the bytes stream through the app anyway), an absence marker for deletes, an old→new pair for folder moves; a newer app write to the same path supersedes the receipt. Classification runs per observed changed file in a debounce window: current on-disk content matches the receipt → **app-mediated**, receipt consumed; no receipt, or mismatch → **foreign**. Final content deciding is what settles the races: an agent writing byte-identical bytes over a fresh app write matches and classifies app-mediated — with identical bytes the misattribution is unobservable in the tree, accepted; a foreign edit landing on an app-written path inside the same window misses the hash and the file classifies foreign — last writer wins the file, the app's subsumed intermediate never separately recorded (the diff compares snapshots, not a journal — 06-history-undo.md). Consumers: the auto-committer's author field and two-commit split (06), and the announcement filter (10) — on no-git boards the ledger runs identically with the announcer as its only consumer. **In-memory, per-store, dies with the session** — losing it costs attribution and nothing else, so the launch catch-up commit (06) classifies everything foreign: the app never vouches for changes it didn't witness. Bracketed operations don't consult it (they commit themselves and announce once at completion), and the reload-granularity origin tag (Live-reload resilience below) is orthogonal: it classifies *reloads*, the ledger classifies *files*. Feeds attribution and announcements only — never the render path (Layering above).
-- **BoardStore** — per-board `@Observable` object holding the current snapshot plus transient UI state that must be shared across that board's windows (TransientBoardState — see Changes from Kanban). Coalesces watcher reloads — at most one tree walk in flight, signals landing mid-walk fold into one follow-up; the debounce itself lives in FolderWatcher (below).
+- **BoardStore** — per-board `@Observable` object holding the current snapshot plus transient UI state that must be shared across that board's windows (TransientBoardState — see Changes from Kanban). Coalesces watcher reloads — at most one tree walk in flight, signals landing mid-walk fold into one follow-up; the debounce itself lives in FolderWatcher (below). **The reload publishes a changed-path channel — paths only, advisory** (ruled 2026-07-31): each reload vends the debounce window's observed path set alongside the generation bump; the initial load, wholesale/bracket-ending reloads, and root recovery vend **nil — "assume everything changed."** The channel is an **optimization surface, never a correctness input**: FSEvents can coalesce and drop, so every consumer must stay correct against nil or an over-broad set, and the render path never consults it — the snapshot remains the only render input. Consumers classify for themselves (the comments pane and search's comment index filter by `CommentPath`; the announcer keeps consuming the EchoLedger, which stays the sole provenance authority — the channel carries no app/foreign classification). This is what lets window-scoped readers stop re-reading on every generation change.
 - **BoardStoreRegistry** — refcounted registry so a board window and its card windows share one live store and one watcher. **The board window owns the board** (settled): card windows never outlive it — closing the board window closes its card windows too, so the last-window teardown and board-window close coincide. (The refcount still earns its keep ordering teardown while multiple windows close.)
 - **FolderWatcher** — FSEvents (debounced: **200 ms trailing**, the timer restarting per event so a burst yields one reload after quiet, over 50 ms FSEvents latency — settled numbers), attached best-effort to whatever path the board lives at. **Events under any `.git` path component are filtered out** (settled): the board's own root-level repo (a worktree-link `.git` file included) is the app's auto-commit churn, and a repo nested deeper — a card folder containing a clone, a submodule — is a stray (01-storage-format.md) whose internals never render; neither can alter the rendered tree, so neither drives reloads. (A nested repo's *working files* still fire events like any stray's — those reloads are value-equal and quiet.) There is only this one watching path: no NSMetadataQuery for iCloud Drive, no polling fallback for network volumes — on those warned-against locations (07-sync-collab.md) FSEvents delivery is unreliable and live reload silently degrades, accepted per 07's no-accommodations stance.
 - **Ranks** — gapped fractional ordering math + compaction. Pure.
 - **DropSlot** — drop-geometry math: hit zones and insertion-position targeting for drags (lane/position within the masonry, cross-board, Finder file drops). Pure, like Ranks.
-- **AgentGuide** — writes/upgrades the board-root `CLAUDE.md` (see 08-agent-integration.md).
-- **HistoryStore** — the history provider behind the edition seam (12-editions.md): the board session binds one `HistoryProviding` implementation at composition — base Lanework's native undo stack (13-native-undo.md, inverse `WriteOperation`s over NSUndoManager) or Pro's git plumbing (06-history-undo.md). Pro-only source; the base target never links git machinery.
+- **AgentGuide** — writes/upgrades the board-root `CLAUDE.md` (see 08-agent-integration.md). Its refresh is a scheduled heal riding the HealScheduler (below).
+- **IntegrityRules** — the one pure vocabulary of object validity (01-storage-format.md ▸ Validation and healing; settled 2026-07-29): the identity predicate and its canonical form (one rule shared by `ItemID` and the Writer's string-level checks — today's parallel `canonicalIdentity` derivation folds in), the per-field coercion rulebook, shape classification (the readable-but-uneditable shapes), per-kind index validation (the card validator generalized per kind — board, lane, card, the enhanced schema's comment when it lands), the reserved-name tables (card children, board-root claimed names — today scattered), the trash `kind` discriminator, and the typed **Defect** vocabulary the loader reports. `LoadResult`'s ad-hoc repair channels (loose files, legacy tombstones) become one typed defect stream; tolerate-tier warnings stay warnings — information, not work. **Loader and Writer remain the enforcement points and call in** — the service consolidates rules and policy, never relocates enforcement; a service smeared across the read/write/orchestration boundaries would be worse than the current discipline.
+- **HealScheduler** — the scheduled-heal engine: the six-step pattern today re-derived per healer in BoardStore (loose-file relocation, tombstone migration, agent-guide refresh), expressed once — compute work from the latest defects → resting-clear when empty → lock-and-writability gate (the read-only-lock deferral plus the guide's narrow `isWritableFile` defense, generalized to every healer) → signature compare → arm the memo *before* attempting → one write bracket whose write half re-verifies each defect against disk → post per one banner-posture table (each defect class declares loss row / silent / failure-only once; BannerCenter still owns all phrasing) → **clear the memo explicitly on success** (today only the guide does; the others' resting states merely happen to converge). Fires uniformly at the reload tail and at registry acquire — closing today's asymmetry where tombstone migration never fires at open. Inline heals (the midpoint-exhaustion renumber-and-retry, the import-boundary remint) stay gesture-scoped, with the renumber's ask-renumber-ask-again two-step as one shared helper instead of today's nine hand-rolled copies; on-touch heals live at the Writer's `updateIndex` seam, which consults IntegrityRules for pending on-touch work on the file it is rewriting (`kind` backfill; the span editor's duplicate-key twin removal and quote-on-first-write are the same class, named). **Window-scoped heals are memo-less — their trigger is their guard** (ruled 2026-07-31; comments' thread-level claimed-name displacement is the first): the memo exists to break reload-cadence hot loops, and window-scoped work runs only on window open or file change — a failed heal changes no files, so failure cannot trigger its own retry, and a partial success converges on the next read. The class-keyed memo stays board-wide (a thread's picture must never overwrite the board's); each new window-scoped heal owes the same no-self-trigger argument, and if one ever gains a self-triggering shape, scoping the memo key by class × container path is the named next step.
+- **HistoryStore** — the history provider behind the tier seam (12-editions.md): the board session binds one `HistoryProviding` implementation at composition, chosen by the entitlement's local read — the free tier's native undo stack (13-native-undo.md, inverse `WriteOperation`s over NSUndoManager) or Pro's git plumbing (06-history-undo.md). One target since the 2026-07-30 collapse: libgit2 and the git provider compile in dormant, and nothing outside the seam touches git machinery.
 
 ### Live-reload resilience
 
 - **A failed reload never replaces a good snapshot.** Fail-fast (01-storage-format.md) is the *initial-load* contract, where there is nothing to fall back on. Once a board is open, a watcher-triggered reload that fails (unparseable YAML, missing required fields — typically a non-atomic external write caught mid-flight) keeps the last good snapshot on screen and raises a **non-modal banner** carrying fail-fast's specifics (offending path + what's wrong). The watcher keeps watching; the next successful reload clears the banner automatically — transient breakage self-heals without the user losing the board, persistent breakage stays loudly visible. Editing is not locked out: writes go through the Writer as usual (the breakage is per-file and localized), and the reload debounce already absorbs most momentary invalid states before they surface.
-- **Duplicate-id detection surfaces as a repairable condition** (settled): the loader's board-wide dedupe (01-storage-format.md ▸ Fractal layout rules) withholds losing occurrences from every snapshot; a warning-tone condition banner names them and offers **Repair** — a Writer remint under user intent (the loader itself never writes). The condition heals when the duplicates are gone, however they go — Repair here, a repair elsewhere, a hand-deleted copy.
-- **The watcher is self-reconciling, never trusted blindly** (settled): every reload is already a full tree walk producing a value-type snapshot, so recovery from any blind window is always the same act — reload. A **reconciling reload** runs on wake-from-sleep and on app re-activation (debounced; an identical tree swaps in value-equal, so quiet reconciliations cost nothing visible), on any FSEvents flag admitting missed events (`MustScanSubDirs`, queue overflow — degrade to the reload rather than trust the gap), and after any stream re-creation. **Streams die and are recreated, not merely kept**: a volume unmount kills the stream with its root; the vanished-root and rename re-resolution rules (below) attach a *fresh* stream at the current root when it returns, reconciling reload included. A silently stale board — the worst failure for a files-are-truth app — is structurally excluded: every known blind window ends in a reload. **A reconcile request arriving mid-bracket is banked** (settled): the mandatory post-bracket reload delivers as the *reconciling* kind rather than app-mediated — an explicit reconciliation is never silently lost. FSEvents missed-events flags arriving mid-bracket are, by contrast, simply swallowed: the post-bracket reload is a full walk either way, and only the origin tag differs (it feeds commit attribution and the VoiceOver announcement vocabulary — a deliberate asymmetry).
+- **Duplicate-id detection heals silently** (re-ruled 2026-07-29, superseding the repairable-condition banner): the loader's board-wide dedupe (01-storage-format.md ▸ Fractal layout rules) withholds losing occurrences from every snapshot; a scheduled heal remints them through the Writer (the loader itself never writes) and a warning-tone notice reports the repair — no banner, no button, nothing waits on consent. The withheld window is one heal cycle, not a standing condition; a remint racing a vanished duplicate (repaired elsewhere, a hand-deleted copy) is a no-op, never an error.
+- **The watcher is self-reconciling, never trusted blindly** (settled): every reload is already a full tree walk producing a value-type snapshot, so recovery from any blind window is always the same act — reload. A **reconciling reload** runs on wake-from-sleep and on app re-activation (debounced; an identical tree swaps in value-equal — and, blessed 2026-07-31, the store **skips the assignment entirely** when the fresh snapshot equals the current one: assigning an equal tree into an `@Observable` property still costs a render pass, so "costs nothing visible" becomes *costs nothing*), on any FSEvents flag admitting missed events (`MustScanSubDirs`, queue overflow — degrade to the reload rather than trust the gap), and after any stream re-creation. **The skip's structural consequence — the two-counter split (blessed 2026-08-06):** once value-equal landings stop bumping the applied-snapshot generation, anything whose subject is the *walk* rather than the applied snapshot can no longer key on it. The store therefore carries two counters — snapshots **applied** (the committed-overlay hold's event, meaning unchanged) and walks **landed** with a snapshot in hand, bumped on every successful reload, equal or not; a failed reload bumps neither. The rule for choosing: **anything outside the snapshot, or about the walk itself, watches landed walks, not applied snapshots** — the card window's comment thread (comments are outside the snapshot, so a foreign comment arriving leaves the model value-equal), the comment search index (same shape), and the auto-committer's covering gate (what covers a flush is a completed walk, whether or not it found anything to show); on the applied counter each would sleep through exactly the value-equal landing it exists to notice. **Streams die and are recreated, not merely kept**: a volume unmount kills the stream with its root; the vanished-root and rename re-resolution rules (below) attach a *fresh* stream at the current root when it returns, reconciling reload included. A silently stale board — the worst failure for a files-are-truth app — is structurally excluded: every known blind window ends in a reload. **A reconcile request arriving mid-bracket is banked** (settled): the mandatory post-bracket reload delivers as the *reconciling* kind rather than app-mediated — an explicit reconciliation is never silently lost. FSEvents missed-events flags arriving mid-bracket are, by contrast, simply swallowed: the post-bracket reload is a full walk either way, and only the origin tag differs (it feeds commit attribution and the VoiceOver announcement vocabulary — a deliberate asymmetry). **The walk memoizes its parse, never its result** (blessed 2026-07-31 — a performance posture, not a semantic change): the loader may reuse the previous snapshot's parsed item for any `index.md` whose path, mtime, and size are unchanged — the previous snapshot *is* the memo — while directory enumeration (folder discovery, attachment listings, trash entries) stays fresh every walk, because attachment changes never touch `index.md`. The loader's contract is result-purity with cost unspecified: same tree in, same snapshot out, and the memo can only change how fast. The mtime+size trust is the git-index heuristic; a writer that defeats it — content changed, mtime and size both preserved — is outside the app's care (blessed 2026-08-06 as a decision on file, the boundary being reachable in practice — a byte-length-preserving edit plus deliberate utimes, a restore tool replaying old attributes — and pinned by test: git itself lives with the same blind spot, and the named tightenings — content hashing, which is the read the memo exists to avoid, or fileSystemFileNumber/generation stamps — wait for a real-world defeat, not a hypothetical one).
 - **App-initiated git churn is bracketed.** Operations the app runs itself (pull-rebase, branch switch, undo restore — 06-history-undo.md, 07-sync-collab.md) suspend watcher reloads for their duration and finish with one full reload — half-checked-out trees are never rendered. **The bracket also locks writes** (settled): for its duration the board is read-only with exactly the failed-reload lock's scope — mutating commands disable via menu validation, drops are refused, selection/navigation/search/copy-out stay live. 07's interaction-rest rule composes: the bracket starts only at gesture rest, so nothing in flight is interrupted; the lock ends with the final reload — seconds, honestly signaled by the operation's in-progress banner row (▸ The banner surface). External git activity (the user running git in a terminal) can't be bracketed: the debounce coalesces its churn, and a transiently inconsistent but parseable tree may render briefly and heals on the next event — accepted.
-- **Selection survives reloads by UUID.** Selection — and every transient state that references items (drag state, pending cut) — is a set of UUIDs over the snapshot, re-resolved when a reload swaps it: items still present stay selected; items that vanished leave the selection silently, no substitute invented — the search filter's hidden-cards-leave-the-selection rule (04-interactions.md) applied to external change. **A liveness flip is a vanish for this purpose**: re-resolution matches UUID *and* liveness side, so a foreign edit that tombstones a selected live card — or restores a selected tombstoned one — ejects it from the selection (and from the pending cut, which 04-interactions.md ▸ Clipboard already states), keeping 04's homogeneous-by-liveness invariant true across reloads. **Liveness here is effective — ancestor-walked** (settled): tombstoning a card's *lane* ejects the card too, its own flag notwithstanding — the card renders nowhere (03-board-ui.md collapses a tombstoned lane to a single restorable trash entry), and nothing invisible may stay selected, drag-included, or pending-cut. The search filter is deliberately absent from that list: the query string is transient state, but its result set is *derived* — the predicate re-runs against each new snapshot (04's live filter), so a card an agent files mid-search appears the moment the reload lands, and a card edited to no longer match animates out. Kin rules elsewhere: card windows dismiss when their card is effectively deleted — the ancestor walk included (05-card-window.md), the placeholder is discarded when its lane vanishes (above), and VoiceOver announces a vanished focused card and recovers focus to its lane (10-accessibility.md). App-mediated deletion is deliberately different — an act, not a surprise: ⌫ selects the successor sibling (04-interactions.md ▸ The map).
-- **A failed reload after a bracketed operation locks the board read-only** — the exception to "editing is not locked out" above. Ordinary watcher breakage is per-file: the snapshot still describes the tree, so editing around the broken file is safe. But a bracketed git operation changed the tree *wholesale*: if its final reload fails, the last-good snapshot on screen describes the pre-operation state (after a branch switch, a different branch entirely — 06-history-undo.md), and writes derived from it would land nonsense on the new tree. The banner carries the same fail-fast specifics plus the read-only state; the next successful reload (typically after the offending file is fixed) clears both. **The rule arms on every bracket exit, thrown operations included** (settled): an operation that fails or aborts mid-flight is precisely when the tree's state is least known, so the mandatory final reload runs regardless — succeeding, it renders whatever the operation left (often value-equal after a clean failure, whose tree is left as it was — 06-history-undo.md); failing, it locks exactly as above. **The lock's scope** (shared with the vanished-root case below) spans every window sharing the store — card windows included: every mutating command disables via menu validation — creation, delete and Put Back, paste, Move/Style/rename, trash operations, the popover's git controls, and the card window's write paths: the flip into Edit mode, raw-source entry and Apply, Add Attachment and the whole-window file drop, the sidebar's mutating actions, and task-list checkbox toggles (these disable in place as controls — 05-card-window.md's in-content rule) — and the board refuses drops, including drags arriving from another board's window. **The lock is a predicate every mutating entry point consults, not a menu-validation sweep** (settled): mutating paths without a menu item exist beyond the checkboxes — the attachment row's ⌫/Remove (grammar key + context menu only, 11-command-nexus.md ▸ Context menus), plain-⌫ delete, Return-creation — and each disables with its surface or follows its command twin's validation; menu validation is the lock's most visible face, never its whole mechanism. **File ▸ Duplicate and File ▸ Save as Template join the disabled set** (settled): both copy the on-disk tree, which the lock marks as gone (vanished root), unknown (this failed-reload state), or unwritable — and both are specified to run the close flush first (03-board-ui.md, 09-templates.md), which the lock's suspended saves make impossible to honor. **One carve-out: under the unwritable-location lock alone (below), Save as Template stays live** — it reads the board and writes into Application Support, the copy-out-is-a-read principle applied (archiving the read-only DMG board being inspected is a legitimate errand). **The carve-out gates on the hazard itself, open sessions, not on lock provenance** (settled): the item disables while any open Edit or raw-source session holds unsaved content — content the lock's suspended saves cannot flush, which the template would silently miss (09-templates.md's never-misses-keystrokes guarantee outranks availability) — and re-enables when those sessions settle or the lock clears. A lock standing since open never meets this state: it disables the flip into Edit mode, so no session can start beneath it and the gate is vacuously open; unsaved sessions under this lock exist only when the symmetric probe (▸ Write-failure surfacing) raised it mid-session. Duplicate stays disabled even there — its destination is the same unwritable parent (a writable-parent/unwritable-board permission split was weighed and set aside as too rare to earn the inconsistency). Drags *out* of a locked board offer the copy variant only — copy-out is a read; a ⌘-drag move's source-side delete is a write, so the modifier doesn't take. **An Edit buffer already open when the lock lands keeps its content and stays typable** — memory is not disk — but its debounced save suspends for the lock's duration; the held text's fate follows the lock's cause: a branch switch or undo restore can't leave a session open behind the lock at all (both settle editors first — 06-history-undo.md), a post-pull buffer saves on clear and wins per the sync model (05-card-window.md, 07-sync-collab.md), and a returned root saves normally (below). Selection, navigation, search, ⌘C copy-out, and Reveal in Finder stay live (reading the last-good snapshot is the point of keeping it).
+- **Selection survives reloads by UUID.** Selection — and every transient state that references items (drag state, pending cut) — is a set of UUIDs over the snapshot, re-resolved when a reload swaps it: items still present stay selected; items that vanished leave the selection silently, no substitute invented — the search filter's hidden-cards-leave-the-selection rule (04-interactions.md) applied to external change. **A container crossing is a vanish for this purpose** (resettled 2026-07-28 — the materialized trash): re-resolution matches UUID *and* container side (board vs `.trash/`), so a foreign move that trashes a selected board card — or restores a selected trash card — ejects it from the selection (and from the pending cut, which 04-interactions.md ▸ Clipboard already states), keeping 04's container-boundary invariant true across reloads. The old effective-liveness ancestor walk is retired with the tombstone model — presence in the snapshot is the whole question. The search filter is deliberately absent from that list: the query string is transient state, but its result set is *derived* — the predicate re-runs against each new snapshot (04's live filter), so a card an agent files mid-search appears the moment the reload lands, and a card edited to no longer match animates out. Kin rules elsewhere: card windows dismiss when their card is deleted or moved to the trash (05-card-window.md), the placeholder is discarded when its lane vanishes (above), and VoiceOver announces a vanished focused card and recovers focus to its lane (10-accessibility.md). App-mediated deletion is deliberately different — an act, not a surprise: ⌫ selects the successor sibling (04-interactions.md ▸ The map).
+- **A failed reload after a bracketed operation locks the board read-only** — the exception to "editing is not locked out" above. Ordinary watcher breakage is per-file: the snapshot still describes the tree, so editing around the broken file is safe. But a bracketed git operation changed the tree *wholesale*: if its final reload fails, the last-good snapshot on screen describes the pre-operation state (after a branch switch, a different branch entirely — 06-history-undo.md), and writes derived from it would land nonsense on the new tree. The banner carries the same fail-fast specifics plus the read-only state; the next successful reload (typically after the offending file is fixed) clears both. **The rule arms on every bracket exit, thrown operations included** (settled): an operation that fails or aborts mid-flight is precisely when the tree's state is least known, so the mandatory final reload runs regardless — succeeding, it renders whatever the operation left (often value-equal after a clean failure, whose tree is left as it was — 06-history-undo.md); failing, it locks exactly as above. **The lock's scope** (shared with the vanished-root case below) spans every window sharing the store — card windows included: every mutating command disables via menu validation — creation, delete and restore, paste, Move/Style/rename, trash operations, the popover's git controls, and the card window's write paths: the flip into Edit mode, raw-source entry and Apply, Add Attachment and the whole-window file drop, the sidebar's mutating actions, and task-list checkbox toggles (these disable in place as controls — 05-card-window.md's in-content rule) — and the board refuses drops, including drags arriving from another board's window. **The lock is a predicate every mutating entry point consults, not a menu-validation sweep** (settled): mutating paths without a menu item exist beyond the checkboxes — the attachment row's ⌫/Remove (grammar key + context menu only, 11-command-nexus.md ▸ Context menus), plain-⌫ delete, Return-creation — and each disables with its surface or follows its command twin's validation; menu validation is the lock's most visible face, never its whole mechanism. **File ▸ Duplicate and File ▸ Save as Template join the disabled set** (settled): both copy the on-disk tree, which the lock marks as gone (vanished root), unknown (this failed-reload state), or unwritable — and both are specified to run the close flush first (03-board-ui.md, 09-templates.md), which the lock's suspended saves make impossible to honor. **One carve-out: under the unwritable-location lock alone (below), Save as Template stays live** — it reads the board and writes into Application Support, the copy-out-is-a-read principle applied (archiving the read-only DMG board being inspected is a legitimate errand). **The carve-out gates on the hazard itself, open sessions, not on lock provenance** (settled): the item disables while any open Edit or raw-source session holds unsaved content — content the lock's suspended saves cannot flush, which the template would silently miss (09-templates.md's never-misses-keystrokes guarantee outranks availability) — and re-enables when those sessions settle or the lock clears. A lock standing since open never meets this state: it disables the flip into Edit mode, so no session can start beneath it and the gate is vacuously open; unsaved sessions under this lock exist only when the symmetric probe (▸ Write-failure surfacing) raised it mid-session. Duplicate stays disabled even there — its destination is the same unwritable parent (a writable-parent/unwritable-board permission split was weighed and set aside as too rare to earn the inconsistency). Drags *out* of a locked board offer the copy variant only — copy-out is a read; a ⌘-drag move's source-side delete is a write, so the modifier doesn't take. **An Edit buffer already open when the lock lands keeps its content and stays typable** — memory is not disk — but its debounced save suspends for the lock's duration; the held text's fate follows the lock's cause: a branch switch or undo restore can't leave a session open behind the lock at all (both settle editors first — 06-history-undo.md), a post-pull buffer saves on clear and wins per the sync model (05-card-window.md, 07-sync-collab.md), and a returned root saves normally (below). Selection, navigation, search, ⌘C copy-out, and Reveal in Finder stay live (reading the last-good snapshot is the point of keeping it).
 
 ### Write-failure surfacing
 
 The read-side rules above have a write-side mirror — one banner vocabulary for both directions:
 
-- **The one-way flow makes write failures honest by construction.** Views render only what is on disk, so a failed Writer operation (disk full, permissions, volume error) never shows phantom state — the action visibly doesn't happen. The failure surfaces in the same non-modal banner as read-side breakage, naming the operation and the cause ("Couldn't move 'Fix login' — disk full"). **The operation is a closed enum, not a string** (settled): Writer errors identify the failed operation as an enum case (create, move, reorder, tombstone, restore, style, …) carrying the affected item's title where known; the banner owns all user-facing phrasing and localization from that vocabulary, and a new Writer operation without a banner rendering is a compile-time hole, not a silent default. **The vocabulary grows with the surfaces** (settled): inline rename and the body save get their own cases when wired ("Couldn't rename 'Fix login'…", "Couldn't save 'Fix login'…") — style stays styling-only, never the generic frontmatter bucket; growing the enum is cheap by design. Free-form English survives only inside the diagnostic `reason`, never as the banner's verb. One-shot actions (move, tombstone, style, create) fail once and wait for the user to act again; nothing is queued behind their back.
-- **The debounced body save retries on its own cadence** — keystrokes stay in the dirty buffer, so nothing is lost while the window stays open; the banner stands until a save lands. The **one modal moment on the write-failure path**: closing a window (or the board, or quitting) with a dirty buffer that cannot be written — the only state that exists nowhere but memory — raises an alert (retry / save a copy elsewhere / discard) instead of failing silently. Everything else on this path stays non-modal. (Deliberate confirmations elsewhere are their own stories: Empty Trash… and Delete Immediately on boards without git history — 03-board-ui.md, the branch-switch save-or-discard step — 06-history-undo.md, machine-key regeneration — 07-sync-collab.md, the raw-source Apply validation alert — 05-card-window.md, the once-per-board iCloud/network-volume warning on open/create — 07, and the SSH trust-on-first-use fingerprint confirmation with its mismatch hard-block — 07.)
+- **The one-way flow makes write failures honest by construction.** Views render only what is on disk, so a failed Writer operation (disk full, permissions, volume error) never shows phantom state — the action visibly doesn't happen. The failure surfaces in the same non-modal banner as read-side breakage, naming the operation and the cause ("Couldn't move 'Fix login' — disk full"). **The operation is a closed enum, not a string** (settled): Writer errors identify the failed operation as an enum case (create, move, reorder, delete, restore, style, …) carrying the affected item's title where known; the banner owns all user-facing phrasing and localization from that vocabulary, and a new Writer operation without a banner rendering is a compile-time hole, not a silent default. **The vocabulary grows with the surfaces** (settled): inline rename and the body save get their own cases when wired ("Couldn't rename 'Fix login'…", "Couldn't save 'Fix login'…") — style stays styling-only, never the generic frontmatter bucket; growing the enum is cheap by design. Free-form English survives only inside the diagnostic `reason`, never as the banner's verb. One-shot actions (move, delete, style, create) fail once and wait for the user to act again; nothing is queued behind their back.
+- **The debounced body save retries on its own cadence** — keystrokes stay in the dirty buffer, so nothing is lost while the window stays open; the banner stands until a save lands. The **one modal moment on the write-failure path**: closing a window (or the board, or quitting) with a dirty buffer that cannot be written — the only state that exists nowhere but memory — raises an alert (retry / save a copy elsewhere / discard) instead of failing silently. Everything else on this path stays non-modal. (Deliberate confirmations elsewhere are their own stories: Empty Trash… and the trash's permanent Delete on boards without git history — 03-board-ui.md, the branch-switch save-or-discard step — 06-history-undo.md, machine-key regeneration — 07-sync-collab.md, the raw-source Apply validation alert — 05-card-window.md, the once-per-board iCloud/network-volume warning on open/create — 07, and the SSH trust-on-first-use fingerprint confirmation with its mismatch hard-block — 07.)
 - **A renamed or moved board root follows its file identity** (settled): the board the app has open is the *file*, not the path string — the registry's security-scoped bookmark is the identity, mid-session as much as across opens (01-storage-format.md calls Finder renames ordinary, and mid-session must honor that). On any root-gone signal — the watcher's path stops delivering, a write lands on a stale path — the app first **re-resolves the bookmark**: if it resolves to a new location, the rename/move is absorbed transparently — the watcher re-attaches there, Writer URLs and card-window keys re-derive from the new root, one full reload runs, and the window title follows the folder-name fallback where it applies — no banner, no lock, nothing was ever wrong. Only when the bookmark does not resolve is the root truly vanished (below). Either way, a root-gone signal **cancels any armed debounced tree-event delivery** (settled): both outcomes end in a full reload — at the re-resolved root, or on the root's return from the vanished-root lock — so delivering a stale tree event for a path that just stopped being the root would only be noise.
 - **A vanished board root locks the board read-only** — the bracketed-reload vocabulary applied to a root that is gone (volume unmounted, folder Finder-deleted while open — and the rename re-resolution above found nothing): every write would land nowhere, so the last-good snapshot stays on screen, read-only, banner up. The watcher keeps watching; if the root returns (remount, Finder undo), the next successful reload clears the lock and pending dirty buffers save normally. **A root change landing mid-bracket is owned by the root-change path, not the bracket** (settled): re-resolution runs immediately even inside a bracket — a rename is absorbed transparently and the bracket's final reload simply runs at the re-resolved root; a true vanish raises this lock at once and the bracket's eventual final reload becomes a no-op rather than a redundant failure. Nothing is lost by skipping it: the root's return runs the reconciling reload, and an operation the vanish killed mid-flight is 06-history-undo.md's own-leftovers case, recognized at the next open or flush. (The composition matters for a pull-rebase mid-flight when a volume unmounts — 07-sync-collab.md.)
 - **An unwritable board location enters the read-only lock at open** (settled): opening probes the root's writability — a read-only volume (DMG, snapshot, read-only share) or a permission-denied folder opens straight into the read-only lock, banner naming the cause — **which specific cause, not a shared line** (settled): the probe distinguishes read-only volume from permission-denied folder and the lock reason carries it ("this board's volume is read-only" vs "you don't have permission to change this folder"), the fixes being different acts — rather than letting every gesture fail one at a time — fail loudly, specifically, *once*. The open-time agent-guide write (08-agent-integration.md) is skipped-with-log, the `CLAUDE.user.md`-taken precedent. Writability re-probes on every reconciling reload (wake, activation — above), **and the probe is symmetric** (settled): a rewritable remount or fixed permission clears the lock without ceremony, and a volume gone read-only mid-session *raises* it at the next probe — banner up front, not every gesture failing one at a time (the lock's own founding rationale). Between probes, a write that hits the newly read-only volume fails as an ordinary one-shot; the next reconciliation converts the condition into the standing lock. The lock's read affordances stay live as always — inspecting an archived board on a DMG is a legitimate errand, and viewing-first is the point.
@@ -63,9 +65,9 @@ The read-side rules above have a write-side mirror — one banner vocabulary for
 
 The non-modal banner named throughout the read- and write-side rules above is one UI component, specified here:
 
-- **Hosted by the window of origin.** Every window hosts a banner strip; a condition surfaces in the window whose action produced it — debounced body save, attachment drop, and raw-source Apply failures in their card window; reload breakage, one-shot write failures, commit failures, and lock states in the board window. A card window that closes while its condition persists re-homes the banner to the board window (the condition is still true; it must stay visible somewhere).
+- **Hosted by the window of origin.** Every window hosts a banner strip; a condition surfaces in the window whose action produced it — debounced body save, attachment drop, and raw-source Apply failures in their card window; reload breakage, one-shot write failures, commit failures, and lock states in the board window. A card window that closes while its condition persists re-homes the banner to the board window (the condition is still true; it must stay visible somewhere). **Reaffirmed 2026-08-06 against the shipped board-strip interim**: everything posts to the board window's strip today, defended in code by "a card window is not always the frontmost thing on screen" — but a full-screen or other-Space card window whose failing save banners into a window the user cannot see is a silence trap, exactly what the form-anchored rule (06 ▸ form-anchored operations) exists to prevent; the window of origin *is* under the user's eye at the moment of the action. The interim's one good idea is absorbed rather than discarded: **rows name their card wherever ambiguity exists, in per-window strips too** — naming and hosting answer different questions ("whose failure" vs "where the user is looking"), and re-homing keeps the name when a card row lands on the board strip.
 - **One-shots dismiss, conditions heal.** One-shot failures ("Couldn't move 'Fix login' — disk full") carry an explicit dismiss control and no timeout — an error never evaporates unread. Persistent conditions (reload breakage, suspended auto-commit, read-only locks) have no dismiss: they describe ongoing state, standing until the next success clears them, per the rules above.
-- **Concurrent conditions stack.** The strip presents independent rows, precedence-ordered: **in-progress rows (pinned) >** read-only lock > reload breakage > one-shot write failures > **loss rows** > commit and attachment failures **> passive info rows** (the remote-change signpost); newest first within a class. **Loss rows are the warning-tone class for non-failure losses** (settled 2026-07-28): content that didn't arrive though nothing failed — a degraded paste, folders skipped from a Finder drop, their future kin. They take the one-shot's lifecycle (dismissable, untimed — a loss the user didn't notice is the harm, so it never auto-expires), rank below the true failures (an action that didn't happen outranks one that partially did), and above the ambient notices. Each row heals or dismisses independently; beyond three rows the remainder collapse behind a "+N more" disclosure. **In-progress rows are exempt from the collapse and don't count toward its budget** (settled): they are the strip's only explanation for a bracket's write lock and for a close/quit deferring teardown, and the copy rows carry the reachable Cancel — a spinner may never hide behind "+N more". They're safe to pin: few at once, self-clearing, **newest first within the class like every other** (ratified — insertion order; the class rarely holds more than two rows, and one ordering rule beats a special case). Passive info rows rank last and may collapse — calm by design, nothing gated on seeing them instantly.
+- **Concurrent conditions stack.** The strip presents independent rows, precedence-ordered: **in-progress rows (pinned) >** read-only lock > reload breakage > one-shot write failures > **loss rows** > commit and attachment failures **> passive info rows** (the remote-change signpost); newest first within a class. **The one-shot failure class carries two shapes** (settled 2026-07-31): the `BoardWriteError`-shaped write failure, and a message-carrying **git-operation failure** — the operation named in the user's words plus the underlying error, phrasing still BannerCenter's — because failures rank by what they are, not by which error vocabulary threw them. A failed undo restore, branch switch, or (pro-m2) pull/push is an action that didn't happen: it presents in the error tone at the failure rank, never as a warning-tone loss row (the shipped loss-row compromise is retired). Git operations stay off the closed `WriteOperation` vocabulary — only the banner tier learns the second shape. Recovery *notices* — "a branch switch was interrupted — the previous state is restored" — report a success, not a failure, and stay warning-tone. **Loss rows are the warning-tone class for non-failure losses** (settled 2026-07-28): content that didn't arrive though nothing failed — folders skipped from a Finder drop, a legacy migration's folded notices, their future kin (the degraded paste left the class 2026-07-29 — a snapshot-less paste now refuses outright, a one-shot failure, 04-interactions.md ▸ Clipboard). They take the one-shot's lifecycle (dismissable, untimed — a loss the user didn't notice is the harm, so it never auto-expires), rank below the true failures (an action that didn't happen outranks one that partially did), and above the ambient notices. Each row heals or dismisses independently; beyond three rows the remainder collapse behind a "+N more" disclosure. **In-progress rows are exempt from the collapse and don't count toward its budget** (settled): they are the strip's only explanation for a bracket's write lock and for a close/quit deferring teardown, and the copy rows carry the reachable Cancel — a spinner may never hide behind "+N more". They're safe to pin: few at once, self-clearing, **newest first within the class like every other** (ratified — insertion order; the class rarely holds more than two rows, and one ordering rule beats a special case). Passive info rows rank last and may collapse — calm by design, nothing gated on seeing them instantly.
 - **Tones, not components.** The banner has kinds — error, warning, info — sharing layout and the accessibility announcement path (10-accessibility.md). The card window's remote-change signpost (07-sync-collab.md) is this same component in the info tone: visually calm, no error color. **Its lifecycle is the one-shot's — dismissable, untimed** (settled): 07's "transient" means non-modal and non-blocking, never auto-expiring; the strip has exactly two lifecycles (one-shots dismiss, conditions heal) and the signpost doesn't add a third.
 - **In-progress operations are info rows** (settled): bracketed git operations ("Pulling…", "Switching to 'main'…") and long non-git work (big-board Duplicate, template instantiation, large attachment imports, and cross-board transfers — drag copies and moves, staged-clipboard pastes) each show an info-tone row with a spinner — determinate where progress is knowable. Completion clears the row (the VoiceOver completion announcement of 10-accessibility.md rides the same event); failure swaps it for the error row. Sighted and VoiceOver users learn one vocabulary.
 - **Cancel appears on safe copies only** (settled): copy-shaped work — attachment imports, Duplicate, template instantiation, cross-board copies and pastes — carries Cancel, meaning "remove the partial copy, nothing lost"; a cross-board ⌘-drag *move* cancels the same way during its copy phase — the source deletes only after the copy lands, so Cancel leaves the original untouched. Git brackets get no Cancel: seconds long, and aborting a rebase mid-flight is a repair job, not a cancel.
@@ -78,10 +80,11 @@ The non-modal banner named throughout the read- and write-side rules above is on
 ### Launch and window lifecycle (settled)
 
 - **Restoration is a preference** — "Restore open boards at launch" in Settings (⌘, — 11-command-nexus.md), default on. On: boards open at last quit reopen (bookmark-resolved), with their per-board frames and 05's card-window restoration. Off: every launch starts at welcome.
-- **The restoration set is a live open marker, never an at-quit write** (settled): each registry record (Per-board app state below) carries an open-now flag, set when the board's window opens and cleared on *user-initiated* close — quit's teardown closes deliberately leave it standing (the boards were open at quit by definition; teardown distinguishes user-close from quit-close, and that distinction is the whole mechanism). Restoration reads the flagged records, reopening by `lastOpened` order. Crash recovery falls out for free: after a crash the flags describe what was open at crash time, so relaunch restores it — no separate recovery logic, no once-at-quit stamp to race teardown or miss on a crash. The preference gates only whether the flagged set is consulted; the flags are maintained regardless.
+- **The restoration set is a live open marker, never an at-quit write** (settled): each registry record (Per-board app state below) carries an open-now flag — set when the board's window opens and cleared on *user-initiated* close — quit's teardown closes deliberately leave it standing (the boards were open at quit by definition; teardown distinguishes user-close from quit-close, and that distinction is the whole mechanism). Restoration reads the flagged records, reopening by `lastOpened` order. Crash recovery falls out for free: after a crash the flags describe what was open at crash time, so relaunch restores it — no separate recovery logic, no once-at-quit stamp to race teardown or miss on a crash. The preference gates only whether the flagged set is consulted; the flags are maintained regardless.
 - **Welcome appears only when nothing restores** — restoration off, nothing was open, or every restoration failed. Always reachable via Window ▸ Welcome to Lanework. Opening a board from welcome closes welcome.
+- **Every open passes through a pre-snapshot loading state** (ruled 2026-07-29): the board window appears **immediately** — welcome click, File ▸ Open…, Finder double-click, restoration alike — at its saved frame, its chrome carrying the registry record's cached title and icon (the same no-scan sources the welcome row reads; a first-ever open shows the folder name, the record's provisional display name). The content area holds a quiet loading surface: a centered system spinner appearing only after a short grace (~200 ms) so ordinary fast opens never flash it — no skeleton lanes, the motion language animates real data only. The first snapshot replaces the surface in place (a snap — there is no prior arrangement to animate from). **The walk is cancellable**: ⌘W during loading cancels it and closes the window, an ordinary user-initiated close clearing the open-now flag. **Restoration is parallel**: every flagged window appears at once in loading state (stacked by `lastOpened` order), each walk independent — a slow network board never delays the others and stays closeable while it loads. Failure resolves by attendance (amended 2026-07-31 — 01-storage-format.md ▸ The decision surface): an **attended** open's fail-fast walk transforms the loading content in place into the aggregated repair surface — a live decision, not an error display — and only Cancel retires the window to the row-level welcome landing; a **restored** window's walk keeps the settled behavior, retiring to welcome row-level — welcome returning if the open came from it or from Finder — and the row's retry click is the attended open that earns the surface. The open walk earns no in-progress info row: the loading state is the surface, and the info-row class stays scoped to copy-shaped work.
 - **Closing the last board window leaves the app windowless** (menu bar alive) — the close is respected. Reactivation (Dock click) with no windows shows welcome.
-- **A restored board that fails surfaces on welcome, row-level**: its window doesn't open; welcome appears alongside whatever did restore, the failed board's recents row carrying fail-fast's specifics (load error) or the unavailable state per Graceful orphaning (offline volume, dead bookmark). Other restorations proceed unaffected — never a launch-time modal chain, never a silent drop.
+- **A restored board that fails surfaces on welcome, row-level**: its loading window retires (the pre-snapshot state above); welcome appears alongside whatever did restore, the failed board's recents row carrying fail-fast's specifics (load error) or the unavailable state per Graceful orphaning (offline volume, dead bookmark). Other restorations proceed unaffected — never a launch-time modal chain, never a silent drop.
 - **Opening a board from Finder is a standard document open** (settled): double-clicking a `.kanban` folder (or `open -a`) routes through the app's open-documents handler into the exact path welcome and File ▸ Open… already use — registry record (created before loading, Per-board app state below), board window, recents stamp. A board already open focuses its existing window — file-identity match, never a second window (one board window per root, above). A fail-fast failure surfaces row-level on welcome, uniform with the restored-board failure row.
 
 - **Close flushes**: closing a board window (and app quit) first closes the board's card windows — each open Edit session ends with its normal session commit (06-history-undo.md's granularity) — then flushes pending debounced work, editor saves before the pending auto-commit, before the store tears down. Nothing about this is conditional: a card window cannot exist without its board window (the ownership rule above), so the close flush is always the whole story.
@@ -89,14 +92,14 @@ The non-modal banner named throughout the read- and write-side rules above is on
 
 ## Per-board app state
 
-State that belongs to the app, not the user's files — the recents list, per-board window frames, the open-now restoration flag (Launch and window lifecycle above), the push-on-commit setting and the once-per-board iCloud warning flag (07-sync-collab.md), and whatever accumulates later — lives in a **board registry in Application Support**: one record per known board, anchored by the **security-scoped bookmark** the sandboxed app keeps anyway for reopening boards.
+State that belongs to the app, not the user's files — the recents list, per-board window frames, the open-now restoration flag (Launch and window lifecycle above), the push-on-commit setting and the once-per-board iCloud warning flag (07-sync-collab.md), and whatever accumulates later — lives in a **board registry in the app's Application Support container** (re-ruled 2026-07-30 — the one-app collapse removed the App Group wholesale; 12-editions.md ▸ App-side state): one record per known board, anchored by the **security-scoped bookmark** the sandboxed app keeps anyway for reopening boards.
 
 - **Keyed by file identity, never by path.** Bookmarks track renames and moves on the same volume; an opened URL is matched to its record by bookmark resolution / file identity, so a moved board keeps its settings. The recents list *is* this registry sorted by last-opened. **One bookmark per open board** (settled): the open flow mints it once and threads it through — the persisted record and the live store's mid-session re-resolution share the same bookmark, never two independent mints.
-- **Recents counts are registry-cached.** The lane/card counts in the welcome window come from the record, stamped at last close — no directory scan at welcome time (which would be slow or hang on big/unavailable boards). Staleness until the next open is accepted. **The counts are live items only** (settled): tombstoned lanes and cards — and cards hidden beneath a tombstoned lane — don't count; the row advertises the board's working size, and the trash is an errand, not inventory. Records that can't be counted show without counts: unavailable boards per Graceful orphaning below; a board that fails to load just fails on open, fail-fast — the welcome row doesn't pre-detect it. **A first open that fails fail-fast still records** (settled): the registry record is created before loading, so the failed board lands in recents carrying fail-fast's specifics — retry after fixing the file is one click, uniform with the restored-board failure row. **The record's provisional display name is the folder name** (settled): fail-fast means the frontmatter can't be trusted, and the folder name is the Finder document name the user just picked; the first successful load replaces it with the cached title. A never-successfully-opened record is not a special class — it lingers in recents like any other, and Forget is the eraser for a genuinely mistaken open. **Records that collapse onto one file identity merge silently** (settled — a restored registry file, or an orphan whose bookmark re-resolves onto a recreated board): on detection, the record with the newest `lastOpened` wins wholesale and the others retire — recents never shows one board twice, and per-board settings are conveniences that don't earn a merge UI.
+- **Recents counts are registry-cached.** The lane/card counts in the welcome window come from the record, stamped at last close — no directory scan at welcome time (which would be slow or hang on big/unavailable boards). Staleness until the next open is accepted. **The counts are working items only** (settled, re-grounded 2026-07-28; extended for the lanes-era trash 2026-07-29): items in `.trash/` don't count — a trashed lane subtracts from the lane count and its nested cards subtract from the card count; the row advertises the board's working size, and the trash is an errand, not inventory. Records that can't be counted show without counts: unavailable boards per Graceful orphaning below; a board that fails to load just fails on open, fail-fast — the welcome row doesn't pre-detect it. **A first open that fails fail-fast still records** (settled): the registry record is created before loading, so the failed board lands in recents carrying fail-fast's specifics — retry after fixing the file is one click, uniform with the restored-board failure row. **The record's provisional display name is the folder name** (settled): fail-fast means the frontmatter can't be trusted, and the folder name is the Finder document name the user just picked; the first successful load replaces it with the cached title. A never-successfully-opened record is not a special class — it lingers in recents like any other, and Forget is the eraser for a genuinely mistaken open. **Records that collapse onto one file identity merge silently** (settled — a restored registry file, or an orphan whose bookmark re-resolves onto a recreated board): on detection, the record with the newest `lastOpened` wins wholesale and the others retire — recents never shows one board twice, and per-board settings are conveniences that don't earn a merge UI.
 - **The row's title and icon are registry-cached too — with live write-through** (settled): the record carries the board's `title`, `icon`, and `iconColor` beside the counts, and the welcome row reads only the record — it never opens any board's `index.md` (the same hang-avoidance that motivated the counts rule). Unlike the counts' at-close stamp, these three refresh **whenever an open board's reload changes them**: the store already holds the new snapshot, so an in-app Board rename (03-board-ui.md) lands in the record instantly — never a welcome row showing a name the user just changed away from — and a foreign rename of an *open* board rides the same path for free. The honest residual: renaming a board that isn't open (an agent editing its root `index.md`) stays stale until the next open — accepted, the counts' staleness class. The title falls back to the folder name per 01-storage-format.md, cached at the same moments.
 - **Files-first stays absolute**: nothing app-private is ever written into the board folder — no frontmatter keys, no sidecar files, no xattrs. Two machines sharing a board via a remote each keep their own record (push-on-commit and window frames are genuinely per-machine choices).
 - **Graceful orphaning**: a record whose bookmark no longer resolves (board deleted, or moved across volumes where bookmarks can't follow) is orphaned — recents surface it as unavailable with Forget; its settings are conveniences and die with it (accepted).
-- **App-wide state has the same home.** Not everything app-side is board-scoped: quick-style recents (03-board-ui.md), the SSH host-key assignment table and TOFU fingerprint store (07-sync-collab.md — host-scoped), the last-used card-window size (05-card-window.md), and their peers live beside the registry in Application Support (or `UserDefaults` where a scalar fits) — no per-board record involved. Secrets are the named exception: Keychain only, never here (07).
+- **App-wide state has the same home.** Not everything app-side is board-scoped: quick-style recents (03-board-ui.md), the SSH host-key assignment table and TOFU fingerprint store (07-sync-collab.md — host-scoped), the last-used card-window size (05-card-window.md), the user template store (09-templates.md — plain board folders), and their peers live beside the registry in Application Support (or standard `UserDefaults` where a scalar fits) — no per-board record involved. Secrets are the named exception: Keychain only, never here (07).
 
 ## Caching and search
 
@@ -109,7 +112,7 @@ The old app loaded boards fast enough that the planned SwiftData cache was never
 
 ## Changes from Kanban
 
-- The store's transient-state grab-bag gets an explicit home (settled, m3): **TransientBoardState**, one per store, holding state by how a reload treats it. **Item-referencing sets** — selection, drag membership, the pending cut — share one shape (a UUID set plus the liveness side it lives on) and one constraint rule, *members must exist in the current universe*, applied in two directions by one primitive: a reload re-resolves each set independently against the new snapshot (present on the same effective-liveness side, ancestor-walked), and the search filter constrains the selection to its visible set — **the trashed side has exactly one definition: the set with trash rows** (settled): a card carrying its own `deleted:` under a tombstoned lane is in *neither* universe (03-board-ui.md's ancestor walk subsumes it — no row, no membership), so an anchor or selection can never survive on an item that renders nowhere; universe and rows are one function, never a broader set with a pointer-side subset — the hidden-cards-leave-the-selection rule and the reload-survival rule are one rule, expressed once. **Derived state is stored as its inputs only**: the search query is kept, its result set never is — the predicate re-runs against each snapshot (04-interactions.md's live filter). **The overlays** — transient render state covering the gap between a gesture and its disk echo, each discarding itself at handoff. The **new-card placeholder** is anchored to its lane, not to items: no UUID until the title commits, discarded when a reload drops or effectively tombstones its lane, and handed off by discarding itself the moment the created card's UUID appears in a snapshot. The **held drop proposal** (settled — 03-board-ui.md ▸ Motion) is its kin on the other side of a write: at drag release the proposed arrangement keeps rendering over the snapshot while the move write brackets, and the proposal discards itself when the echo reload lands (positions match, nothing visibly moves); a failed write or a reload that vanishes the dragged items discards it and the board animates back to snapshot order. **Its home is the app-wide DragSession, not this per-store state** (settled 2026-07-28 — the one overlay that outlives a store's scope): a drag inherently crosses boards, so the hold lives once on AppModel, keyed by board root and snapshot generation; per-store homing would need a store-to-store hand-off mid-gesture for no behavioral gain. The placeholder kinship is semantic — hold, hand off at echo, discard on vanish — not residential. A refused write produces no echo reload, so **a short timeout stands in for the failed-write discard signal** (accepted): the hold snaps back animated when no echo arrives. Trash visibility rides along as a plain per-open value: hidden on every open, never persisted — visiting the trash is an errand, not a layout choice.
+- The store's transient-state grab-bag gets an explicit home (settled, m3): **TransientBoardState**, one per store, holding state by how a reload treats it. **Item-referencing sets** — selection, drag membership, the pending cut — share one shape (a UUID set plus the container side it lives on, board or trash) and one constraint rule, *members must exist in the current universe*, applied in two directions by one primitive: a reload re-resolves each set independently against the new snapshot (present on the same container side — resettled 2026-07-28, the materialized trash: presence is the whole test, no ancestor walk, no effective liveness), and the search filter constrains the selection to its visible set — the hidden-cards-leave-the-selection rule and the reload-survival rule are one rule, expressed once. **Derived state is stored as its inputs only**: the search query is kept, its result set never is — the predicate re-runs against each snapshot (04-interactions.md's live filter). **The overlays** — transient render state covering the gap between a gesture and its disk echo, each discarding itself at handoff. The **new-card placeholder** is anchored to its lane, not to items: no UUID until the title commits, discarded when a reload drops its lane, and handed off by discarding itself the moment the created card's UUID appears in a snapshot. The **held drop proposal** (settled — 03-board-ui.md ▸ Motion) is its kin on the other side of a write: at drag release the proposed arrangement keeps rendering over the snapshot while the move write brackets, and the proposal discards itself when the echo reload lands (positions match, nothing visibly moves); a failed write or a reload that vanishes the dragged items discards it and the board animates back to snapshot order. **Its home is the app-wide DragSession, not this per-store state** (settled 2026-07-28 — the one overlay that outlives a store's scope): a drag inherently crosses boards, so the hold lives once on AppModel, keyed by board root and snapshot generation; per-store homing would need a store-to-store hand-off mid-gesture for no behavioral gain. The placeholder kinship is semantic — hold, hand off at echo, discard on vanish — not residential. A refused write produces no echo reload, so **a short timeout stands in for the failed-write discard signal** (accepted): the hold snaps back animated when no echo arrives. Trash visibility rides along as a plain per-open value: hidden on every open, never persisted — visiting the trash is an errand, not a layout choice (the trash itself is `.trash/` on disk — 03-board-ui.md).
 
 ## Open questions
 

DESIGN/03-board-ui.md

@@ -4,15 +4,16 @@ The board window: layout, lanes, cards, and styling. Interaction mechanics (sele
 
 ## Layout — full visibility
 
-- **Every lane is always on screen.** The window width divides across the lanes' width units — no horizontal scroll, no enforced minimum lane width. Resizing the window is the width control. (Settled emphatically in the old app: horizontal scroll strays from what kanban is for.) The degenerate case is accepted, not floored: enough lanes/units in a small window compress every lane, titles and cards truncate gracefully, and the remedy is the user's (fewer units, bigger window). A minimum-width setting that reintroduces scroll was considered in the pathfinder and deliberately rejected. **Lane-count changes re-divide, never resize**: new lane (⇧⌘N), lane paste or cross-board lane drop, lane tombstone, Put Back, and Show/Hide Trash (the quasi-lane's fixed unit joins and leaves the division — Trash below) all re-divide the existing window width across the new unit total — window-growing behavior belongs to the right-edge drag alone (Lane below).
+- **Every lane is always on screen.** The window width divides across the lanes' width units — no horizontal scroll, no enforced minimum lane width. Resizing the window is the width control. (Settled emphatically in the old app: horizontal scroll strays from what kanban is for.) The degenerate case is accepted, not floored: enough lanes/units in a small window compress every lane, titles and cards truncate gracefully, and the remedy is the user's (fewer units, bigger window). A minimum-width setting that reintroduces scroll was considered in the pathfinder and deliberately rejected. **Lane-count changes re-divide, never resize**: new lane (⇧⌘N), lane paste or cross-board lane drop, lane delete (and its undo), and Show/Hide Trash (the trash lane's fixed unit joins and leaves the division — Trash below) all re-divide the existing window width across the new unit total — window-growing behavior belongs to the right-edge drag alone (Lane below).
 - A lane spans a **whole number of width units** (`width` frontmatter, ≥ 1, no cap). Cards stay standard width; a wide lane flows them into as many interior masonry columns as it has units.
+- **Zoom scales the ruler, never the strip** (settled 2026-08-02 — View ▸ Zoom In / Zoom Out / Actual Size, 11-command-nexus.md). The board's whole geometry is already derived from the body font's point size (10-accessibility.md ▸ Full relative scaling — every figure an em multiple, no fixed point sizes), and macOS supplies no text-size control to move it, so the zoom commands *are* that control: a rung on the level ladder raises the effective body size, and type, card chrome, lane chrome and card heights grow together off it. **Full visibility above is untouched, and that is the whole design constraint**: a canvas magnification would have to widen the strip and reintroduce the horizontal scroll this section rejects, so zoom does not do that — lane *width* stays the window's division at every rung. Zoom does move the inter-lane gap (an em multiple like everything else), so lanes narrow by a few percent across the ladder's whole range; the felt effect is the intended one — zoom in for bigger, more legible cards and fewer per screen, out for a denser board. **The level is app-wide, persisted, and never a property of a board**: it lives beside Show Comments in the app's preferences, not in any lane's or board's frontmatter, because it describes how a user likes to read rather than what a board is. **Zoom never moves the window** — the minimum content size stays pinned to the *system* body size, since window-growing behavior belongs to the right-edge drag alone (Lane below).
 - New lanes are created via a **File-menu item** (the one committed surface; ⇧⌘N — 11-command-nexus.md); new cards from the lane (see 04-interactions.md for creation flows). **The created lane becomes the sole selection** (settled): ⇧⌘N → Board ▸ Rename is a pure keyboard path — the create-then-act texture (Return-creation re-selects its lane, ⌫ picks a successor).
 
 ## Toolbar (board + card windows)
 
 Toolbars are **pure enhancement**: every function they host already has a menu item + shortcut (04-interactions.md's contract), so nothing below is anyone's only path. Both windows' toolbars are **user-customizable, macOS-native** (right-click ▸ Customize Toolbar…, drag to rearrange, system overflow and icon/text display options) — the sets below are shipped defaults, not verdicts. Toolbar item labels match their menu-item titles exactly (Show Trash, Edit Body, Raw Source, …), minus any trailing ellipsis (macOS convention: "Add Attachment…" labels as Add Attachment) — one vocabulary everywhere, and the customize palette self-documents against the menus. One exception: the Undo/Redo toolbar items keep static labels — NSUndoManager rewrites their menu titles dynamically ("Undo Move Card…", 04-interactions.md ▸ Configurable bindings), which a toolbar label doesn't track.
 
-- **Board window default: the search field, nothing else** — trailing, the one default item; the titlebar stays clean. ⌘F always summons search: with the field removed from the toolbar, invoking it surfaces the field transiently until the search clears. **Catalog** (available via Customize): New Card, New Lane, Undo, Redo (the pair disabled on boards without undo — no-git and repo-nested boards, matching their menu items — 06-history-undo.md), Show Trash (toggle state matching the View menu checkmark). The board popover deliberately has **no toolbar item** — the window-title widget is its committed home (below), and a second entry would muddy it.
+- **Board window default: the search field and Appearance** — both **centered** (ratified 2026-08-06 off the 2026-08-01 live try-out, reversing the earlier trailing ruling; Appearance joined the default set 2026-08-07 — 11-command-nexus.md ▸ View ▸ Appearance): the titlebar reads as a placement grammar — leading is board identity (the title widget), center is view controls (search and the app's Auto/Light/Dark override today, the filter family if one ever grows), trailing remains the user's catalog space. The mechanism is `NSToolbar.centeredItemIdentifiers`, deliberately not a flexible-space sandwich: it centers against the window rather than leftover space, holds as catalog items install, and sits outside the autosaved configuration, so it takes effect on machines with a saved arrangement — and `defaultItems` is unchanged, keeping the pinned default-set tests standing. The known tensions were weighed and accepted at ratification: the 400pt leading widget and a centered field share the titlebar's budget in narrow windows (the squeezed field's expand-in-place answer below is the relief), and HIG's trailing-edge convention yields to the grammar. The titlebar stays clean. ⌘F always summons search: with the field removed from the toolbar, invoking it surfaces the field transiently until the search clears. **A squeezed field expands in place; the strip answers only genuine unreachability** (blessed 2026-08-06): a space-constrained `NSSearchToolbarItem` collapses to a magnifying-glass button still in the window, and ⌘F expands and focuses it — the toolbar's own field, a better surface than the fallback — so the transient strip fires only for a truly windowless field (true overflow, or the item removed from the toolbar). **The item's overflow row is the platform's own second answer, and the duality is blessed** (2026-08-06): AppKit's overflow menu row carries a live action that widens the window until the field is usable, and suppressing it would destroy the honest overflow presentation — so a squeezed toolbar reaches search two ways with two honest resolutions: ⌘F expands the item or surfaces the strip (ours), the overflow row grows the window (the platform's) — different gestures, reasonable respective outcomes, no contradiction to resolve. **The field is the platform's own search toolbar item and grows on focus** (2026-08-01): the em-derived width is the *focused* width — applied when the field takes the keyboard, expanding via the item's own animation — and the resting width is AppKit's natural one, not the app's to set. **The two-homes width rule is focused-width parity** (ruled 2026-08-01): the width the user *types in* is the same em-derived figure whichever home the field is in — the toolbar item focused, or the transient strip; the toolbar field's resting width is outside the invariant (the strip never rests — it exists only while a search is live or focused, so it has no collapsed state to mirror). **Catalog** (available via Customize): New Card, New Lane, Zoom In, Zoom Out (the zoom pair is catalog-only, unlike Appearance below — the titlebar's default is the search field plus Appearance, nothing more; each disables at its end of the ladder, and both disable mid-drag like their menu rows — Layout ▸ zoom above), Undo, Redo (the pair disabled only under locks and on empty stacks — re-ruled 2026-07-31, twice: the provider follows the board, so boards without app-managed git — repo-nested included — bind 13-native-undo.md's native stack in **every** tier and Pro git boards bind the git provider — 06-history-undo.md), Show Trash (toggle state matching the View menu checkmark), Appearance (a pull-down of Auto/Light/Dark — 11-command-nexus.md ▸ View ▸ Appearance; the one catalog command that also ships as a default item, centered beside search rather than reached through Customize). The board popover deliberately has **no toolbar item** — the window-title widget is its committed home (below), and a second entry would muddy it.
 - **Card window default: Edit Body · Raw Source · Add Attachment** — the window's three committed functions, all discoverable from its toolbar; the catalog is the same trio. Edit Body is a **single toggle button** (on-state in Edit — mirroring the View ▸ Edit Body checkmark and the ⌘E/Return/Escape grammar; the pathfinder's segmented Preview|Edit is retired). Raw Source is likewise a toggle showing on-state; while source mode is active, Edit Body disables (Cancel/Apply own the exits — 05-card-window.md). Add Attachment stays enabled in every mode — attachment operations never touch `index.md`, so they're safe alongside a raw edit (the sidebar's feedback returns on exit).
 
 ## Lane
@@ -32,45 +33,73 @@ Toolbars are **pure enhancement**: every function they host already has a menu i
 
 ### Capabilities (settled)
 
-- **`background`** on board / lane / card: palette name (kebab-case, hand-editable) or `#RRGGBB[AA]` hex. Board color paints the board window's content background (the surface behind and between lanes). Lane and card color are **edge accents, not fills** (settled in the pathfinder's treatment shootout — its settings matrix of C-series lane / K-series card variants landed on **C7 · full-column top edge** and **K1 · left edge stripe**): a lane's color paints a full-width band along its top edge, a card's a stripe along its left edge; the surfaces themselves keep the standard chrome, so colored title text never sits on a colored fill.
+- **`background`** on board / lane / card: a mapping, `{color: …, image: …}`, and only a mapping (settled 2026-08-06 — 01-storage-format.md § Frontmatter; a bare scalar has no reading and paints nothing). `color` is a palette name (kebab-case, hand-editable) or a `#RRGGBB[AA]` hex; either subkey may stand alone. Board color paints the board window's content background (the surface behind and between lanes). **A board's background may also carry an image**: the `image` path is relative to the board root so the picture travels with the document. Color and image both paint the **full window** — the content runs under a transparent title bar, with a frosted strip across the title-bar/toolbar band keeping the chrome legible over them; the extended chrome applies only while the board has a background of its own, and a board without one keeps the standard chrome unchanged. The image draws over the color, scaled to fill and cropped, with the color standing in while it loads or if it can't be read; an unresolvable path paints nothing, the lenient degrade an unrecognized color already gets. **There is no in-app control for the image** — the raw file is the escape hatch (the stance custom hex held until the 2026-08-06 combo reversal; for images it stands) — and **the board-level ink rule still derives from the color reading alone**: an image makes no AA claim (10-accessibility.md), since a picture has no single luminance to threshold against. Lane and card color are **edge accents, not fills** (settled in the pathfinder's treatment shootout — its settings matrix of C-series lane / K-series card variants landed on **C7 · full-column top edge** and **K1 · left edge stripe**): a lane's color paints a full-width band along its top edge, a card's a stripe along its left edge; the surfaces themselves keep the standard chrome, so colored title text never sits on a colored fill.
+- **The standard chrome is the pathfinder's surface stack** (settled 2026-08-06): the window keeps the neutral system background; every lane wears a quiet quaternary-wash plate (the trash plate's own figure — translucent, so a board-chosen color shows through and the board-level ink rule keeps its premise; opaque under Reduce Transparency, the trash precedent); every card sits on an opaque `controlBackgroundColor` plate — white over the washed lane in light appearance, a step *darker* than the window in dark. One plate value for every face a card draws (resting, replicas, placeholder, arriving), so a card is the same object wherever it renders.
 - **`icon`**: SF Symbol per item with per-level defaults (board `rectangle.split.3x1`, lane `square.stack`, card `doc.text`).
 - **`iconColor`**: resolved — **schema yes, control no**. The field renders when hand-written (tint palette name or hex); the app offers no control for it (Controls below).
 - The pathfinder's palettes (12 icon tints, 12 backgrounds) carry over as the starting point. **The 12+12 split is a picker split, not a name split** (settled): color resolution searches foregrounds then backgrounds, so a hand-written `background: carnation` (an icon-tint name) resolves and paints — the split governs what the grids offer, never what a name means.
 
 ### Controls (settled)
 
-One **style editor** component — a background palette grid and a curated symbol grid — presented from three anchors: **embedded** in the card window sidebar's Style section (05-card-window.md) and in the board popover's styling area, and as a **popover** opened by Style… from a card/lane context menu or the menu bar (Board ▸ Style…, ⌥⌘S — 11-command-nexus.md; selection-aware: it styles the selected cards or lane, and with nothing selected, the board). One component, one behavior, three anchors — replacing the pathfinder's swatch-row-plus-Style-popover split, whose functions were right and whose form wasn't.
+One **style editor** component — a background palette grid and a curated symbol grid — presented from two anchors: **embedded** in the card window sidebar's Style section (05-card-window.md), and as a **popover** opened by Style… from a card/lane context menu or the menu bar (Board ▸ Style…, ⌥⌘S — 11-command-nexus.md; selection-aware: it styles the selected cards or lane, and with nothing selected, the board). One component, one behavior — replacing the pathfinder's swatch-row-plus-Style-popover split, whose functions were right and whose form wasn't. **The anchors compose the halves they need** (2026-08-06): the card sidebar shows the symbol grid with the **color combo** (below) standing in for the background half — the narrow context the combo was built for; the Style… popover carries both grids in full. (The board popover was briefly a third anchor — the background half embedded in its Theme tab — until the 2026-08-07 Theme rework made that tab preset-only; Style… with nothing selected is the board's manual grid now, and the popover's symbol picker beside the rename field still owns the board glyph.)
 
-- **Palette-only in-app**: the background grid offers the 12 palette colors — every pair AA-verified at design time (10-accessibility.md), the claim pinned by a computed-contrast unit test over all 12 pairs so palette drift can never silently break it — plus a leading **None** well that removes the `background` key. Custom hex is not pickable in-app but stays fully honored from disk (runtime contrast, 10-accessibility.md): curated in-app, unlimited on disk.
-- **Curated symbol grid**: a hand-picked set (roughly five dozen kanban-relevant SF Symbols); its leading well is the level's default symbol and removes the `icon` key. Any other SF Symbol name works written by hand — named symbols the running OS knows, that is: inventories grow per macOS release, so a newer-OS name renders the level default on an older Mac, value preserved on disk — the palette stance again. No full-browser escape hatch in-app; the raw file is the escape hatch.
+- **Curated-first, panel-backed** (re-ratified 2026-08-06, reversing 2026-07-29's palette-only ruling): the background grid offers the 12 palette colors — every one AA-verified through one code path (ratified 2026-07-29: palette names route through the same runtime ink-selection seam as hand-written hex — the appearance flip picks the readable label vocabulary — and PaletteContrastTests pins that the chosen ink meets AA in both appearances for all 12 backgrounds, so palette drift can never silently break it) — plus a leading **None** well that removes the `background` key. Beside the grid the vocabulary now has a second, compact form: the **color combo** — a swatch-faced popup listing None, the role's twelve, the current off-palette value verbatim when there is one, and **Other…**, which opens the system Colors panel. The panel is the in-app escape hatch the 2026-07-29 ruling withheld: a pick landing exactly on a palette color stores the *name* (so a re-pick never drifts to a hex spelling), anything else stores the hex — the same unlimited vocabulary hand-editing always had, now pickable. An arbitrary pick changes no contrast story (it lands on the identical runtime ink computation hand-written hex already gets — 10-accessibility.md), and the quick-style recents stay palette-vocabulary: a panel pick never enters them.
+- **Curated symbol grid**: a hand-picked set (roughly five dozen kanban-relevant SF Symbols); its leading well is the level's default symbol and removes the `icon` key. Any other SF Symbol name works written by hand — named symbols the running OS knows, that is: inventories grow per macOS release, so a newer-OS name renders the level default on an older Mac, value preserved on disk — the palette stance again. No full-browser escape hatch in-app; the raw file is the escape hatch. (Symbols keep this stance deliberately — the 2026-08-06 color-panel reversal above is colors only: the system offers a Colors panel worth deferring to, and no symbol browser of equal standing.)
 - **Off-palette values display leniently**: a hand-written hex background or uncurated symbol shows as the current value in the editor (labeled verbatim, outside the grids); choosing any well replaces it.
 - **Batch edits**: a multi-selection shows per-dimension mixed state (no well selected, "—" where a value would read); choosing a well applies to the whole selection — one gesture, one commit on git boards.
-- **The Style… popover tracks its target set live and dismisses when it empties** (settled): its target is the selection, re-resolved across reloads by 02-architecture.md's UUID rule — a member that vanishes or flips liveness leaves the set and the mixed-state display recomputes; a set emptied by a foreign reload dismisses the popover (the inline-rename discard applied here) — it never silently retargets to the board, and nothing writes into a vanished or tombstoned folder. **The read-only lock instead disables its wells in place** (settled): a popover open when the lock lands stays open, content disabled — the banner names why, and the lock never yanks a surface (the Edit buffer's keeps-its-place posture). The embedded anchors need no rule of their own: the card sidebar dismisses with its card's window, and the board popover's target is the board itself.
+- **The Style… popover tracks its target set live and dismisses when it empties** (settled): its target is the selection, re-resolved across reloads by 02-architecture.md's UUID rule — a member that vanishes or flips liveness leaves the set and the mixed-state display recomputes; a set emptied by a foreign reload dismisses the popover (the inline-rename discard applied here) — it never silently retargets to the board, and nothing writes into a vanished folder (a member moved to the trash leaves the set like any other departure). **The read-only lock instead disables its wells in place** (settled): a popover open when the lock lands stays open, content disabled — the banner names why, and the lock never yanks a surface (the Edit buffer's keeps-its-place posture). The embedded anchors need no rule of their own: the card sidebar dismisses with its card's window, and the board popover's target is the board itself.
 - **Quick-style row, recents only**: card and lane context menus carry one compact row of recently used backgrounds plus the Style… item — one-click recolor for the common case; the pathfinder's second full-palette tier is gone. Before any background has ever been applied, the row is omitted entirely — never an empty strip. Recents are app-wide and persist app-side (user preference, never board data).
 - **Keyboard path**: Style… is a menu item with a shortcut (04-interactions.md's contract); inside the editor the grids are arrow-navigable and every well Tab-reachable (10-accessibility.md).
 
 ## Board popover
 
-The window-title widget opens the **board popover** — the one board-level surface, hosting:
+**The tabbed popover (2026-08-07, restructure complete — all three tab sessions settled).** The symbol/name header stays at the top — the board's glyph with its tint row beside the rename field; below it sit tabs — **Info**, **Theme**, **Git** — each the settings surface for one aspect of board configuration, each settled in its own dedicated session. **Tab membership is the git posture's** (the Git session's ruling): the Git tab joins the strip only when the git section has something true to say — `BoardGitSection` resolves to anything but absent — so a free-tier board with no `.git` shows Info | Theme alone. This carries 12-editions.md's "absent, no placeholder" rule up to the tab strip: a standing Git tab on every free board would be the standing ad for Pro that 12 forbids. *(Pivot 2026-08-07, same day — 12: git left the paywall, so the absent posture is unreachable and every board carries all three tabs. The membership rule stands structurally — the strip still asks the posture — it just never hears "absent" anymore.)* **Selection resets to Info on every open** (ruled in the Git session, closing the question the earlier tab sessions deferred): the popover is transient and Info is the board's face — and a remembered tab could strand selection on a tab the next posture doesn't offer. *(Added 2026-08-07, the same night the settings sheet retired: a fourth tab, **Sync** — a standing placeholder, last in the strip, rendering one honest "Nothing here yet." caption. It claims the position where the remote half of the git story will live — tracking, Pull/Push, the badges, and whatever home 07-sync-collab.md's setup surfaces are ruled into — without ruling any of that: the open Redesign card owns the question, and the placeholder is deliberately empty rather than a greyed-out preview.)*
+
+**The Theme tab** (settled 2026-08-07, its dedicated session; reworked same day from the first "Background" cut — the style-editor embed was in, then ruled out): a **preset-only** surface — no palette grid, no "Board" subtitle, no manual controls (the manual surface is Style… with nothing selected; the raw file remains the image escape hatch). One **Solid color / Pattern** segmented choice at the top, then the filters that apply to the chosen kind, then one carousel of the eight wheel hues with tall skinny chevrons flanking it (compact-chevron paging buttons, ~three swatches per press, each disabling at its end of the strip). **Solid color** shows Tone (defaults to the current appearance) and Saturation only; the carousel holds flat swatches — each hue at the selected tonality's base saturation and lightness, exactly the primary color the matching facets recipe would write — and clicking one sets `background.color` and *removes* `background.image` in one write (the generated PNG stays on disk so undo can restore the field that pointed at it). **Pattern** is the faceted-background picker (DESIGN/explorations/board-backgrounds.md ▸ Faceted gallery, the reviewed recipe): four filters — Tone and Saturation shared with Solid, plus Colors mono/duo/trio and Mesh coarse/medium/fine — over rendered previews, one seed per hue, plus a Reroll button that re-mints the seeds (filters change the treatment, Reroll the geometry; preview and file share a seed, so what's clicked is what lands). Clicking a pattern swatch renders the recipe at the 3072 px decode ceiling off-main and lands it in one write: the PNG into the board root as `facets.png` (Finder-ladder rename only when a foreign file owns the name), `background.image` pointed at it, and `background.color` set to the recipe's primary color — the underlay that stands in while the image decodes or if the file ever goes missing. The mode opens on whichever kind the board currently wears (Pattern when `background.image` is the generated file, Solid otherwise). **Backgrounds ship as static pixels, never live-rendered views** (the perf/sync ruling, 2026-08-07): the generator runs at pick time, the render loop only ever composites a decoded bitmap. Native undo restores the two fields, not overwritten bytes — regenerating over our own PNG is destructive, documented, and accepted. The whole tab disables under the read-only lock as one surface.
+
+### Info tab (settled 2026-08-07)
+
+The board's vital statistics, read-only, in two registers with one honest split: **model facts** off the live snapshot — Lanes, Cards, Attachments — counting *the board you see* (the welcome-count live-only rule; the Cards row grows a quiet "· N in Trash" tail only when the trash holds anything, counting freight the way the purge confirms do — never a standing "0 in Trash"); and **disk facts** off one background whole-folder walk — File (the `.board` folder's name), Files, Size, Created, Modified — counting *everything*, `.git` and `.trash/` included, because their job is to agree with Finder's Get Info about the same folder (a size that quietly excluded the repository would send a user hunting for missing gigabytes). Disk facts are honest-as-of-appearance, refreshed per tab visit, never live — `FolderWatcher` filters `.git` churn out of the reload stream by design, so there is no event they could honestly hang off, and a ticking size is motion without meaning on a settings surface; an em dash holds each disk row until the walk answers. Modified is the tree's newest content-modification date, directories included (a deletion-only change moves no file's mtime, only its parent folder's); Created is the folder's filesystem birth date, not frontmatter — the folder may predate any stamp in it. A **Reveal in Finder** link closes the tab — the rows describe the folder, and this is the door to it; not disabled under the read-only lock, since revealing is not a mutation.
+
+### Git tab (settled 2026-08-07)
+
+The pre-tab closing git section rehomed whole — and, later the same day, **the retired settings sheet's contents with it**: this tab is where a board's repository is both operated and set up (a repository-facts dossier in the Info register was considered this session and declined — the popover's git surface is for operating, and per-item history is the card History section's). The postures (06-history-undo.md ▸ Rules; 12-editions.md) render one tab surface each, with the tab's own label doing the work the section's "Git" header used to:
+
+- **No repository** → one caption stating the fact, then **add-git** directly under it — the fact-then-offer posture blessed 2026-08-06, whose middle term was a **Board Settings…** door for the week the sheet existed *(amended 2026-08-07: the split reversed, so the offer is the control itself again)*. *(Pivot 2026-08-07 — 12: this is every tier's posture now, and git stays opt-in per board: the button is an offer, never an auto-init.)*
+- **Repo-nested** and **unverifiable** → their settled prose, no action (nothing setup-shaped can apply).
+- **Git mode** → the branch display with the **switch picker**, the abnormal-state notes (paused, unreadable, switch failure — 06), and a **Commit Identity** block under a heading VoiceOver navigates by *(rehomed 2026-08-07 from the sheet; withheld when the repository won't open, since writing an identity is a write into a repository the app can't open — the branch surface's own unreadable sentence stands alone there)*; on remote-backed boards, remote tracking (ahead/behind) with **Pull/Push** controls and the status badges (Authentication needed, queued pushes, last error) join as one more block under the branch controls (07-sync-collab.md's cards, whose own setup half needs a home now that the sheet is gone — open).
+- **Free + inert `.git`** and **absent** — *retired by the 2026-08-07 pivot (12: git left the paywall)*: the Pro pointer described a gate that no longer exists, and with no free-only postures every board resolves one of the three families above, so the tab is always in the strip.
+
+**Branch creation is the switch menu's again** *(2026-08-07, reversing the 2026-07-31 relocation to the sheet)*: below the switch targets sits a divider and a **New Branch…** entry that reveals an inline name field with Create under the branch row — the shape creation had before the split, restored when the sheet retired. Escape steps outward one layer per press (a dirty field clears, an empty one closes the reveal, then the popover dismisses); create-and-switch runs 06's identical settle sequence, and its failures answer at the section's own caption.
+
+**A single-branch board's picker opens onto a disabled explanatory row** (ruled 2026-08-06, built with the tab): the menu's upper half holds only the *other* local branches, and an unexplained gap above the divider reads as a menu that lost something — a disabled "No other branches" row says why there is nothing to pick. *(Amended 2026-08-07: the row taught a second thing while creation lived in the sheet — that creation was no longer here — and that half retires with the reveal's return.)* The popover is now the one configuration home; each control keeps exactly one home within it.
+
+The window-title widget opens the **board popover** — the one board-level surface. **The widget is a two-line identity block** (reworked 2026-08-07): the board's glyph at roughly double its drawn text height, sized to span both lines, beside a stack whose first line is the board's name (titlebar weight, the string the window title would show) and whose second — **git-mode boards only** — is the current branch, smaller and secondary; then the disclosure chevron. It was one line reading `glyph  Name — branch  ⌄`, and the em-dash retired with the rework: a separator was doing a hierarchy's job, and the branch was competing for width with the name it qualifies. Both lines truncate at the tail inside the widget's 400pt cap; a board with no branch is the same block with one line, centered against the same glyph. Its header hosts, on every board:
 
 - **Board rename** (settled: this function stays in-app, unlike the pathfinder which dropped it with the inspector). Rename edits the board's frontmatter `title` only — the folder is never renamed by the app; the Finder document name is Finder's to change (01-storage-format.md's board-naming rule). A foreign rename landing while the popover is open resyncs the field from the snapshot only while the field is unfocused — a focused field keeps the user's keystrokes, the dirty-buffer courtesy applied here (settled).
-- **Board styling** — the embedded style editor (Styling ▸ Controls above).
-- **Git integration** — Pro edition surface, mode-aware (06-history-undo.md, 07-sync-collab.md; in base Lanework this section is absent on ordinary boards and reduces to the contextual one-line Pro pointer on boards carrying an inert `.git` — 12-editions.md): on a mode-none board, the **add-git** action (opt-in init; on repo-nested boards replaced by the honest this-board-lives-inside-a-repository explanation — 06); on git boards, branch/source display, branch switching and creation, the commit-identity name/email fields (06), and **add/change remote** (a remote can be added or changed at any point — 07); for remote-backed boards additionally remote tracking (ahead/behind) with Pull/Push controls and the push-on-every-commit option. **Remote authentication surfaces inline here** (07 ▸ Remote authentication): credential fields on add/verify, the SSH key surface — the machine key with Copy + Verify, key import by paste or drag, the per-host key picker with removal of unreferenced imports, and confirm-gated machine-key regeneration — and the Authentication-needed badge state.
+- **The board glyph** — the symbol picker with its tint row beside the rename field owns the board's `icon`/`iconColor` (Styling ▸ Controls above); manual board styling beyond the glyph is Style… ⌥⌘S with nothing selected, and the Theme tab owns the preset backgrounds.
+
+## Board settings sheet — RETIRED 2026-08-07
+
+**The surface is gone, and the 2026-07-31 popover/sheet split with it.** The split's promise was one home per control across two committed surfaces; a week of it showed the cost — setup a user could only reach through a door, a second surface whose existence had to be validated before either door could point at it, and a menu command that did nothing but open it. So the popover is the board's **one configuration home** again: **add-git** and **commit identity** render inline in the Git tab's postures (▸ Git tab above), **branch creation** went back into the switch menu's New Branch… reveal, the sheet's **availability rule** retires with the surface it gated, and **Board ▸ Board Settings…** leaves the menu bar (11-command-nexus.md). Board Info ⌘I is the door to all of it. The mechanical arguments the split rested on stand as *unfinished business*, not as a case for the sheet: 07-sync-collab.md's credential and SSH surfaces still want confirmation alerts, inline network probes and drag-in key import, and where those live is that card's to rule — the popover is not obviously wrong for them (an alert can present over it), but nothing here decides it.
+
+The retired ruling, kept for its reasoning:
+
+**The setup home** (ruled 2026-07-31 — the popover/sheet split, 04-interactions.md's configuration carve-out): a board-scoped, titled, sectioned sheet on the board window, opened from the popover's Board Settings… row and from Board ▸ Board Settings… (11-command-nexus.md). It hosts everything setup-shaped: **add-git** (mode none; opt-in init — 06), **add/change remote** with the inline verify probe (07 ▸ Setup verifies right there), **credentials** — HTTPS username/token fields and the whole SSH surface (machine key Copy + Verify, key import by paste or **drag** — the sheet's stable frame is part of why it exists — the per-host key picker, unreferenced-import removal, confirm-gated machine-key regeneration), the TOFU first-connect confirm and mismatch block, **commit identity** name/email (06 — the visibility-scoped 2 s config re-read rides with the fields), **branch creation** (switching stays in the popover; create-and-switch runs 06's identical settle sequence from here), and **push-on-commit**. The mechanics that forced the split live comfortably here: confirmation alerts present over the sheet without dismissing the flow that owns them, network probes and their spinners survive focus changes, and typed-but-unverified credentials are never discarded by a stray click. Under the read-only lock the sheet's mutating controls disable in place (the Style-popover rule); every control is Tab-reachable and labeled (10-accessibility.md). Each control has exactly one home — the popover never duplicates a sheet control, the sheet never hosts the daily surface.
 
 ## Trash
 
-Deletion is a two-stage, Finder-style story: ⌫ tombstones (01-storage-format.md), and the **trash quasi-lane** is where tombstoned items live on screen. It is a **pure view** — tombstoned cards keep their `deleted:` key and stay exactly where they are on disk; nothing about the storage schema is trash-specific.
+**Resettled 2026-07-28 — the materialized trash.** The tombstone model (a `deleted:` flag on items left in place, rendered by a pure-view quasi-lane) is **retired**: it generated a standing tax of nesting rules — ancestor walks, effective liveness, entry-vs-universe splits, kind-homogeneous selection — that this design replaces wholesale. Deletion is now a **move**: deleting a card moves its folder into **`<board-root>/.trash/`**, a reserved, materialized container (01-storage-format.md). A trashed card is an ordinary card in a special place — search, selection, rendering, styling, and clipboard all treat it exactly like any other card, and `.trash/` is self-describing in Finder and to agents.
 
-- **Rendering**: trailing (rightmost) position, visually distinct — dimmed/hatched header, trash SF Symbol, count badge; no new-card button; not draggable, not resizable, excluded from lane reordering. It spans a **fixed one width unit** — no `width` frontmatter, and neither the stepper nor the edge drag applies — consumed only while shown: Show/Hide Trash is a re-divide trigger (Layout above), dividing the window across lane units + 1. A small window compresses like any lane add — accepted, not floored.
-- **Contents**: the board's tombstoned cards, sorted by `deleted` timestamp (newest first). **The sort is fully deterministic** (settled — the trash's order is load-bearing for input: arrow walks, ⇧-ranges, and the rubber band all read it, 04-interactions.md): ties — a multi-card ⌫ stamps one second onto N cards — break by folder name, ascending; an entry whose `deleted` value doesn't parse (01-storage-format.md's unusable-timestamp rule) sorts as *oldest*, after every dated entry, folder-name-ordered among its kind — a corrupt stamp must not outrank fresh deletions for the trash's most prominent rows. Lane entries interleave in the same single ordering by their own `deleted` stamp. A tombstoned *lane* appears as a single restorable entry — its cards were hidden with it, not individually tombstoned, and it restores as a whole. **The ancestor walk is absolute here too** (settled): the lane's single entry subsumes *everything* beneath it — a card that carries its own `deleted:` under a tombstoned lane has **no row of its own** (01-storage-format.md's consumer rule, no trash carve-out; 02-architecture.md's effective liveness agrees: such a card renders nowhere). The entry's card count counts what Put Back returns to the board — cards without their own flag; individually tombstoned descendants aren't in that number, since they come back to the *trash* (below).
-- **Visibility**: hidden by default; **View ▸ Show Trash** toggles it (no default chord — ⇧⌘T belongs to the system's Show Tab Bar, window tabbing staying enabled, 11-command-nexus.md; stable title with checkmark state, per 04-interactions.md's configurable-bindings rules). Transient board-scoped state, held in the BoardStore (02-architecture.md; one board window per board, so board-scoped and per-window coincide today) — resets to hidden on open, not persisted (visiting the trash is an errand, not a layout choice). Hidden trash is invisible to search; shown, it participates in the filter like any lane.
-- **Put Back** (context menu, Finder vocabulary; ⌘⌫ on a tombstoned selection — Finder's own symmetry): removes `deleted:` — the item reappears in its lane at its old `order` (ties break deterministically). **Putting back a lane splits its contents by flag** (settled): cards hidden with the lane return to the board with it; cards carrying their own `deleted:` stay tombstoned — their rows reappear in the trash. Recovering one of those is deliberately two steps: Put Back the lane, then Put Back the card (the one-step cascade was considered and rejected — the card has no row to act on while its lane is tombstoned, per Contents above). Restore fidelity is perfect because nothing ever moved.
-- **Drag-to-restore**: dragging a card out of the trash into one of its own board's lanes restores it at the drop position (key removed, `order` set, folder moved only if the destination lane differs). Dropped on another board it follows the drag locality model (04-interactions.md) — a live copy by default, the tombstoned original staying put; ⌘-drag for the true restore-move.
-- **Keyboard, selection, and clipboard semantics** inside the shown trash (navigation, no mixed live/tombstoned selections, copy-out-only clipboard, inert moves) are specified in 04-interactions.md ▸ The trash, keyboard-first.
-- **No editing in the trash**: tombstoned cards don't open — double-click does nothing beyond selection; Put Back or drag out first (Finder vocabulary: the trash is for restoring or purging, not working). Tombstoning a card whose window is open dismisses that window (05-card-window.md).
-- **Delete Immediately** (per item, ⌥⌘⌫) and **Empty Trash…** (confirmed, ⇧⌘⌫) physically remove the folder(s) — Finder's trash trio throughout. **Delete Immediately confirms exactly where the loss is real** (settled): on boards without app-managed git history — mode none and repo-nested — the alert stands between one keystroke and unrecoverable deletion; on git boards it acts immediately, since the content remains reachable in history (06-history-undo.md's delete-never-forgets). A deliberate divergence from Finder's always-confirm: the prompt tracks actual recoverability, not ceremony. Empty Trash… confirms everywhere (bulk scope, not per-item recoverability, is what it guards) — and its scope is **the whole trash, search-independent** (settled): emptying purges every tombstone on the board, filter or no filter, the confirmation naming the true count — **counted in entries, the rows the user sees** (settled): a tombstoned lane's single entry counts once, and the alert appends "Deleting a lane also deletes every card inside it." to cover the subsumed interiors honestly ("Permanently delete 5 items" — 06-history-undo.md's plural folding); a bulk command about the trash itself never silently narrows to the visible subset, and menu validation's "non-empty" reads the board's tombstones, not the filtered view. Time-based auto-purge remains a deferred follow-up (01-storage-format.md).
-- Every trash operation is an ordinary file write — auto-committed and undoable on git boards; on no-git boards the trash itself is the delete-recovery story (07-sync-collab.md).
-- **Naming constraint**: two "Trash" concepts coexist — attachment Remove moves the file to the *system* Trash (05-card-window.md), while card/lane deletion lands in this in-app quasi-lane. UI copy must keep them distinguishable: Finder's "Move to Trash" phrasing is reserved for the system Trash; board deletion says "Delete", and the quasi-lane is "Trash" / "Show Trash". Final strings settled in one naming pass when the trash UI copy is written.
+- **Lanes trash too** (re-ruled 2026-07-29, retiring "cards only" and with it the design's sole destructive delete): deleting a lane moves its folder — subtree intact — into `.trash/`, exactly as a card moves; `kind: lane` in its frontmatter is what tells a trashed lane from a card in the flat container (01-storage-format.md ▸ Deletion), stamped on the way in when absent. The no-dialog posture survives for a better reason: the move is recoverable, so nothing needs confirming. Native undo's inverse is the ordinary move back (13-native-undo.md — the capture/recreate machinery retires). **A trashed lane is an opaque unit**: one distinct dimmed row showing its title and held-card count ("Doing — 5 cards"), no styling accents, never expandable; its cards are invisible to search and not individually addressable — it restores whole or purges whole. The row matches the search filter by lane title only. **The held count is a load-time disk fact** (pinned 2026-07-31): counted from a subtree the snapshot deliberately does not hold — the model's one number not derivable from the model — refreshed by reload like every snapshot field (its changes speak in the digest, 10-accessibility.md); the freight confirm's "…and its 5 cards" is thereby the design's one confirmation counting unrendered content, honest as of the latest reload — the opaque-unit trade, deliberate. Lane rows and cards interleave in the one trash column by `modified` descending (the trash's sort — Entry below).
+- **Entry is always at the top — the trash sorts by `modified` descending** (re-ruled 2026-07-31, retiring the arrival rank mint): every arrival, card or lane — ⌫/⌘⌫ delete and drag-to-trash alike — lands at the top because the move **stamps `modified`** (a container-changing move — 01's `modified` scope; deletion is an edit to the card's story), and that stamp is the position: newest-first with no `order` rewrite, no rank minting, the item's `order` key riding along untouched for its eventual restore. Ties break by title (case-insensitive), then folder name. **Undated entries sort after every dated one** (blessed 2026-07-31 — the comments rule's rung applied here: malformed sorts after dated siblings), then fall to the same tail. **Whole-second stamps make batch deletes tie deliberately** (blessed 2026-07-31): `modified` serializes at second granularity, so a multi-item delete bracket — and any two deletes inside one wall-clock second — carries identical stamps and orders by the tail; "newest first" reading as title-order within a second is the accepted consequence, not worth a schema-wide move to fractional stamps. **The merged order is one derivation** (both kinds interleaved — the column, the keyboard grammar, and the path resolver all read the same sequence; a second implementation of "the row below this one" is a bug by definition). The stamp is also what a future age-based auto-purge will read (deferred, 01-storage-format.md).
+- **Rendering**: trailing (rightmost) position when shown, visually distinct — dimmed/hatched header, trash SF Symbol, count badge — **the badge counts rows** (blessed 2026-07-31): its one invariant is matching what the column draws, so a trashed lane counts as one whatever its freight; card-level totals surface where consequences are decided — the freight confirm and the spoken accessibility value; no new-card button; not draggable, not resizable, excluded from lane reordering. Fixed one width unit, consumed only while shown; Show/Hide Trash is a re-divide trigger (Layout above). **Visibility**: hidden by default; View ▸ Show Trash toggles (no default chord — ⇧⌘T belongs to the system's Show Tab Bar, 11-command-nexus.md); per-open transient state, resets to hidden, never persisted. Hidden, the trash is invisible to every gesture and to search; shown, its cards participate in the filter **exactly like any other card** — the point of the pivot.
+- **No Put Back** (settled): the valuable item is the card (or lane); where it goes on the way out is the user's cheap decision. Restoring is an ordinary move out: **drag** a trash card into any lane at any position — or a trashed lane row to a lane-strip slot — or **⌘X in the trash, ⌘V** — into a lane for cards, after the anchor lane for a trashed lane (04-interactions.md's lane-paste rule verbatim); the clipboard works on trash items like on any item, which is also the keyboard-native restore path (10-accessibility.md). Dropped on another board it follows the drag locality model (04-interactions.md).
+- **No editing in the trash**: trash cards don't open — double-click stops at selection; move it out first — and a trashed lane row never expands. Moving a card to the trash dismisses its open card window (05-card-window.md), and an external move-in observed by reload does the same; a lane entering the trash dismisses the open card windows of every card it carries (they entered the trash with it).
+- **Permanent deletion**: on a trash selection, **Delete (⌫/⌘⌫) is permanent** — one delete vocabulary, staged by place: on the board it moves to the trash, in the trash it removes the folder. **Delete Immediately is deliberately absent** (removed 2026-07-30): Finder's ⌥⌘⌫ answers disk-space pressure boards don't have, and it was the one gesture reaching unrecoverable straight from the board — permanence is only reachable inside the trash, where the staging makes the loss visible. The trash-side Delete **confirms exactly where the loss is real** (carried over): on boards without app-managed git history the alert stands between one keystroke and unrecoverable deletion; on git boards it acts immediately (delete-never-forgets). Confirms name the freight honestly — a trashed lane's alert counts its cards ("Permanently delete lane 'Doing' and its 5 cards"). **Empty Trash…** (⇧⌘⌫) confirms everywhere and purges the whole `.trash/`, lane subtrees walked, search-independent, the confirmation naming the full count ("Permanently delete 41 cards", "… 41 cards and 2 lanes containing 9 more cards" — 06-history-undo.md's plural folding); menu validation's "non-empty" reads `.trash/`, not the filtered view.
+- Every trash operation is an ordinary file operation — auto-committed and undoable on git boards; native undo restores a delete-to-trash in-session on any board (a trash move undoes as a move back — durable across relaunch, since it is just a move), while a permanent delete registers no step (13-native-undo.md: the confirm is the safety).
+- **Naming constraint** (carried over): attachment Remove moves files to the *system* Trash (05-card-window.md); board deletion says "Delete" and this container is "Trash" / "Show Trash" — Finder's "Move to Trash" phrasing stays reserved for the system Trash.
+- **Materialized reserved lanes are a pattern, not a one-off**: `.trash` is the first; an **archive lane** (`<root>/.archive`, intake criteria to be designed) is the anticipated second (WISHLIST) — same mechanics, ordinary cards in a reserved dot-named container, different entry semantics. Nothing beyond `.trash` is committed yet.
 
 ## Welcome screen & templates
 
@@ -78,7 +107,7 @@ The welcome window carries over from the pathfinder unchanged — confirmed, it
 
 - Welcome: resizable, no title bar (background drag); recents list with board icon, name, location, counts; single click selects, double click opens; context menu Open / Reveal in Finder / Forget.
 - **Templates**: New Board (⌥⌘N — ⌘N is new *card*; 11-command-nexus.md) opens a Pages-style chooser with a mini per-lane preview per template. Inventory and definition format: 09-templates.md.
-- File menu: Open Recent (with Clear Menu; available everywhere), and Duplicate (⇧⌘S) — **board window only** (11-command-nexus.md), duplicating the frontmost open board to a Finder-style "copy" sibling; it never acts on a welcome-selected recent. **A sandbox refusal of the sibling write falls back to a save panel** (settled — the board's security-scoped bookmark grants its subtree, not its parent, so the sibling destination may be unwritable): the silent Finder-style sibling is attempted first; on a permission refusal a save panel opens pre-filled with the parent folder and the "copy" name — the panel's grant is the sandbox's own answer, and it doubles as a choose-another-location affordance. Cancelling the panel cancels the duplicate quietly (no banner — the user declined, nothing failed); non-permission failures (disk full, …) keep the ordinary one-shot banner. **The copy itself is cancellable** (settled — 02-architecture.md's in-progress banner promises Cancel on copy-shaped work, and Duplicate honors it): the copy runs as a per-item file walk that checks cancellation between items — never one monolithic `copyItem` — and Cancel removes the partial sibling before dismissing the banner (the attachment partial-cleanup precedent): a cancelled duplicate never happened. The copy is preceded by the close flush (02-architecture.md ▸ Windows; the rule and its Edit-session exception are stated at 09-templates.md ▸ Save as Template), so neither the tree nor the copied history misses pending work; under the read-only lock Duplicate disables in every state (02-architecture.md — the flush can't run and the sibling destination shares the board's fate). The duplicate **opens in its own board window** once copied — macOS Duplicate convention; the original stays open too. On a git board, the duplicate **keeps `.git` but has its remote configuration stripped** — remotes only: the repo-local `user.name`/`user.email` (06-history-undo.md's identity home) survives, so the fork keeps its commit identity. The copy keeps every GUID — a whole-board copy is 01-storage-format.md's explicit carve-out from the copies-remint rule (a new identity namespace, no collision possible), and keeping them is what keeps the copied history true: its commits name paths that still exist. **Tombstoned items are carried too** (settled): Duplicate is a full fork, trash included — dropping them would leave the copy's working tree disagreeing with its own copied HEAD (the tombstone folders are tracked), where keeping them means the duplicate is born exactly matching its history; Empty Trash in the copy is one command away. Save as Template makes the opposite choice — a template isn't a fork (09-templates.md). A fork of the board keeps its history (undo trail, delete-never-forgets — and it opens straight in git mode via 06-history-undo.md's adoption rule), but it must not silently push into the original's remote — sharing stays a deliberate per-board opt-in. (Push-on-commit lives app-side in the board registry and never carries to a new board path anyway.)
+- File menu: Open Recent (with Clear Menu; available everywhere), and Duplicate (⇧⌘S) — **board window only** (11-command-nexus.md), duplicating the frontmost open board to a Finder-style "copy" sibling; it never acts on a welcome-selected recent. **A sandbox refusal of the sibling write falls back to a save panel** (settled — the board's security-scoped bookmark grants its subtree, not its parent, so the sibling destination may be unwritable): the silent Finder-style sibling is attempted first; on a permission refusal a save panel opens pre-filled with the parent folder and the "copy" name — the panel's grant is the sandbox's own answer, and it doubles as a choose-another-location affordance. Cancelling the panel cancels the duplicate quietly (no banner — the user declined, nothing failed); non-permission failures (disk full, …) keep the ordinary one-shot banner. **The copy itself is cancellable** (settled — 02-architecture.md's in-progress banner promises Cancel on copy-shaped work, and Duplicate honors it): the copy runs as a per-item file walk that checks cancellation between items — never one monolithic `copyItem` — and Cancel removes the partial sibling before dismissing the banner (the attachment partial-cleanup precedent): a cancelled duplicate never happened. The copy is preceded by the close flush (02-architecture.md ▸ Windows; the rule and its Edit-session exception are stated at 09-templates.md ▸ Save as Template), so neither the tree nor the copied history misses pending work; under the read-only lock Duplicate disables in every state (02-architecture.md — the flush can't run and the sibling destination shares the board's fate). The duplicate **opens in its own board window** once copied — macOS Duplicate convention; the original stays open too. On a git board, the duplicate **keeps `.git` but has its remote configuration stripped** — remotes only: the repo-local `user.name`/`user.email` (06-history-undo.md's identity home) survives, so the fork keeps its commit identity. The copy keeps every GUID — a whole-board copy is 01-storage-format.md's explicit carve-out from the copies-remint rule (a new identity namespace, no collision possible), and keeping them is what keeps the copied history true: its commits name paths that still exist. **The trash is carried too** (settled, re-grounded 2026-07-28): Duplicate is a full fork, `.trash/` included — dropping it would leave the copy's working tree disagreeing with its own copied HEAD (the trash folders are tracked), where keeping it means the duplicate is born exactly matching its history; Empty Trash in the copy is one command away. Save as Template makes the opposite choice — a template isn't a fork (09-templates.md). A fork of the board keeps its history (undo trail, delete-never-forgets — and it opens straight in git mode via 06-history-undo.md's adoption rule), but it must not silently push into the original's remote — sharing stays a deliberate per-board opt-in. (Push-on-commit lives app-side in the board registry and never carries to a new board path anyway.)
 
 ## Editing surfaces summary
 
@@ -101,7 +130,7 @@ The pathfinder's animation behavior carries over as the committed motion languag
 - **Equivalent operations share one dialect.** Paste animates exactly like a drop commit (same curve, same duration) so the clipboard's move story *feels* like drag landing; keyboard one-slot moves slide for the same reason a drop does — an item that teleports is harder to follow than one that slides; cut dims the card in place, Finder-style, until paste moves it (04-interactions.md).
 - **Appear/disappear is scale + fade** (cards scale from ~0.8, lanes ~0.9, combined with opacity). A restore that moves a card across lanes flies it from old frame to new via matched geometry. Search-hiding rides the same structural transition — hiding is removal, not a special fade.
 - **Some things deliberately never animate**: the rubber-band marquee tracks the cursor 1:1 (an eased band visibly lags the mouse), and the selection highlight rides whatever transaction is active rather than easing on its own.
-- **Animated transactions are keyed narrowly** — on the search query (filter reflow) and on the drag's **drop proposal** (the reflow-to-make-room above animates under it, ~0.18 s) — never on broad state like the selection set (selection changes styling only, never geometry — Card face above, the no-carousel resettlement). What stays animation-free by construction rather than by suppression: the drag replica's tracking and the marquee rectangle (1:1 cursor following — animating input echo would be lag), and multi-select churn. **The replica's bracketing transitions do animate** (settled): the pickup lift (scale + shadow as it detaches from the card) and the cancel fly-back are the system drag session's own behaviors and match the spec verbatim; only the tracking between them is verbatim input echo. **The drop settle is the board's, not the replica's** (resettled 2026-07-28 — drags are system `NSItemProvider` sessions, required for cross-board transfer and the copy badge, and a successful drop's drag image has no fly-to-slot hook, only AppKit's brief fade): at release the held overlay (below) renders the dropped arrangement instantly while the system fade dissolves the drag image over it — the item is in its slot the moment the mouse releases, which is the promise that matters. A custom fly-to-slot animator (shadow-window replica, masked system fade) remains a deliberate later upgrade, not a commitment (WISHLIST). **The settle holds the drop proposal until the echo lands** (settled — the one-way flow means the write is still in flight at release, and a snapshot-order re-render would glide the dragged item back before the reload animates it forward again): the proposal survives release as overlay state in the app-wide DragSession (02-architecture.md — the placeholder's kin in semantics; app-wide in home because a drag crosses boards), the board keeps rendering the proposed arrangement under the system fade (the drop settle above) — and **rendering the arrangement means rendering the card**: at release the shadow is replaced by the dropped card(s) drawn in place immediately, the appear never waiting for the echo (a lingering shadow over a hidden card is the hold failing its one job) — and the proposal discards itself when the bracket's echo reload lands — positions already match, so the handoff moves nothing. A **failed write discards the proposal** and the board animates back to snapshot order with the ordinary one-shot banner — the width-drag rollback posture (the action visibly doesn't happen); a foreign reload that vanishes the dragged item discards it too (02-architecture.md's constraint rule).
+- **Animated transactions are keyed narrowly** — on the search query (filter reflow) and on the drag's **drop proposal** (the reflow-to-make-room above animates under it, ~0.18 s) — never on broad state like the selection set (selection changes styling only, never geometry — Card face above, the no-carousel resettlement). What stays animation-free by construction rather than by suppression: the drag replica's tracking and the marquee rectangle (1:1 cursor following — animating input echo would be lag), and multi-select churn. **The replica's bracketing transitions do animate** (settled): the pickup lift (scale + shadow as it detaches from the card) and the cancel fly-back are the system drag session's own behaviors and match the spec verbatim; only the tracking between them is verbatim input echo. **The drop settle is the board's, not the replica's** (resettled 2026-07-28 — drags are system `NSItemProvider` sessions, required for cross-board transfer and the copy badge, and a successful drop's drag image has no fly-to-slot hook, only AppKit's brief fade): at release the held overlay (below) renders the dropped arrangement instantly while the system fade dissolves the drag image over it — the item is in its slot the moment the mouse releases, which is the promise that matters. A custom fly-to-slot animator (shadow-window replica, masked system fade) remains a deliberate later upgrade, not a commitment (WISHLIST). **The settle holds the drop proposal until the echo lands** (settled — the one-way flow means the write is still in flight at release, and a snapshot-order re-render would glide the dragged item back before the reload animates it forward again): the proposal survives release as overlay state in the app-wide DragSession (02-architecture.md — the placeholder's kin in semantics; app-wide in home because a drag crosses boards), the board keeps rendering the proposed arrangement under the system fade (the drop settle above) — **the release presentation is an open question** (reopened 2026-07-28): the first treatment — swapping the shadow for the dropped card(s) drawn in place immediately at release — was implemented and backed out on user review; the pause between release and the card's appearance still wants a designed answer, revisited separately (Redesign board ▸ Issues to Resolve). Until then the shadow holds through the gap and the card appears at the echo — and the proposal discards itself when the bracket's echo reload lands — positions already match, so the handoff moves nothing. A **failed write discards the proposal** and the board animates back to snapshot order with the ordinary one-shot banner — the width-drag rollback posture (the action visibly doesn't happen); a foreign reload that vanishes the dragged item discards it too (02-architecture.md's constraint rule).
 - **Motion never feeds back into logic** (the pathfinder's animation-proof-inputs rule, kept as a hard constraint): drop-proposal math reads analytically computed resting zones, the physical mouse position, and item sizes frozen at drag start — never mid-flight measured frames, which are garbage precisely during the ~0.2 s reflow they trigger.
 - **Reduce Motion is a rewrite obligation, not an inheritance**: the pathfinder ships zero reduced variants; 10-accessibility.md's commitments (crossfade or instant for reflow, search animate-out, the drag replica's lift and settle, the lane-resize rubber-band feedback, trash) are new work.
 

DESIGN/04-interactions.md

@@ -5,9 +5,9 @@ Selection, drag & drop, keyboard, clipboard, search. This is where the old app s
 ## Selection
 
 - Cards: click selects; ⌘-click toggles; ⇧-click range-extends; click-drag rubber-bands across lanes. Lanes: ⌘/⇧-click multi-select.
-- **The range anchor** (settled — standard macOS list semantics): the anchor is the last plain- or ⌘-clicked item, per board window, transient — never persisted. ⇧-click ranges from anchor to target in the flatten order (cards), lane order (lanes), or the trash's sort filtered to kind (its skipping rule below), replacing the selection and leaving the anchor in place. A marquee and wholesale selections (Select All) set no anchor, so a following ⇧-click acts as a plain click; a reload that drops or liveness-flips the anchor clears it.
-- Selection is **homogeneous**: cards XOR lanes.
-- **Board background** — the margins around and between lanes, and below short content (settled): a plain click clears the selection — the pointer twin of Escape's deselect, Finder's behavior; modified clicks (⇧/⌘) are no-ops there — extension needs an item to extend to; the background is also a rubber-band origin surface on the live side, alongside lane empty space (live) and the trash column's empty space (trashed).
+- **The range anchor** (settled — standard macOS list semantics): the anchor is the last plain- or ⌘-clicked item, per board window, transient — never persisted. ⇧-click ranges from anchor to target in the flatten order (cards), lane order (lanes), or the trash's own order — rows of both kinds included, since trash selection went kind-blind (re-ruled 2026-07-31; The trash below) — replacing the selection and leaving the anchor in place. A marquee and wholesale selections (Select All) set no anchor, so a following ⇧-click acts as a plain click; a reload that drops or liveness-flips the anchor clears it.
+- Selection is **homogeneous**: cards XOR lanes — on the live board. The trash's selection is **kind-blind** (re-ruled 2026-07-31; The trash below): cards and lane rows select together there, and the guard lives at the exits instead.
+- **Board background** — the margins around and between lanes, and below short content (settled): a plain click clears the selection — the pointer twin of Escape's deselect, Finder's behavior; modified clicks (⇧/⌘) are no-ops there — extension needs an item to extend to; the background is also a rubber-band origin surface on the live side, alongside lane empty space (live) and the trash column's empty space (trashed) — which extends the full column height below the last row, card and lane rows alike (re-affirmed 2026-07-29; the rewrites dropped the clause, the ruling never changed): no dead zone, a band can arm from anywhere in the shown trash's column.
 - Lane empty-space: single click selects the lane (click again to unselect); double click creates a card at the bottom, title editor focused. **The lane header is click-to-select too** (settled — a full lane has no empty space left): a plain click on the title bar selects the lane — **and toggles like empty space** (settled): a click on the already-selected lane's header unselects, one lane-click behavior everywhere, so a full lane keeps a pointer path out of selection; the drag surface (03-board-ui.md ▸ Lane) engages only on movement — the click-vs-drag split cards already have.
 - **Clicking never edits** (pivot from the pathfinder's Finder-rename two-stage click): one click selects, and that is all a single click ever does — no slow-second-click rename, no timers, no accidental edit on a hesitant click. Inline rename is **Return** on a sole selected card, or Board ▸ Rename — the menu item is a lane's only rename path, since Return on a lane creates a card (Grammar below). A fast double-click opens the card window (⌘↩'s pointer twin). Committing an empty rename on an existing item removes its `title` key (titles are optional; the face shows the untitled placeholder).
 
@@ -18,17 +18,17 @@ Selection, drag & drop, keyboard, clipboard, search. This is where the old app s
 - **Multi-drag**: dragging any member of a multi-selection drags the whole selection; N contiguous shadows; drop inserts contiguously in preserved relative order — defined, for any multi-selection, as lane `order` first, then card `order` (a cross-lane selection flattens left-to-right, top-to-bottom).
 - **Locality picks the default — the Finder volume model** (settled): within a board a drag is a **move** (rearranging); between boards it is a **copy** (transferring — the system copy badge shows over the foreign board). **⌥ always forces copy** and **⌘ always forces move**, Finder's exact modifier grammar; each is a no-op where its behavior is already the default. The badge tracks the effective operation live as the cursor crosses a board boundary.
 - **Within-board ⌥-drag copies**: originals stay, cursor shows the copy badge, fresh-GUID duplicates land at the drop. Lane drags never copy *within their board* — a within-board lane duplicate is **not available by drag** (⌥ is simply ignored there: the drag stays a clean reorder and the badge never shows copy); the duplicate itself is supported, via the clipboard (Lane paste below) — the usual shape: the keyboard path is the canonical one, drag the enhancement (10-accessibility.md).
-- **Cross-board copy** (the default): cards and lanes (including multi-selections) drag between open boards; fresh-GUID duplicates land at the drop, originals stay, `created` is kept (a copy is a fork — 01-storage-format.md). Lanes copy cards and all — transferring workflow structure between boards is safe by default. A lane copy **strips tombstoned cards**: the copy transfers content, and trash isn't content (09-templates.md's instantiation precedent — a board isn't born with trash); the tombstoned originals stay recoverable in the source board. A ⌘-drag *move* carries them whole — the folder moves as-is, and they land in the destination's trash.
+- **Cross-board copy** (the default): cards and lanes (including multi-selections) drag between open boards; fresh-GUID duplicates land at the drop, originals stay, `created` is kept (a copy is a fork — 01-storage-format.md). **Locality means the board the drag was picked up from** (ruled 2026-08-06): a drag knows where it came from — the Finder volume model — so a rename or Finder move of the source board absorbed mid-drag is not a departure: the relocation carries the live drag with it (the drag holds its source *store's* identity, not a frozen copy of its key — a frozen key would let a new board opened at the vacated path compare equal to the renamed-away one, turning a copy into a silent cross-board move, the worse failure), and a within-board reorder stays a reorder across a mid-drag rename. Until the carry ships, the recorded residue — the minted key follows the folder, so a mid-drag rename finishes a reorder as a copy — is cosmetic and bounded by the seconds a drag is in flight. Lanes copy cards and all — transferring workflow structure between boards is safe by default. A lane carries exactly its cards — the trash is board-level (`.trash/` — 03-board-ui.md), so there is nothing lane-nested to strip or carry: copy and ⌘-drag move alike transfer the lane's folder as it is (resettled 2026-07-28; the old tombstone-stripping rule is retired with the tombstone model).
 - **Cross-board move** (⌘-drag): a real filesystem move, works across volumes — identity travels. A moved folder whose UUID already exists in the destination board arrives as a fresh-UUID copy (01-storage-format.md's import-boundary rule); in a compound move (lane with cards, multi-selection) only the colliding folders are reminted — the rest is a true move (01's per-folder degradation).
 - **Files from Finder**: dropped on a card → copied into its `attachments/` (any *file* type, multi-file; card highlights while hovered). Dropped on lane empty space → creates a card with the file attached, titled with the filename without its extension (multi-file drop: one card per file). **Folders are refused at hover** (settled — the attachment model is flat top-level files, and the importer refuses directories by design): a drag containing only folders never engages — no highlight, no drop proposal, the standard incompatible-payload read; a mixed drag proposes for its files only, and the drop imports the files while a loss row (02-architecture.md's warning tone) names the skipped folders ("Folders can't be attached — 2 skipped"). The create path thereby only ever fires with at least one importable file — no card is minted for an import that cannot succeed. **Created cards land at the drop position** (settled): resolved through the same card-grid zones an ordinary card drag uses, shadow included — drops are positional everywhere, and append-at-bottom stays the creation *trio's* rule, not the drop's. A multi-file drop shows **one nominal-height shadow per incoming file** (the multi-drag precedent; when macOS withholds item counts during hover the count floors at one shadow, the commit unaffected). **A release on the lane header resolves to the topmost position** (settled — forgiving beats a dead stripe: the header's chrome roles don't collide with a file payload). **The landing shadow is the create path's whole feedback** (settled): no lane-level highlight on top — each target gets one clear signal, and the card-attach highlight exists precisely because that target has no shadow.
-- **A foreign reload mid-drag re-grounds the drag, never corrupts the drop** (settled — a two-second drag racing agent edits is the designed concurrency). Three rules compose: (1) **geometry re-derives** — the frozen-at-drag-start inputs are the *dragged items'* sizes and the physical pointer only (03-board-ui.md ▸ Motion); the analytic resting zones recompute against each new snapshot, so a foreign lane-count re-divide mid-drag just moves the zones and the next proposal targets the board as it now is. (2) **Proposals re-validate by liveness** — a proposal whose target lane was tombstoned or vanished in the reload is invalidated (tombstoned lanes are never drop targets — The trash below); the shadow withdraws and no proposal stands until the pointer reaches a live target, and **release with no valid proposal cancels** — items return, nothing is written; a card is never filed under a `deleted:` parent. (3) **An emptied drag cancels itself** — drag membership is already a UUID set that vanished items leave silently (02-architecture.md); when the *last* dragged item vanishes the replica dissolves and release is a no-op. Partial vanishing drops the survivors, matching the pending-cut precedent. **A cross-board lane arrival pre-divides the destination strip during hover** (settled): while a foreign lane drag proposes into a board, the destination's standard width is computed with the arriving run's units included, so the shadow draws at the width the lane will actually take — without this it overflows the strip (the pathfinder's stripWidthUnits). The first entry samples the un-widened standard for one frame before hysteresis settles — accepted, imperceptible.
+- **A foreign reload mid-drag re-grounds the drag, never corrupts the drop** (settled — a two-second drag racing agent edits is the designed concurrency). Three rules compose: (1) **geometry re-derives** — the frozen-at-drag-start inputs are the *dragged items'* sizes and the physical pointer only (03-board-ui.md ▸ Motion); the analytic resting zones recompute against each new snapshot, so a foreign lane-count re-divide mid-drag just moves the zones and the next proposal targets the board as it now is. (2) **Proposals re-validate by liveness** — a proposal whose target lane vanished in the reload is invalidated; the shadow withdraws and no proposal stands until the pointer reaches a live target, and **release with no valid proposal cancels** — items return, nothing is written; a card is never filed under a vanished parent. (3) **An emptied drag cancels itself** — drag membership is already a UUID set that vanished items leave silently (02-architecture.md); when the *last* dragged item vanishes the replica dissolves and release is a no-op. Partial vanishing drops the survivors, matching the pending-cut precedent. **A cross-board lane arrival pre-divides the destination strip during hover** (settled): while a foreign lane drag proposes into a board, the destination's standard width is computed with the arriving run's units included, so the shadow draws at the width the lane will actually take — without this it overflows the strip (the pathfinder's stripWidthUnits). The first entry samples the un-widened standard for one frame before hysteresis settles — accepted, imperceptible.
 
 ## Clipboard
 
-- ⌘X/⌘C/⌘V on cards **and lanes** (resettled — lanes joined the clipboard so cross-board structure transfer has a keyboard path under the every-function contract; the cards-XOR-lanes selection rule means the clipboard holds cards or lanes, never both). Hybrid clipboard: pasteboard carries a JSON manifest + plain text; full folder snapshots staged in Application Support so paste reproduces the item byte-for-byte — cards, attachments and all — across boards. Each manifest entry embeds the full `index.md` as a staging-less fallback (a lane entry embeds its cards' too, attachment-less). **Staging lifecycle** (settled): snapshots are staged **eagerly at ⌘C/⌘X time** — copy captures the source as it is at the gesture, immune to later deletion or unmount — and the store holds at most the *current* copy: a new Lanework copy replaces the previous snapshot, and a sweep at launch and on each copy purges entries the pasteboard no longer references (another app taking the pasteboard orphans the snapshot; the next sweep collects it). The snapshot survives relaunch exactly as long as the pasteboard still points at it — a copy made before quitting pastes whole after restart. **A paste is an import boundary, so normalization applies** (settled 2026-07-28 — 01-storage-format.md's loose-file rule): loose files the staged snapshot carries beside a card's `index.md` land in the pasted card's `attachments/`, Finder-renamed on collision — nothing the snapshot preserved is dropped on arrival. **A degraded paste is loud, never silent** (the banner vocabulary — 02-architecture.md): if the staged snapshot is missing or unreadable at paste time, paste falls back to the embedded `index.md` — content intact, files absent — and a **loss row** (warning tone, user-dismissed) names what was lost with true totals, attachments and loose files alike, folding plurals ("Pasted 'Fix login' without its 3 attachments"; "Pasted 2 items without their 5 files" — BannerCenter owns the phrasing, the manifest records each entry's staged file count so the totals stay honest); the user never discovers an empty `attachments/` later. **The pasteboard is re-read lazily, and the brief lie is accepted** (settled): changeCount is checked on activation, on menu validation, and before paste — no timers; a background app taking the pasteboard while Lanework stays frontmost can leave Edit ▸ Paste enabled until the next check, and the paste itself re-validates and no-ops — nothing stale ever lands, which is the guarantee that matters.
-- **Cut is Finder-style deferred**: cut items dim in place until paste moves them; voided if another app takes the pasteboard or the source board closes; second paste materializes copies. **Deletion voids per item**: a cut item that is tombstoned or vanishes externally before paste drops out of the pending cut — 02-architecture.md's UUID-set rule; transient state never resurrects what's gone — so paste moves only the survivors, and a cut voided down to nothing is simply void (paste disabled, no error).
-- Paste lands after the anchor card (or appends to a selected lane); a multi-selection anchors at its last member in flatten order — the ⌘N target rule's shared anchor (The map below). Copies keep `created` (a duplicate is a fork) and take fresh GUID/`order`/`modified`. **A tombstoned selection never anchors paste** (settled — the ⌘N target rule's own wording, returned to the precedent it cites): ⌘V stays enabled and behaves exactly as with nothing selected — a card payload appends to the last-active lane, a lane payload lands at the board's right end; the trash is never the destination (▸ The trash), and a trashed card's live disk-lane never leaks in as "the selected card's lane".
-- **Lane paste** lands after the anchor lane — the selected lane, or the selected card's lane (several selected: the last, per the shared anchor rule); nothing selected = the board's right end. Semantics mirror the drag pair above exactly: a pasted *copy* takes fresh GUIDs throughout and **strips tombstoned cards**; a cut-paste is the ⌘-drag move — the folder moves whole, tombstoned cards landing in the destination's trash. **Pasting into the source board is supported and is the within-board lane duplicate** (settled): fresh GUIDs and tombstone-stripping apply as anywhere else, no menu-validation special case — the drag path deliberately lacks this operation (⌥ ignored on lane drags, above), the clipboard is its one home.
+- ⌘X/⌘C/⌘V on cards **and lanes** (resettled — lanes joined the clipboard so cross-board structure transfer has a keyboard path under the every-function contract; the cards-XOR-lanes selection rule means the clipboard holds cards or lanes, never both). Hybrid clipboard: pasteboard carries a JSON manifest + plain text; full folder snapshots staged app-side (02-architecture.md ▸ Per-board app state's app-wide home) so paste reproduces the item byte-for-byte — cards, attachments and all — across boards. Each manifest entry embeds the full `index.md` — identification metadata (menu validation, refusal wording, the plain-text flavor's source), **never a materialization source** since the 2026-07-29 refuse-don't-degrade ruling below (a lane entry embeds its cards' too). **Staging lifecycle** (settled): snapshots are staged **eagerly at ⌘C/⌘X time** — copy captures the source as it is at the gesture, immune to later deletion or unmount — and the store holds at most the *current* copy: a new Lanework copy replaces the previous snapshot, and a sweep at launch and on each copy purges entries the pasteboard no longer references (another app taking the pasteboard orphans the snapshot; the next sweep collects it). The snapshot survives relaunch exactly as long as the pasteboard still points at it — a copy made before quitting pastes whole after restart. **A paste is an import boundary, so normalization applies** (settled 2026-07-28 — 01-storage-format.md's loose-file rule): loose files the staged snapshot carries beside a card's `index.md` land in the pasted card's `attachments/`, Finder-renamed on collision — nothing the snapshot preserved is dropped on arrival. **A paste whose staged snapshot is missing or unreadable refuses loudly — never degrades** (re-ruled 2026-07-29, retiring the degraded embedded-`index.md` fallback and its loss row; Finder's invariant adopted, and 01's leniency doctrine applied — proceed-partially-lose-a-little is never a verdict): the paste produces **nothing**, and a one-shot failure banner names it from the manifest's metadata ("The copied cards are no longer available" / "Couldn't paste 'Fix login' — the copied content is gone"; BannerCenter owns the phrasing). An item arrives **whole — index, attachments, loose files, and comments when they ship — or not at all**; a hollowed card is never materialized, so the loss-accounting problem (what didn't arrive, and whether the totals are honest) dissolves rather than being solved. The refusal is transactional — all-or-nothing for the whole paste, the copies-are-transactions posture (01). With eager staging and the shared-store sweep discipline this is a rare corner, not a flow: the refusal names it, and ⌘C again is the recovery. **The pasteboard is re-read lazily, and the brief lie is accepted** (settled): changeCount is checked on activation, on menu validation, and before paste — no timers; a background app taking the pasteboard while Lanework stays frontmost can leave Edit ▸ Paste enabled until the next check, and the paste itself re-validates and no-ops — nothing stale ever lands, which is the guarantee that matters.
+- **Cut is Finder-style deferred**: cut items dim in place until paste moves them; voided if another app takes the pasteboard or the source board closes; second paste materializes copies. **Deletion voids per item**: a cut item that is deleted (moved to the trash or destroyed) or vanishes externally before paste drops out of the pending cut — 02-architecture.md's UUID-set rule; transient state never resurrects what's gone — so paste moves only the survivors, and a cut voided down to nothing is simply void (paste disabled, no error).
+- Paste lands after the anchor card (or appends to a selected lane); a multi-selection anchors at its last member in flatten order — the ⌘N target rule's shared anchor (The map below). Copies keep `created` (a duplicate is a fork) and take fresh GUID/`order`/`modified`. **A trash selection never anchors paste** (settled — the ⌘N target rule's own wording, returned to the precedent it cites): ⌘V stays enabled and behaves exactly as with nothing selected — a card payload appends to the last-active lane, a lane payload lands at the board's right end; the trash is never the destination (▸ The trash), and a trashed card's live disk-lane never leaks in as "the selected card's lane".
+- **Lane paste** lands after the anchor lane — the selected lane, or the selected card's lane (several selected: the last, per the shared anchor rule); nothing selected = the board's right end. Semantics mirror the drag pair above exactly: a pasted *copy* takes fresh GUIDs throughout; a cut-paste is the ⌘-drag move — the folder moves whole (nothing lane-nested to strip or carry — the trash is board-level, resettled 2026-07-28). **Pasting into the source board is supported and is the within-board lane duplicate** (settled): fresh GUIDs apply as anywhere else, no menu-validation special case — the drag path deliberately lacks this operation (⌥ ignored on lane drags, above), the clipboard is its one home.
 
 ## Keyboard
 
@@ -39,11 +39,11 @@ Selection, drag & drop, keyboard, clipboard, search. This is where the old app s
 - **Arrows**: spatial card navigation (nearest card in the direction, across interior grid columns and lanes); with a lane selected, ←/→ move lane selection; ⇧-arrow extends — except **⇧↑/⇧↓ in the lane domain, which are inert** (settled: there is nothing above the lane domain and no vertical range within it); selection scrolls into view; all grammar keys inert while a title editor is focused, and menu dispatch narrows to the text domain (focused-editor rule below).
 - **⌥-arrows jump**: ⌥↑/⌥↓ to the current lane's first/last card; ⌥←/⌥→ to the first/last lane. **The horizontal jumps land on a card** (settled — ⌥↑ is the keyboard's one entry to lane selection, so ⌥←/⌥→ never select the lane itself): the first card of the first/last *non-empty* lane, scanning inward past empty lanes; ⌥→ prefers the shown non-empty trash — its first entry — per the last-container rule (The trash below). **⌥↑ escalates into the lane domain** (settled — the keyboard's one entry to lane selection): with the lane's first card already selected, ⌥↑ selects the *lane* itself — up in the hierarchy sense, the same key one press deeper; with a lane selected, ↓ (or ⌥↓) descends back into its cards at the first (last) card, and ⌥↑ is inert. **An empty selection seeds at the first lane's first card** on any plain arrow (deterministic origin; the ⌥-jumps behave as specified regardless) — two ⌥↑ presses from nothing reach the lane domain.
 - **Return** on a selected lane: creates a card at its bottom, editor focused; Return commits and re-selects the lane (next Return = next card); ⌘↩ commits and opens the card window. Abandoned placeholders (Escape, empty commit, click-away) are discarded — creating-then-abandoning never leaves an empty card behind (untitled cards exist only when made deliberately, e.g. by an external writer or by clearing an existing title). The placeholder is store-transient overlay state — the named exception to 02-architecture.md's one-way flow; nothing exists on disk until the title commits.
-- **Inline rename tracks its target by UUID, and vanishing discards it** (the placeholder and card-window kin rules — 02-architecture.md — applied to the third inline editor): a foreign *move* mid-rename is invisible — the editor follows the UUID and the commit writes the title wherever the card now lives; a target that is tombstoned, deleted, or gone at commit time discards the editor and its keystrokes silently (a liveness flip is a vanish; nothing is ever written into a vanished folder, and no partial `index.md` can resurrect deleted data). A write that fails *after* a valid commit is the ordinary one-shot write-failure banner. VoiceOver announces the vanished target per 10-accessibility.md's recovery rule.
+- **Inline rename tracks its target by UUID, and vanishing discards it** (the placeholder and card-window kin rules — 02-architecture.md — applied to the third inline editor): a foreign *move* mid-rename is invisible — the editor follows the UUID and the commit writes the title wherever the card now lives; a target that is trashed, deleted, or gone at commit time discards the editor and its keystrokes silently (entering the trash is a vanish from the board; nothing is ever written into a vanished folder). A write that fails *after* a valid commit is the ordinary one-shot write-failure banner. VoiceOver announces the vanished target per 10-accessibility.md's recovery rule.
 - **Return** on a sole selected **card**: inline rename. Return disambiguates on card selection — sole card = rename, lane = create (above) — and is **inert on a multi-card selection**; a lane's rename path is Board ▸ Rename. **Escape** steps outward one layer per press: abandons an open editor; else clears search, returning focus to the board (Search below); else **clears the selection** — the keyboard deselect.
 - **Focused editor = text domain** (settled): while an inline title editor — rename or the new-card placeholder — is focused, board-scoped menu commands (Delete, New Card, Paste, Move, Style, …) disable via menu validation; text-domain chords route to the field as standard text ops — ⌘Z/⇧⌘Z are the editor's text undo (06-history-undo.md ▸ Undo routing), ⌘X/⌘C/⌘V/⌘A act on the text. The one board-command carve-out is **Open Card ⌘↩**, which stays enabled to commit the edit — placeholder or rename — and open the card window. Exits are otherwise unchanged: Return commits, Escape abandons; click-away splits by editor kind — a **rename commits** (focus loss = commit, matching the card window's title field in 05-card-window.md and the branch-switch parenthetical in 06-history-undo.md), while the **placeholder discards** per its rule above, the deliberate exception because nothing exists on disk yet.
 - **Caret chords yield to any focused text control** (settled): Board ▸ Move Left/Move Right ⌘←/⌘→ and the width pair ⌥⌘←/⌥⌘→ disable via menu validation whenever *any* text control has keyboard focus — inline title editors, the board search field, board-popover fields (rename, git identity, remote), and card-window fields — because an enabled menu key equivalent fires before the field ever sees the key, and ⌘←/⌘→ are the standard line-start/end caret chords. Caret motion always wins in text (the Safari pattern: ⌘← is Back, yet moves the caret while a field is focused); the lane commands re-enable the moment focus returns to the board. This is a narrow, per-command broadening of the focused-editor rule, not a general one: board commands whose chords carry no text meaning keep their surface-specific dispatch — in particular the search field's board-commands-stay-enabled rule (Search below) — and the search field's explicitly ruled ⌘⌫ steal (File ▸ Delete, not delete-to-line-start) stands.
-- **⌫** on a live selection: delete (tombstone) — the plain-key synonym for File ▸ Delete ⌘⌫ (see The map). Grammar, not a menu item: giving it a menu home would require a second "Delete"-titled item, which would collide for title-matched remapping (Configurable bindings). Inert while a title editor is focused, like every grammar key.
+- **⌫** on a selection: delete — the plain-key synonym for File ▸ Delete ⌘⌫, staged by place like the menu item (see The map). Grammar, not a menu item: giving it a menu home would require a second "Delete"-titled item, which would collide for title-matched remapping (Configurable bindings). Inert while a title editor is focused, like every grammar key.
 - The card window speaks the same grammar: **Return** in Preview enters Edit, **Escape** returns to Preview (05-card-window.md) — plain keys, not menu items.
 - These plain-key behaviors are platform grammar (Finder's own Return/arrows aren't remappable either) and sit below the remapping mechanism, which handles modifier chords on menu items only — see Configurable bindings.
 
@@ -52,23 +52,22 @@ Selection, drag & drop, keyboard, clipboard, search. This is where the old app s
 Every command is a menu item. The full inventory — every command and action, its default binding, applicable context, and customizability class — lives in **11-command-nexus.md**, the single source of truth for what the app can do; the command titles there are the stable strings the remapping mechanism keys on (Configurable bindings below). The rules below are the behavior behind those bindings and stay normative here.
 
 - **⌥⌘↑/⌥⌘↓ sort within the lane** (the move-vs-jump question, resettled: *card* moves live on the ⌥⌘ chord, joining ⌥⌘←/⌥⌘→ lane width in a "⌥⌘ modifies" family; plain ⌥-arrows stay jumps; plain ⌘↑/⌘↓ are unassigned): the selected card(s) move one position within the lane — logical `order`, across interior masonry columns (10-accessibility.md's logical-order rule). A non-contiguous multi-selection **gathers on the first press**: the cards collect into a contiguous block anchored at the first selected card (first = lowest logical order; the rest follow in preserved relative order), and subsequent presses move the block one position. **Cards never change lanes by ⌘-arrow** (settled): inter-lane movement is drag or Cut/Paste (the clipboard rules above), so ⌥⌘↑/⌥⌘↓ disable when a card selection spans lanes and ⌘←/⌘→ are inert on card selections. With a **lane** selected, ⌘←/⌘→ move the lane one slot — closing 10-accessibility.md's lane-move defect — and ⌥⌘↑/⌥⌘↓ are inert.
-- **⌫/⌘⌫ delete** (unchanged): tombstone into the trash quasi-lane (03-board-ui.md); lanes included, no dialog. Selection moves to the deleted item's successor sibling, Finder-style (next card in the lane, next lane on the board; the last sibling's predecessor otherwise; empty container = nothing selected) — repeated ⌫ walks down a lane. Deliberate deletes pick a successor; *external* vanishing never does (02-architecture.md's reload-survival rule: the selection just shrinks). On a **tombstoned** selection ⌘⌫ is **Put Back** instead — Finder's exact symmetry (⌘⌫ trashes and un-trashes). The dual role is carried by **twin menu items sharing the chord** — File ▸ Delete ⌘⌫ and File ▸ Put Back ⌘⌫, validation enabling exactly one by selection state; AppKit routes a shared key equivalent to the enabled item (Finder ships this exact pair as Move to Trash/Put Back; ours says Delete per 03-board-ui.md's naming constraint). Both titles stay stable (titles-are-API), and each is independently remappable — remapping one never moves the other's role. Plain ⌫ performs the same tombstone as fixed grammar (see Grammar above) — there is no Edit ▸ Delete item, so the two Delete-titled homes never collide for title-matched remapping.
-- **Select All**: all visible cards on the board — filter-respecting, like every surface (Search below). **On the active trash side it selects by kind** (settled): with the trash visible and a non-empty tombstoned selection, Select All selects all visible trash entries of the current selection's kind — the kind-homogeneity invariant decides which "all" is meant; in every other state it selects all visible live cards.
-- **The contract's one carve-out is configuration** (settled): form-like git and board setup — add git, add/change remote, branch switching and creation, commit identity, credentials — lives in the board popover only, its committed home; its keyboard path is Board Info (⌘I) plus Tab-reachable controls (10-accessibility.md's Full Keyboard Access). Recurring remote *operations* stay under the contract: Board ▸ Pull and Board ▸ Push are menu items (no default chord, remappable; validation enables them only on remote-backed boards — 07-sync-collab.md).
-- **⌘N target rule** (settled): with a card selected, the new card is created in that card's lane, immediately after it (paste-anchor consistency); with a lane selected, appended at its bottom (Return consistency); **a multi-selection anchors at its last member in flatten order** (settled — lane `order`, then card `order`, the multi-drag order; the same anchor serves paste): creation follows the last selected card, or appends to the last selected lane; the lane header's new-card button **overrides this rule** — the click names its target lane, selection notwithstanding (11-command-nexus.md ▸ Pointer grammar); with nothing selected — or a **tombstoned** selection, which never anchors creation — the **last-active lane** — the lane that most recently held selection or a creation in this window session — falling back to the first lane. Title editor focused; same placeholder/abandon semantics as Return-creation. **Zero-lane board** (hand-made, or every lane deleted): card creation and card paste have no target — New Card, Return-creation, and Paste with a *card* payload disable via menu validation until a lane exists. New Lane (⇧⌘N) is one way in; Paste with a **lane** payload is the other — it stays enabled and lands at the board's right end (the lane-paste rule above), so cross-board structure transfer never needs a lane to exist first.
+- **⌫/⌘⌫ delete** (resettled 2026-07-28; lanes rejoined 2026-07-29): on cards *and lanes*, a move into the trash (`.trash/`, top position — 03-board-ui.md; a lane travels subtree-intact, `kind: lane` stamped when absent, no dialog — recoverable now, so nothing needs confirming); on a **trash** selection the same chord deletes **permanently** (one Delete vocabulary, staged by place — confirmation per 03's recoverability rule, a lane's alert counting its cards, a mixed trash selection's alert counting both kinds). Selection moves to the deleted item's successor sibling, Finder-style (next card in the lane, next lane on the board; the last sibling's predecessor otherwise; empty container = nothing selected) — repeated ⌫ walks down a lane. **In the trash the successor walk is kind-blind** (ruled 2026-07-31): the next row of either kind, in the same all-rows order plain arrows walk — a successor is a fresh singleton selection, so the landing violates no grammar, and repeated ⌘⌫ empties a mixed trash without dead-ends, each delete confirm-gated per its kind. Deliberate deletes pick a successor; *external* vanishing never does (02-architecture.md's reload-survival rule: the selection just shrinks). **Put Back is retired with the tombstone model** (resettled 2026-07-28): File ▸ Delete is the chord's only owner — no twin menu items, no shared-equivalent routing; restore is drag-out or ⌘X/⌘V (The trash below). Plain ⌫ performs the same delete as fixed grammar (see Grammar above) — there is no Edit ▸ Delete item, so the two Delete-titled homes never collide for title-matched remapping.
+- **Select All**: all visible cards on the board — filter-respecting, like every surface (Search below). **On the active trash side it selects the trash** (resettled 2026-07-28): with the trash visible and a non-empty trash selection, Select All selects all visible trash cards; in every other state, all visible live cards — the container boundary decides which "all" is meant (The trash below).
+- **The contract's one carve-out is configuration** (settled; containers re-ruled 2026-07-31 — the popover/sheet split — and **re-ruled back 2026-08-07**): form-like configuration keeps exactly one home per control, and that home is the **board popover** — rename, styling, branch display and *switching*, branch *creation*, add git, commit identity, ahead/behind with Pull/Push, the status badges; its keyboard path is Board Info (⌘I) plus Tab-reachable controls (10-accessibility.md's Full Keyboard Access). *(For a week, setup lived in a board settings sheet reached by Board ▸ Board Settings…; the split's mechanical argument — setup flows fire confirmation alerts, run inline network probes, and accept drag-in key import, acts that want a surface a stray click can't dismiss — did not survive the cost of a second validated surface for controls a user could otherwise reach directly. 03-board-ui.md ▸ Board settings sheet carries the retirement, and 07-sync-collab.md's credential and SSH surfaces are where the argument gets its next hearing.)* Recurring remote *operations* stay under the contract: Board ▸ Pull and Board ▸ Push are menu items (no default chord, remappable; validation enables them only on remote-backed boards — 07-sync-collab.md).
+- **⌘N target rule** (settled): with a card selected, the new card is created in that card's lane, immediately after it (paste-anchor consistency); with a lane selected, appended at its bottom (Return consistency); **a multi-selection anchors at its last member in flatten order** (settled — lane `order`, then card `order`, the multi-drag order; the same anchor serves paste): creation follows the last selected card, or appends to the last selected lane; the lane header's new-card button **overrides this rule** — the click names its target lane, selection notwithstanding (11-command-nexus.md ▸ Pointer grammar); with nothing selected — or a **trash** selection, which never anchors creation — the **last-active lane** — the lane that most recently held selection or a creation in this window session — falling back to the first lane. Title editor focused; same placeholder/abandon semantics as Return-creation. **Zero-lane board** (hand-made, or every lane deleted): card creation and card paste have no target — New Card, Return-creation, and Paste with a *card* payload disable via menu validation until a lane exists. New Lane (⇧⌘N) is one way in; Paste with a **lane** payload is the other — it stays enabled and lands at the board's right end (the lane-paste rule above), so cross-board structure transfer never needs a lane to exist first.
 
-### The trash, keyboard-first (settled)
+### The trash, keyboard-first (resettled 2026-07-28 — the materialized trash)
 
-The trash quasi-lane (03-board-ui.md ▸ Trash) speaks the same keyboard language when shown; hidden, it is invisible to every gesture — and **hiding it clears a tombstoned selection** (settled): nothing invisible stays selected, so the Show Trash toggle-off drops the selection (and with it Put Back / Delete Immediately validation) rather than leave commands enabled against rows nobody can see. Rules:
+The trash lane (03-board-ui.md ▸ Trash — cards and lanes moved into `<root>/.trash/`; lanes rejoined 2026-07-29 as opaque-unit rows) speaks the board's ordinary keyboard language when shown; hidden, it is invisible to every gesture — and **hiding it clears a trash selection** (nothing invisible stays selected, so the toggle-off drops the selection rather than leave commands enabled against rows nobody can see). Trash cards are ordinary cards; a trashed lane is one opaque row (title + card count) — the old liveness machinery stays retired: no ancestor walks, no entry-vs-universe split, one container boundary plus the board's own kind rule. Rules:
 
-- **Navigation**: the shown trash is the **last container for card navigation** — arrows walk into and out of it, and ⌥→ jumps to it. The quasi-lane itself is never selectable *as a lane* (no lane op applies to it): with a lane selected, ←/→ and ⌥→ stop at the last real lane.
-- **Dropping a live card on the shown trash deletes it** (settled 2026-07-28): the drag becomes the pointer's delete gesture — release tombstones the dragged card(s), exactly the ⌫ tombstone. The drop diverges from positional drops in one way: **the shadow always takes the topmost position** — which the sort makes honest, not arbitrary: the trash orders by `deleted` newest-first, so a fresh tombstone genuinely lands on top. Lanes are not deliverable this way (a lane drag proposes only lane slots); the trash stays undropppable-into while hidden, like every gesture. Implementation is scheduled, not shipped (Implementation board).
-- **Moves are inert across the boundary**: no move or paste ever targets the trash (deleting is ⌫/⌘⌫), and ⌥⌘↑/⌥⌘↓ are inert *on* tombstoned cards (moving out is Put Back or drag-to-restore).
-- **Selection is homogeneous by liveness** (extending the homogeneous-selection rule): a selection never mixes live and tombstoned cards. Select All selects visible live cards only; a rubber-band stays on the side of the boundary it started on. **⇧-arrow extension stops at both boundaries — liveness and kind** (settled, the rubber-band's rule applied to the keyboard): a ⇧-arrow whose next step would cross from live cards into the trash (or back), or from card entries onto a lane entry within it, is simply inert — the held range is never silently dropped for a move-and-replace, and the invariants below are unbreakable by keyboard. Plain arrows still walk across (navigation moves, extension stops). Menu validation stays binary — Delete for live selections, Put Back / Delete Immediately for tombstoned ones. External liveness flips can't breach the invariant: a reload that flips `deleted:` on a selected card ejects it from the selection (02-architecture.md's reload-survival rule — a flip is a vanish from its side of the boundary), so validation never sees a mixed selection.
-- **Tombstoned lane entries are full keyboard citizens, homogeneous by kind**: arrows walk every trash entry in its sorted order — card and lane entries alike (a lane's single restorable entry, 03-board-ui.md ▸ Trash) — and the board's cards-XOR-lanes rule extends into the trash: a selection never mixes card entries and lane entries (on top of never mixing live and tombstoned). Put Back (⌘⌫) and Delete Immediately (⌥⌘⌫) apply to lane entries exactly as to cards — a put-back lane returns whole, cards and all. A lane entry is not draggable (its entry is a compact row, not the lane); its copy-out is ⌘C only, and its move-out is Put Back. **Pointer ranges keep the kind invariant by skipping, not stopping** (settled): a ⇧-click range collects only entries of the anchor's kind, skipping other-kind rows inside the span — the pointer names an unambiguous same-kind target, so it skips where the keyboard (which must cross row by row) goes inert; a trash-side marquee takes the kind of the topmost intersected entry and selects only that kind. Both keep every selection kind-homogeneous, each in the idiom of its input. **The column's gesture surface is full height** (settled): the trash column carries a full-height backdrop like the board background, so a marquee can arm from the blank area below the last row — the board side has no dead zone and the trash side doesn't either.
-- **Clipboard: copy out only.** ⌘C (cards and lane entries), ⌥-drag, and the cross-board drag default (cards) always yield *live* copies — `deleted:` is stripped on paste/duplicate/drop, like copying a file out of Finder's Trash; a lane entry's copy additionally strips its tombstoned interior cards (the lane-copy rule — copies transfer content, and trash isn't content). ⌘X is disabled: the move-out vocabulary is Put Back or drag-to-restore, nothing else. The *cross-board restore-move* (⌘-drag below) needs no command of its own — its keyboard equivalent is the composition Put Back → ⌘X → ⌘V in the destination: same folder, same identity.
-- **Everything edit-shaped is disabled** on tombstoned selections — Open Card, Rename, Style… (File ▸ Duplicate is untouched: it duplicates the board, never the selection — 11-command-nexus.md; card copies out of the trash are ⌘C or ⌥-drag, which name a live destination). Finder file drops (attachment import) on tombstoned cards are inert — 03-board-ui.md's no-editing-in-the-trash.
-- **Drag-to-restore follows the locality model**: dropping a tombstoned card into one of its own board's lanes restores it at the drop position (`deleted:` removed, `order` set). Dropped on *another* board it follows the copy default — a live copy lands there and the tombstoned original stays in the source trash (copy-out, like ⌘C); ⌘-drag forces the true cross-board restore-move (the tombstone leaves the source board; ordinary cross-board move semantics, `deleted:` cleared at the destination).
+- **Navigation**: the shown trash is the **last container for card navigation** — arrows walk into and out of it, and ⌥→ jumps to it; inside, plain arrows walk every row, card and lane row alike (navigation crosses kinds). The trash lane itself is never selectable *as a lane* (no lane op applies to it): with a lane selected, ←/→ and ⌥→ stop at the last real lane.
+- **Dropping a live card — or lane — on the shown trash deletes it** (lanes extended 2026-07-29): the drag is the pointer's delete gesture — release moves the dragged item(s) into `.trash/`; a lane drag over the shown trash proposes the delete alongside its strip slots. The drop diverges from positional drops in one way: **the shadow always takes the topmost position** — honest, not arbitrary: every trash arrival stamps `modified` and the trash sorts newest-first by that stamp (03 ▸ Trash), so a fresh delete genuinely lands on top. The trash takes no drops while hidden, like every gesture. Cross-board arrivals and ⌥-copies refuse too (a transfer-and-delete compound and a copy-into-the-trash are operations the design doesn't name), and a refusal falls through to the strip retarget rather than cancelling the held drag. **A refusal arriving over a standing trash proposal withdraws it** (ruled 2026-08-06 — the stationary ⌥ flip made the state reachable without a mouse move): the fall-through's honest reading — the column declines to be a target, it does not cancel the drag the user is still holding — covers only promises the refusal leaves keepable: shadows standing in a lane keep drawing, and an ⌥-copy released over the column lands where they are. A standing proposal naming the trash itself is the one promise the refusal just broke — tombstone rows promising a delete the release will refuse — so it withdraws rather than holds: the drag goes proposal-less over the column (the foreign-reload rule's shape — the shadow withdraws, no proposal stands until the pointer reaches a live target, and a release with no valid proposal cancels, which now agrees with the empty picture). Lifting ⌥ re-asks at the same address (the stationary flip's re-read) and the trash's proposal returns.
+- **Selection keeps one container boundary — and goes kind-blind inside the trash** (re-ruled 2026-07-31, superseding the lanes-rejoin pass's kind-homogeneous trash grammar): a selection never mixes trash items with board items, but *within* the trash cards and lane rows select together — clicks, ⇧-click ranges, ⇧-arrow extension, and the rubber band all sweep every row (the band's full-height backdrop covers both kinds), and Select All with a non-empty trash selection selects **all visible trash rows**. The live board keeps cards XOR lanes, and its Select All stays card-scoped, as everywhere. The guard moves to the exits (the mixed-payload drop refusal and ⌘C/⌘X validation below) — inside the trash the only verbs are Delete and the restore paths, so upstream homogeneity bought nothing the exits don't. ⇧-arrow extension still stops at the container boundary. Menu validation stays binary by container: Delete = move to trash on board selections, Delete = permanent on trash selections (03 ▸ Trash) — and Delete works on a mixed selection, the alert counting both kinds. An external move observed by reload re-resolves the selection by presence, as everywhere (02-architecture.md).
+- **Within-trash moves are inert**: no move or paste ever targets the trash (deleting is ⌫/⌘⌫ or the drag above), and ⌥⌘↑/⌥⌘↓ are inert on trash rows — the trash's order is its arrival order, not a workspace to arrange.
+- **Clipboard: the restore path.** ⌘C copies a trash card (a live copy lands wherever pasted — like copying out of Finder's Trash); **⌘X works** (resettled — it was disabled under the tombstone model): cut in the trash, paste is the keyboard-native restore, an ordinary folder move (10-accessibility.md's drag-free contract) — a card pastes into a lane, a trashed lane pastes after the anchor lane (the lane-paste rule above, verbatim). **⌘C and ⌘X validate against mixed selections** (ruled 2026-07-31, with kind-blind selection): the pasteboard's payload types are per-kind, so Cut and Copy grey out via ordinary menu validation while a trash selection mixes kinds — no failed gesture, no beep; the drag path's drop-time explanation (Drag-to-restore below) is where the rule teaches itself. **An item entering the trash voids its pending cut** (the deliberate-removal rule): a cut card — or lane — that gets deleted drops out of the pending cut, as under the old model.
+- **Everything edit-shaped is disabled** on trash selections — Open Card, Rename, Style…, and lane width ops on lane rows; Finder file drops on trash rows are inert (03's no-editing-in-the-trash). Creation never anchors to the trash: ⌘N and paste with a trash selection fall back to their nothing-selected targets.
+- **Drag-to-restore follows the locality model**: dropping a trash card into one of its own board's lanes — or a trashed lane row onto its own board's strip — is an ordinary move to the drop position. Dropped on *another* board it follows the copy default — a live copy lands there, the original stays in the source trash; ⌘-drag forces the true cross-board restore-move. **A mixed-kind drag never leaves the trash** (ruled 2026-07-31): pickup is allowed — the selection is legal — but every out-of-trash drop target refuses the mixed payload, and the release surfaces a notice explaining the rule ("Cards and lanes leave the trash separately — restore one kind at a time"); the refused drag ends like any refusal, rows staying put. Within-trash drops stay inert as above.
 
 ### Configurable bindings (settled)
 
@@ -77,7 +76,7 @@ Custom shortcuts are **system-native, with no in-app remapping UI**: macOS's App
 - **Menu item titles are API.** The mechanism matches on exact titles — renaming a menu item orphans users' bindings. Titles change only with the deliberateness of a schema change.
 - **Toggles keep one stable title** with a checkmark state — "Show Trash" stays "Show Trash" when checked, never becomes "Hide Trash". (Same for Edit Body and Raw Source.)
 - **Undo/Redo are effectively not remappable** — NSUndoManager rewrites their titles dynamically ("Undo Move Card…"), which defeats title matching. Accepted; nobody remaps ⌘Z.
-- **Two items may share a default chord when validation is mutually exclusive** (Delete / Put Back on ⌘⌫) — AppKit fires the enabled one. Each keeps its own stable title, so remapping stays per-item. Corollary: no two menu items share a *title* either (titles are the remap key), which is why plain-⌫ delete is grammar rather than a second Delete item.
+- **Two items may share a default chord when validation is mutually exclusive** (a pattern currently unused — Put Back's retirement removed its one instance) — AppKit fires the enabled one. Each keeps its own stable title, so remapping stays per-item. Corollary: no two menu items share a *title* either (titles are the remap key), which is why plain-⌫ delete is grammar rather than a second Delete item.
 
 ## Accessibility
 
@@ -85,8 +84,8 @@ Custom shortcuts are **system-native, with no in-app remapping UI**: macOS's App
 
 ## Search
 
-- Search field invoked with ⌘F (the board toolbar's sole default item; removed from the toolbar, ⌘F surfaces it transiently — 03-board-ui.md ▸ Toolbar; in the **card window**, Edit ▸ Find is find-in-text instead — 05-card-window.md), live filter: cards whose title *and* body both miss the query animate out; case/diacritic-insensitive substring. Scope is **title + body only** (settled) — attachment filenames are not searched.
-- The filter is the single source of truth for "what's on the board": layout, drop zones, marquee, ranges, arrow nav, and lane count badges all read it. Hidden cards leave the selection; creating a card clears the search — creation's carve-out exists because a brand-new card must not be born invisible, and it is **stated by mechanism, not by gesture** (settled): *any* user-initiated creation on the board clears the query — ⌘N, Return-creation, the header button, empty-space double-click, paste, and Finder file drops alike — while foreign/agent-filed cards keep riding the live filter (02-architecture.md's derived-result rule). **Rename deliberately gets no carve-out**: a rename committed during an active search re-runs the predicate like any edit — a title that stops matching animates the card out and drops it from the selection, exactly as an agent's edit would; the filter stays a pure predicate with one exception, not two. **Escape is staged** (settled): in a non-empty field it clears the query, focus staying in the field; in an empty field it returns focus to the board; with *board* focus and an active search, one press clears the search and the full board returns — search takes Escape before its clear-selection meaning, which applies only when no search is active. **A lane the query empties keeps its slot** (settled): lanes are never filtered out — an all-misses lane stays on the board at its width with a 0 badge (the count reads the filter, 03-board-ui.md); the search filters cards, and the board's structure is not a search result. **A leaving card stays input-reachable for its out-transition** (settled): marquee and arrow targets deregister when the ~0.28 s animate-out ends, so a card mid-departure is briefly reachable while already out of the selection — accepted: it is literally on screen for that span, and closing the window would teach three input sites a predicate the layout already applied. **An open inline rename survives the filter hiding its card** (settled): the editor is a surface the filter doesn't reach — it stays open and focused, commits by UUID wherever the card lives, Escape abandons; keystrokes are never silently discarded for a card that still exists (the dirty-buffer courtesy), and the vanish-discard rule stays reserved for true liveness flips. The typed-query path can't even occur — focusing the search field is focus loss, which commits the rename first — so the rule covers foreign edits that stop the card matching.
+- Search field invoked with ⌘F (the board toolbar's sole default item; removed from the toolbar, ⌘F surfaces it transiently — 03-board-ui.md ▸ Toolbar; in the **card window**, Edit ▸ Find is find-in-text instead — 05-card-window.md), live filter: cards whose title *and* body both miss the query animate out; case/diacritic-insensitive substring. Scope is **all card content the format makes meaningful** (re-ruled 2026-07-29, superseding title-plus-body-only): title + body today; **comment bodies join when comments ship** — via a search-owned transient comment index, never the snapshot: the first live-query keystroke kicks an async sweep of `comments/*/index.md` bodies (`.draft` and `comments/.trash/` excluded), kept fresh by the same FSEvents stream while a query is active and discarded when it clears — the board walk stays O(cards), 01's window-scoped read untouched; **attributes join as they activate** (title now; labels/tags and their kin are reserved, inert keys this version — nothing to search until a future version gives them life). Attachment filenames stay unsearched. Scope options (content vs attributes, either/or) are WISHLIST #10.
+- The filter is the single source of truth for "what's on the board": layout, drop zones, marquee, ranges, arrow nav, and lane count badges all read it. **A drop under an active filter counts in the rendered space** (ruled 2026-08-06, closing the divergence found 2026-08-01): the zones, the shadow, and the write all resolve through the same filtered list — the position the shadow shows is the landing the write performs (the shipped interim — zones and write counting the unfiltered lane while the slots rendered filtered — was self-consistent but named a position the user could not see; retired). The slot's meaning in the full order is its **visible anchor**: the dropped card enters immediately *after* the slot's visible predecessor — or immediately *before* its visible successor when the slot has none (top of the lane) — and a lane the query emptied appends at its true end; a multi-card drop enters in proposal order beside the same anchor. Hidden cards keep their ranks untouched, never displaced by a gesture that could not see them — and the anchor is what makes the gesture's meaning survive the query's clearing: when the filter lifts, the card sits exactly beside the card it was dropped against. The rendered space means everything rendered — the new-card placeholder occupies its slot for the zones exactly as it does for layout. Hidden cards leave the selection; creating a card clears the search — creation's carve-out exists because a brand-new card must not be born invisible, and it is **stated by mechanism, not by gesture** (settled): *any* user-initiated creation on the board clears the query — ⌘N, Return-creation, the header button, empty-space double-click, paste, and Finder file drops alike — while foreign/agent-filed cards keep riding the live filter (02-architecture.md's derived-result rule). **Rename deliberately gets no carve-out**: a rename committed during an active search re-runs the predicate like any edit — a title that stops matching animates the card out and drops it from the selection, exactly as an agent's edit would; the filter stays a pure predicate with one exception, not two. **Escape is staged** (settled): in a non-empty field it clears the query, focus staying in the field; in an empty field it returns focus to the board; with *board* focus and an active search, one press clears the search and the full board returns — search takes Escape before its clear-selection meaning, which applies only when no search is active. **A lane the query empties keeps its slot** (settled): lanes are never filtered out — an all-misses lane stays on the board at its width with a 0 badge (the count reads the filter, 03-board-ui.md); the search filters cards, and the board's structure is not a search result. **A leaving card stays input-reachable for its out-transition** (settled): marquee and arrow targets deregister when the ~0.28 s animate-out ends, so a card mid-departure is briefly reachable while already out of the selection — accepted: it is literally on screen for that span, and closing the window would teach three input sites a predicate the layout already applied. **An open inline rename survives the filter hiding its card** (settled): the editor is a surface the filter doesn't reach — it stays open and focused, commits by UUID wherever the card lives, Escape abandons; keystrokes are never silently discarded for a card that still exists (the dirty-buffer courtesy), and the vanish-discard rule stays reserved for true liveness flips. The typed-query path can't even occur — focusing the search field is focus loss, which commits the rename first — so the rule covers foreign edits that stop the card matching.
 - **Dispatch while the search field is focused** (settled): the field is a *control*, not a content editor — the focused-editor lockdown (Grammar above) does not apply. Text-domain keys route to the field: ⌘A/⌘X/⌘C/⌘V act on the query, plain ⌫ edits the query and never reaches the board, horizontal arrows move the caret. **Every key with the field focused acts on the field — stock NSSearchField behavior, no pass-throughs** (settled): vertical arrows are caret movement, ⇧-arrows select query text, and **Return is a swallowed no-op** (the filter is live, there is nothing to submit — it never reaches the board's rename/create grammar). **Tab is the keep-filter path**: plain key-view traversal moves focus to the board with the query intact, and the whole board grammar (arrows, ⌥↑ escalation, Return, ⌘↩) then applies over the *filtered* board; ⌘F returns to the field. Board menu commands stay enabled and act on the board selection exactly as when the field is unfocused — ⌘N included (creating a card clears the search, above) — **except the caret-chord commands**: Move Left/Right ⌘←/⌘→ and the width pair ⌥⌘←/⌥⌘→ disable while the field is focused (Grammar above, caret-chords rule), so ⌘←/⌘→ stay line-start/end in the query even with a lane selected — and the Delete pair stays unambiguous by construction: plain ⌫ is query editing, ⌘⌫ is File ▸ Delete on the selection, and ⌘Z/⇧⌘Z are the field's own text undo, never git undo (06-history-undo.md ▸ Undo routing's control-class rule).
 
 ## Changes from Kanban

DESIGN/05-card-window.md

@@ -2,14 +2,15 @@
 
 The standalone per-card window. Opened by fast double-click, ⌘↩, or the context menu; at most one window per card (reopening a live card focuses the existing window); board and card windows share one live store, so edits reflect everywhere instantly (02-architecture.md).
 
-> **Status: designed** — composition, body column, and the attributes sidebar are all settled. The storage-facing rules the pathfinder settled painfully — Preview/Edit over WYSIWYG, the untouched-body byte-identical guarantee, validate-before-write on the raw outlet, dirty-buffer-wins — carry over unchanged.
+> **Status: designed** — composition, body column, the attributes sidebar, and the comments column (2026-07-29) are all settled. The storage-facing rules the pathfinder settled painfully — Preview/Edit over WYSIWYG, the untouched-body byte-identical guarantee, validate-before-write on the raw outlet, dirty-buffer-wins — carry over unchanged.
 
 ## Composition
 
-Two full-height columns: a wide **body column** (leading) and a narrow **attributes sidebar** (trailing), each scrolling independently. Visual reference: [assets/card-sidebar-reference.png](assets/card-sidebar-reference.png) — a GitLab-style issue pane; its *pattern* (stacked small-caps sections, quiet read-first rows, actions at the bottom) is what carries over, not its enhanced-schema content.
+Three **componentized panes** (re-composed 2026-07-29, comments design): a wide **body pane** (leading), the **comments pane** (middle, when shown — The comments column below), and the narrow **attributes sidebar** (trailing) — each an independent component with its own scroll, arranged by the window's layout rather than wired to each other; componentization is the rule, so the comments pane mounts beside the body or below it (the layout option, next) without either pane knowing which. Visual reference: [assets/card-sidebar-reference.png](assets/card-sidebar-reference.png) — a GitLab-style issue pane; its *pattern* (stacked small-caps sections, quiet read-first rows, actions at the bottom) is what carries over, not its enhanced-schema content.
 
 - **Body column, top to bottom**: the **title field** — large, borderless; edits write through to frontmatter on commit (Return or focus loss); clearing it removes the `title` key (titles are optional — the untitled placeholder shows here as on the face); Return commits and moves focus into the body. **Escape abandons** (settled — the board inline rename's abandon, applied here): the field reverts to the on-disk title and focus moves into the body, never a commit. The Edit-mode collision resolves by focus, 06-history-undo.md's first-responder rule: while the title field is focused, Escape is the title abandon even with the body in Edit; with the body editor focused, Escape is the Edit→Preview flip as specified. Beneath it, a **quiet created/modified line** ("Created ⟨date⟩ · Modified ⟨date⟩ · by ⟨modified-by⟩", secondary styling, omitting whichever keys are absent — the "by" segment renders only when the self-reported provenance stamp is present, 01-storage-format.md; this is provenance made visible where git history may not exist) — the read-only readout the pathfinder dropped with its inspector, back where the mockup puts it. Then the **body** (Preview/Edit, below).
 - **Attributes sidebar**: everything about the card that isn't the body — sections below. Fixed narrow width derived from font metrics (full relative scaling, 10-accessibility.md); the window's resize flex goes to the body.
+- **Body/comments layout is an option** (ruled 2026-07-29 — componentized panes make it cheap): side-by-side is the default; **View ▸ Comments Beside Body** unchecked stacks them — body pane above, comments pane below at a fixed ≈3:2 split, each keeping its own scroll — for narrow displays. App-wide, persisted. The panes are identical in both mounts, and the thread stays visible through body **Edit** in either (Edit swaps only the body pane's content — the sidebar's own precedent); the window's minimum width grows only while the column is shown side-by-side, and resize flex always goes to the body, never the fixed panes.
 
 (The pathfinder's compositions are both gone: the metadata bar — labels, assignees, due — left with those fields' move to the enhanced schema, and the horizontal attachments strip dissolves into the sidebar.)
 
@@ -30,7 +31,7 @@ Settled the hard way in the pathfinder (WYSIWYG built, then reversed): the body
 - **Remote images are never fetched** — Preview does no networking (sandbox-quiet, files-first). An `![](https://…)` renders as a quiet placeholder chip carrying the alt text (or the URL); the file-relative form above is the supported image story.
 - **Task-list checkboxes are live**: clicking a `- [ ]` / `- [x]` checkbox flips exactly that marker in the source — a single-character textual edit; every other byte of the body is untouched. This is the deliberate exception to "Preview only reads": checklists are kanban's working currency, and a mode flip to tick a box is ceremony. A toggle is an ordinary user edit — the standard atomic write, auto-committed and undoable on git boards. **The pointer-free path is the system focus model** (settled): checkboxes — like Preview's links — are real controls in the keyboard-focus and accessibility tree, so Full Keyboard Access Tab-reaches them and Space toggles, and VoiceOver toggles with VO-Space (10-accessibility.md's real-accessible-checkboxes promise, honored natively). Without FKA they are not in the key loop — standard macOS content behavior, so ordinary Tab users never wade through a long checklist. In-content controls are *content*, not commands: no menu item, no chord — 04's every-function-has-a-menu-item contract covers commands, and 11-command-nexus.md scopes them accordingly. Under the read-only lock (02-architecture.md) the controls disable in place — an in-content mutation menu validation can't reach (and not the only such path: the attachment row's ⌫/Remove shares the posture — 02's every-entry-point predicate).
 - Links: external URLs open in the browser; relative links open the target file with its default app (resolved against the card folder, like images).
-- **Edit ▸ Find (⌘F) is find-in-text here** — the standard find bar over the focused body surface (Preview's selectable text, the Edit editor, raw source); board search is a board-window concern (04-interactions.md ▸ Search).
+- **Edit ▸ Find (⌘F) is find-in-text here** — the standard find bar over the focused surface (Preview's selectable text, the Edit editor, raw source — and the comments pane, where it searches the thread's **content — every comment's body**, cross-row with wraparound, `.draft` excluded (tightened 2026-07-31: author and date lines are metadata, not find targets — a match the bar cannot highlight is worse than none); the composer and an inline comment edit are their own focused text surfaces with the editor's ordinary find). Board search is a board-window concern (04-interactions.md ▸ Search — which reaches comment bodies through its own transient index since the 2026-07-29 re-ruling, so the two finds never overlap in scope).
 
 ### Edit
 
@@ -56,13 +57,13 @@ Stacked sections under small-caps headers, in this order; quiet rows, read-optim
 ### Attachments
 
 - Shows **every top-level file of `attachments/`** — including files also embedded in the body (settled: the section is the card's complete file inventory, no reference-tracking magic; an image appearing in both places is honest, not a bug). Subfolders are tolerated but not surfaced (01-storage-format.md's attachments rules).
-- **Compact rows**: small QuickLook thumbnail (Finder-icon fallback) + middle-truncated filename, one row per file. The section header carries a quiet add affordance; empty, the section stays with a one-line hint (drop files, or File ▸ Add Attachment…, ⇧⌘A) — the drop surface remains the **whole window** (name collisions auto-rename, Finder-style — 01-storage-format.md). **Drop precedence is split by payload** (settled): file drops import as attachments anywhere in the window — Edit mode included, the text editor never intercepts a file drop; dragged *text* lands in the Edit editor at the caret within its bounds as ordinary insertion, and is inert elsewhere in the window.
+- **Compact rows**: small QuickLook thumbnail (Finder-icon fallback) + middle-truncated filename, one row per file. The section header carries a quiet add affordance; empty, the section stays with a one-line hint (drop files, or File ▸ Add Attachment…, ⇧⌘A) — the drop surface remains the **whole window** (name collisions auto-rename, Finder-style — 01-storage-format.md). **Drop precedence is split by payload** (settled): file drops import as attachments anywhere in the window — Edit mode included, the text editor never intercepts a file drop; dragged *text* lands in the Edit editor at the caret within its bounds as ordinary insertion, and is inert elsewhere in the window. **One carve-out by hover target** (ruled 2026-07-29 — comment attachments are authorable): a file dropped **within the comment composer's bounds** imports to the draft's `attachments/`, and within an **inline comment edit session's bounds** to that comment's — the window-wide card default covers everywhere else (The comments column below).
 - Row interactions: double-click or Return opens; context menu Open / Reveal in Finder / Remove (moves to the **system** Trash, never hard-deletes — 03-board-ui.md's naming constraint keeps this distinct from board deletion); rows drag out their file URL.
 - **Keyboard-native, new in the rewrite** (the pathfinder's strip was pointer-only): the section is focusable; arrows move between rows, **Space QuickLooks** the selected row, Return opens it, ⌫ removes it (same system-Trash semantics).
 
 ### Style
 
-The card-level styling home: the **embedded style editor** — background palette grid (with the leading None well) and curated symbol grid, per 03-board-ui.md ▸ Styling ▸ Controls. Card styling is discoverable here without a context menu; the same component appears in the board popover and behind Style….
+The card-level styling home: the **Background color combo** over the **curated symbol grid** (03-board-ui.md ▸ Styling ▸ Controls, its 2026-08-06 anchor-ownership rule) — the sidebar is exactly the narrow context the combo was built for, so it stands in for the well grid's background half here, panel escape hatch included; the full grid remains the surface at the other anchors. Card styling is discoverable here without a context menu; the component family is shared with the board popover and Style….
 
 ### Details — unknown frontmatter keys
 
@@ -79,23 +80,36 @@ The card-level styling home: the **embedded style editor** — background palett
 
 ### Actions (bottom)
 
-- **Delete** — tombstones the card (destructive styling; the window then dismisses itself per Deletion & lifecycle below; recoverable from the board's trash quasi-lane).
+- **Delete** — moves the card to the trash (destructive styling; the window then dismisses itself per Deletion & lifecycle below; recoverable from the board's trash lane — 03-board-ui.md).
 - **Reveal in Finder** — the card's folder.
 
+## The comments column
+
+Designed 2026-07-29 (storage: 01-storage-format.md ▸ Enhanced schema). Ships in **every tier** — only tracker sync is tier-gated (12-editions.md). Feature lands post-2.0.
+
+- **Visibility** (re-ruled 2026-07-29 — the pane obeys the user, not the content): **View ▸ Show Comments** is a checkmark toggle à la Show Trash, and its choice is **app-wide and persisted across restarts** (`UserDefaults.standard`, beside Comments Beside Body — the one-app collapse's scalars rule), and it **defaults ON** (ruled 2026-07-31): the trash's hidden-by-default bargain hides destructive residue, while the pane invites content — a new feature behind an unchecked menu item would never be discovered; one persisted uncheck opts out forever. One bit, no content-derived auto-show: checked, every card window carries the pane (a comment-less card shows the empty thread and the composer — the invitation is the point); unchecked, threads and drafts are out of sight until the user says otherwise, the Show Trash bargain. The checkmark reads the bit — the menu never lies. **File ▸ Add Comment** flips the bit on when it's off (the gesture *is* the user choosing to see comments — same persistence) and focuses the composer in one gesture (11-command-nexus.md). Deleting the last comment never closes the pane — nothing but the toggle does.
+- **The thread**: one comment = an author line (self-reported `author`, unattributed when absent; timestamp; "· edited" when `modified` differs from `created`), the rendered Markdown body (the card-body subset), and attachment chips when its `attachments/` is non-empty (Quick Look, the sidebar section's pattern). No avatars — there is no identity system, and initials faked from self-reported strings would be decoration. The section header carries the count ("Comments · 3") and the **sort-direction control**: chronological ascending by default, flippable to newest-first (app-wide, persisted).
+- **The composer edits `comments/.draft/`** (ruled 2026-07-29 — the draft is user content in the board, the `.trash` pattern applied to composition): an always-visible text area ("Add a comment…", Edit-mode Markdown highlighting) whose backing file is the card's single draft — a reserved dot-named folder under `comments/` holding ordinary comment schema, `attachments/` included, excluded from the thread listing. Restore-on-reopen falls out for free (the composer just reads its file); drafts ride git and sync across machines like any file; concurrent drafts on two machines are an ordinary file race (local-wins). **The composer sits at the thread's newest end** (bottom ascending, top descending) and the window opens scrolled to it — a thread opens where the conversation is happening. **Comment attachments author here** (ruled 2026-07-29): a file dropped within the composer's bounds imports to the draft's `attachments/` (the hover-target carve-out — Attachments above), a quiet **paperclip affordance** on the composer covers the no-drag path (the section header's add-affordance pattern; File ▸ Add Attachment… stays card-scoped), and the same pair applies within an inline comment edit session, targeting that comment's `attachments/`. Chips on an authoring surface carry remove (to the **system** Trash — the sidebar row's rule); a posted comment's chips are read-only, Quick Look only — Edit the comment to change its files.
+- **Draft saves are slow-cadence, never prompted** (flow breakage minimized): the draft writes on composer blur, window close, quit, and a lazy interval (~30 s) — not the body editor's 700 ms, so a Pro user's typing never becomes a commit stream; the saves that do land compose the quiet path-shaped **"Draft comment on '⟨card⟩'"**. Close and quit just proceed — no DirtyBufferGuard on the ordinary path, nothing to lose while saves land. **The failure path gets the guard** (re-ruled 2026-07-31, narrowing "nothing to lose" to its true premise): a close-time draft flush that *fails* with typed text in the buffer raises the DirtyBufferGuard modal (retry / save a copy / discard) exactly as the body's does — the buffer is then the only home the text has, 02-architecture.md's one-modal-moment class; ordinary closes stay ceremony-free since the guard only ever fires on a failed write. A draft emptied of text with no attachments deletes its folder — no litter. **Escape moves focus out of the composer, draft untouched** (ruled 2026-07-29 — Escape never discards: the draft is a durable file, so "abandon" has no meaning here; emptying the draft is the discard gesture, and the title field's abandon-Escape stays the transient-bubble exception).
+- **⌘↩ posts** (a Comment button twins it): posting renames `.draft` → a fresh lowercase UUID and **restamps `created`/`modified`** in the same write bracket — chronology is when it was posted, not when drafting began — one gesture, one commit ("Comment on '⟨card⟩'" — 06-history-undo.md's verb family per 01).
+- **Edit and delete**: every comment is editable and deletable — files-first has no enforced identity. The comment's context menu (the per-item inventory — 10-accessibility.md) carries **Edit / Delete / Reveal in Finder**. Inline Edit is a **body-edit session in miniature** (no second draft mechanism): debounced saves to the comment's own file keep it crash-safe, Save (or ⌘↩) ends the session as its commit point, Cancel — or Escape, its keyboard twin (ruled 2026-07-29; 11's grammar table) — reverts to session-start bytes, window close flushes the session exactly as the body's does. Delete is immediate and undoable, no confirm (01's ruling — undo is the net: the comment moves into `comments/.trash/`, undo is the move back on the **window's own stack**; after close, board-level undo of the session restores it, and the folder purges only when undo no longer needs it — 13-native-undo.md's session-coarsening model, re-ruled 2026-07-31).
+- **Live updates**: the pane reloads its thread from the same FSEvents stream (01's window-scoped rule — the board snapshot never loads comment content); foreign arrivals snap in per the motion language, and the announcer speaks them path-shaped ("New comment on '⟨card⟩'" — 10-accessibility.md).
+- **Raw Source still swaps the entire content area** — all panes, comments included; the raw outlet's rule is unchanged.
+
 ## Window
 
-- **The subtitle shows the card's place**: "⟨board⟩ › ⟨lane⟩" under the window title, live-updating as the card moves (the window follows its card).
+- **The subtitle shows the card's place**: "⟨board⟩ › ⟨lane⟩" under the window title, live-updating as the card moves (the window follows its card). **Hidden with the title, and the loss is blessed** (ruled 2026-08-06): the no-title titlebar (Toolbar below — `titleVisibility = .hidden`) collapses AppKit's title and subtitle as one field, so the pair hides together; the window is usually beside its board, and `window.title`/`window.subtitle` keep feeding the Window menu, Exposé, VoiceOver, and restoration, so only the visual rendering is lost. The computation and live-update wiring stand untouched — if a visible placement surface is ever wanted (a details-sidebar placement row is the named candidate), it is a surface away, not a rewiring; deliberately not built now.
 - New windows open at the last-used card-window size, cascaded; frames restore per card across relaunch where state restoration allows.
 - **Toolbar (settled — 03-board-ui.md ▸ Toolbar)**: default set Edit Body (single toggle, on-state in Edit) · Raw Source (toggle; while active, Edit Body disables) · Add Attachment; user-customizable like the board window's.
 
 ## Deletion & lifecycle
 
 - The window follows its card across lanes (keyed by board URL + GUID) — *within its board*. A **cross-board move dismisses the window like a delete**: the card left this board — its UUID travels with the move (reminted only on an import-boundary collision, 01-storage-format.md's identity lifecycle), but the window's key is board URL + GUID, and the board half no longer names it.
-- Window dismisses itself if the card is deleted — and a **tombstone counts as deleted**: ⌫ on the board closes the card's open window (the card is gone from the board's perspective; Put Back and reopen if it was a slip). **Liveness is effective — ancestor-walked** (settled; 02-architecture.md's rule extended to its last consumer): tombstoning or deleting the card's *lane* dismisses the window too, the card's own flag notwithstanding — the card renders nowhere and the trash shows only the lane's single subsuming entry, so no window may stay open, much less writable, over it. Put Back of the lane reopens nothing — reopening is the user's act, like any open. **Dismissal never eats typed work silently where a save can land** (settled): a dirty Edit buffer flushes into the tombstoned card's folder before the window dismisses — a surgical body write that leaves `deleted:` intact, so the keystrokes survive Put Back and enter history on git boards (the composer reads it as an edit to a deleted card — accurate). An open raw-source buffer discards instead: its Apply writes the *whole* pre-tombstone `index.md` and would silently undelete the card — a foreign delete is never reverted by a stale buffer. A card hard-deleted externally (folder gone) discards both — nowhere left to write, the inline-rename rule. Cards in the shown trash quasi-lane don't open at all — restore first (03-board-ui.md). Reopening a live card focuses the existing window.
+- Window dismisses itself if the card is deleted — and **entering the trash counts as deleted** (resettled 2026-07-28, the materialized trash): ⌫ on the board closes the card's open window (the card left the working set; restore and reopen if it was a slip), an external move into `.trash/` observed by reload does the same, and deleting the card's *lane* deletes the card with it — the window dismisses because the card is gone. Restoring reopens nothing — reopening is the user's act, like any open. **Dismissal never eats typed work silently where a save can land** (settled): a dirty Edit buffer flushes into the card's folder at its new `.trash/` location before the window dismisses — a surgical body write, so the keystrokes survive a later restore and enter history on git boards (the composer reads it as an edit to a trashed card — accurate). An open raw-source buffer discards instead: its Apply would write a whole stale `index.md` over the trashed card — a delete is never fought by a stale buffer. A card whose lane was deleted discards both — nowhere left to write. A card hard-deleted externally (folder gone) discards both — nowhere left to write, the inline-rename rule. Cards in the shown trash lane don't open at all — restore first (03-board-ui.md). Reopening a live card focuses the existing window.
 
 ## Changes from Kanban
 
-- **Two-column composition** replaces the pathfinder's vertical title/strip/body stack: body column (title atop it, created/modified line beneath) plus a full-height attributes sidebar.
+- **Three componentized panes** replace the pathfinder's vertical title/strip/body stack: the body pane (title atop it, created/modified line beneath), the comments pane (when shown — the 2026-07-29 re-composition), and a full-height attributes sidebar.
 - **The sidebar revives the dropped readouts**: created/modified return under the title; unknown frontmatter keys get the read-only Details section (the pathfinder's inspector casualties, rehomed).
 - **Empty body opens in Edit**; Return in Preview enters Edit; Escape returns to Preview (the pathfinder always opened in Preview, toggle-only).
 - **Live task-list checkboxes in Preview** — the pathfinder's preview was fully inert.

DESIGN/06-history-undo.md

@@ -1,83 +1,86 @@
 # History & Undo
 
-**Edition scope: Lanework Pro** (12-editions.md). This doc is the git HistoryProvider; base Lanework ships mode:none only, with macOS-native undo (13-native-undo.md) and the inert-`.git` posture (12). The Undo routing section below is edition-independent — both substrates dispatch through it.
+**Tier scope: every tier** (Pivot 2026-08-07 — 12-editions.md: git left the paywall; this line formerly scoped the doc to Lanework Pro, with the free tier shipping mode:none only over the now-retired inert-`.git` posture). This doc is the git HistoryProvider, composed on git-mode boards in every tier; boards without app-managed git bind macOS-native undo (13-native-undo.md). The Undo routing section below was always tier-independent — both substrates dispatch through it.
 
-Git is the undo substrate — on boards that have git. **Git is opt-in per board (a pivot from the pathfinder, which auto-initialized every board): a board may be created without git, and git can be added later** (via the board popover; see 07-sync-collab.md's mode progression). A board without git has **no undo/redo** (board history, that is — text editors keep their standard typing undo everywhere; see Undo routing below) — consistent with the settled no-undo stance for repo-nested boards; deletes are the exception, recoverable on every board via the tombstone trash (03-board-ui.md). On git-enabled boards, every settled change auto-commits; those mechanics are carried over from the pathfinder with their hard rules intact.
+Git is the undo substrate — on boards that have git. **Git is opt-in per board (a pivot from the pathfinder, which auto-initialized every board): a board may be created without git, and git can be added later** (via the board popover's Git tab — 03-board-ui.md; see 07-sync-collab.md's mode progression). A board without app-managed git binds the **native undo stack in every tier** — repo-nested included (re-ruled 2026-07-31, twice — the provider follows the board, 13-native-undo.md; formerly no-undo under Pro, which made upgrading remove undo from mode-none boards, and the repo-nested no-undo residue retired the same day: the native stack touches no git, so leave-strictly-alone is untouched and no board lacks ⌘Z). (Text editors keep their standard typing undo everywhere; see Undo routing below.) Deletes — card or lane — are recoverable on every board via the materialized trash (03-board-ui.md). Add-git swaps native → git mid-session, discarding the in-session native stack and seeding the git trail — the branch-switch discard-and-reseed precedent. On git-enabled boards, every settled change auto-commits; those mechanics are carried over from the pathfinder with their hard rules intact.
 
 ## Rules
 
-- **Opt-in init**: adding git to a board initializes a local repo at the board root. Bundled libgit2 — no git install required. No silent auto-init, ever.
+- **Opt-in init**: adding git to a board initializes a local repo at the board root. Bundled libgit2 — no git install required. No silent auto-init, ever. **The initial branch is `main`** (blessed 2026-07-31): the host's `init.defaultBranch` lives in config layers the sandbox can't read, so add-git sets it deterministically — git's modern default, the pathfinder's choice.
 - **Adoption**: a board whose root already contains `.git` opens **in git mode, silently** — adoption is not init. The no-silent-auto-init rule forbids *creating* a repository the user didn't ask for; recognizing one that exists is the opposite of that: the repo's presence *is* the opt-in (someone ran `git init` or `git clone`), and this is the primary way a second machine joins a shared board — clone in a terminal, open in the app (07-sync-collab.md's second entry arrow). All git-mode behavior applies from the first open: auto-commit, undo reseeded from the existing HEAD's first-parent ancestry, remote tracking if a remote is configured.
-- **Detection is nearest-`.git`-wins**, checked at every board open: `.git` at the board root → git mode (adoption above); no `.git` at the root but one at any ancestor → repo-nested (below); neither → mode none. A board can therefore change mode between opens (e.g. the user ran `git init` in a terminal) — the app just reflects what it finds. **Open-time only, deliberately — for *discovery***: a `git init` under an open mode-none board takes effect at the next open — the running session keeps its mode, and the watcher does not scan for `.git` appearing (no mid-session mode flips from watching; stated here so it isn't rediscovered as a bug). The one deliberate mid-session transition is the app's own **add-git** (Opt-in init above): clicking it flips the open board into git mode immediately — the popover flows straight into the git controls, the first auto-commit follows — the rule forbids *discovered* flips, never commanded ones.
-- **Abnormal repo states** (settled; adoption never assumes a tidy clone): an **unborn HEAD** (`git init`, no commits yet) is normal git mode — the first auto-commit creates the root commit on the branch HEAD names, and the undo trail simply starts empty. **The root commit has its own subject** (settled): whenever the app creates a repo's first commit — immediately on the app's own add-git (init doesn't wait for the debounce; the board is protected from the moment git exists), or at the first settled change on an adopted unborn repo — it commits the whole tree as **"Initial board state"**, never a folded diff-from-empty: there is no last-committed snapshot to diff against, and forty Adds would bury the event. A **detached HEAD**, or an **in-progress merge/rebase/cherry-pick** left by outside-the-app git (`MERGE_HEAD`, `rebase-merge`/`rebase-apply`, `CHERRY_PICK_HEAD` — pause states that load fine on a clean tree and are otherwise invisible), instead **pauses the git surface honestly — the *whole* surface, remote half included** (settled): auto-commit holds (the auth-pause posture, 07-sync-collab.md — pause, badge, explain, never hammer), Undo/Redo and the branch controls disable, **and Pull, Push, and push-on-commit hold with them** — with auto-commit held, 07's clean-tree-by-pull-time invariant is false, and a pull's rebase (or a rejected push's fetch→rebase→push) would run against a dirty tree carrying uncommitted edits, precisely what flush-before-overwrite exists to prevent; the ahead/behind badge keeps counting (a fetch is a read), and the popover's git section names the state plainly ("HEAD is detached — commits would belong to no branch"; "a merge is in progress") and says resolving it belongs to the tool that created it. Edits keep landing on disk — files are the board — and commit as one settled batch when the state clears. The app **never mutates repo state it didn't create** (no auto branch-at-HEAD, no `merge --abort`); the check runs at open and again before every flush, so finishing the operation in a terminal resumes the pipeline without ceremony. **The one exemption is the app's own leftovers** (settled): every bracketed operation stamps its intent app-side (per-board registry) before touching the repo, so an interrupted app-run rebase or checkout is recognizable as Lanework's — finding a pause state with a matching stamp, the app **aborts its own unfinished operation** to restore the pre-operation state and says so via banner ("a branch switch was interrupted — the previous state is restored"), then clears the stamp. Abort discards nothing: fetched commits stay fetched, local commits are restored — the rebase's own no-loss accounting. Without a matching stamp the leftover is outside git's, and the pause-and-defer stance above holds unchanged.
-- **Boards nested inside an existing repository are left strictly alone** — git cannot be added to them (no nested repo, no commits into the user's repo), so they get **no undo** (settled; no app-managed undo journal, which would violate self-containment). The board popover's git section must say so honestly: not a hidden "add git" but a short explanation ("this board lives inside a repository; Lanework leaves it to that repository") — the option is absent because it *can't* apply, and the UI should teach that rather than look broken.
-- **Auto-commit**: every settled change (debounced past drag/typing churn) commits with a descriptive message ("Move card 'Fix login' to Doing"). Board undo sees **Edit sessions, not save ticks** (resettled from typing-settle granularity): the body editor's ~700 ms disk saves (05-card-window.md) keep the file crash-safe throughout a session but stay **uncommitted** — the body commit lands when the session ends, the **Edit→Preview flip being the effective Save button** (raw-source entry and window close end the session too). The committer **stages around open Edit sessions**: a board change committing mid-session excludes the session card's folder from staging, so a lane move never sweeps half-typed body text into its commit. Settled-tree events that cannot wait — a pull's flush-before-overwrite — commit the session's on-disk saves as-is (a mechanical exception; 07-sync-collab.md's same-card signpost covers the visible half); branch switch instead gates on explicit save-or-discard (Branch switching below). The cadence constraint below demands batching at least this coarse. **Board-window close and app quit flush the pipeline** — any pending editor save (05-card-window.md), then the pending auto-commit — before teardown; nothing settled is ever left unsaved or uncommitted by closing.
-- **Flush-before-overwrite**: before an app write overwrites on-disk state that differs from the last-loaded snapshot (an uncommitted external change — e.g. an agent's body rewrite racing the card editor's debounced save, 05-card-window.md), the pending auto-commit is flushed so the external version enters history first. "Both versions exist as commits" is thereby a guarantee, not a likelihood. The same flush settles the tree before a pull runs (07-sync-collab.md).
+- **Detection is nearest-`.git`-wins**, checked at every board open: `.git` at the board root → git mode (adoption above); no `.git` at the root but one at any ancestor → repo-nested (below); neither → mode none. **Denial is not absence** (ruled 2026-07-31): the ancestor walk crosses paths above the board's sandbox grant, and a check the sandbox *refuses* (EACCES/EPERM) must never read as "no repo there" — detection distinguishes **clean none** (every ancestor answered not-found) from **unverifiable** (a check was denied); add-git is offered only on clean none, and unverifiable takes the repo-nested posture (conservative — the popover explains rather than offers). As hardening, add-git's create re-runs full detection and refuses unless it reads clean none, so the forbidden nested init is impossible even on a raced or stale read. Whether the shipped sandbox actually denies ancestor stats is an open empirical question (manual-verification list: a board deep inside an ungranted repo, and an ordinary board under an ungranted parent) — if it denies everywhere, every board would read unverifiable and this posture needs a data-informed revisit. A board can therefore change mode between opens (e.g. the user ran `git init` in a terminal) — the app just reflects what it finds. **Open-time only, deliberately — for *discovery***: a `git init` under an open mode-none board takes effect at the next open — the running session keeps its mode, and the watcher does not scan for `.git` appearing (no mid-session mode flips from watching; stated here so it isn't rediscovered as a bug). The one deliberate mid-session transition is the app's own **add-git** (Opt-in init above): clicking it flips the open board into git mode immediately — the tab flows straight from the add-git offer into the git-mode posture, the first auto-commit follows — the rule forbids *discovered* flips, never commanded ones.
+- **A `.git` that isn't a valid repository still reads as git mode — and fails loudly** (ruled 2026-07-31): detection is presence-shaped (any root `.git` entry, directory or worktree/submodule pointer file), so a corrupt or unopenable repo never falls to mode none — Add Git is never offered against an existing `.git`, whatever its condition (init into a repairable repo is exactly the never-mutate hazard). The board itself loads and edits normally — files are the board — but the failure is **loud**: a standing breakage-class banner at detection ("This board's git repository can't be read — history is paused; Lanework leaves the repository untouched"), announced per 10-accessibility.md, with the whole git surface paused (the abnormal-states posture below) and the popover's git section naming the state; the banner clears when a later open or reload finds the repo readable. Never a silent placeholder discovered only in the popover.
+- **Abnormal repo states** (settled; adoption never assumes a tidy clone): an **unborn HEAD** (`git init`, no commits yet) is normal git mode — the first auto-commit creates the root commit on the branch HEAD names, and the undo trail simply starts empty. **The root commit has its own subject** (settled): whenever the app creates a repo's first commit — immediately on the app's own add-git (init doesn't wait for the debounce; the board is protected from the moment git exists), or at the first settled change on an adopted unborn repo — it commits the whole tree as **"Initial board state"**, never a folded diff-from-empty: there is no last-committed snapshot to diff against, and forty Adds would bury the event. **The root commit is never split and is user-authored** (blessed 2026-07-31): it is a baseline, not a change-set — the event it records is the user's act of putting the board under git, adopted unborn repos' unwitnessed files included. A **detached HEAD**, or an **in-progress merge/rebase/cherry-pick** left by outside-the-app git (`MERGE_HEAD`, `rebase-merge`/`rebase-apply`, `CHERRY_PICK_HEAD` — pause states that load fine on a clean tree and are otherwise invisible), instead **pauses the git surface honestly — the *whole* surface, remote half included** (settled): auto-commit holds (the auth-pause posture, 07-sync-collab.md — pause, badge, explain, never hammer), Undo/Redo and the branch controls disable, **and Pull, Push, and push-on-commit hold with them** — with auto-commit held, 07's clean-tree-by-pull-time invariant is false, and a pull's rebase (or a rejected push's fetch→rebase→push) would run against a dirty tree carrying uncommitted edits, precisely what flush-before-overwrite exists to prevent; the ahead/behind badge keeps counting (a fetch is a read), and the popover's git section names the state plainly ("HEAD is detached — commits would belong to no branch"; "a merge is in progress") and says resolving it belongs to the tool that created it. Edits keep landing on disk — files are the board — and commit as one settled batch when the state clears. The app **never mutates repo state it didn't create** (no auto branch-at-HEAD, no `merge --abort`); the check runs at open and again before every flush — and, because a terminal's cleanup moves only files under `.git`, which the watcher never delivers, **a standing pause re-reads the repository state every 15 s** (blessed 2026-07-31; injectable cadence, only while paused, a handful of stats — not a retry, nothing is attempted) — so finishing the operation in a terminal resumes the pipeline without ceremony. **The one exemption is the app's own leftovers** (settled): every bracketed operation stamps its intent app-side (per-board registry) before touching the repo, so an interrupted app-run rebase or checkout is recognizable as Lanework's — finding a pause state with a matching stamp, the app **aborts its own unfinished operation** to restore the pre-operation state and says so via banner ("a branch switch was interrupted — the previous state is restored"), then clears the stamp — **on success only; a failed abort keeps the stamp** (blessed 2026-07-31): the stamp is the sole evidence the leftover is the app's, and clearing it on failure would demote the leftover to somebody-else's forever — the pause would then send the user to "the tool that created it," which was this app. Kept, the next open or paused-state re-read recognizes it and retries; recovery converges instead of orphaning. Abort discards nothing: fetched commits stay fetched, local commits are restored — the rebase's own no-loss accounting. Without a matching stamp the leftover is outside git's, and the pause-and-defer stance above holds unchanged.
+- **Boards nested inside an existing repository are left strictly alone** — git cannot be added to them (no nested repo, no commits into the user's repo), so they get **no app-managed history — while the native session stack still serves ⌘Z there in every tier** (re-ruled 2026-07-31, retiring the old no-undo residue: 13's stack is memory-only and journal-free, so self-containment holds; what repo-nested denies is git, never undo). The board popover's git section must say so honestly: not a hidden "add git" but a short explanation ("this board lives inside a repository; Lanework leaves it to that repository") — the option is absent because it *can't* apply, and the UI should teach that rather than look broken.
+- **Auto-commit**: every settled change (debounced past drag/typing churn) commits with a descriptive message ("Move card 'Fix login' to Doing"). Board history sees **card-window sessions, not gestures** (re-ruled 2026-07-31, widening the Edit-sessions-not-save-ticks rule — 13-native-undo.md's session-coarsening model, applied to the commit substrate): while a card's window is open, everything happening inside it — the body editor's ~700 ms crash-safe disk saves, comment posts and deletes, draft-save cadence, sidebar changes — stays **uncommitted**, and the committer **stages around the whole open card folder** (the former Edit-session stage-around, widened; comments included); **window close flushes the session as one commit** ("Update card 'Fix login'"-shaped, the composer folding the card-scoped diff, body bullets carrying the events) — granular window activity never litters history. **The flush awaits the snapshot that covers it** (ruled 2026-07-31): the composer diffs `store.snapshot` against HEAD, so the close flush awaits a snapshot generation covering its changed paths before the committer runs — the commit's subject can never be outrun by its own reload; the cadence margin (2 s debounce vs 200 ms watcher) is the practical cushion, never the guarantee (the awaiting-bracket machinery is the shape). **The await's baseline is the bracket close, not the walk's start** (blessed 2026-08-06): a reload already in flight when the bracket closes clears the gate without a started-after guarantee — only the store knows when a walk began, and the committer deliberately does not ask. The racer window is academic under the cadence margin, the post-bracket reload is scheduled unconditionally either way, and the deadline already accepts composing from a near-covering snapshot when the watcher is broken — the tree, not the snapshot, is what gets staged, so the exposure was always the message's precision, never the commit's content. Walk-start bookkeeping (the store exposing when a walk began) is the named escalation if the window ever stops being academic. **A commit's comment bullets sort chronologically** (blessed 2026-07-31): by the comments' own `created`, folder name on ties — event order reads as the conversation did, never UUID-arbitrary. The EchoLedger's two-commit split still applies at close when the held window mixes foreign changes to that card with the app's own. Settled-tree events that cannot wait — a pull's flush-before-overwrite — commit the session's on-disk state as-is (a mechanical exception; 07-sync-collab.md's same-card signpost covers the visible half); branch switch instead gates on explicit save-or-discard (Branch switching below). The cadence constraint below demands batching at least this coarse. **Board-window close and app quit flush the pipeline** — any pending editor save (05-card-window.md), then open card-window sessions, then the pending auto-commit — before teardown; nothing settled is ever left unsaved or uncommitted by closing.
+- **Flush-before-overwrite**: before an app write overwrites on-disk state that differs from the last-loaded snapshot (an uncommitted external change — e.g. an agent's body rewrite racing the card editor's debounced save, 05-card-window.md), the pending auto-commit is flushed so the external version enters history first. "Both versions exist as commits" is thereby a guarantee, not a likelihood — **as strong as the watcher's knowledge** (bounded, blessed 2026-07-31): the gate fires on *known* foreign changes, learned from landed reloads, so a foreign write still inside the watcher debounce can be overwritten unflushed; the window is the debounce (~200 ms), the disk-level outcome inside it is 05's last-writer-wins — the same ruling at history granularity — and `index.md` writes compose over fresh disk bytes anyway, so wholesale loss needs a body-save or raw-Apply race. A **failed reload counts as a foreign change** (can't know, so protect). A pre-write disk compare was weighed and declined — a read per write to buy back the debounce corner. **The flush commits synchronously on the main actor** (blessed 2026-07-31): the write path it must precede is synchronous, so the ordering guarantee can only be kept by a synchronous commit — 02's hang-avoidance doctrine and this guarantee genuinely conflict here, and the guarantee wins, being rare (the known-foreign window only), bounded (one stage-and-commit plus the composer's HEAD-tree materialization — a few board-sized walks, accepted so exactly the commit that preserves somebody else's version keeps its full semantic subject), and load-bearing (the alternative loses a version no commit protects). One attempt, no lock backoff on this path — a held `index.lock` falls through to the next quiet debounce. The same flush settles the tree before a pull runs (07-sync-collab.md).
 - **Cadence constraint** (agreed): the auto-commit cadence must not make the history of a remote-shared board unbearable — one commit per drag is fine for a local undo trail but noisy as a shared log. The debounce/batching design here must serve both consumers; the push/pull side is settled in 07-sync-collab.md (optional push-on-commit, automatic fetch-rebase-push on rejected pushes).
 - **Undo never rewrites history.** Undo (⌘Z) and redo (⇧⌘Z) restore earlier states as **new forward commits** — never reset, never force. The whole trail stays inspectable in any git client. The one deliberate rewrite anywhere in the app is pull's rebase of **unpushed local** commits (07-sync-collab.md); published history is never touched.
 - **Undo restore vs open Edit sessions** (settled): a restore materializes only the diff between the current tree and the target state, so a card whose open Edit session the diff doesn't touch is simply unaffected — its uncommitted ~700 ms saves and the stage-around rule continue undisturbed, and most undos never meet an editor at all. When the diff *does* touch a session card, the restore **gates on the branch-switch save-or-discard step** (Branch switching below — Save All / Discard / Cancel, same machinery, same rationale): silently flushing would commit a tree the user deliberately hasn't saved, a checkout over uncommitted on-disk saves would destroy text no commit protects (the one place "both versions exist as commits" could otherwise fail), and a surviving dirty buffer's next debounced save would write pre-undo text over the restored card — a ⌘Z that visibly doesn't happen. With sessions settled the restore runs on a settled tree. Redo is symmetric. Open raw-source buffers get the branch-switch settle treatment too (Branch switching below).
-- **The stack is HEAD's first-parent ancestry, live** (settled): foreign commits — watcher-auto-committed agent work and agents' *self*-commits alike — push onto the in-session undo stack as ordinary steps as they land. The stack re-syncs its top to HEAD before every undo/redo (self-commits move HEAD outside the app's committer; the pre-flight sync is how the stack learns), so ⌘Z always steps back exactly **one** commit — it can never silently revert twenty minutes of agent work landed since the user's last operation. Any commit arriving from anywhere clears the redo stack (classic behavior; redo also starts empty on the relaunch reseed below). In-session and post-relaunch behavior are thereby one rule — the reseed is the same ancestry walk from scratch.
+- **The stack is HEAD's first-parent ancestry, live** (settled): foreign commits — watcher-auto-committed agent work and agents' *self*-commits alike — push onto the in-session undo stack as ordinary steps as they land. The stack re-syncs its top to HEAD before every undo/redo (self-commits move HEAD outside the app's committer; the pre-flight sync is how the stack learns), so ⌘Z always steps back exactly **one** commit — it can never silently revert twenty minutes of agent work landed since the user's last operation. Any commit arriving from anywhere clears the redo stack (classic behavior; redo also starts empty on the relaunch reseed below) — **except a heal-only window** (blessed 2026-07-31): heal transparency (below) makes heal commits invisible to the stack, and a heal-only clear would half-defeat it — the trap would dissolve for undo while redo still died on every landed repair; a window mixing a heal with real changes clears via the real changes. In-session and post-relaunch behavior are thereby one rule — the reseed is the same ancestry walk from scratch. **The root commit is the stack's floor, not a step** (settled 2026-07-31): it is a baseline, not a change-set (Abnormal repo states above), and it has no parent — crossing it could only mean restoring the empty tree, every file on the board deleted by one ⌘Z. The stack stops above it: undo bottoms out at the initial board state, and the reseed walk stops in the same place.
 - **Undo survives relaunch**: the undo stack reseeds from HEAD's first-parent ancestry on load; redo starts empty. In-session it behaves as classic dual stacks; after relaunch, past restore commits reappear as ordinary undoable steps. Deliberate: no sidecar state, nothing ever lost. Interaction with pull (07-sync-collab.md): a pull rebases unpushed local commits, so the in-session stack must remap onto the rewritten commits — the pre-rebase hashes are orphaned. A pleasant consequence of the reseed rule: the fetched remote commits sit in HEAD's first-parent ancestry, so after the next relaunch remote work becomes ordinary undoable steps too.
+- **Heal commits are transparent to undo, in-session** (ruled 2026-07-29): heal-class commits — their paths known by the Writer's heal-marked receipts (Commit messages below) — never become undo steps: the stack pointer passes over them, and a restore materializing an older target **excludes paths whose divergence is heal work**, so a ⌘Z run never reverts a repair and never summons the scheduler (reverting one would re-arm the memo on the recreated defect signature, land a fresh heal commit, and — redo cleared — trap the run on an ever-renewing top; transparency dissolves the trap instead of suppressing the healer). The in-session qualifier is honest: receipts live in memory and the reseed is deliberately sidecar-free, so after relaunch old heal commits reappear as ordinary steps — undoing one recreates its defect and the scheduler re-heals within a reload, restore commit plus fresh heal commit, notice included. That **residual bounce is accepted family-wide** — the agent-guide quirk (Agent collaboration below) generalized to the relocation, the legacy migration, the displacement, and the remint — and it is **self-limiting to one bounce**: the fresh heal commit is in-session, transparent, and the undo run continues past it. Redo is symmetric.
 - **Undo is board-local.** A cross-board move-out undone at the source resurrects the card even though it lives on in the destination — per-board histories cannot and must not mutate other boards. The resulting same-UUID fork across boards is legitimate (boards are independent identity namespaces); if the two ever meet through a move-in, the import boundary remints the arrival (01-storage-format.md's identity lifecycle).
-- The git surface lives in the **board popover** (03-board-ui.md): branch/source display, branch switching and creation, and the commit-identity name/email fields (see Interaction with external writers below) — alongside board rename and styling.
+- The git surface is the **board popover's Git tab**, whole (03-board-ui.md): branch/source display, the switch picker with its New Branch… reveal, the posture lines, add-git, and the commit-identity name/email fields (see Interaction with external writers below), alongside board rename and styling in the popover's other tabs. *(Amended 2026-08-07 — the 2026-07-31 popover/sheet split is reversed: setup lived in a board settings sheet for a week, and that surface retired with its menu command; 03 ▸ Board settings sheet carries the reasoning. Remote and credentials — 07 — need a home ruled on that card.)*
 
 ## Undo routing
 
-**Routing is by focus** — the platform's first-responder rule, its own section because two undo systems coexist and four docs cite the rule. While a text-editing surface is focused (card title field, body Edit mode, raw source, board inline rename), ⌘Z/⇧⌘Z are that editor's own **text undo** — standard, transient, session-scoped: leaving the editor (mode flip, focus loss, close) ends the session, and from then on that content's undo story is the git trail. Text undo works on **every** board — no-git and repo-nested included; "no undo/redo" above means board history, not typing. **Control-class text fields route the same way** (settled): the search field (04-interactions.md ▸ Search) and the popover's text fields (board rename, commit identity, credentials) own ⌘Z/⇧⌘Z as field-local text undo while focused — "board menu commands stay enabled" never hands Edit ▸ Undo to git while a text-bearing control has focus; a reflexive undo over a typo must never become a tree checkout. With focus outside every text-bearing surface — editor or control — Edit ▸ Undo/Redo are git undo (and are disabled on boards without it). **No fall-through**: exhausting a focused editor's stack beeps; it never reaches board history.
+**Routing is by focus** — the platform's first-responder rule, its own section because two undo systems coexist and four docs cite the rule. While a text-editing surface is focused (card title field, body Edit mode, raw source, board inline rename), ⌘Z/⇧⌘Z are that editor's own **text undo** — standard, transient, session-scoped: leaving the editor (mode flip, focus loss, close) ends the session, and from then on that content's undo story is the git trail. Text undo works on **every** board — and since the 2026-07-31 repo-nested re-ruling, so does board-level undo: every board binds a provider (native or git), so "no undo" is no longer a state any board is in. **Control-class text fields route the same way** (settled): the search field (04-interactions.md ▸ Search), the popover's rename field, and the popover's own configuration fields (commit identity, the New Branch… name, and 07's credentials and remote URL when they land) own ⌘Z/⇧⌘Z as field-local text undo while focused — "board menu commands stay enabled" never hands Edit ▸ Undo to git while a text-bearing control has focus; a reflexive undo over a typo must never become a tree checkout. With focus outside every text-bearing surface — editor or control — Edit ▸ Undo/Redo are, **in a card window, that window's own session stack** (13-native-undo.md's two-level model, re-ruled 2026-07-31 — fine-grained window gestures, both tiers; the coarse close unit is the tier-split: one native board step, or one commit), and on board surfaces board history — the board's bound provider, git or native (every board binds one since 2026-07-31; disabling is locks and empty stacks). **No fall-through**: exhausting a focused editor's — or the window's — stack beeps; it never reaches board history.
 
 ## Commit messages
 
 The pathfinder's message engine carries over as the model — it is what earns the "semantic" in semantic commit messages, and it stays a pure, testable function:
 
-- **Pure snapshot diff, no write-site tagging.** Messages compose at commit time from a structural diff of two board snapshots (last-committed vs. current) — never by intercepting operations. Items match by id across the *whole* board, so a lane change is distinguishable from delete+add and a cross-lane move reads as a move. Bookkeeping — `order` changes that preserve sibling sequence (a renumber's rescale — 01-storage-format.md), `modified`/`created` — produces no events: a diff touching only those composes nothing. Sequence is what the diff compares, not raw `order` values: an order change that *repositions* an item among its siblings composes Reorder, so a foreign writer's single-file reorder still reads as one. A midpoint-exhaustion renumber batches with the insert or move that triggered it, so its commit reads as that event.
-- **Vocabulary**: Add / Delete / Move / Rename / Edit / Restyle / Resize / Reorder over cards, lanes, and the board, plus Attach / Remove for attachment files ("Move card 'Fix login' to Doing", "Rename lane 'Todo' → 'Doing'"), plus **Repair** for the duplicate-id remint ("Repair duplicate of 'Fix login'" — 01-storage-format.md's banner-gated fix; app-mediated, so the composer names it directly instead of reading the folder swap as Permanently delete + Add), plus the trash pair (settled) — **Restore** and **Permanently delete** — distinguished by diff shape alone, keeping the composer a pure snapshot diff: `deleted:` appearing is Delete (the tombstone), `deleted:` *clearing* is Restore ("Restore card 'X'" — Put Back, drag-to-restore), and an item *leaving the tree entirely* is Permanently delete ("Permanently delete card 'X'" — Delete Immediately, Empty Trash, and any foreign hard removal, which the shape rule catches and describes accurately for free). The trail thereby tells moved-to-trash from gone-forever — the distinction Deleting never forgets (below) asks users to learn. Plural folding applies as usual: Empty Trash reads "Permanently delete 12 cards", cleanly distinct from a multi-select ⌫'s "Delete 12 cards". One commit per debounce window: a single event is the subject (with a detail body where one helps); several events of one kind fold into a plural subject, with shared destinations preserved ("Move 3 cards to Done"); genuinely mixed windows fall back to "Update board" — always with a bulleted body naming every event, so the oneline log stays scannable and the full message stays complete.
-- **Implied events don't steal the subject**: deleting a lane with five cards reads "Delete lane 'X'" with the card deletions as body bullets — not "Update board".
+- **Pure snapshot diff, no write-site tagging.** Messages compose at commit time from a structural diff of two board snapshots (last-committed vs. current) — never by intercepting operations. Items match by id across the *whole* board, so a lane change is distinguishable from delete+add and a cross-lane move reads as a move. Bookkeeping — `order` changes that preserve sibling sequence (a renumber's rescale — 01-storage-format.md), `modified`/`created`, and an on-touch heal's backfilled `kind` (01-storage-format.md ▸ Validation and healing) — produces no events: a diff touching only those composes nothing. Sequence is what the diff compares, not raw `order` values: an order change that *repositions* an item among its siblings composes Reorder, so a foreign writer's single-file reorder still reads as one. A midpoint-exhaustion renumber batches with the insert or move that triggered it, so its commit reads as that event.
+- **Vocabulary**: Add / Delete / Move / Rename / Edit / Restyle / Resize / Reorder over cards, lanes, and the board, plus Attach / Remove / **Replace** for attachment files ("Move card 'Fix login' to Doing", "Rename lane 'Todo' → 'Doing'"; Replace added 2026-07-31 — a changed file under a card's `attachments/` with an unchanged listing is a content replacement, named from the path alone: "Replace attachment 'photo.png' — card 'X'", never the anonymous path generic), plus **Repair** for the duplicate-id remint ("Repair duplicate of 'Fix login'" — 01-storage-format.md's silent scheduled heal, re-ruled 2026-07-29 from its former banner gate; app-mediated and heal-marked, so its separate heal commit names the remint directly instead of reading the folder swap as Permanently delete + Add), plus the trash pair (settled) — **Restore** and **Permanently delete** — distinguished by diff shape alone, keeping the composer a pure snapshot diff: a move into `.trash/` is Delete, a move out of it is Restore ("Restore card 'X'" — drag-to-restore, cut+paste), and an item *leaving the tree entirely* is Permanently delete ("Permanently delete card 'X'" — the trash's Delete, Empty Trash, and any foreign hard removal, which the shape rule catches and describes accurately for free); the inverse oddity — a card *arriving from outside the tree directly in `.trash/`* — composes "Add card 'X'" with a to-the-trash detail (blessed 2026-07-31: the arrival shape is an Add, the detail names the destination). The trail thereby tells moved-to-trash from gone-forever — the distinction Deleting never forgets (below) asks users to learn. Plural folding applies as usual: Empty Trash reads "Permanently delete 12 cards", cleanly distinct from a multi-select ⌫'s "Delete 12 cards". One commit per debounce window: a single event is the subject (with a detail body where one helps); several events of one kind fold into a plural subject, with shared destinations preserved ("Move 3 cards to Done"); genuinely mixed windows **say so in the subject** (re-ruled 2026-07-31, retiring the bare "Update board" fallback): **"Mixed update — N changes"**, always with a bulleted body naming every event, so the oneline log stays scannable and never dresses a grab-bag as one thing; when every event in the window shares one item — the card-window session flush's usual shape — the subject keeps the name: **"Mixed update — N changes to card '⟨title⟩'"**.
+- **Implied events don't steal the subject**: deleting a lane with five cards reads "Delete lane 'X'" with the card deletions as body bullets — not "Update board". **One level further down, a card's own event swallows its thread entirely** (blessed 2026-07-31): a card moved, deleted, restored, purged, or reminted carries its `comments/` paths silently — the card's event already explains every file under it, and comment bullets trailing "Delete card 'X'" would be the burying this rule exists to prevent.
 - **Non-snapshot files commit too** (settled — the repo tracks more than the model: the agent guide, `CLAUDE.user.md`, the seeded `.gitignore`, and strays at every level): the committer **stages the whole board root** — whatever `git status` shows, `.gitignore` respected, **open Edit sessions still staged around** (settled): the session card's folder stays excluded exactly as in Rules ▸ Auto-commit, whole-root staging widening *what* commits, never overriding the exclusion — and its commit condition is the *tree*, not the snapshot diff, so a stray-only window commits rather than leaving the tree dirty (firing mid-session, it commits the strays and leaves the session folder untouched) (a permanently dirty stray would break branch switch's cannot-fail-dirty guarantee and void flush-before-overwrite for every file the model can't see). The composer's input extends accordingly: beside the snapshot diff it receives the changed-path list, and non-snapshot paths compose **path-shaped events** — `CLAUDE.md` composes "Update agent guide (vN)", the version read from the guide's marker first line (a pure function of file content, *not* write-site tagging — the no-interception rule stands); any other non-snapshot path composes "Update '⟨path⟩'", folding plural ("Update 3 files"). Model events keep the subject when present; non-snapshot changes then ride as body bullets — recorded, never silently absorbed under an unrelated subject. Attribution needs no new rule: the EchoLedger (02-architecture.md) is path-keyed, so the app's guide write classifies app-mediated by its receipt (the mechanism behind the guide-attribution exception below) and a stray edit classifies foreign, the two-commit split applying per file as everywhere else.
-- **Titles truncate in subjects only** (~40 chars, keeping `git log --oneline` sane); body lines carry full titles. An untitled item reads "(untitled)" — never a bare `""` (a pathfinder edge fixed, not carried). Undo/redo restores commit as "Undo: ⟨subject⟩" / "Redo: ⟨subject⟩"; the undo-menu labels are the *crossed* commit's subject, so labels never nest.
+- **Healing mutations commit separately** (ruled 2026-07-29 — 01-storage-format.md ▸ Validation and healing): a debounce window holding a scheduled heal's changes alongside anyone else's splits the heal's paths into their own commit — the two-commit split's mechanism with a third class, keyed by the Writer's heal-marked receipts in the EchoLedger; a three-way window commits **foreign → heal → user** (blessed 2026-07-31 — causal: what was found, the response to it, the newest overwrite); split staging starts by **resetting the shared index to HEAD** (blessed 2026-07-31 — another writer's staged-but-uncommitted picks are discarded, their *content* still committing on the app's classified terms; the exposed race is only the gap between a foreign `add` and its `commit`, since a held `index.lock` already backs the app off, and a private in-memory index beneath the wrapper is the named upgrade if cohabitation friction ever shows) (attribution machinery, like the author split; the composer stays a pure diff reader and names the heal commit from its own diff shape — a loose-file relocation reads as its Attach-shaped event, a legacy migration's move into `.trash/` as Delete, the guide as "Update agent guide (vN)"; that the shape vocabulary doesn't say "healed" is accepted, the banner already told the user). Mostly redundant — each scheduled healer runs its own bracket at the reload tail, normally its own window — but the split makes separation a guarantee rather than a timing accident. **Heal commits are authored `Lanework Integrity <[email protected]>`** (ruled 2026-07-31 — the third pinned synthetic, joining Lanework External and the agent-slug family; strings are API): a heal is a third origin — not the user's gesture, not a foreign writer — and the separation exists for audit, so the trail filters by author like every origin; the committer stays the user (the recorded-by convention above). On-touch and inline heals are structurally exempt: each lives inside a host write or its triggering gesture and rides that commit, the backfilled `kind` composing no event per the bookkeeping rule above.
+- **Titles truncate in subjects only** (~40 chars, keeping `git log --oneline` sane); body lines carry full titles. An untitled item reads "(untitled)" — never a bare `""` (a pathfinder edge fixed, not carried). Undo/redo restores commit as "Undo: ⟨subject⟩" / "Redo: ⟨subject⟩"; the undo-menu labels are the *crossed* commit's subject, so labels never nest. **Subjects don't nest either — crossing a restore composes the inverse** (settled 2026-07-31): when the crossed commit's subject already carries a restore prefix — the post-relaunch case, where the reseed has made old restore commits ordinary steps — the composer emits the *inverse* label instead of stacking: crossing "Undo: S" yields "Redo: S", crossing "Redo: S" yields "Undo: S". This is the truer label, not a euphemism — undoing the restore that undid a move *re-applies* the move — and it caps prefixes at one across any number of relaunches. The sniff is on the subject string, so a foreign commit that happens to open with a prefix gets the inverse label too; that's cosmetic — the restore itself is unaffected. **Restore commits are user-authored, whatever they cross** (blessed 2026-07-31): the commit records the user's decision to put things back, not the crossed change — a foreign or agent-authored commit undone by ⌘Z yields a restore under the user's identity, keeping `--author` filtering truthful (an agent never appears to revert itself). **Menu enablement reads a cached stack picture that refreshes asynchronously after a landed commit** (blessed 2026-07-31): a crossing always awaits settlement — ⌘Z acts on true history, never the cache — so the lag can only mislabel or mis-grey a menu row for one beat, matching AppKit's own validation cadence; a synchronous walk on the commit-report path was declined as cost without an observable win.
 
 **The external gap, closed** (the pathfinder weakness this section exists to fix): the composer is origin-agnostic, but external writers routinely touch what the pathfinder's diff never modeled — `labels`, `assignees`, `due`, custom frontmatter keys — so their commits degraded to a generic fallback even though the attribution machinery knew plenty. The rewrite:
 
-- **The diff models the full schema-1 surface — plus the reserved metadata trio, deliberately**: label, assignee, and due changes compose ("Relabel card 'X'", "Assign card 'X'", "Set due date on card 'X'") even though 01-storage-format.md reserves those keys out of this version's UI — external writers (pathfinder-era boards, agents) are exactly who touches them, and naming three known keys in a pure diff function costs nothing. A change to any other unmodeled or custom key composes a named generic ("Update card 'X'") — never a board-level shrug when the touched item is identifiable.
+- **The diff models the full schema-1 surface — plus the reserved metadata trio, deliberately**: label, assignee, and due changes compose ("Relabel card 'X'", "Assign card 'X'", "Set due date on card 'X'") even though 01-storage-format.md reserves those keys out of this version's UI — external writers (pathfinder-era boards, agents) are exactly who touches them, and naming three known keys in a pure diff function costs nothing. A change to any other unmodeled or custom key **says what it is** (re-ruled 2026-07-31 — first lines self-describe; generics are a last resort, kept very rare): **"Change custom key on card 'X'"** (board and lane likewise — "Change custom key on board '⟨title⟩'"; several keys fold plural), the body naming each key with its old → new values. The bare named generic ("Update card 'X'") survives only for a change in a known file that is neither a vocabulary event nor a key change — a shape that should almost never occur; never a board-level shrug when the touched item is identifiable.
 - **Foreign commits speak the same vocabulary.** Origin lives in the author field (structural attribution below), not in message prose — a foreign move reads "Move card …" exactly like an app-mediated one, and any git client filters by author.
 - **The launch catch-up commit composes too**: changes found pending at board open diff HEAD's tree against the working tree through the same composer, instead of committing blind.
 
 ## Branch switching
 
-Switching (or creating-and-switching) a branch from the board popover:
+Switching a branch from the popover's picker, or creating-and-switching from the **New Branch…** reveal behind that picker's divider (03-board-ui.md ▸ Git tab; the field moved to the settings sheet with the 2026-07-31 split and came back with the 2026-08-07 reversal, the sequence untouched by either move) — **create-and-switch runs the identical settle → flush → stamp → switch sequence, no at-HEAD fast path** (blessed 2026-07-31): "creating at HEAD can't change the tree" fails as a proof under concurrent writers (a foreign commit can land between the check and the create), and flushing pending work onto the branch it was made on is the honest cadence regardless — the occasional save-or-discard beat on a create buys one sequence with no special case:
 
-- **Settle the editors first — explicitly, never silently.** Branch switch neither silently commits nor silently abandons an open card-body Edit session: if any open card window has one (unsaved keystrokes, or on-disk ~700 ms saves the session hasn't committed — the mid-session state Auto-commit above deliberately leaves uncommitted), the switch presents a **save-or-discard step**: **Save All** ends every session with its normal commit (each card's Edit→Preview flip), **Discard** reverts buffers and uncommitted saves to HEAD, **Cancel** keeps the current branch and the sessions. **Open raw-source buffers are settled by the same step** (settled — an unsettled raw buffer is the worse hazard: its Apply later writes the *entire* pre-switch `index.md` byte-for-byte onto the new branch's card): Save All *applies* each raw buffer — and since Apply validates, a buffer that fails validation cancels the whole switch with focus on the offending window, nothing half-switched; Discard exits raw source without writing; Cancel keeps everything. External checkouts the app can't gate are the accepted last-writer-wins case, same as the Edit buffer (05-card-window.md's dirty-buffer rule; on git boards the overwritten version is a commit, one revert away). Silently flushing the commit alone would be wrong twice over: the tree can be clean precisely because a save hasn't landed, and a later debounced save would write old-branch text onto the new branch's card. With sessions settled, the pending auto-commit flushes (flush-before-overwrite above) and checkout runs on a truly settled tree: it cannot fail dirty, and no in-flight work is lost or dragged across branches. (Inline title editors need no step of their own: reaching the popover's branch controls commits them — click-away commits, and board-scoped commands disable while one is focused — 04-interactions.md ▸ Grammar.)
+- **Settle the editors first — explicitly, never silently.** Branch switch neither silently commits nor silently abandons an open card-body Edit session: if any open card window has one (unsaved keystrokes, or on-disk ~700 ms saves the session hasn't committed — the mid-session state Auto-commit above deliberately leaves uncommitted), the switch presents a **save-or-discard step**: **Save All** ends every session with its normal commit (each card's Edit→Preview flip), **Discard** reverts buffers and uncommitted saves to HEAD, **Cancel** keeps the current branch and the sessions. **Open raw-source buffers are settled by the same step** (settled — an unsettled raw buffer is the worse hazard: its Apply later writes the *entire* pre-switch `index.md` byte-for-byte onto the new branch's card): Save All *applies* each raw buffer — and since Apply validates, a buffer that fails validation cancels the whole switch with focus on the offending window, nothing half-switched; Discard exits raw source without writing; Cancel keeps everything. External checkouts the app can't gate are the accepted last-writer-wins case, same as the Edit buffer (05-card-window.md's dirty-buffer rule; on git boards the overwritten version is a commit, one revert away). Silently flushing the commit alone would be wrong twice over: the tree can be clean precisely because a save hasn't landed, and a later debounced save would write old-branch text onto the new branch's card. With sessions settled, the pending auto-commit flushes (flush-before-overwrite above) and checkout runs on a truly settled tree: it cannot fail dirty, and no in-flight work is lost or dragged across branches. **The settle also clears each open card window's fine undo stack** (ruled 2026-07-31): pre-switch steps describe the branch being left — Save All and Discard alike end with every window's stack empty, the board-stack discard-and-reseed precedent one level down; the windows stay open, following their cards onto the new branch with fresh stacks. **The flush is Save-All-shaped** (blessed 2026-07-31): after Discard, the session's reverted bytes are *reconciled, never flushed* — the pending window for that folder drops, since disk again agrees with HEAD and committing the discarded saves would betray the button; pending changes elsewhere on the board still flush normally. (Inline title editors need no step of their own: reaching the popover's picker or its New Branch… field commits them — click-away commits, and board-scoped commands disable while one is focused — 04-interactions.md ▸ Grammar.)
 - **The undo/redo stack does not survive a switch.** It is discarded and reseeded from the new HEAD's first-parent ancestry — the relaunch rule applied at switch time; redo starts empty. (Replaying a restore commit from the previous branch onto the new one would be wrong.)
 - **Everything remote-facing tracks the current branch**: ahead/behind, Pull/Push, and push-on-commit all operate against the current branch's upstream. On a branch with no upstream yet, the first push — manual or push-on-commit — **creates it on the remote quietly** (`push -u` semantics): creating a remote branch is non-destructive, and quiet is consistent with push-failures-never-nag (07-sync-collab.md). Genuine failures queue with the badge as usual.
 - The switch itself is bracketed (02-architecture.md): watcher suspended, one full reload at the end. If that final reload fails, the board locks read-only until a successful reload — see 02's live-reload resilience; the on-screen snapshot is from the previous branch and must not be edited over the new one.
 
 ## Interaction with external writers
 
-Agent and hand edits arrive through the watcher like any change and get auto-committed on the same debounce — so agent work is undoable, attributed, and *described* in the same trail: foreign changes compose through the same message engine as app-mediated ones (Commit messages above — the pathfinder's generic "External edit: 2 cards changed" fallback is gone), with origin carried by the author field. One attribution exception: the app's own agent-guide writes (08-agent-integration.md) are the app's own Writer operations — app-mediated by the echo machinery, carrying the guide's version-marker first line — and committed as "Update agent guide (vN)", not "External edit". Known quirk, not a bug: undoing an "Update agent guide (vN)" commit restores an older guide that the app immediately re-upgrades — a one-bounce no-op undo (restore commit + fresh upgrade commit). Harmless; the guide is app-owned and self-healing by design.
+Agent and hand edits arrive through the watcher like any change and get auto-committed on the same debounce — so agent work is undoable, attributed, and *described* in the same trail: foreign changes compose through the same message engine as app-mediated ones (Commit messages above — the pathfinder's generic "External edit: 2 cards changed" fallback is gone), with origin carried by the author field. One attribution exception: the app's own agent-guide writes (08-agent-integration.md) are the app's own Writer operations — app-mediated by the echo machinery, carrying the guide's version-marker first line — and committed as "Update agent guide (vN)", not "External edit". The guide-commit undo quirk is the heal-transparency rule's oldest case (Rules ▸ Heal commits are transparent): in-session the upgrade commit never enters the stack; only a relaunch-old guide commit bounces — once, restore commit plus fresh upgrade commit, the fresh one transparent. Harmless; the guide is app-owned and self-healing by design.
 
-**Commit attribution is structural, not just a message convention.** The Writer/echo machinery (the **EchoLedger** — 02-architecture.md ▸ Components, where its matching rule and race cases are settled) lets the auto-committer classify every observed change, per file, as **app-mediated** (the user acting through the app) or **foreign** (anything else). User-driven commits carry the user's git identity; foreign changes are committed under the pinned synthetic author **`Lanework External <[email protected]>`** — so any git client can filter, log, and blame by origin. The strings are API (users script against them; the `.invalid` TLD honestly marks a non-routable synthetic identity) — they change with the deliberateness of a schema change.
+**Commit attribution is structural, not just a message convention.** The Writer/echo machinery (the **EchoLedger** — 02-architecture.md ▸ Components, where its matching rule and race cases are settled) lets the auto-committer classify every observed change, per file, as **app-mediated** (the user acting through the app) or **foreign** (anything else). User-driven commits carry the user's git identity; foreign changes are committed under the pinned synthetic author **`Lanework External <[email protected]>`** — so any git client can filter, log, and blame by origin. **The committer field is always the user's identity** (blessed 2026-07-31 — git's own `am`/cherry-pick convention: author = whose change, committer = who recorded it): every commit the app makes, foreign-authored included, records the user's app as its committer. The strings are API (users script against them; the `.invalid` TLD honestly marks a non-routable synthetic identity) — they change with the deliberateness of a schema change.
 
-**Where the user's git identity comes from** (no git install is assumed, and the sandbox doesn't read `~/.gitconfig` — honest limits, not bugs): **repo-local `.git/config` wins when present** — standard git semantics, readable in-sandbox because it lives under the board root, and the natural state of adopted/cloned boards. The board popover's git section exposes name/email fields that **write that repo-local config** — the setting *is* the file, portable to any git client, per-board by nature (work and personal boards can differ). Absent repo config, the **derived default** applies: the macOS account's full name plus `shortname@hostname` — git's own no-config fallback shape, zero ceremony. Commits pushed to a forge under the derived email won't link to a forge account; the popover fields are the fix when that matters. A debounce window containing both kinds is **split into two commits**, never mixed (flush-before-overwrite already orders them: foreign first, then the user's overwrite). Honest limit: the app distinguishes app-mediated from foreign, not human from agent — a hand edit in a text editor and an agent write look identical *unless the writer says otherwise via `modified-by` (below)*. Agents wanting precise attribution are encouraged (via the agent guide, 08-agent-integration.md) to commit their own changes; the app follows along.
+**Where the user's git identity comes from** (no git install is assumed, and the sandbox doesn't read `~/.gitconfig` — honest limits, not bugs): **repo-local `.git/config` wins when present** — standard git semantics, readable in-sandbox because it lives under the board root, and the natural state of adopted/cloned boards. The **popover's Git tab** carries an identity section (03-board-ui.md — the 2026-07-31 split moved the fields onto a settings sheet and the 2026-08-07 reversal brought them back) exposing name/email fields that **write that repo-local config** — the setting *is* the file, portable to any git client, per-board by nature (work and personal boards can differ). **The fields re-read the config at 2 s while they are visible** (blessed 2026-07-31; container amended 2026-08-07 — the poll rides with the fields, so it now lives and dies with the popover's Git tab rather than with the retired sheet): the watcher never delivers `.git`, so no board event can carry a terminal-side config edit — the unfocused-resync courtesy needs its own signal, and a visibility-scoped poll is the 15 s paused-state re-read's shape at form cadence (a focused field keeps its keystrokes; dismissing the surface stops the poll). **Writes append, reads take the last** (blessed 2026-07-31): the writer appends a plain `[user]` section and never edits existing sections or `[user "…"]` subsections (their semantics are tool-specific); the reader — like git itself — takes the last plain-section value, which is exactly what an append produces. The asymmetry lets the write always win without the writer ever reformatting what it didn't create — the frontmatter engine's never-reformat instinct applied to git config; the worst case is a slightly redundant file git reads correctly. A write whose keys already read back at their target values is skipped whole, so revisiting the fields never grows the file. **Clearing a key is the one sanctioned in-place edit** (ruled 2026-08-06): an empty field means "no repo-local opinion", and the config format spells absence one way only — the key not being there. The append-shaped alternative, an empty `email =` line, is an opinion in the wrong direction: a repo-level empty value *overrides* the user's global `~/.gitconfig` in their own terminal and fails their commits with git's empty-ident error. So a clear deletes every plain-section line for that key — deleting fewer than all of them changes nothing under last-wins — and drops any plain `[user]` header left with no keys under it; clearing both fields leaves the file with no plain-section identity at all, the state a never-configured repo is in. Subsections stay untouchable in both directions. Absent repo config, the **derived default** applies: the macOS account's full name plus `shortname@hostname` — git's own no-config fallback shape, zero ceremony. Commits pushed to a forge under the derived email won't link to a forge account; the identity fields are the fix when that matters. **The derived default is passed as an explicit per-commit signature, never written into repo config** (ruled 2026-07-31 — the signature-capable commit path gates the pro-m1 ship): repo config is the record of the user's popover edits and of adopted repos' own state, and an app-written identity there would outrank the user's global `~/.gitconfig` for their *own terminal commits* in that board. The build-time interim that materializes identity into a fresh repo's `.git/config` (SwiftGitX 0.4.0's signatureless commit + the sandbox's unreadable global config) is tolerated in-tree during pro-m1 construction and must die before release — the attribution rules above (per-commit author variation) require explicit signatures anyway. A debounce window containing both kinds is **split into two commits**, never mixed (flush-before-overwrite already orders them: foreign first, then the user's overwrite). Honest limit: the app distinguishes app-mediated from foreign, not human from agent — a hand edit in a text editor and an agent write look identical *unless the writer says otherwise via `modified-by` (below)*. Agents wanting precise attribution are encouraged (via the agent guide, 08-agent-integration.md) to commit their own changes; the app follows along.
 
 **`modified-by` refines foreign attribution** (the self-reported provenance key — 01-storage-format.md): when every file changed in a foreign debounce window carries the same `modified-by: X`, that commit is authored as **X** with the synthetic email `<slug>@agents.lanework.invalid` (display name verbatim, email local part slugified; the domain marks self-reported identity, distinct from both the user and the generic external author). Any disagreement between stamps, any unstamped changed file, or any true deletion in the window falls back to `Lanework External` — a deletion leaves no file to stamp. **A folder move is not a deletion**: items match by id across the whole board (Commit messages above — the same matching that reads a move as a move, not delete+add), so a moved card attributes by its stamp like any changed file. But a bare `mv` rewrites nothing — the moved `index.md` still carries whatever the app last wrote (no stamp) and demotes the window under the unstamped-file rule — so the agent guide teaches re-stamping on move (08-agent-integration.md). Same trust level as self-committing — it's what the writer claims, accepted as such; the stale-stamp hand-edit case (01) is the known misattribution edge. Self-committing remains the precise path; the stamp is the lightweight middle.
 
 **Two writers, one repository — the designed situation, not an edge case.** Self-committing agents mean the auto-committer shares the repo with concurrent `git` processes, and it must be graceful about it:
 
-- **`index.lock` contention is never an error.** If the auto-committer finds the index locked (an agent's commit in flight), it backs off briefly and retries; if the lock persists, it simply re-debounces — the pending changes are still pending, and the next quiet moment commits them. No banner, no log-worthy failure: a held lock is another writer doing its job. (Genuine commit failures — disk full, repo corruption — are different: files stay safe on disk but history stops advancing; surfaced per 02-architecture.md ▸ Write-failure surfacing, retried on the next debounce.) **The same posture covers every app-initiated operation** (settled): pull, push, branch switch, and undo restore meeting a held lock wait and retry briefly, silently; contention outlasting the brief retry surfaces as a *waiting* state in the operation's in-progress banner row ("waiting for another writer's git lock"), retrying on its cadence — never an error dialog, never a hammer — and a wait that persists implausibly long names the lock path (a crashed writer's leftover is the user's to clear; the never-mutate rule's one exemption is the app's own leftovers, Abnormal repo states above). An operation that fails *cleanly* — disk error, refused checkout; network and auth are 07-sync-collab.md's pause-and-badge story — surfaces as a one-shot banner failure naming the operation and the error, the tree left as it was; failure after the tree changed wholesale is instead 02-architecture.md's failed-final-reload lock.
+- **`index.lock` contention is never an error.** If the auto-committer finds the index locked (an agent's commit in flight), it backs off briefly and retries; if the lock persists, it simply re-debounces — the pending changes are still pending, and the next quiet moment commits them. No banner, no log-worthy failure: a held lock is another writer doing its job. (Genuine commit failures — disk full, repo corruption — are different: files stay safe on disk but history stops advancing; surfaced per 02-architecture.md ▸ Write-failure surfacing, retried on the next debounce.) **The same posture covers every app-initiated operation** (settled): pull, push, branch switch, and undo restore meeting a held lock wait and retry briefly, silently; contention outlasting the brief retry surfaces as a *waiting* state in the operation's in-progress banner row ("waiting for another writer's git lock"), retrying on its cadence — never an error dialog, never a hammer — and a wait that persists implausibly long names the lock path (a crashed writer's leftover is the user's to clear; the never-mutate rule's one exemption is the app's own leftovers, Abnormal repo states above). **The wait is bounded — 30 s, then a clean failure** (blessed 2026-07-31; injectable): a genuine writer finishes in seconds, so only a stale lock ever reaches the bound, and an eternal spinner holding the wholesale bracket — and with it the board — is worse than a failure that names the path to delete. The bound expiring is the clean-failure case below, tree untouched. An operation that fails *cleanly* — disk error, refused checkout; network and auth are 07-sync-collab.md's pause-and-badge story — surfaces as a one-shot banner failure naming the operation and the error, the tree left as it was; failure after the tree changed wholesale is instead 02-architecture.md's failed-final-reload lock. **Form-anchored operations answer at the form first** (ruled 2026-07-31; container updated twice — by the popover/sheet split, then back by the 2026-08-07 reversal, so these forms live in the popover's Git tab): add-git — and later form-asked operations like verify-remote — fail into an inline caption in the tab's relevant posture while the popover is up (the user asked from a form still under their eye; dismissing the popover dismisses the stale error, retry is right there, VoiceOver reads it from the focused surface); if the popover has been dismissed before the answer arrives, the failure falls back to the one-shot banner above — inline is the primary surface, never a silence trap. The banner enumeration stays the posture for board-wholesale brackets that outlive any one surface — branch switch and undo restore included (blessed 2026-07-31: a switch's bounded lock wait can expire long after the popover dismissed). **The two rules compose rather than conflict** (ruled 2026-08-06, the create-and-switch overlap; simplified 2026-08-07 by the reversal): a board-wholesale operation asked from a form is both at once, and the form rule wins while the asking surface stands — create-and-switch and a plain switch are now asked from the same surface and answer at the same caption, the popover's, so there is one inline slot for the branch affordance rather than two that had to be kept from showing at once. The banner remains the posture for whatever outlives the asking surface — the form rule's own fallback generalized: **inline while the asking surface is up, banner once it is gone.** Banner-only-everywhere was weighed and set aside — it would answer a form's question away from the form still under the user's eye. Which window's strip carries the row is 02-architecture.md's hosted-by-the-window-of-origin rule — the card window hosts its own strip, and a ⌘Z pressed there surfaces its failure there (re-homing to the board window if the card window closes first, per 02).
 - **A clean tree is the happy path, not a malfunction.** When the debounce fires and the tree has nothing to commit — the agent already committed its own work — the auto-committer no-ops silently. The agent's commit, under the agent's own authorship, *is* the record; that is precisely what the self-commit recommendation is for.
 - **An agent's `git add -A` can sweep up the user's not-yet-committed app-mediated changes** under the agent's authorship, muddying structural attribution for that window. Accepted limit — the app cannot police another process's staging; the agent guide (08-agent-integration.md) tells agents to commit only their own paths, which keeps well-behaved agents honest.
 
 ## Repository hygiene
 
-- **`.gitignore` seeded at init, never touched after.** Adding git to a board writes a minimal `.gitignore` (`.DS_Store`) if none exists; the app never edits an existing one and never manages the file afterward — it's the user's from then on. (Repo-nested boards have no app-managed git, so no app `.gitignore` either.)
-- **Repo growth is accepted.** Unbounded history is the price of never-rewrite, and every attachment version lives in the repo forever. The app may run safe libgit2 housekeeping (repacking loose objects) periodically — it rewrites nothing. Content-removing compaction is explicitly out (it would rewrite history); size tooling joins the wishlist if growth ever bites in practice.
-- **Deleting never forgets.** On a git board, deleting a card removes it from the board but never from history — every version of its content and attachments stays reachable in any git client, and even the future tombstone purge (01-storage-format.md) only cleans the working tree. This is part of the design; users should learn it here, not from a repo browser.
+- **`.gitignore` seeded on every board, never touched after** (re-ruled 2026-07-31 — the file outgrew git: it is the one noise definition the loose-file relocation heal obeys, 01-storage-format.md ▸ Rules, so every board carries it, git or not). Board creation writes the minimal seed — `.DS_Store` plus the writer's temp pattern (`.*.lanework-*`) — and a board missing the file gains it by scheduled heal at open (the guide-refresh cadence; deletion is answered by re-seeding, and the escape hatch for wanting no exclusions is an *empty* file, which the app honors and never rewrites). The app never edits an existing `.gitignore` — it's the user's from the seed on, and fine-tuning what counts as noise over time means fine-tuning the seed. Repo-nested boards are seeded too (re-ruling the old no-app-`.gitignore` posture): the file serves the heal there, not any app-managed git; the visible untracked file in the user's repository is accepted on the agent-guide precedent, with the honest side effect that the enclosing repo's git reads it for paths under the board.
+- **Repo growth is accepted.** Unbounded history is the price of never-rewrite, and every attachment version lives in the repo forever. The app may run safe libgit2 housekeeping (repacking loose objects) periodically — it rewrites nothing. **"Periodically" has numbers** (blessed 2026-07-31, all injectable): the pack runs when the loose-object count crosses **6,700** — git's own `gc.auto` default, borrowed for the identical reason — **8 s after session activation** (outlasting the committer's launch catch-up), at background priority, skipped under a pause, a lock, or an in-flight commit, and **attempted at most once per session** — hygiene must never become a hot loop; a skipped or failed pack waits for the next open. **Packs accumulate — the pass never consolidates, rewrites, or deletes existing packs** (blessed 2026-07-31): it deletes only loose files it proved redundant against the pack it just wrote, so a long-lived board accrues roughly one pack per threshold's worth of objects, forever — the never-rewrite posture's accepted cost (git tolerates many packs gracefully; a terminal `git gc` consolidates at the user's discretion). **SHA-256 repositories are unsupported, safely** (blessed 2026-07-31): an adopted SHA-256 repo the engine cannot open takes the corrupt-repo loud-failure path — never a silent fall to mode-none; should one ever open, hygiene abstains by construction — its loose-object filter matches the SHA-1 filename shape only, so its work list is empty and the repo is left untouched (recognizing nothing and touching nothing is the fail-safe direction; a looser match that deleted half-recognized files would be the dangerous one). Content-removing compaction is explicitly out (it would rewrite history); size tooling joins the wishlist if growth ever bites in practice.
+- **Deleting never forgets.** On a git board, deleting a card removes it from the board but never from history — every version of its content and attachments stays reachable in any git client, and even a trash purge (Empty Trash, or the future age-based auto-purge — 01-storage-format.md) only cleans the working tree. This is part of the design; users should learn it here, not from a repo browser.
 
 ## Changes from Kanban
 
 - **Commit granularity resettled to Edit sessions**: body commits land at the Edit→Preview flip (the effective Save button), not at typing-settle; the committer stages around open sessions (Rules ▸ Auto-commit).
 - **Branch switch gates on explicit save-or-discard** for open Edit sessions instead of silently flushing (Branch switching).
 - **Commit messages upgraded for external writers**: full schema-1 diff surface, foreign commits in the same vocabulary (no "External edit" prose), semantic launch catch-up, untitled-item rendering (Commit messages).
-- The rewrite should extract the old repo's AI-ANALYSIS-git-operations.md conclusions (forward-restore model, C3/C8) into a short normative doc rather than re-deriving them.
+- The old repo's AI-ANALYSIS-git-operations.md conclusions (forward-restore model, C3/C8) are extracted into [14-git-operations.md](14-git-operations.md) rather than re-derived — cite it, not the pathfinder file.
 
 ## Out of scope
 

DESIGN/07-sync-collab.md

@@ -1,6 +1,6 @@
 # Sync & Collaboration
 
-**Edition scope: Lanework Pro** (12-editions.md). Base Lanework ships mode:none only — the state machine below never leaves its first state there, `.git` encountered on disk is inert (12), and the Mode: none section's no-undo caveat is superseded in base by native undo (13-native-undo.md). Teams adds tracker-backed sync behind the same seam (deferred).
+**Tier scope: Lanework Pro** (12-editions.md). The free tier ships mode:none only — the state machine below never leaves its first state there, `.git` encountered on disk is inert (12), and the Mode: none section's old no-undo caveat is superseded in every tier by native undo (13-native-undo.md — the provider follows the board, re-ruled 2026-07-31). Teams adds tracker-backed sync behind the same seam (deferred).
 
 Every board has exactly one **collab mode** at a time, but the mode is not fixed at creation — it can evolve over the board's lifetime:
 
@@ -14,7 +14,7 @@ A board may be created plain — **without any git repository** (a pivot from th
 
 ## Mode: none (local-only)
 
-Plain folders on local disk. **No git repository at all** — and therefore, since git is the undo substrate, no undo/redo (06-history-undo.md). FSEvents live-reload works as on any board. Adding git later initializes the repo and moves the board to git mode. Honest caveat: without git there is no commit-before-overwrite protection, so on a no-git board **real data loss is possible** (e.g. concurrent or external overwrites) — accepted; adding git is the remedy. Repo-nested boards share this caveat: a repo exists, but the app manages no git there (06-history-undo.md), so its protections never run — committing is the user's own workflow. Deletion is the exception: the tombstone trash (03-board-ui.md) makes deletes recoverable even without git — overwrites are the lossy case, and Empty Trash is deliberate.
+Plain folders on local disk. **No git repository at all** — and therefore no git history; undo/redo binds the native stack in every tier (13-native-undo.md, re-ruled 2026-07-31). FSEvents live-reload works as on any board. Adding git later initializes the repo and moves the board to git mode. Honest caveat: without git there is no commit-before-overwrite protection, so on a no-git board **real data loss is possible** (e.g. concurrent or external overwrites) — accepted; adding git is the remedy. Repo-nested boards share this caveat: a repo exists, but the app manages no git there (06-history-undo.md), so its protections never run — committing is the user's own workflow. Deletion is the exception: the materialized trash (03-board-ui.md) makes card and lane deletes recoverable even without git — overwrites are the lossy case, and Empty Trash is deliberate.
 
 ## Mode: git
 
@@ -22,7 +22,7 @@ The board is a git repository (the 06-history-undo.md substrate — undo/redo, a
 
 - Push/pull becomes a sharing mechanism between machines/people at file-level granularity; the fractal one-item-one-file design keeps conflicts rare and small (a reorder touches one file).
 - **Remote tracking lives in the board popover** (03-board-ui.md): ahead/behind indicator plus manual **Pull** and **Push** controls — which are also Board-menu items (no default chord, remappable — 11-command-nexus.md; the configuration carve-out is 04-interactions.md's).
-- **Which remote is the board's remote** (settled — adopted clones can carry several): resolution is git's own defaulting — the current branch's upstream remote; else `origin`; else the repo's sole remote. The popover names the remote it tracks, its change-remote control edits exactly that one, add-remote on a remote-less repo creates `origin`, and 06-history-undo.md's quiet first `push -u` targets the resolved remote (recording it as the upstream, which pins resolution thereafter). The unresolvable case — several remotes, no upstream, none named `origin` — is surfaced honestly: remote operations disable and the popover offers a one-time remote picker, whose choice becomes the branch's upstream on the next push.
+- **Which remote is the board's remote** (settled — adopted clones can carry several): resolution is git's own defaulting — the current branch's upstream remote; else `origin`; else the repo's sole remote. The settings sheet names the remote it tracks (the popover's tracking badge shows it at a glance — the 2026-07-31 popover/sheet split, 03-board-ui.md), its change-remote control edits exactly that one, add-remote on a remote-less repo creates `origin`, and 06-history-undo.md's quiet first `push -u` targets the resolved remote (recording it as the upstream, which pins resolution thereafter). The unresolvable case — several remotes, no upstream, none named `origin` — is surfaced honestly: remote operations disable and the sheet offers a one-time remote picker, whose choice becomes the branch's upstream on the next push.
 - **Optional push-on-commit**: a per-board setting (stored app-side in the board registry — 02-architecture.md's per-board app state); when enabled, **every commit the app makes** is pushed immediately — auto-commits and undo/redo restore commits alike (06-history-undo.md's restores are commits like any other; a shared board never shows a phantom lag after an undo).
 - **Push failures never nag.** A push rejected as non-fast-forward (another machine pushed first) triggers an automatic **fetch → rebase → push**, with bounded retries — the same rebase machinery as Pull, so it cannot block and cannot conflict. Manual Push behaves identically. Stated plainly: enabling push-on-commit implicitly accepts that remote commits may land in the live board whenever pushes race — consistent with the board's live-reload nature, but it should be learned from the design, not discovered. All other push failures stay quiet: pushes queue, the ahead/behind indicator in the board popover carries the pending count and the last error, and pushing resumes automatically on the next commit or manual Push. No modals, no per-commit errors. The one refinement: **authentication failures pause rather than retry** — see Remote authentication below.
 - **There can be no conflicts — and no data loss.** Every edit becomes a commit before anything can overwrite it (auto-commit settles local changes; the tree is clean by the time a pull runs). The clean-tree premise is why **abnormal repo states pause the remote half too**: a detached HEAD or in-progress merge/rebase holds Pull, Push, and push-on-commit alongside auto-commit (06-history-undo.md ▸ Rules ▸ Abnormal repo states — the whole git surface pauses; the ahead/behind badge keeps counting, a fetch being a read). A pull — manual, or the automatic fetch-rebase after a rejected push — runs only at **interaction rest**: it queues behind an in-flight drag or open inline editor (the same settled-change notion the auto-commit debounce uses), flushes the pending auto-commit (06-history-undo.md's flush-before-overwrite), then runs bracketed (02-architecture.md's live-reload resilience) — never an error dialog, never a board yanked mid-drag. An open card-body **Edit session neither blocks a pull nor is interrupted by one**: the flush commits the session's on-disk saves as-is (06-history-undo.md's mechanical exception to session-granularity commits) and the rebase runs; when the pulled commits touch the very card being edited, the card window **signposts** the remote change (a transient banner, no modal, no merge UI) while the dirty buffer stays put and wins per 05-card-window.md — the losing remote version is a commit, one revert away. An open **raw-source buffer gets the same treatment** (settled): a pull neither blocks on it nor invalidates it — the bracket's write lock merely disables Apply while the pull runs — and the same-card signpost shows in source mode too (the banner strip is window furniture, not part of the swapped content area). A later Apply is last-writer-wins across the *whole file*, frontmatter included, with the overwritten pulled version a commit one revert away — on the same branch this is exactly the Edit-buffer race. (Branch switch and undo restore must gate raw buffers on save-or-discard instead — 06-history-undo.md ▸ Branch switching — because there a stale Apply would write onto a *different tree's* card, not merely race a newer version of the same one.) A pull fetches the remote's commits and **rebases local commits on top of them**; where a rebase hits a genuinely conflicting hunk, the **local side wins** — always, with no configuration. (This is the one deliberate history rewrite in the app, and it only ever touches unpushed local commits — see 06-history-undo.md's undo-never-rewrites rule.) Crucially, resolution discards nothing: the losing remote version survives intact in the fetched commits below, so an edit that "lost" the rebase is visible in any git client and one revert away. What may *appear* as data loss is always recoverable. No interactive merge UI, no conflict markers written by the app, sync never blocks. A pull that cannot start or fails cleanly follows 06-history-undo.md's app-initiated-operation posture — lock contention shows as a waiting state in the operation's banner row, clean failures as one-shot banner errors, an interrupted rebase is aborted-and-reported via the own-leftovers exemption; push alone keeps the richer queue-and-badge story (below). Conflict markers encountered in files (from git activity *outside* the app) fail fast only where they break parsing — markers in or around the frontmatter make the file the malformed-input case the loader rejects loudly with the offending path. Markers wholly inside a Markdown body are, honestly, valid input: they load fine and render as body text, and the app deliberately doesn't police body content to detect them (stated stance, not an oversight). (The old repo's AI-THINKING-merge-conflicts.md explored this territory; mine it when specifying the rebase mechanics.)
@@ -32,13 +32,13 @@ The board is a git repository (the 06-history-undo.md substrate — undo/redo, a
 Everything above assumes credentials exist; this is where they come from. Constraints first, stated as honest limits: a sandboxed app with bundled libgit2 cannot read `~/.ssh` (no entitlement grants it — silent access to every key is exactly what the sandbox exists to prevent), cannot reach `ssh-agent` (a unix socket outside the container; this also rules out 1Password/Secretive/YubiKey agents), cannot run the user's credential helpers, and gains nothing by shelling out (children inherit the sandbox). The network-client entitlement is assumed. Auth is therefore app-native, and **the Keychain is the only credential store** — credentials never live in board files or repo config. That is the deliberate inversion of files-are-truth: secrets are the one thing that must never be a file in the board.
 
 - **Transports: HTTPS and SSH, both Keychain-backed.**
-  - **HTTPS (primary)**: username + token (forge PATs; plain basic auth for generic hosts), stored as a Keychain internet password keyed by **host + username** — git's own scoping model, shared across boards: one GitHub token serves every board, and two accounts on one host coexist as two usernames. **Which username a board uses is the remote URL's business** (git's own answer, and the HTTPS analogue of the SSH per-host table): a username in the URL (`https://alice@host/…`) selects the Keychain item `host + alice`, and the popover's credential capture stamps the entered username into the remote URL in repo config — the URL is the assignment record, no app-side state (the secret itself stays in the Keychain). A URL naming no username resolves to the host's sole stored username; when a host has several, the popover's username field becomes a picker and saving stamps the choice into the URL, while background operations treat the ambiguity as **Authentication needed** (pause and badge, never guess — the same posture as auth failure).
-  - **SSH — Keychain-resident keys, never key files.** Each Mac has a **Lanework key**: an app-generated ed25519 keypair whose private half lives as an ACL-protected Keychain item and is handed to libssh2 from memory — it never exists on disk. The board popover shows the public key with a Copy affordance; the user adds it to their forge like any machine key. An **existing key imports by paste or drag** (a one-time read under user intent): copied into the Keychain — passphrase entered once at import, stored under Keychain protection thereafter — and the original file is never referenced again. Per-machine identity, per-Mac revocable on the forge — the ssh-idiomatic shape. (Secure Enclave-backed keys — non-exportable, custom sign callback, P-256 — are a possible later hardening, not v1.)
-  - **Key scope: app-level objects, per-host assignment.** Keys are never board state — the machine key plus any imports live app-wide (Keychain), and each SSH host maps to one of them: default the machine key; importing a key during a host's setup assigns it to that host. A "host" is `hostname[:port]` parsed from the remote URL — the same endpoint identity the TOFU fingerprint store uses (OpenSSH's own `[host]:port` convention); the URL's username (`git@`) disambiguates nothing and stays out of it. The assignment table holds **only overrides** — no entry means the machine key, so the default costs zero records and removing an override self-heals to it. The popover's key picker is labeled per-host ("key for github.com"), which teaches the one cross-board consequence: switching a host's key switches it for every board on that host — the same rotate-once-follow-everywhere behavior as HTTPS tokens. Housekeeping stays small: an import referenced by no host row can be removed; the machine key only regenerates (confirm-gated — it invalidates the old public half on every forge), and that is the entire rotation story. The board popover is only the surface — it shows the key for *that remote's host*, the way the commit-identity fields front repo-local config. Known limit, accepted: two accounts on the *same* host can't be told apart by key (forges bind key→account globally; git's own answer is ssh-config aliases, which live in files the sandbox can't read) — a per-remote key override joins the wishlist if it ever bites.
-  - **Host verification is trust-on-first-use**: with no `~/.ssh/known_hosts` readable, the first connection to an SSH host confirms its fingerprint with the user; accepted fingerprints live app-side in Application Support (02-architecture.md's app-wide state home, host-scoped). A later mismatch **hard-blocks with an explanation** — that mismatch is the attack the check exists for.
-- **Setup verifies right there.** Adding or changing a remote (board popover — 03-board-ui.md) probes with authentication immediately (ls-remote): missing or rejected credentials surface **inline in the popover** — HTTPS shows username + token fields with a forge-appropriate hint; SSH shows the machine key to copy plus Verify. The user leaves the popover with a remote that demonstrably works, or knowingly not. Boards adopted from a terminal clone (whose auth lives outside the sandbox and can't be reused) hit the same inline flow at the first in-app operation that needs credentials.
-- **Auth failures pause; they never nag and never hammer.** A push or pull rejected for authentication (expired token, revoked key) is not retried — a dead credential cannot succeed, and hammering invites rate limits and lockouts. The push queue pauses and the popover badge switches to a distinct **Authentication needed** state carrying the error; the popover presents the same inline fields, prefilled where possible. Updating the credential (or fixing forge-side and hitting Verify) resumes the queue. Network failures keep the quiet auto-resume above — only auth pauses.
-- **Background operations never prompt.** Push-on-commit and the automatic fetch-rebase-push stay silent through auth trouble (badge only); credential capture happens exclusively in the popover, where the user already is when it matters (manual Pull/Push live there too).
+  - **HTTPS (primary)**: username + token (forge PATs; plain basic auth for generic hosts), stored as a Keychain internet password keyed by **host + username** — git's own scoping model, shared across boards: one GitHub token serves every board, and two accounts on one host coexist as two usernames. **Which username a board uses is the remote URL's business** (git's own answer, and the HTTPS analogue of the SSH per-host table): a username in the URL (`https://alice@host/…`) selects the Keychain item `host + alice`, and the settings sheet's credential capture stamps the entered username into the remote URL in repo config — the URL is the assignment record, no app-side state (the secret itself stays in the Keychain). A URL naming no username resolves to the host's sole stored username; when a host has several, the sheet's username field becomes a picker and saving stamps the choice into the URL, while background operations treat the ambiguity as **Authentication needed** (pause and badge, never guess — the same posture as auth failure).
+  - **SSH — Keychain-resident keys, never key files.** Each Mac has a **Lanework key**: an app-generated ed25519 keypair whose private half lives as an ACL-protected Keychain item and is handed to libssh2 from memory — it never exists on disk. The board settings sheet shows the public key with a Copy affordance; the user adds it to their forge like any machine key. An **existing key imports by paste or drag** (a one-time read under user intent): copied into the Keychain — passphrase entered once at import, stored under Keychain protection thereafter — and the original file is never referenced again. Per-machine identity, per-Mac revocable on the forge — the ssh-idiomatic shape. (Secure Enclave-backed keys — non-exportable, custom sign callback, P-256 — are a possible later hardening, not v1.)
+  - **Key scope: app-level objects, per-host assignment.** Keys are never board state — the machine key plus any imports live app-wide (Keychain), and each SSH host maps to one of them: default the machine key; importing a key during a host's setup assigns it to that host. A "host" is `hostname[:port]` parsed from the remote URL — the same endpoint identity the TOFU fingerprint store uses (OpenSSH's own `[host]:port` convention); the URL's username (`git@`) disambiguates nothing and stays out of it. The assignment table holds **only overrides** — no entry means the machine key, so the default costs zero records and removing an override self-heals to it. The sheet's key picker is labeled per-host ("key for github.com"), which teaches the one cross-board consequence: switching a host's key switches it for every board on that host — the same rotate-once-follow-everywhere behavior as HTTPS tokens. Housekeeping stays small: an import referenced by no host row can be removed; the machine key only regenerates (confirm-gated — it invalidates the old public half on every forge), and that is the entire rotation story. The board settings sheet is only the surface — it shows the key for *that remote's host*, the way the commit-identity fields front repo-local config. Known limit, accepted: two accounts on the *same* host can't be told apart by key (forges bind key→account globally; git's own answer is ssh-config aliases, which live in files the sandbox can't read) — a per-remote key override joins the wishlist if it ever bites.
+  - **Host verification is trust-on-first-use**: with no `~/.ssh/known_hosts` readable, the first connection to an SSH host confirms its fingerprint with the user; accepted fingerprints live app-side (02-architecture.md's app-wide state home, host-scoped). A later mismatch **hard-blocks with an explanation** — that mismatch is the attack the check exists for.
+- **Setup verifies right there.** Adding or changing a remote (board settings sheet — 03-board-ui.md, the 2026-07-31 popover/sheet split) probes with authentication immediately (ls-remote): missing or rejected credentials surface **inline in the sheet** — HTTPS shows username + token fields with a forge-appropriate hint; SSH shows the machine key to copy plus Verify. The user leaves the sheet with a remote that demonstrably works, or knowingly not. Boards adopted from a terminal clone (whose auth lives outside the sandbox and can't be reused) hit the same inline flow at the first in-app operation that needs credentials.
+- **Auth failures pause; they never nag and never hammer.** A push or pull rejected for authentication (expired token, revoked key) is not retried — a dead credential cannot succeed, and hammering invites rate limits and lockouts. The push queue pauses and the popover badge switches to a distinct **Authentication needed** state carrying the error (the badge points at the settings sheet); the sheet presents the same inline fields, prefilled where possible. Updating the credential (or fixing forge-side and hitting Verify) resumes the queue. Network failures keep the quiet auto-resume above — only auth pauses.
+- **Background operations never prompt.** Push-on-commit and the automatic fetch-rebase-push stay silent through auth trouble (badge only); credential capture happens exclusively in the settings sheet, one click behind the badge that says it's needed (manual Pull/Push stay in the popover — daily operations, the split's other half).
 
 ## iCloud Drive — not supported (decided)
 

DESIGN/08-agent-integration.md

@@ -17,10 +17,14 @@ The app silently maintains a `CLAUDE.md` in every board — a condensed, agent-f
 
 - Creating cards (mkdir UUID, write `index.md`, ordering rules) — plain UTF-8, no BOM, preserving each file's existing line endings (01-storage-format.md's encoding contract).
 - Moving between lanes (folder move), reordering (gapped ranks, only touch the moved item).
-- Tombstone deletes, colors/icons.
-- New in the rewrite: **attachments** (the `attachments/` convention, importing files) — including the rule that **card files belong in `attachments/`**: a loose file written beside `index.md` will be relocated there by the app with a notice (01-storage-format.md's loose-file carve-out), so agents should put it there in the first place.
-- New in the rewrite: **`modified-by` self-stamping** — stamp files you write; re-stamp every write *and every move* (the app clears it on its own writes; a bare folder move leaves the card unstamped); self-commit instead when you need exact authorship.
-- New in the rewrite: a pointer to the optional **`CLAUDE.user.md`** (see below), instructing agents to read it when present.
+- Deletes — move the card **or lane** folder into `<root>/.trash/` and restamp `modified` (the trash sorts newest-first by that stamp — re-ruled 2026-07-31, no rank to mint; never delete a folder outright unless permanence is meant); colors/icons.
+- **`kind`** — common schema, written at creation of every object: include `kind: lane` / `kind: card` when creating anything (`kind: board` at board root), and stamp `kind: lane` when trashing a lane that lacks it. The *value* is what tells a trashed lane from a card inside the flat `.trash/` (01-storage-format.md ▸ Deletion); the app backfills a missing key on touch (01 ▸ Validation and healing), so omitting it is healable, never fatal.
+- **Attachments** (the `attachments/` convention, importing files) — including the rule that **card files belong in `attachments/`**: a loose file written beside `index.md` will be relocated there by the app with a notice (01-storage-format.md's loose-file carve-out), so agents should put it there in the first place — and the card-level **`attachments` claimed name**: `attachments` inside a card folder is the app's (the card's file folder); never create a *file* by that name.
+- **`modified-by` self-stamping** — stamp files you write; re-stamp every write *and every move* (the app clears it on its own writes; a bare folder move leaves the card unstamped); self-commit instead when you need exact authorship.
+- **The stamp discipline** of 01 ▸ `modified`'s scope: **reordering within a lane rewrites only `order`** — leave `modified` and `modified-by` alone — while **a move between lanes, between boards, or into/out of `.trash/` updates both** (stamp `modified`, re-stamp `modified-by`).
+- A pointer to the optional **`CLAUDE.user.md`** (see below), instructing agents to read it when present.
+
+This list is **present-tense and normative for the current guide** (re-ruled 2026-07-30): it states what the shipped guide teaches *now*, and editing it means editing the guide literal in the same change. Per-version changelog bullets are deliberately gone — a hand-maintained version history beside the literal drifted within days of v6 (claiming teachings the shipped body lacked), the same failure class as README's hand-enumerated deferred list; version history lives in git.
 
 Mechanics: version marker in the first line (`lanework-agent-guide vN`); rewritten when missing or older, never downgraded, left untouched when current or newer. To the loader it's just another ignored file.
 

DESIGN/09-templates.md

@@ -27,7 +27,7 @@ All ten pathfinder templates carry over: Basic, Classic Kanban, Software Project
 
 ### Instantiation
 
-Creating a board from a template: copy the tree — **skipping tombstoned items** (Save as Template already strips them, but hand-dropped user templates can carry them; a new board isn't born with trash) — **mint fresh GUIDs** for every lane/card folder, stamp `created`/`modified` fresh (the stated exception to 01-storage-format.md's copies-keep-`created` rule — a new board is born today, not forked from the template), seed the save panel's suggested name from the template title, and **set the new board's `title` to the user-chosen document name** (per 01-storage-format.md's board-naming rule, so display name and folder name start out matching). The `template:` key is kept — inert on an ordinary board. **`.git` is never copied** — a template is content, not history, and a hand-dropped user template that carries one must not produce boards that are silently in git mode (06-history-undo.md's no-silent-auto-init — the principle is *never give the user a repo they didn't ask for*, and it scopes to instantiation: File ▸ Duplicate deliberately carries `.git`, because a duplicate of a git board is a fork of its history — 03-board-ui.md): an instantiated board is never in *git* mode — its actual mode follows 06's nearest-`.git`-wins detection at the destination the save panel chose: mode `none` in a plain folder, repo-nested when saved inside an existing repository (no undo, no add-git — the popover explains, 06-history-undo.md). Beyond the `template:` residue, the result is indistinguishable from a hand-built board.
+Creating a board from a template: copy the tree — **skipping `.trash/`** (Save as Template already strips it, but hand-dropped user templates can carry one; a new board isn't born with trash) — **mint fresh GUIDs** for every lane/card folder, stamp `created`/`modified` fresh (the stated exception to 01-storage-format.md's copies-keep-`created` rule — a new board is born today, not forked from the template), seed the save panel's suggested name from the template title, and **set the new board's `title` to the user-chosen document name** (per 01-storage-format.md's board-naming rule, so display name and folder name start out matching). The `template:` key is kept — inert on an ordinary board. **`.git` is never copied** — a template is content, not history, and a hand-dropped user template that carries one must not produce boards that are silently in git mode (06-history-undo.md's no-silent-auto-init — the principle is *never give the user a repo they didn't ask for*, and it scopes to instantiation: File ▸ Duplicate deliberately carries `.git`, because a duplicate of a git board is a fork of its history — 03-board-ui.md): an instantiated board is never in *git* mode — its actual mode follows 06's nearest-`.git`-wins detection at the destination the save panel chose: mode `none` in a plain folder, repo-nested when saved inside an existing repository (no app-managed git, no add-git — the popover explains; native undo still serves, 06-history-undo.md). Beyond the `template:` residue, the result is indistinguishable from a hand-built board.
 
 ### Why this format
 
@@ -38,14 +38,14 @@ Creating a board from a template: copy the tree — **skipping tombstoned items*
 
 ## Save as Template
 
-A "Save as Template" function copies the current board into the user templates store; the chooser lists user templates after the bundled ones. **The copy is preceded by the close flush** (02-architecture.md ▸ Windows: editor saves, then the pending auto-commit — with the pull-style mechanical exception committing an open Edit session's on-disk saves as-is, sessions staying open), so the template never misses the last keystrokes; the same rule covers File ▸ Duplicate (03-board-ui.md), where the flush also keeps the copied `.git`'s history from lagging its tree. Under the read-only lock, Save as Template disables with one exception — the unwritable-location state, where it stays live unless an open Edit or raw-source session holds unsaved content the suspended saves can't flush (reads the board, writes Application Support; 02-architecture.md ▸ Live-reload resilience has the settled scoping). Because a template *is* a board, the copy is nearly literal: **`.git` is not copied** (a template is content, not history — copying it would embed the board's full repo, every attachment version included, in the template store; see 06-history-undo.md's repo-growth note), tombstoned items are dropped, a `template:` key is added — or, when the board already carries one (e.g. it was itself instantiated from a template), its stale `order` is overwritten — with an order appended after existing user templates; GUIDs are left as-is (instantiation mints fresh ones anyway), and timestamps are kept per 01-storage-format.md's copies-keep-`created` rule (equally inert — instantiation restamps them).
+A "Save as Template" function copies the current board into the user templates store; the chooser lists user templates after the bundled ones. **The copy is preceded by the close flush** (02-architecture.md ▸ Windows: editor saves, then the pending auto-commit — with the pull-style mechanical exception committing an open Edit session's on-disk saves as-is, sessions staying open), so the template never misses the last keystrokes; the same rule covers File ▸ Duplicate (03-board-ui.md), where the flush also keeps the copied `.git`'s history from lagging its tree. Under the read-only lock, Save as Template disables with one exception — the unwritable-location state, where it stays live unless an open Edit or raw-source session holds unsaved content the suspended saves can't flush (reads the board, writes the app-side store; 02-architecture.md ▸ Live-reload resilience has the settled scoping). Because a template *is* a board, the copy is nearly literal: **`.git` is not copied** (a template is content, not history — copying it would embed the board's full repo, every attachment version included, in the template store; see 06-history-undo.md's repo-growth note), `.trash/` is dropped, a `template:` key is added — or, when the board already carries one (e.g. it was itself instantiated from a template), its stale `order` is overwritten — with an order appended after existing user templates; GUIDs are left as-is (instantiation mints fresh ones anyway), and timestamps are kept per 01-storage-format.md's copies-keep-`created` rule (equally inert — instantiation restamps them).
 
 Two edges, settled:
 
 - **Store collisions auto-rename, Finder-style** (`Board.kanban` → `Board 2.kanban`) — the 01 import precedent: saving never overwrites an existing template and never refuses.
-- **Strays copy through.** The copy is literal apart from the stated exclusions (`.git`, tombstoned items) — `CLAUDE.user.md`, a seeded `.gitignore`, and other non-schema files carry through Save as Template *and* instantiation alike. Deliberate: a template is the folder, and `CLAUDE.user.md` carrying a board's custom agent instructions into boards born from it is a feature. The app-owned `CLAUDE.md` copies inertly and self-heals to the current guide version when the new board is opened (08-agent-integration.md).
+- **Strays copy through.** The copy is literal apart from the stated exclusions (`.git`, `.trash/`) — `CLAUDE.user.md`, a seeded `.gitignore`, and other non-schema files carry through Save as Template *and* instantiation alike. Deliberate: a template is the folder, and `CLAUDE.user.md` carrying a board's custom agent instructions into boards born from it is a feature. The app-owned `CLAUDE.md` copies inertly and self-heals to the current guide version when the new board is opened (08-agent-integration.md).
 
-**Storage (settled): Application Support** (`…/Lanework/Templates/`, inside the app container) as the canonical store — friction-free sandbox writes, no location ceremony — kept honest by a **Reveal in Finder** affordance in the template chooser: revealed, it's plain board folders, hand-editable and agent-writable, and a board folder dropped in becomes a template — **no `template:` key required**. Chooser order: bundled templates by `template.order`, then keyed user templates by `template.order`, then keyless user boards last, sorted by display name (`title` ?? folder name — 01-storage-format.md's board naming). An unloadable user template sorts with the keyless tier, by folder name — the failed load can supply neither `template.order` nor `title`, so the folder name is the only identity it has (and the one its unloadable row already shows). The app never stamps a key into store files it didn't write itself — a hand-dropped board is never touched, and adding a key by hand is how its user picks a position; the one writer of keyed files is Save as Template, whose own copies arrive keyed (above). A user-visible or user-configurable location was considered and set aside as ceremony disproportionate to a secondary feature; revisit if template sharing becomes a real workflow.
+**Storage (re-homed 2026-07-30 with the one-app collapse): the app's Application Support container** (`…/Application Support/<bundle id>/Templates/`, beside the registry per 02-architecture.md ▸ Per-board app state's app-wide-state rule) as the canonical store — friction-free sandbox writes, no location ceremony. Templates are plain board folders — no bookmark grant ceremony, the container is the app's own. Kept honest by a **Reveal in Finder** affordance in the template chooser: revealed, it's plain board folders, hand-editable and agent-writable, and a board folder dropped in becomes a template — **no `template:` key required**. Chooser order: bundled templates by `template.order`, then keyed user templates by `template.order`, then keyless user boards last, sorted by display name (`title` ?? folder name — 01-storage-format.md's board naming). An unloadable user template sorts with the keyless tier, by folder name — the failed load can supply neither `template.order` nor `title`, so the folder name is the only identity it has (and the one its unloadable row already shows). The app never stamps a key into store files it didn't write itself — a hand-dropped board is never touched, and adding a key by hand is how its user picks a position; the one writer of keyed files is Save as Template, whose own copies arrive keyed (above). A user-visible or user-configurable location was considered and set aside as ceremony disproportionate to a secondary feature; revisit if template sharing becomes a real workflow.
 
 ## Rejected alternative
 
@@ -57,4 +57,4 @@ Keeping the Swift-struct catalog (pathfinder approach). Simpler to ship, but it'
 
 ## Open questions
 
-None currently — the storage location is settled (Application Support as the canonical store, kept honest by Reveal in Finder; a user-visible or configurable location was set aside as ceremony, revisit if template sharing becomes a real workflow).
+None currently — the storage location is settled (the app's Application Support container as the canonical store, re-homed 2026-07-30 with the one-app collapse; kept honest by Reveal in Finder; a user-visible or configurable location was set aside as ceremony, revisit if template sharing becomes a real workflow).

DESIGN/10-accessibility.md

@@ -11,11 +11,11 @@ The stance is committed in 00-vision.md: **accessibility is a requirement of "na
 ## The board through VoiceOver
 
 - **Tree shape**: window → lanes (accessibility containers, in lane `order`) → cards (leaf elements, in card `order`). A lane container is labeled "⟨title⟩, lane, N cards" — the count reads the search filter like the visible badge (04-interactions.md). The lane header's new-card button is a labeled child ("New card in ⟨lane⟩"). A card is **one flattened element**: label = title (or the untitled placeholder), value carries the attachment count when present, selected state via trait. Face icon and chips are decorative — folded into the element, never separately focusable: the flattened element carries the attachment count in its value, and the accessible attachment surface is the card window's keyboard-native section (below); the face itself has no media presentation (03-board-ui.md's no-carousel resettlement).
-- **Logical order, not masonry position** (decided): within a wide lane, VoiceOver reads cards by `order` — the interior grid columns are presentation only. This deliberately diverges from on-screen geometry; the spatial arrow-key model (04-interactions.md) remains available alongside, since board keyboard navigation keeps working with VoiceOver running.
-- **VO cursor and app selection are independent** (Finder-style): moving the VoiceOver cursor never mutates selection. VO-Space on a card toggles its selection (the ⌘-click analogue — a toggle, never plain click's replace, 04-interactions.md ▸ Selection); ⌘↩ opens the card window; arrow keys and ⇧-arrows drive selection exactly as without VoiceOver. Selection state is always readable from the element (trait), and cut cards expose their dimmed pending state in the value ("cut, pending paste").
-- **Actions come from the context menu.** Context menus are the single inventory of per-item actions (Open, Rename, Delete, Put Back, Delete Immediately, width stepper, …), reachable the standard way (VO-⇧-M); where SwiftUI additionally surfaces menu items as custom accessibility actions, that's free improvement, not a separate design surface.
-- **Rotor**: lane titles are headings, so the headings rotor jumps lane-to-lane — on a one-dimensional board that *is* structural navigation; no custom rotors unless practice shows the need.
-- **Trash quasi-lane**: when shown (View ▸ Show Trash), it is the last container, labeled as Trash with its count; toggling visibility is announced. Tombstoned cards read their deletion state and expose Put Back / Delete Immediately via the context menu; there is no Open (03-board-ui.md's no-editing-in-the-trash). A tombstoned lane's single entry reads "⟨title⟩, deleted lane, N cards" and exposes the same actions; keyboard reachability follows 04-interactions.md's homogeneous-by-kind trash rules.
+- **Logical order, not masonry position** (decided): within a wide lane, VoiceOver reads cards by `order` — the interior grid columns are presentation only. This deliberately diverges from on-screen geometry (narrowed by the 2026-07-31 column-major masonry: walking down one column now *is* consecutive `order`; the divergence that remains is a geometry-sorted reading-order sweep — left-to-right, then down — which interleaves the columns); the spatial arrow-key model (04-interactions.md) remains available alongside, since board keyboard navigation keeps working with VoiceOver running.
+- **VO cursor and app selection are independent** (Finder-style): moving the VoiceOver cursor never mutates selection. VO-Space on any selectable element — card or lane header — toggles its selection (the ⌘-click analogue — a toggle, never plain click's replace, 04-interactions.md ▸ Selection; ruled 2026-07-29: a replace would silently wipe a multi-element selection, and one uniform VO-Space rule means the user never has to know the element kind to predict Space); ⌘↩ opens the card window; arrow keys and ⇧-arrows drive selection exactly as without VoiceOver. Selection state is always readable from the element (trait), and cut cards expose their dimmed pending state in the value ("cut, pending paste").
+- **Actions come from the context menu.** Context menus are the single inventory of per-item actions (Open, Rename, Delete, width stepper, …), reachable the standard way (VO-⇧-M); where SwiftUI additionally surfaces menu items as custom accessibility actions, that's free improvement, not a separate design surface. **The custom-action cut** (confirmed 2026-07-29): every plain button row of an item's context menu becomes a custom action; rows that open their own accessible surface (Style…'s popover) and non-action controls (the quick-style swatch picker) stay menu-only — the context menu remains the full inventory either way. Each action must call the same method as its menu row, so the two surfaces cannot drift.
+- **Rotor**: lane titles are headings, so the headings rotor jumps lane-to-lane — on a one-dimensional board that *is* structural navigation; no custom rotors unless practice shows the need. **The title doubling is accepted** (ruled 2026-07-29): entering a lane reads the container label ("Doing, lane, 3 cards") and then the heading ("Doing, heading") — two elements, two purposes: the label gives boundary-crossing context, the heading feeds the rotor. This is the platform-standard landmark-plus-heading pattern; collapsing it would cost the on-entry announcement, the more valuable half.
+- **Trash lane**: when shown (View ▸ Show Trash), it is the last container, labeled as Trash with its count; toggling visibility is announced — "Trash shown" / "Trash hidden" (confirmed 2026-07-29: resulting state, not the action, so a mis-hit tells the user where the board ended up and the toolbar toggle reads like the menu checkmark; the count stays on the container label, which VO reads on arrival, rather than duplicated into the announcement). Its cards are ordinary card elements (resettled 2026-07-28 — the materialized trash: no special states beyond the container) exposing Delete and Reveal in Finder via the context menu; there is no Open (03-board-ui.md's no-editing-in-the-trash), and restore is drag-out or the ⌘X/⌘V keyboard path; keyboard reachability follows 04-interactions.md ▸ The trash. A trashed **lane** (rejoined 2026-07-29) is one flattened opaque element — "⟨title⟩, deleted lane, N cards" — never a container: its cards are not in the tree (the opaque unit, 03 ▸ Trash), its actions are the same Delete / Reveal in Finder, and its restore paths are the same drag-out or ⌘X/⌘V.
 - **Search**: filtered-out cards leave layout and the accessibility tree together — the filter is the single source of truth for "what's on the board" (04-interactions.md), and the tree is one of its readers. Lane counts announced reflect the filter.
 
 ## Moving without dragging
@@ -24,12 +24,13 @@ The stance is committed in 00-vision.md: **accessibility is a requirement of "na
 - **Lanes**: the defect this doc originally named (lanes had no keyboard-move path) is closed by the keyboard map — with a lane selected, ⌘←/⌘→ move it (Board ▸ Move Left / Move Right, 04-interactions.md); cards gain ⌥⌘↑/⌥⌘↓ within-lane sorting, and cross lanes drag-free via cut/paste (04-interactions.md's clipboard rules). Lanes carry the clipboard too (resettled, 04-interactions.md ▸ Clipboard), so cross-board lane copy/move — once drag-only, the contract's last gap — is ⌘C/⌘X, then ⌘V with the destination board frontmost.
 - **Lane resize**: the header context menu's width stepper (03-board-ui.md) — and its keyboard face, the Increase/Decrease Lane Width menu items (⌥⌘→/⌥⌘←, 11-command-nexus.md) — is the accessible path; edge drag is enhancement only.
 - **Attachments**: the card window's sidebar items expose Open / Reveal in Finder / Remove via context menu, and the section is keyboard-navigable outright (arrows, Space-QuickLook, Return, ⌫ — 05-card-window.md); adding files drag-free is File ▸ Add Attachment… (⇧⌘A, 11-command-nexus.md) alongside Finder-drop.
+- **Comments** (05-card-window.md ▸ The comments column): the pane is a labeled container ("Comments, N"); each comment is **one flattened element** — author, date, edited state, body — with its context-menu rows (Edit / Delete / Reveal in Finder) riding as custom actions per the cut; the composer is a labeled text field (⌘↩ posts) and the header's sort control is Tab-reachable. Foreign comment arrivals announce path-shaped ("New comment on '⟨card⟩'") — the window-scoped read never blocks the announcement, which composes from the path alone. **Edits and deletes speak the same family** (pinned 2026-07-31): "Edit comment on '⟨card⟩'" / "Delete comment on '⟨card⟩'" — 06-history-undo.md's path-shaped verb family verbatim, arrivals leading by precedence, plurals folding ("3 new comments on 'X'"); the exact strings live in AccessibilityPhrases, one home.
 
 ## Live board announcements
 
-- **Foreign changes announce, app-mediated echoes never do.** The auto-committer already classifies every observed change as app-mediated or foreign (the EchoLedger — 02-architecture.md ▸ Components) and synthesizes diff summaries for commit messages (06-history-undo.md); announcements reuse that summarizer — one polite (non-interrupting) digest per reload debounce ("Board changed: 2 cards edited, 1 card added"), never per-file chatter. On no-git boards the same classifier runs without the committer — announcements don't depend on git mode.
-- **A vanishing focus is called out specifically.** If the selected or VO-focused card disappears in a reload (deleted externally, or hidden by a lane tombstone), the announcement names it ("Card 'Fix login' was deleted externally") and focus recovers to the card's lane (mirroring selection's reload-survival rules, 02-architecture.md). **When the lane itself vanished, recovery walks up then sideways** (settled): focus lands on the lane now occupying the vanished lane's position — the next lane by `order`, else the previous one — and on the board container only when no lanes remain (the ⌫-successor pattern, 04-interactions.md, applied to external change; never into the trash, which stays hidden — no layout side effects from a foreign edit). The announcement then names the *lane*, not the card ("Lane 'Doing' was deleted externally, with 5 cards") — the implied-events-don't-steal-the-subject discipline of 06-history-undo.md's composer, applied to speech.
-- **Bracketed operations announce once, at completion** ("Pulled 3 commits", "Switched to branch 'redesign'") — never their internal churn (02-architecture.md's bracketing). The live-reload-resilience banner (02-architecture.md) is an accessibility element and is announced when it appears and when it clears — including the read-only lock after a failed bracketed reload.
+- **Foreign changes announce, app-mediated echoes never do.** The auto-committer already classifies every observed change as app-mediated or foreign (the EchoLedger — 02-architecture.md ▸ Components) and synthesizes diff summaries for commit messages (06-history-undo.md); announcements reuse that summarizer — one polite (non-interrupting) digest per reload debounce ("Board changed: 2 cards edited, 1 card added"), never per-file chatter. **The announcer consumes the ledger's per-file facts on every reload origin, reconciling included** (ruled 2026-07-29 — the EchoLedger builds pre-release in base, not with Pro's committer): files changed during a blind window (sleep, deactivation) carry no receipts, so they classify foreign and announce — the launch-catch-up doctrine ("the app never vouches for changes it didn't witness") applied to speech; a reconciling reload that reveals external changes is never silent. On no-git boards the same classifier runs without the committer — announcements don't depend on git mode. **The digest covers the trash only while the trash lane is shown** (ruled 2026-07-29): with View ▸ Show Trash on, trash cards are ordinary elements of the visible board (▸ Trash lane above), so a foreign purge, restore, or Empty Trash joins the digest like any lane's churn — a user working in the shown trash must hear it emptied under them; while hidden, trash churn stays silent, matching "no layout side effects from a foreign edit". **A shown trashed-lane row's held count speaks when it changes** (ruled 2026-07-31): foreign churn *inside* a trashed lane's subtree is invisible to the snapshot, but the row's count is part of its visible face — a sighted user sees the number move, so the digest says it ("Deleted lane 'Doing' now holds 6 cards", plural-folded as usual), sourced from the disk-side held count. The opacity doctrine holds: the digest narrates the row's visible value, never the interior.
+- **A vanishing focus is called out specifically.** If the selected or VO-focused card disappears in a reload (deleted externally, or gone with its deleted lane), the announcement names it ("Card 'Fix login' was deleted externally") and focus recovers to the card's lane (mirroring selection's reload-survival rules, 02-architecture.md). **Naming and recovery are independent axes** (ruled 2026-07-29): when the head of a multi-selection vanishes but co-selected cards survive, the announcement still names the vanished head — the thing under the cursor was deleted, and that is what the rule exists to say — while the focus move is vetoed by the survivors (02's re-resolution rule: the head re-anchors within the surviving selection; a reload never edits a selection the user still partly holds). Vanished non-head members stay unnamed and fall to the digest's counts. **When the lane itself vanished, recovery walks up then sideways** (settled): focus lands on the lane now occupying the vanished lane's position — the next lane by `order`, else the previous one — and on the board container only when no lanes remain (the ⌫-successor pattern, 04-interactions.md, applied to external change; never into the trash, which stays hidden — no layout side effects from a foreign edit). The announcement then names the *lane*, not the card ("Lane 'Doing' was deleted externally, with 5 cards") — the implied-events-don't-steal-the-subject discipline of 06-history-undo.md's composer, applied to speech.
+- **Bracketed operations announce once, at completion** ("Pulled 3 commits", "Switched to branch 'redesign'") — never their internal churn (02-architecture.md's bracketing). The live-reload-resilience banner (02-architecture.md) is an accessibility element and is announced when it appears and when it clears — including the read-only lock after a failed bracketed reload. **Banner transitions are origin-independent** (confirmed 2026-07-29): "app-mediated echoes never announce" governs the change digest — never narrate the user's own edits — but a banner appearing or clearing is surface liveness, visible to a sighted user regardless of cause, so it speaks on any reload origin (an app write whose reload clears a breakage is exactly a moment the user should hear "cleared"). Precedence ladder: raised condition > bracket completion > cleared condition > vanished focus > digest.
 
 ## Card window, welcome, template chooser, popover
 
@@ -37,20 +38,22 @@ The stance is committed in 00-vision.md: **accessibility is a requirement of "na
 - **Welcome window**: recents rows are elements labeled "⟨name⟩, ⟨location⟩, N lanes, M cards" (name, icon, and counts all registry-cached — 02-architecture.md; the row never reads a board's files); row actions (Open / Reveal in Finder / Forget) via context menu; unavailable rows say so ("unavailable — board not found").
 - **Template chooser**: templates are elements labeled by title; the mini per-lane previews are decorative and hidden from the tree.
 - **Board popover**: labeled controls throughout; the ahead/behind indicator's information — counts, queued pushes, last error — must be readable as text, never conveyed by color or shape alone.
+- **Board settings sheet** — *retired 2026-08-07* (03 ▸ Board settings sheet; the 2026-07-31 popover/sheet split reversed). Its bar carries over to the popover's Git tab, which now hosts what it held: headers VoiceOver can navigate by (the Commit Identity block keeps its heading trait); labeled controls throughout; inline probe/verify outcomes announced from the focused surface; every control Tab-reachable under Full Keyboard Access. The original objection stands as the standing test — Tab-walking two dozen controls in an *untitled, unsectioned* surface fails this bar — and the tab strip plus per-block headings are what answer it now that the controls are back in the popover.
 - **Style editor** (card sidebar section, board popover, Style… popover — 03-board-ui.md ▸ Styling ▸ Controls): grids are arrow-navigable, every well Tab-reachable and labeled by name (palette color, symbol name; leading wells "None" / "Default"); the current value is stated by trait, and a batch selection's mixed state reads as "mixed", never conveyed by highlight alone.
 
 ## Text scaling & visual accommodations
 
 - **Full relative scaling** (decided): relative text styles everywhere, no fixed point sizes. Card face, lane header, and masonry metrics derive from font metrics, so layout survives the largest system text sizes; the no-horizontal-scroll invariant is untouched (lane count is the user's choice; lanes scroll vertically), and 03-board-ui.md's graceful-truncation rules apply at every scale.
-- **Contrast is pinned to WCAG AA.** Lane and card colors render as edge accents (03-board-ui.md's top-edge band / left-edge stripe), so text never sits on them — they are supplementary decoration, never the sole carrier of information, and carry no text-contrast obligation. The ≥ 4.5:1 automatic-contrast rule binds where text does sit on a user-chosen color: the **board** background (palette pairs verified at design time; arbitrary hex computes its text color at runtime against that threshold). An `#RRGGBBAA` background with alpha computes against the color **composited over its effective backdrop** in the active appearance (the board's over the window background; light and dark resolve differently), recomputed on appearance change. Increase Contrast strengthens borders and the selection indicator.
+- **Board zoom is that scaling's user-facing control** (settled 2026-08-02; behavior in 03-board-ui.md ▸ Layout, rows in 11-command-nexus.md). macOS ships no system text-size setting, so the commitment above had nothing to move it — the point size the whole board derives from is read once and never changes. View ▸ Zoom In / Zoom Out / Actual Size supply the multiplier: one ladder, one effective body size, and every em multiple and every text style scaling off it together. This is an accessibility feature before it is a convenience one, which is why it is a first-class menu command with a chord rather than a setting buried in a pane, and why **the strip's own truncation rules are the acceptance test** — 03's graceful-truncation promise "at every scale" is only checkable now that a scale exists. **A zoom change announces its new level** ("Zoom 125%") through the ordinary announcement path: it is chrome, not information — nothing about the board's meaning changes — so no label, value, or trait anywhere else moves with it.
+- **Contrast is pinned to WCAG AA.** Lane and card colors render as edge accents (03-board-ui.md's top-edge band / left-edge stripe), so text never sits on them — they are supplementary decoration, never the sole carrier of information, and carry no text-contrast obligation. The ≥ 4.5:1 automatic-contrast rule binds where text does sit on a user-chosen color: the **board** background (palette pairs verified at design time; arbitrary hex computes its text color at runtime against that threshold). The 2026-08-06 color-combo reversal (03 ▸ Styling ▸ Controls) changes none of this: a panel-picked color is stored as the palette name when it lands on one, else as hex, and either spelling renders through the same runtime ink seam — in-app picking gained the freedom hand-editing always had, and the ink math was already waiting for it. No warning surface exists or is owed; the app's answer to a low-contrast pick is to choose readable ink, not to argue. An `#RRGGBBAA` background with alpha computes against the color **composited over its effective backdrop** in the active appearance (the board's over the window background; light and dark resolve differently), recomputed on appearance change. Palette names and hex share one ink-selection code path — the palette's AA claim is pinned by a computed-contrast test over all 12 backgrounds in both appearances (ratified 2026-07-29). **The AA obligation binds the primary label tier** (ruled 2026-07-29): the ink seam moves the whole label hierarchy with the primary, and subordinate tiers (.secondary, .quaternary) inherit the system vocabulary's own contrast posture, which sits below 4.5:1 on any background including the system's — the platform-standard reading; the strict path for users who need more is Increase Contrast, which raises accents and washes to full alpha (▸ Visual accommodations). Increase Contrast strengthens borders and the selection indicator.
 - **State is never color-alone**: selection is a ring plus trait, cut-pending is dim plus stated value, the trash header is hatched plus labeled — all already patterned; kept as a rule.
 - **Reduce Motion is a per-voice rule, not a feature list** (settled): movement animations go **instant**, appear/disappear transitions go **crossfade**, uniformly — every animated surface derives its reduced variant from its voice, the store's reload seam included (the largest animated surface in the app), so new surfaces never need individual rulings. The named cases — reflow-on-drag, search animate-out, the drag replica's lift and settle transitions (its 1:1 tracking never animates, like the selection marquee, which needs no variant — 03-board-ui.md ▸ Motion), the lane-resize rubber-band feedback (03-board-ui.md ▸ Lane), trash animations — are applications of the rule, not the rule itself. **Reduce Transparency**: glass underlays go solid, wherever they appear.
-- **Full Keyboard Access** (independent of VoiceOver): the board is one tab stop with arrow-key navigation within; every control — lane buttons, popover, card window, welcome — is Tab-reachable.
+- **Full Keyboard Access** (independent of VoiceOver): the board is one tab stop with arrow-key navigation within; every control — lane buttons, popover, card window, welcome — is Tab-reachable. **"Every control" is literal and includes banner-row buttons** (ruled 2026-07-29): a Dismiss or Cancel on a banner must be a Tab stop — FKA serves sighted keyboard-only users, to whom VO custom actions are invisible, and Cancel on an in-progress operation is exactly the control that cannot require a pointer. This coexists with the VoiceOver presentation (one combined row-sentence with Dismiss/Cancel as custom actions): the AX combine and the FKA focus loop are independent surfaces; the implementation may uncombine conditionally under FKA if the focus system requires it.
 
 ## Verification
 
-- **Automated audits are test failures**: Xcode's accessibility audit (`performAccessibilityAudit`) runs in UI tests over every surface — board (trash shown and hidden), card window (Preview, Edit, raw source), welcome, template chooser, board popover.
-- **A manual VoiceOver smoke script** lives with the test plan: create lane → create card → rename → cut/paste to another lane → external edit lands (announcement heard) → delete → Put Back → Empty Trash. Run per release; it is the canonical "does the board actually work blind" check.
+- **Automated audits are test failures**: Xcode's accessibility audit (`performAccessibilityAudit`) runs in UI tests over every surface — board (trash shown and hidden), card window (Preview, Edit, raw source), welcome, template chooser, board popover. *(Amended 2026-08-07: the board settings sheet retired and its controls rehomed into the popover's Git tab, so the inventory is one surface shorter; auditing that tab specifically — the popover opens on Info — is an open card, tracked with the manual pass in `KanbanUITests/AccessibilityVerification.md`.)* **Pro surfaces audit through a fixture-gated tier override** (ruled 2026-08-06): the audit's every-surface claim reaches tier-gated UI (the settings sheet's Pro sections, remote/credentials, the card History section in its present state) via a launch flag honored **only when `UITestLaunch.isFixtureLaunch` is also set** — the fixture flag already redirects registry and app state to a scratch container and builds a throwaway board, so the override grants Pro on a disposable sandbox and never over real boards; a bare tier flag in the shipping binary would be a subscription bypass, and this one is not (a Terminal user gains a Pro-looking toy, not a working subscription). The weighed alternatives lose on the audit's own terms: a permanent manual-checklist carve-out would asterisk the every-surface claim, and a debug-build-only override would leave release builds unauditable. Surfaces whose reachable-state audit is genuinely partial pin what the free fixture can reach (the disabled settings row, the absent History section) *and* audit the full surface under the override — both states are shipping states, both audit.
+- **A manual VoiceOver smoke script** lives with the test plan: create lane → create card → rename → cut/paste to another lane → external edit lands (announcement heard) → delete → restore from the trash (⌘X/⌘V) → Empty Trash. Run per release; it is the canonical "does the board actually work blind" check.
 
 ## Changes from Kanban
 

DESIGN/11-command-nexus.md

@@ -10,7 +10,7 @@ The single source of truth for **every command and action the app can perform**
 | **M−** | Menu command, effectively fixed | Undo/Redo only: NSUndoManager rewrites their titles dynamically, which defeats title-matched remapping (04). |
 | **G** | Fixed grammar key | Platform grammar, deliberately not remappable — Finder's own Return/arrows aren't either (04 ▸ Grammar). |
 | **P** | Pointer grammar | Clicks, drags, modifiers — not customizable. |
-| **C** | Configuration control | Form-like controls (board popover, chooser, welcome); the keyboard path is reachability (Board Info ⌘I + Tab-reachable controls), not bindings — 04's configuration carve-out. |
+| **C** | Configuration control | Form-like controls (board popover, chooser, welcome); the keyboard path is reachability (Board Info ⌘I + Tab-reachable controls), not bindings — 04's configuration carve-out. *(Container amended 2026-08-07: the board settings sheet and its Board ▸ Board Settings… path retired with the reversal of the 2026-07-31 popover/sheet split — 03 ▸ Board settings sheet.)* |
 
 **Toolbar presence is a separate axis**, orthogonal to the classes: toolbar items mirror menu commands, their presence per window is user-customizable (Customize Toolbar — 03-board-ui.md ▸ Toolbar; defaults and catalogs live there), and a toolbar is never a function's only home. Labels match menu titles except Undo/Redo, whose toolbar labels stay static (03).
 
@@ -29,27 +29,34 @@ The single source of truth for **every command and action the app can perform**
 | File | Save as Template | — (no default) | Board window; 09-templates.md |
 | File | Reveal in Finder | — (no default) | Board window: the selection's folder(s), or the board root with nothing selected; card window: the card's folder — the selected attachment's file instead when the attachments section is focused; welcome: the selected recent's folder (disabled on unavailable rows) — the context-menu entry's required twin |
 | File | Add Attachment… | ⇧⌘A | Card window |
-| File | Delete | ⌘⌫ | Board window, live selection (chord twin of Put Back — validation enables exactly one). Deliberately **not** extended to the card window: an enabled ⌘⌫ key equivalent would steal delete-to-line-start from the window's text surfaces, so there the card's delete is the sidebar Actions button (05) |
-| File | Put Back | ⌘⌫ | Board window, tombstoned selection (chord twin of Delete) |
-| File | Delete Immediately | ⌥⌘⌫ | Board window, tombstoned selection; confirmed on boards without git history (mode none / repo-nested), immediate on git boards — 03 ▸ Trash |
+| File | Add Comment | — (no default) | Card window (all tiers — 12); if Show Comments is off, turns it on (persisted, the same user choice) and focuses the composer — 05 ▸ The comments column |
+| File | Delete | ⌘⌫ | Board window, any card or lane selection — staged by place (resettled 2026-07-28; lanes rejoined 2026-07-29): board cards and lanes move to `.trash/`, trash selections delete permanently (03's recoverability confirm — freight-counting for lanes). Deliberately **not** extended to the card window: an enabled ⌘⌫ key equivalent would steal delete-to-line-start from the window's text surfaces, so there the card's delete is the sidebar Actions button (05). **Delete Immediately (⌥⌘⌫) is deliberately absent** (removed 2026-07-30): permanence is only reachable inside the trash — 03 ▸ Trash |
 | File | Empty Trash… (confirmed) | ⇧⌘⌫ | Board window, trash shown and non-empty (whole-trash scope, search-independent — 03 ▸ Trash) |
 | File | Close | ⌘W | Any window; flushes per 02 ▸ Windows |
 | Edit | Undo / Redo (M−) | ⌘Z / ⇧⌘Z | Focus-routed (06 ▸ Undo routing): text undo in a focused editor, git undo otherwise; git undo disabled on no-git and repo-nested boards, during 06's abnormal-state pause (detached HEAD, in-progress merge/rebase), and under the read-only lock (02) |
-| Edit | Cut / Copy / Paste | ⌘X / ⌘C / ⌘V | Board window: cards and lanes (cards-XOR-lanes selections; lane paste lands after the anchor lane — 04 ▸ Clipboard; on a zero-lane board only a lane payload pastes — 04 ▸ ⌘N target rule); in the trash, ⌘C copy-out only (card and lane entries), ⌘X disabled (04 ▸ The trash); text editors: standard text clipboard |
-| Edit | Select All | ⌘A | Board: all visible live cards (filter-respecting); text editors: the text |
+| Edit | Cut / Copy / Paste | ⌘X / ⌘C / ⌘V | Board window: cards and lanes (cards-XOR-lanes selections; lane paste lands after the anchor lane — 04 ▸ Clipboard; on a zero-lane board only a lane payload pastes — 04 ▸ ⌘N target rule); in the trash, ⌘C copies out and ⌘X/⌘V is the keyboard restore path (resettled 2026-07-28 — 04 ▸ The trash); paste never targets the trash; text editors: standard text clipboard |
+| Edit | Select All | ⌘A | Board: all visible cards on the active board side (filter-respecting); on the active trash side it selects all visible trash rows, both kinds — the container boundary decides which "all" is meant, and trash selection is kind-blind (04 ▸ The trash); text editors: the text |
 | Edit | Find | ⌘F | Board window: board search (04 ▸ Search); card window: find-in-text (05) |
-| Edit | Find Next / Find Previous | ⌘G / ⇧⌘G | Card window: the find bar's stepping; disabled in the board window — board search is a live filter, not a cursor. **Use Selection for Find (⌘E) is deliberately absent**: the chord belongs to View ▸ Edit Body, which outranks the text view's binding; a user who wants it back remaps Edit Body system-natively |
+| Edit | Find Next / Find Previous | ⌘G / ⇧⌘G | Card window: the find bar's stepping — the rows enable only while the comments-thread find bar is up and step *that* bar; otherwise they disable and the chord falls through the responder chain to the focused text surface's own NSTextFinder stepping (pinned 2026-07-31 — routing by focus applied to find); disabled in the board window — board search is a live filter, not a cursor. **Use Selection for Find (⌘E) is deliberately absent**: the chord belongs to View ▸ Edit Body, which outranks the text view's binding; a user who wants it back remaps Edit Body system-natively |
 | Board | Open Card | ⌘↩ | Board window, sole selected live card; during an inline title edit (placeholder or rename), commits it and opens — the one board command enabled mid-edit (04 ▸ Grammar) |
 | Board | Rename | — (cards: Return in place) | Board window, sole selected card/lane; a lane's only rename path (Return on a lane creates); exists for completeness and remapping |
 | Board | Style… (the style editor; selection-aware) | ⌥⌘S | Board window: selected cards or lane; nothing selected = the board |
-| Board | Move Up / Move Down | ⌥⌘↑ / ⌥⌘↓ | Card selection within one lane (within-lane sort, logical order; non-contiguous selections gather behind their first card on the first press); disabled when the selection spans lanes; inert on lanes and on tombstoned cards |
+| Board | Move Up / Move Down | ⌥⌘↑ / ⌥⌘↓ | Card selection within one lane (within-lane sort, logical order; non-contiguous selections gather behind their first card on the first press); disabled when the selection spans lanes; inert on lanes and on trash cards |
 | Board | Move Left / Move Right | ⌘← / ⌘→ | Lane selection only (one slot; never into the trash) — cards cross lanes by drag or Cut/Paste, not ⌘-arrows; disabled while any text control is focused (04 ▸ Grammar, caret-chords rule) |
 | Board | Increase Lane Width / Decrease Lane Width (the stepper's re-divide semantics, never the window's size — 03 ▸ Lane) | ⌥⌘→ / ⌥⌘← | Selected lane(s) — batches over a multi-lane selection like style (03 ▸ Lane); disabled while any text control is focused (04 ▸ Grammar, caret-chords rule) |
 | Board | Pull / Push | — (no default) | Remote-backed boards only (07); disabled during 06's abnormal-state pause (the whole git surface holds) and on an unresolvable remote (07's one-time remote picker case); popover twins exist |
 | View | Show Trash (checkmark toggle) | — (no default) | Board window — ⇧⌘T is deliberately left to the system's Show Tab Bar: window tabbing stays enabled (settled; see Standard macOS furniture), so the chord is the system's; assign one via the remapping mechanism if wanted (04 ▸ Configurable bindings) |
+| View | Zoom In | ⌘+ | Board window; steps the board's zoom one rung up the ladder (03 ▸ Layout — zoom). Disabled at the top rung, and while a drag session is in flight (a drag freezes geometry the level feeds — the dragged run's heights and the resting-layout cache) |
+| View | Zoom Out | ⌘− | Board window; the twin, one rung down. Disabled at the bottom rung and under the same guard |
+| View | Actual Size | ⌘0 | Board window; returns to 100%, where the strip renders exactly what it rendered before zoom existed. Disabled when already there, and under the same guard. The level is app-wide and persisted across restarts (the Show Comments precedent) — a zoom is a viewing comfort, not a property of any one board |
 | View | Edit Body (checkmark toggle) | ⌘E | Card window; disabled while Raw Source is active |
+| View | Show Comments (checkmark toggle) | — (no default) | Card window; app-wide, persisted across restarts (re-ruled 2026-07-29 — no content-derived auto-show; 05 ▸ The comments column) |
+| View | Comments Beside Body (checkmark toggle) | — (no default) | Card window; checked = side-by-side (default), unchecked = body over comments; app-wide, persisted (05 ▸ Composition) |
 | View | Raw Source (checkmark toggle; toggling off = Apply) | ⌥⌘E | Card window |
 | View | History | — (no default) | Card window; focuses the sidebar History section (05); git boards only — section absent, item disabled on mode none / repo-nested |
+| View | Appearance ▸ Auto | — (no default) | Everywhere (no board or card window needed); app-wide, persisted across restarts — follows the system appearance; radio-exclusive with Light/Dark, checkmark on the active one (03-board-ui.md ▸ Toolbar) |
+| View | Appearance ▸ Light | — (no default) | Everywhere; app-wide, persisted across restarts; radio-exclusive with Auto/Dark |
+| View | Appearance ▸ Dark | — (no default) | Everywhere; app-wide, persisted across restarts; radio-exclusive with Auto/Light |
 | Window | Welcome to Lanework | — (no default) | Everywhere; shows (or focuses) the welcome window (02 ▸ Launch and window lifecycle) |
 
 ## Fixed grammar keys (G)
@@ -63,10 +70,13 @@ All board grammar keys are inert while a title editor is focused, and menu dispa
 | Return | Board, lane selected | Create card at its bottom (placeholder; Return commits and re-selects the lane) |
 | Return | Board, sole selected card | Inline rename; committing empty removes `title`; inert on multi-card selections |
 | Escape | Board window | One layer per press: abandon editor, else clear search (focus to board), else deselect |
-| ⌫ | Board, live selection | Tombstone — plain-key synonym of File ▸ Delete, kept grammar so no second "Delete" title exists (04) |
+| ⌫ | Board, any selection | Delete, staged by place — plain-key synonym of File ▸ Delete (board side moves to `.trash/`, trash side deletes permanently with 03's confirm), kept grammar so no second "Delete" title exists (04) |
 | Return | Card window, Preview | Enter Edit |
 | Escape | Card window, Edit | Return to Preview |
 | Return | Card window, title field | Commit title, focus into body |
+| ⌘↩ | Card window, comment composer or inline comment editor focused | Post the draft (rename + restamp, one commit) / end the edit session at its commit point — 05 ▸ The comments column; twinned by the Comment / Save buttons |
+| Escape | Card window, comment composer focused | Focus moves out, draft file untouched — Escape never discards a draft (ruled 2026-07-29; 05 ▸ The comments column) |
+| Escape | Card window, inline comment editor focused | Cancel — revert to session-start bytes and end the session, the Cancel button's keyboard twin (05) |
 | Escape | Card window, title field | Abandon: revert to the on-disk title, focus into body — routes by focus, winning over Edit-mode's Escape while the field is focused (05) |
 | Escape / ⌘↩ | Card window, source mode | Cancel / Apply (leaving-by-toggle is Apply too — 05) |
 | Arrows / Space / Return / ⌫ | Card window, attachments section focused | Row navigation / QuickLook / open / Remove to *system* Trash (05) |
@@ -87,18 +97,21 @@ Context menus are the per-item action inventory VoiceOver reads (10 ▸ The boar
 
 | Surface | Entries |
 |---|---|
-| Card | Open, Rename, Style…, quick-style recents row (03), Delete |
+| Card | Open, Rename, Style…, quick-style recents row (03), Delete (the ⌥-alternate Delete Immediately row retired with the command, 2026-07-30) |
 | Lane | One menu, invoked on the header or lane empty space (settled — a full lane still has its header): Rename, Style…, quick-style recents row (03), Width control (stepper — menu twins Increase/Decrease Lane Width), Delete |
-| Trash entries | Put Back, Delete Immediately, Reveal in Finder (inspection before a purge; twin of File ▸ Reveal in Finder, which is not edit-shaped and stays enabled on tombstoned selections — 04 ▸ The trash) |
+| Trash selection | Delete (permanent — 03's recoverability confirm), Reveal in Finder (inspection before a purge; twin of File ▸ Reveal in Finder, not edit-shaped, enabled on trash selections — 04 ▸ The trash) |
 | Attachment row | Open, Remove (system Trash) — twins of the focused section's grammar keys (Return / ⌫ — 05); Reveal in Finder — twin of File ▸ Reveal in Finder in its attachments-focused context |
+| Comment | Edit (inline session — 05 ▸ The comments column), Delete (immediate, undoable — 01), Reveal in Finder |
 | Welcome recent | Open, Reveal in Finder, Forget (C — registry management, welcome-scoped) |
 
 ## Configuration controls (C)
 
-- **Board popover** (Board Info ⌘I — 03 ▸ Board popover): board rename; embedded style editor; add-git (mode none) / repo-nested explanation (06); branch display, switch, create; commit-identity name/email (06); add/change remote, credential fields, the SSH key surface — machine key Copy + Verify, key import by paste or drag, the per-host key picker, removal of an unreferenced import, confirm-gated machine-key regeneration — Authentication-needed state (07); ahead/behind with Pull/Push buttons and the push-on-commit toggle.
+- **Board popover** (Board Info ⌘I — 03 ▸ Board popover; **the board's one configuration surface** since the 2026-08-07 reversal of the 2026-07-31 popover/sheet split): board rename and the board glyph; the Theme tab's preset backgrounds; the Info tab's dossier; and the Git tab — posture lines (repo-nested explanation, unreadable/paused states — 06); branch display and switch picker with its New Branch… reveal; add-git (mode none, 06); commit-identity name/email (06); ahead/behind with Pull/Push buttons and the status badges.
+- **Board settings sheet** — *retired 2026-08-07* (03 ▸ Board settings sheet). Its contents rehomed into the popover above, and Board ▸ Board Settings… left this document's menu inventory with it. 07-sync-collab.md's own surfaces — add/change remote with inline verify, credential fields, the SSH key surface (machine key Copy + Verify, key import by paste or drag, the per-host key picker, removal of an unreferenced import, confirm-gated machine-key regeneration), the Authentication-needed capture and TOFU confirms, the push-on-commit toggle — need a home ruled on that card; they were inventoried here as the sheet's and are homeless until then.
 - **Style editor** (three anchors — 03 ▸ Styling ▸ Controls): grids arrow-navigable, every well Tab-reachable.
 - **Template chooser** (09): template selection; Reveal in Finder for the user store.
 - **Welcome** (03): recents list; Forget.
+- **Comments header** (05 ▸ The comments column): the sort-direction control (ascending/descending, app-wide persisted) — Tab-reachable beside the count.
 
 ## Standard macOS furniture
 

DESIGN/12-editions.md

@@ -1,45 +1,59 @@
-# Editions
+# Tiers
 
-Lanework ships as three editions built from one codebase and one on-disk format. This doc owns the edition axis: what each edition is, how the split is engineered (targets, the provider seam), and which features land where. Individual docs stay edition-agnostic where they can — they conditionalize on **board mode** (none / git / git+remote — 07-sync-collab.md), and this doc defines which modes each edition ships.
+Lanework ships as **one Mac App Store app** — `dev.rzen.indie.Kanban`, free, 2.0 updating the existing record — built from one codebase and one on-disk format, with **Lanework Pro as an auto-renewable subscription** unlocking the git tier. This doc owns the tier axis: what each tier is, how the gate is engineered (the provider seam, the entitlement), and which features land where. Individual docs stay tier-agnostic where they can — they conditionalize on **board mode** (none / git / git+remote — 07-sync-collab.md), and this doc defines which modes each tier ships.
 
-## The three editions
+**PIVOT 2026-08-07 — git leaves the paywall.** Git integration — detection, adoption, auto-commit, git-backed undo/history, branches (06-history-undo.md), and remotes/auth when they ship (07-sync-collab.md) — is **tier-independent**: every tier composes the git stack on git-mode boards exactly as Pro did. The base/Pro feature split is being re-decided, and git isn't going to be it. Until the new split is ruled: the subscription **machinery stays built and tested but dormant** — the entitlement's mechanics (local read, composition-time, offline grace, the recorded session tier) are unchanged and correct for whatever the next split gates, but the Settings Pro section is not rendered and no surface names or sells Pro. The free-only git postures are **retired**: the inert-`.git` stance and the popover's Pro pointer describe a gate that no longer exists — a `.git` at a board root is live in every tier, detection runs at every board open, and every board carries the popover's Git tab (the mode-driven postures: no-repository door, repo-nested, unverifiable, branch). What the pivot does **not** change: git stays **opt-in per board** (06 — creating a local repository is the user's deliberate choice, never auto-initialized), and a board without app-managed git binds conventional native undo/redo (13) exactly as before — the provider still follows the board. The sections below describing the git gate (the tier matrix's git rows, the inert posture, no-grandfathering) stand as record of the pre-pivot design and are not restated; read them through this note.
 
-- **Lanework** (base) — no git integration. Boards are plain folders (mode `none` everywhere); undo/redo is macOS-native (13-native-undo.md). The full board experience: lanes, cards, styling, trash, attachments, card window, templates, agents, accessibility.
-- **Lanework Pro** — git integration as designed in 06-history-undo.md and 07-sync-collab.md: opt-in init, adoption, git-backed undo/history, branches, remotes, pull/push, auth. Plus Pro-only differentiators (matrix below).
-- **Lanework Teams** — Pro plus tracker integration over the reserved enhanced schema (`remote`/`remote-state`, `comments/` — 01-storage-format.md). **Deferred** — months out, no design pass yet; this doc only keeps the seam honest.
+**Re-ruled 2026-07-30 — the one-app collapse.** This supersedes the 2026-07-27 two-app split (separate base and Pro targets) and the 2026-07-29 App Group ruling that served it. The split's compile-time purity (base never links libgit2, no network entitlement) dragged permanent coexistence machinery behind it: a shared App Group, per-edition grant slots (security-scoped bookmarks never cross sandboxes), registry freshness stamping between two live processes, UTI-ownership twins, a both-apps-installed rulebook — a tax on every layer that generated a steady stream of design findings, all serving a state (two sandboxed apps sharing app-side state) that existed only because the packaging created it. One app makes that state unrepresentable. Costs accepted with eyes open: libgit2 rides dormant in the free download, and the one app declares the network-client entitlement (exercised only under Pro) — the "free app provably has no network access" story is traded for "no network use until you subscribe," which is honest but weaker.
 
-Why a real split and not feature flags: the editions differ at the binary level — base ships without libgit2 and without the network-client entitlement; Pro links git machinery and talks to remotes. And the strategic reason (settled): Teams' card sync must be **backend-agnostic** — it has to work over git and over a range of trackers — so history and sync must sit behind a genuine provider seam. Base's native undo is the first proof the seam is real: two working history providers before a third arrives.
+## The tiers
 
-## Distribution (settled)
+- **Lanework** (free) — no git integration. Boards are plain folders (mode `none` everywhere); undo/redo is macOS-native (13-native-undo.md). The full board experience: lanes, cards, styling, trash, attachments, card window, templates, comments (when they ship), agents, accessibility.
+- **Lanework Pro** (subscription) — git integration as designed in 06-history-undo.md and 07-sync-collab.md: opt-in init, adoption, git-backed undo/history, branches, remotes, pull/push, auth. Plus Pro-only differentiators (matrix below).
+- **Lanework Teams** — tracker integration over the reserved enhanced schema (`remote`/`remote-state`, tracker-*synced* comment threads — comments themselves ship in every tier). **Deferred** — no design pass; probably a separate app when it comes. Whatever shape it takes, it will **never share an app group or any cross-app state** with Lanework (ruled 2026-07-30) — files are the only interchange this family recognizes.
 
-Separate Mac App Store apps — real Xcode targets, not an IAP unlock. Both editions declare the same `.kanban` package UTI (`dev.rzen.indie.kanban-board`) verbatim, so any board opens in either app; the format is one format, owned by 01-storage-format.md, with no edition-specific keys. Upgrade path is buying the other app; boards need no migration whatsoever (files are the interchange).
+The strategic reason for the seam stands unchanged (settled): Teams' card sync must be **backend-agnostic** — it has to work over git and over a range of trackers — so history and sync sit behind a genuine provider seam. The free tier's native undo is the first proof the seam is real: two working history providers before a third arrives.
+
+## Distribution (re-ruled 2026-07-30)
+
+One record: `dev.rzen.indie.Kanban`, free, all territories, 2.0 as an update — the 1.x listing simply grows the subscription. The `.kanban` package UTI (`dev.rzen.indie.kanban-board`) is declared and exported once, by the one app — no ownership twins, no default-claim choreography. **Lanework Pro is an auto-renewable subscription** (StoreKit 2), purchased and managed in a **Pro section of Settings (⌘,)** — subscribe, manage, restore purchases. Teams' eventual monetization is deferred with Teams. **2.0 ships only when both tiers are ready** (ruled 2026-07-31 — RELEASE.md): the Settings Pro section never faces a store without its product, so its unreachable state is only ever a true sentence.
+
+**No grandfathering** (ruled 2026-07-30): 1.x shipped git-backed undo free; 2.0's free tier is native undo over the inert-`.git` posture (below). Existing users' boards keep working untouched, their histories stay intact and inspectable in any git client — the app just stops *extending* them until Pro is subscribed, and git resumes exactly where it left off (the committer's whole-root staging collapses the gap into one catch-up commit). No receipt-date logic exists.
+
+## The entitlement (ruled 2026-07-30)
+
+- **A local read, never a network call.** Pro state is read from StoreKit's signed on-device transaction store at **board-session composition** — the open path gains no network dependency (02-architecture.md's hang-avoidance doctrine extends here). Offline with an active subscription is indistinguishable from online.
+- **Subscribe takes effect at each board's next open** — the provider binding is a composition-time fact, the design the seam was built for. The purchase flow offers to reopen open boards so the upgrade feels immediate.
+- **A lapse never interrupts an open session**: an open board finishes with the provider it composed; the next open composes the native stack over inert `.git`. Unsubscribed and lapsed are **one state** — the inert posture, nothing lost, histories frozen not forfeited.
+- **Offline grace resolves toward the paying user**: an on-disk expiry passing while offline, with the last known state *active and auto-renew on*, holds the entitlement until StoreKit actually refreshes and answers. A cancellation (auto-renew off) lapses at expiry, offline or not. Either wrong-for-a-window direction costs nothing: a wrong lapse pauses auto-commits into one catch-up commit; a wrong hold gives away days of local commits — Apple's own billing grace makes the same trade.
+- **A fresh install that has never been online** has no cached transactions and reads as the free tier until the first refresh — honest and self-correcting.
 
 ## The provider seam
 
-History (and later sync) is a provider behind one protocol boundary, chosen per edition at the composition root:
+History (and later sync) is a provider behind one protocol boundary, bound per board session at composition from the entitlement:
 
-- **HistoryProviding** — the undo/redo substrate. Base binds the native undo stack (13-native-undo.md: NSUndoManager over inverse `WriteOperation`s). Pro binds the git provider (06-history-undo.md: undo as forward restore commits over HEAD's first-parent ancestry). Teams inherits Pro's.
+- **HistoryProviding** — the undo/redo substrate. **The provider follows the board** (re-ruled 2026-07-31): gitless boards bind the native undo stack (13-native-undo.md: NSUndoManager over inverse `WriteOperation`s) in every tier — an upgrade never removes undo — while Pro binds the git provider on git boards (06-history-undo.md: undo as forward restore commits over HEAD's first-parent ancestry); repo-nested boards bind native too (re-ruled 2026-07-31 — the stack touches no git, so what matters is the absence of *app-managed* git, and the upgrade story is exceptionless). Teams inherits Pro's. Add-git swaps native → git mid-session by the branch-switch discard-and-reseed precedent (13).
 - **Sync/tracker providers** — deferred with Teams; the reserved schema keys and the one-way file flow (02-architecture.md) are the format-level seam already in place.
 
-What is shared across providers (settled): **06's Undo routing is edition-independent** — focus decides text-undo vs board-undo; only the substrate behind board-undo differs. The command surface is identical (⌘Z/⇧⌘Z, dynamically retitled menu items — both providers use NSUndoManager's title rewriting); menu titles draw on the same semantic vocabulary (06 ▸ Commit messages). A user moving between editions relearns nothing.
+What is shared across providers (settled): **06's Undo routing is tier-independent** — focus decides text-undo vs board-undo; only the substrate behind board-undo differs. The command surface is identical (⌘Z/⇧⌘Z, dynamically retitled menu items — both providers use NSUndoManager's title rewriting); menu titles draw on the same semantic vocabulary (06 ▸ Commit messages). A user subscribing (or lapsing) relearns nothing.
 
-## Base and `.git` — the inert posture (settled)
+## The free tier and `.git` — the inert posture (settled; now also the lapsed posture)
 
-Base Lanework generalizes the repo-nested stance to every `.git` it meets: **any `.git` is inert**. Opening a board that has one (a Pro user's board, a repo-nested board) works normally — files read and write as on any board, native undo runs, the trash works — but the app never reads history, never commits, never touches `.git` in any way. To base, `.git` at the board root is a stray like any other, preserved verbatim. Pro's external-writer machinery (06 ▸ Interaction with external writers) already reconciles the uncommitted drift a base session leaves behind — a base edit is just a foreign change to Pro. The watcher's `.git` event filtering stays in base (it exists to ignore git churn, which mixed households will produce).
+The free tier generalizes the repo-nested stance to every `.git` it meets: **any `.git` is inert**. Opening a board that has one (a formerly-subscribed user's board, a 1.x board, a repo-nested board) works normally — files read and write as on any board, native undo runs, the trash works — but the app never reads history, never commits, never touches `.git` in any way. To the free tier, `.git` at the board root is a stray like any other, preserved verbatim. Pro's external-writer machinery (06 ▸ Interaction with external writers) already reconciles the uncommitted drift a free-tier session leaves behind — a free-tier edit is just a foreign change to the git provider's next composition. The watcher's `.git` event filtering is unconditional (it exists to ignore git churn, which lapsed-and-resumed boards will produce).
 
-Base's popover git slot (03-board-ui.md ▸ Board popover) does not offer add-git. **Its posture is contextual** (settled — ruled 2026-07-27): on ordinary boards the section is simply absent — the popover is rename + style, complete in itself. Only when the board carries an inert `.git` does a calm info line appear: "This board has a git history. Lanework Pro works with it." — an honest explanation of what the folder is, surfacing exactly where the question arises, never a standing ad. The card window's absent History section follows the same pattern: absent, no placeholder.
+The free tier's popover git slot (03-board-ui.md ▸ Board popover) does not offer add-git. **Its posture is contextual** (settled — ruled 2026-07-27, carried through the collapse): on ordinary boards the section is simply absent — the popover is rename + style, complete in itself. Only when the board carries an inert `.git` does a calm info line appear: "This board has a git history. Lanework Pro works with it." — an honest explanation of what the folder is, surfacing exactly where the question arises, never a standing ad; it is also the one in-context pointer to Settings' Pro section. The card window's absent History section follows the same pattern: absent, no placeholder.
 
-## Edition matrix
+## Tier matrix
 
 The feature sort. Everything not listed rides with "board experience" and is identical everywhere.
 
-| Feature | Lanework | Pro | Teams |
+| Feature | Lanework (free) | Pro | Teams |
 |---|---|---|---|
 | Board experience: lanes, cards, drag & drop, keyboard map, clipboard, search, styling, trash, attachments, card window, templates, welcome screen | ✓ | ✓ | ✓ |
 | Agent integration: agent guide, `modified-by` attribution, tolerance rules | ✓ | ✓ | ✓ |
 | Accessibility (10-accessibility.md, all of it) | ✓ | ✓ | ✓ |
-| Comments (post-2.0 design pass; per the standing decision, **all editions**) | ✓ (future) | ✓ (future) | ✓ (future) |
-| Undo/redo | native (13) | git (06) | git (06) |
+| Comments (designed 2026-07-29 — 01 ▸ Enhanced schema + 05 ▸ The comments column; ships post-2.0) | ✓ | ✓ | ✓ + tracker-synced threads |
+| Undo/redo | native (13) | git on git boards, native otherwise — repo-nested included (06/13, re-ruled 2026-07-31) | inherits Pro |
 | Undo of foreign/agent edits | — (honest gap, 13) | ✓ (stack absorbs foreign commits) | ✓ |
 | Overwrite protection (flush-before-overwrite, both-versions-as-commits) | — (07's accepted caveat is permanent here; trash + native undo are the safety story) | ✓ | ✓ |
 | History surfaces: card History sidebar (05), View ▸ History (11) | — | ✓ | ✓ |
@@ -48,16 +62,20 @@ The feature sort. Everything not listed rides with "board experience" and is ide
 | "While you were away" digest (WISHLIST item 1, requires git) | — | ✓ (future) | ✓ (future) |
 | Tracker integration (`remote`/`remote-state` sync, tracker-backed boards) | — | — | ✓ (future) |
 
-Docs 06 and 07 are **Pro-edition docs**; every other doc applies to all editions, with mode-conditioned passages (undo availability, popover git surface, Delete Immediately's confirmation branch) resolving per the modes the edition ships. Base ships exactly one mode: `none` (with the inert-`.git` posture above); Pro ships the full state machine.
+Docs 06 and 07 are **Pro-tier docs**; every other doc applies to all tiers, with mode-conditioned passages (undo availability, popover git surface, the permanent-delete confirmation branch) resolving per the modes the tier ships. The free tier ships exactly one mode: `none` (with the inert-`.git` posture above); Pro ships the full state machine.
 
-## Targets (settled shape; details at implementation)
+## The target (re-ruled 2026-07-30)
 
-Three app targets sharing sources: `Lanework` (base — excludes Pro-only source dirs, no libgit2, current minimal entitlements), `LaneworkPro` (adds git sources, libgit2 dependency, network-client entitlement, Keychain access), Teams deferred. **Bundle ids** (settled — ruled 2026-07-27): base keeps `dev.rzen.indie.Kanban` — it is the current app and ships first, so nothing re-wires; Pro mints `dev.rzen.indie.KanbanPro` with matching test-target ids; Teams reserves nothing yet. Shared UTI declaration in both Info.plists (base remains the exporter); distinct icon assets; parallel test targets and schemes. Milestones: the current plan's m7-git-undo and m8-remote-sync become Pro milestones, built as the git HistoryProvider behind the seam after base ships; a new native-undo milestone takes their place for base.
+**One app target.** The 2026-07-27 target split retires wholesale: the `KanbanPro` target, scheme, bundle id, module-alias test arrangement, `verify-editions.sh`, and the edition-twin files (EditionAbout, EditionTypes — Info.plist-posture twins existed only because two bundles claimed different ownership) all come out; the UTI is exported once. libgit2 links into the one target when the git provider is built (pro-m1) — dormant code behind the entitlement gate, not a second binary. Entitlements: the current minimal set plus `network-client` (exercised only under Pro; Keychain needs no access group — groups exist for sharing across apps). The pro-m1/pro-m2 milestones are unchanged in content — the git HistoryProvider and remote sync, built behind the seam — they now compile into the one target and activate by subscription.
 
-## Edition naming in base (settled — ruled 2026-07-27)
+## App-side state (re-ruled 2026-07-30)
 
-**Quiet signposts.** Base presents as a complete app, not a demo: Pro is named in exactly two places — one line in the About box, and the contextual popover line on `.git` boards (above). Nothing on the welcome screen, nothing in banners. The iCloud/network-volume warning (07-sync-collab.md) is rewritten for base without the git recommendation — it warns on its own merits (eviction, silent forks) and recommends a local folder; there is no git to recommend and no Pro pitch in a warning (a warning that sells reads as manufactured).
+One sandbox: the board registry and its Application Support peers (02-architecture.md ▸ Per-board app state) home in the app's **ordinary sandbox container** — the App Group is removed wholesale, superseding the 2026-07-29 group ruling. No group entitlement, no per-edition grant slots (one bookmark per record), no per-edition open-now flags (one flag), no cross-process freshness stamping (one process — macOS apps are single-instance), no "Also open in…" awareness line, no group-id provisioning risk. The clipboard staging store, template store, and scalar defaults follow the same collapse.
+
+## Tier naming in the free app (settled — ruled 2026-07-27, carried through the collapse)
+
+**Quiet signposts.** The free tier presents as a complete app, not a demo: Pro is named in exactly three places — one line in the About box, the contextual popover line on `.git` boards (above), and the Settings Pro section where the subscription actually lives. Nothing on the welcome screen, nothing in banners. The iCloud/network-volume warning (07-sync-collab.md) is written for the free tier without a git recommendation — it warns on its own merits (eviction, silent forks) and recommends a local folder; no Pro pitch in a warning (a warning that sells reads as manufactured).
 
 ## Open questions
 
-None currently — bundle ids, the popover slot posture, and edition naming were ruled 2026-07-27 and are settled above.
+None currently — the one-app collapse, subscription shape, entitlement semantics, App Group removal, and no-grandfathering were ruled 2026-07-30; the popover slot posture and quiet signposts carry from 2026-07-27.

DESIGN/13-native-undo.md

@@ -1,21 +1,23 @@
-# Native Undo (base edition)
+# Native Undo
 
-The undo/redo substrate for base Lanework (12-editions.md), filling the one gap mode:none admits (06-history-undo.md, 07-sync-collab.md): boards without git had no undo. Pro's substrate remains git (06); this doc never applies there. The design problem is not NSUndoManager itself — it is native undo over **files-are-truth**: the disk can change underneath the stack, because the app is not the only writer.
+The undo/redo substrate for **every board without app-managed git** (re-ruled 2026-07-31 — the provider follows the board, not the tier alone; formerly free-tier-only, which made a Pro upgrade *remove* undo from mode-none boards). Since the 2026-08-07 pivot (12-editions.md — git left the paywall) the tier axis is gone entirely, and one thing the pivot does **not** change: git remains **opt-in per board** — creating a local repository is the user's deliberate choice (add-git, 06), never something the app initializes for them — so a board whose user never opted in keeps this conventional stack for good. The substrate is the board's mode alone: mode-none **and repo-nested** boards bind it (the repo-nested no-undo case retired 2026-07-31: leave-strictly-alone concerns *git*, and this stack never touches git — memory-only, journal-free, session-scoped — so what repo-nested denies is app-managed history, never ⌘Z; the upgrade story is thereby exceptionless), switching to the git provider (06-history-undo.md) where the board's own git exists. **Add-git swaps the substrate mid-session** — the commanded flip discards the in-session native stack and seeds the git trail from the root commit, the branch-switch discard-and-reseed precedent applied; a subscription lapse still never interrupts (12). The design problem is not NSUndoManager itself — it is native undo over **files-are-truth**: the disk can change underneath the stack, because the app is not the only writer.
 
 ## Rules
 
-- **One stack per board, owned by the board session.** Not per-window: every window over a board (board window, its card windows) shares the store and shares the stack. `window.undoManager` for board surfaces returns the session's manager; 06 ▸ Undo routing applies unchanged — text-editing surfaces get their session-scoped text undo, everywhere else ⌘Z/⇧⌘Z hit the board stack. Undo is board-local, exactly as git undo was.
-- **Registration at the Writer boundary.** Every app-mediated mutation already passes through the Writer as a `WriteOperation` (02-architecture.md) — that closed enum is the exact inventory of undoable operations. Each Writer call site registers the inverse operation, computed from the pre-write snapshot the store already holds: move → move back (original lane, original `order`); reorder → restore original `order`; rename → restore title; restyle → restore prior style; resize → restore prior width; Edit-session body save → restore prior body bytes; tombstone (⌫) → restore; restore (Put Back) → tombstone; create → remove the created folder.
-- **What is not undoable** (settled): **Permanently delete** (Delete Immediately, Empty Trash) — `purgeIsUnrecoverable` stays true in base, and the existing confirmation rule (03-board-ui.md) already fires on all base boards, since none have git history: the confirm *is* the safety. **Repair** (01-storage-format.md's duplicate-id remint) — undoing a remint would recreate the duplicate id the operation exists to remove. Both match their existing "destructive, confirmed, final" posture.
-- **Coalescing follows commit granularity** (settled): one gesture, one undo step — a multi-card move is one step with a plural title; an Edit session is one step, registered at the Edit→Preview flip (the effective Save — 05-card-window.md); a styling batch is one step (03's one-gesture-one-commit rule, substrate swapped). The 06 vocabulary supplies menu titles ("Undo Move 3 Cards"), via NSUndoManager's dynamic retitling — the same naming machinery both editions use.
+- **Two levels: one stack per board, one per open card window** (re-ruled 2026-07-31 — the session-coarsening model, superseding the pure one-stack rule): the **board stack** is owned by the board session and shared by board surfaces; a **card window owns its own stack** for the session it represents — every gesture issued in that window (comment post/delete/edit, body Edit sessions, style/details changes, attachment ops where undoable) registers there at fine grain, and `window.undoManager` answers with it (standard per-window AppKit scoping). Disk stays live throughout — files-first untouched; this is history granularity only. **Window close coarsens**: the session's net effect registers on the board stack as **one coarse step named "Changes to '⟨card⟩'"** (ruled 2026-07-31 — the board row reads "Undo Changes to 'Fix login'": plural and scope-flavored, distinct from every fine verb, honest about folding many kinds; the fine body-edit wording never leaks onto the board menu), values-based, whose undo restores the card subtree to its session-start state — deleted comments included — and whose redo reapplies the net effect; a session with no net change registers nothing. The coarse step is transactional at apply time: staleness validation runs per component (the field-level predicate below), and any stale component skips the whole step — never a partial session revert. **Session steps anchor by card identity, never by path** (ruled 2026-07-31): the coarse step — and the window's fine steps it folds — stores the card's UUID plus expected values, and apply-time validation resolves the card's *current* folder exactly the way the window itself always resolves its card (the per-snapshot UUID walk; `writeCardBody` already resolves trash locations on purpose). A tracked relocation — a lane move mid-session or after close, a trash move — therefore never stales the step; only genuine content changes do, which is what the validation exists to catch. A card that resolves nowhere (purged, or moved out of the board) is the honest skip. 06 ▸ Undo routing applies unchanged — text-editing surfaces get their session-scoped text undo above either stack. **Two stacks over one open card are the blessed shape** (2026-07-31): a board-issued gesture on a card whose window is open registers on the board stack while the window's own gestures register on the window stack — no ordering relation between the two, interleaving decided by ⌘Z focus (06 ▸ Undo routing); routing board gestures into the open window's stack was considered and rejected, since board ⌘Z must never see card-session steps.
+- **Registration at the Writer boundary.** Every app-mediated mutation already passes through the Writer as a `WriteOperation` (02-architecture.md) — that closed enum is the exact inventory of undoable operations. Each Writer call site registers the inverse operation, computed from the pre-write snapshot the store already holds: move → move back (original lane, original `order`); reorder → restore original `order`; rename → restore title; restyle → restore prior style; resize → restore prior width; Edit-session body save → restore prior body bytes; card or lane delete (⌫) → move back out of `.trash/` (lanes rejoined the trash 2026-07-29 — the recreate-from-capture inverse retires with the last destructive delete); restore-by-move → move back in; create → remove the created folder.
+- **What is not undoable** (settled): **Permanently delete** (the trash's Delete, Empty Trash) — `purgeIsUnrecoverable` stays true in base, and the existing confirmation rule (03-board-ui.md) already fires on all base boards, since none have git history: the confirm *is* the safety. **The duplicate-id remint** (01-storage-format.md — a silent scheduled heal since 2026-07-29, formerly the user-gated Repair) — heals aren't user gestures, so nothing enters the stack, and undoing one would recreate the duplicate id it exists to remove. Permanently delete matches its existing "destructive, confirmed, final" posture; the remint sits outside undo as all heals do. **Raw Source Apply** (blessed 2026-07-31): the hatch writes byte-for-byte outside every contract — no `modified` stamp, no attribution clear, and no history step at either level; an Apply-only session folds to no coarse step, and an Apply mixed into a session is invisible to the fold. The hatch's story is "you edited the file," and files-are-truth covers it — on git boards the write commits like any disk change (05-card-window.md's carve-outs are the same statement from the stamping side).
+- **Coalescing follows commit granularity** (settled; window scoping added 2026-07-31): one gesture, one undo step — a multi-card move is one step with a plural title; an Edit session is one step, registered at the Edit→Preview flip (the effective Save — 05-card-window.md) **on the card window's stack**, like every window gesture; the window close registers the one coarse session step on the board stack (Rules above); a styling batch is one step (03's one-gesture-one-commit rule, substrate swapped). The 06 vocabulary supplies menu titles ("Undo Move 3 Cards"), via NSUndoManager's dynamic retitling — the same naming machinery both editions use.
 - **Session-only persistence** (settled): the stack lives with the board session and dies at close/quit — standard macOS behavior. Git undo's survive-relaunch property is a Pro difference, stated honestly (12's matrix).
 - **Foreign writes never join the stack** (settled): NSUndoManager can only undo what the app mediated. An agent's or hand edit is not a step — the honest capability gap vs Pro (12's matrix). Foreign changes also do not clear the stack wholesale; collisions are handled lazily, per step, by validation:
-- **Staleness validation before every apply** (settled): an inverse operation re-checks its target against the current snapshot at ⌘Z time. **The predicate is field-level** (settled — ruled 2026-07-27): each step registers both sides of its write anyway (the before-value is the inverse; the after-value is what its write set), so validation compares the targeted field's current value against the expected after-value — nearly free, and truer to never-surprise-the-file than an existence-only check (an inverse rename must not clobber a foreign rename on a still-existing card; body steps compare bytes). Target folder gone, or the field no longer holding the step's after-value → the step is **skipped, not applied**: popped from the stack with an info-tone banner ("Undo skipped — 'Fix login' changed outside Lanework"), and ⌘Z falls through to the next step. Never apply a stale inverse on top of someone else's newer write. **Invalidation is lazy** (settled — ruled 2026-07-27): staleness is discovered at ⌘Z time, never by background pruning — the EchoLedger's foreign diffs do not eagerly drop colliding steps. The stack always looks full; with the field-level predicate a skip fires only on a genuine per-field collision, and a skipped step's banner explains itself, where eager pruning would shrink the stack invisibly mid-session.
+- **Staleness validation before every apply** (settled): an inverse operation re-checks its target against the disk — a fresh read of the target at ⌘Z time (blessed 2026-07-29: not the store snapshot, which is by construction one reload behind the app's own writes; a rapid ⌘Z run validated against the snapshot would compare pre-state and false-skip every step). **The predicate is field-level** (settled — ruled 2026-07-27): each step registers both sides of its write anyway (the before-value is the inverse; the after-value is what its write set), so validation compares the targeted field's current value against the expected after-value — nearly free, and truer to never-surprise-the-file than an existence-only check (an inverse rename must not clobber a foreign rename on a still-existing card; body steps compare bytes). Target folder gone, or the field no longer holding the step's after-value → the step is **skipped, not applied**: popped from the stack with an info-tone banner ("Undo skipped — 'Fix login' changed outside Lanework"), and ⌘Z falls through to the next step. Never apply a stale inverse on top of someone else's newer write. **Delete steps validate their undo by existence only** (blessed 2026-07-31): a delete's forward write sets nothing but the `modified` stamp (the arrival rank mint retired 2026-07-31), and a clock reading is not a choosable after-value — pinning it would false-skip the restore whenever an agent touched the trashed card; the undo therefore expects only that the trashed folder still exists, while the redo stays field-level via the restore's `order` write. **Invalidation is lazy** (settled — ruled 2026-07-27): staleness is discovered at ⌘Z time, never by background pruning — the EchoLedger's foreign diffs do not eagerly drop colliding steps. The stack always looks full; with the field-level predicate a skip fires only on a genuine per-field collision, and a skipped step's banner explains itself, where eager pruning would shrink the stack invisibly mid-session.
 - **Locks disable the stack** (settled): every read-only lock (vanished root, failed reload after wholesale ops, unwritable location — 02-architecture.md) disables Undo/Redo with the other mutating commands; the stack itself survives the lock and resumes when it clears. Steps landed before a lock validate like any other at apply time.
 
 ## Interaction with the trash
 
-⌫'s undo is restore and Put Back's undo is tombstone — the stack and the trash are two doors to the same tombstone state, never in conflict: undo of a delete is *identical* in effect to Put Back (position-preserving, 01's deletion bullet), just addressed by recency instead of by selection.
+⌫'s undo is the move back — a delete is a move into `.trash/` (cards resettled 2026-07-28; lanes rejoined 2026-07-29), so its undo is the ordinary inverse move, returning a card to its source lane and rank, a lane to its strip position (subtree intact — it never left the folder); a restore-by-move undoes the same way in reverse. The stack and the trash never conflict — they are the same folder moves addressed by recency instead of by selection. The old lane-delete recreate-from-capture inverse is **retired** — no destructive delete remains outside a trash, so nothing needs byte capture. A **permanent delete registers no step** — the trash's Delete and Empty Trash are not undoable (Rules above), lanes and their freight included; the confirm is the safety.
+
+**Comments keep the no-capture rule true — on the window stack** (re-ruled 2026-07-31, superseding the board-stack routing): a comment delete is a move into the card's `comments/.trash/` (01-storage-format.md ▸ Enhanced schema — the materialized-trash pattern one level down), its inverse the ordinary move back, and the step lives on the **card window's own stack** (Rules above) — the board stack never carries a granular comment step, so the old stale-after-close skip scenario cannot arise. **The purge of `comments/.trash/` defers with the coarse step** (re-ruled 2026-07-31, superseding purge-at-close): the coarse close step's undo restores deleted comments, so their backing lives as long as the step does — the purge runs when the coarse step leaves the board stack **cleanly** — undone-and-superseded, or dropped off the end — or when the board session ends; **a stale-skipped step's backing instead survives to board-session end** (ruled 2026-07-31, decoupling skip from purge): the skip banner says nothing was applied, and an irreversible purge riding that gesture would be surprise loss — the skip is exactly when the user may want to inspect what the collision left; crash residue still sweeps at the next card-window open — **and residue is defined by the purge-deferral condition itself** (ruled 2026-07-31): `comments/.trash/` content referenced by a live coarse step on the board stack is a step's backing, not residue — the open-time sweep consults the stack and skips owned content, re-arming when the owning step leaves the stack (which is exactly when the deferred purge wanted to run; one condition, two consumers). Reopening a window can therefore never destroy its prior session's undo backing. Unowned content sweeps as before, armed-then-cleared like every heal memo. **Every purge of `comments/.trash/` is per-entry behind the ownership gate** (ruled 2026-08-06 — the container-whole retirement purge retires): a step's retirement and a no-step close remove only entries no live step still backs — the same `backedContent` inventory the sweep consults, making it one condition, *three* consumers. The container-whole purge assumed one owning step per card's comment trash, and two sessions over the same card broke it: the second step's retirement — or a mere reopen-and-close that registered nothing — emptied the first step's backing out from under it, silently killing an undo the stack still promised. Under the gate a purge cannot stale a live step by construction; an entry that outlives its owner is collected by whichever consumer runs next (the next retirement, close, open-time sweep, or session end — convergence, not a leak). One carve-out: **an open card window is itself an owner of its card's comment trash** — a retirement firing while the card's window is open defers its purge to that window's close, because entries deleted in the live session are backed by the window's fine steps, which the board-stack inventory cannot see; the close then settles by the same gate (its coarse step becomes the owner, or the no-step close purges the unowned). On Pro the substrate is history: the close commit nets delete-plus-purge to a removal, revert restores it, so purge rides the close flush there as before — purge timing follows the undo substrate's need.
 
 ## Out of scope
 

DESIGN/14-git-operations.md

@@ -0,0 +1,37 @@
+# Git Operations — Extracted Conclusions
+
+**Tier scope: Lanework Pro** (12-editions.md). This doc extracts the settled conclusions from the pathfinder's git-operations analysis (`../../Kanban/AI-ANALYSIS-git-operations.md`, 2026-07-23) so the git milestone has a citable in-repo source. It resolves the design corpus's outstanding tbd — the git-operations doc extraction the Implementation board's root index names as one of two TBDs graduating into work items. The source file catalogued issues and deliberately made no decisions; the decisions were made in 06-history-undo.md and 07-sync-collab.md, and this doc records which of the source's conclusions those docs build on — and which of its leanings later design deliberately settled otherwise. Issue tags (A1, C3, …) are the source file's.
+
+## The forward-restore model (C3, C9) — the load-bearing extraction
+
+**Every restorative operation moves history forward. Nothing the app does ever rewrites a published commit: no reset, no force-push, no revert-by-rewrite.**
+
+- Undo (⌘Z) and redo (⇧⌘Z) restore earlier states as **new forward commits** ("Undo: ⟨subject⟩"). Reset-based undo is forbidden once any second observer exists — a remote, another machine, an agent reading the repo — because it rewrites history that observer may already have seen (C3). And the observer assumption is not optional: agents-as-concurrent-editors is a product requirement, so the safe case for reset (a never-pushed, never-read local tip) is never provable. Forward-only sidesteps the entire class.
+- Under sync, forward-only undo makes an undo **just another change for the sync loop to carry** — nothing special, no divergent realities for anyone who saw the abandoned state (C9). Reset-based undo would instead manufacture divergence with every ⌘Z.
+- The **one deliberate rewrite** in the app is pull's rebase of **unpushed local** commits (07-sync-collab.md) — local-only history, never published, rebased so the shared trail stays linear. Published history is never touched, by anyone, for any reason.
+
+This is the conclusion 06-history-undo.md's "Undo never rewrites history" rule builds on, and the reason a rewritten remote (an outside agent force-pushed) is treated as fresh divergence to merge — never mimicked locally, never force-pushed back (B7).
+
+## Persistence across relaunch (C8) — as later design settled it
+
+The source left C8 open between an in-memory stack that dies with the app and a git-enabled "restore to any point" browser. Later design settled it past both options, and the settled form is what m7 builds:
+
+- **No sidecar undo state, ever.** The undo stack **reseeds from HEAD's first-parent ancestry on load**; redo starts empty. In-session it behaves as classic dual stacks; after relaunch, past restore commits reappear as ordinary undoable steps (06-history-undo.md ▸ Rules). Nothing is stored beside the repo, so nothing can drift from it.
+- **The board-wide history browser / timeline is explicitly out of scope** — it is a tracker-integration-era feature (07-sync-collab.md's deferred story), not part of the git milestone. The commit trail remains its natural substrate whenever it happens; the forward-restore model is all the preparation it needs.
+- **The one deliberate carve-in**: the card window's read-only per-card History section (05-card-window.md) — a scoped log view, not a browser. Per-row restore and lane history stay on the wishlist.
+
+## What did not carry over
+
+Three of the source's leanings were settled **differently** by 06/07; they are recorded here so this doc cannot be read as endorsing them:
+
+- **C1, the undo substrate**: the source leaned toward a hybrid — model-layer inverse operations for ⌘Z, with git as a recorder. Settled differently: on git boards **the commit trail itself is the substrate** — the stack *is* HEAD's first-parent ancestry, and undo applies forward restore commits (06-history-undo.md). Inverse operations exist, but as the **free tier's** native undo substrate (13-native-undo.md) behind the same HistoryProviding seam — a tier seam, not a hybrid inside one system.
+- **A1, iCloud coexistence**: the source's lean (via the pathfinder wishlist) was dual mode per document — cloud-synced boards silently get no git. Settled differently: **iCloud Drive is not supported at all** — no accommodations, a thorough once-per-board warning that recommends local disk plus git remote, and no hard block (07-sync-collab.md ▸ iCloud Drive). Mode is decided by `.git` presence alone, never by the board's location.
+- **B6, sync cadence as the divergence budget**: the source framed cadence as the decision that determines how good a silent merge engine must be. Settled differently: **there is no merge engine** — auto-commit keeps the tree clean by pull time, pull rebases with local-wins on conflicting hunks, and rejected pushes fetch-rebase-push automatically, so conflicts are structurally impossible rather than managed (07-sync-collab.md). Cadence survives only as 06's history-legibility constraint (a shared board's log must stay bearable), not as a divergence budget.
+
+## Already absorbed — pointers, not restatements
+
+The rest of the source's conclusions that motivated 06/07 live there in settled form; cite those docs, not this one: repo maintenance and growth posture (A2 → 06 ▸ Repository hygiene), the commit-failure taxonomy and lock handling (A3 → 06 ▸ Interaction with external writers), the repo-state gate for foreign states (A4 → 06 ▸ Rules ▸ Abnormal repo states), auth and transport limits (B5 → 07 ▸ Remote authentication), history as a read surface and per-mutation semantic messages (B8, C2, and the source's strongest cross-cutting signal → 06 ▸ Commit messages), undo scope and focus routing (C6 → 06 ▸ Undo routing), and the connect-time privacy sentence (B9 → owed by the remote-setup surface; 07 ▸ Mode: git).
+
+## Open questions
+
+None — this doc extracts settled material only. The source file's eight "open decisions" are all closed: 1 (A1), 3 (B6), 4 (C1) as recorded above; 2 (A4), 5 (C2/B8), 6 (C4), 7 (C5) in 06-history-undo.md's Rules and Commit messages; 8 (C8) as recorded above.

DESIGN/README.md

@@ -13,23 +13,26 @@ Each document covers one aspect of the design. Within each:
 | Doc | Aspect |
 |---|---|
 | [00-vision.md](00-vision.md) | What Lanework is, who it's for, goals and non-goals |
-| [01-storage-format.md](01-storage-format.md) | On-disk contract: folders, frontmatter, ordering, tombstones |
+| [01-storage-format.md](01-storage-format.md) | On-disk contract: folders, frontmatter, ordering, the materialized trash |
 | [02-architecture.md](02-architecture.md) | App structure: source of truth, stores, watchers, concurrency |
 | [03-board-ui.md](03-board-ui.md) | Board window: layout, lanes, cards, styling, templates |
 | [04-interactions.md](04-interactions.md) | Selection, drag & drop, keyboard, clipboard, search |
 | [05-card-window.md](05-card-window.md) | The card window: Markdown preview/edit, attachments |
-| [06-history-undo.md](06-history-undo.md) | Git-backed undo/redo and history — **Pro edition** |
-| [07-sync-collab.md](07-sync-collab.md) | Board modes: local-only, git; iCloud Drive warned against — **Pro edition** |
+| [06-history-undo.md](06-history-undo.md) | Git-backed undo/redo and history — **Pro tier** |
+| [07-sync-collab.md](07-sync-collab.md) | Board modes: local-only, git; iCloud Drive warned against — **Pro tier** |
 | [08-agent-integration.md](08-agent-integration.md) | AI agents as first-class users of the board |
 | [09-templates.md](09-templates.md) | Board templates: inventory and definition format |
 | [10-accessibility.md](10-accessibility.md) | VoiceOver, text scaling, visual accommodations |
 | [11-command-nexus.md](11-command-nexus.md) | The command Nexus — every command and action: bindings, contexts, customizability |
-| [12-editions.md](12-editions.md) | The three editions (Lanework / Pro / Teams): distribution, provider seam, feature matrix |
-| [13-native-undo.md](13-native-undo.md) | macOS-native undo/redo — the base edition's history substrate |
+| [12-editions.md](12-editions.md) | The tiers (free / Pro subscription / Teams deferred): one-app distribution, entitlement, provider seam, feature matrix |
+| [13-native-undo.md](13-native-undo.md) | macOS-native undo/redo — the free tier's history substrate |
+| [14-git-operations.md](14-git-operations.md) | Extracted pathfinder git-operations conclusions: the forward-restore model — **Pro tier** |
 
 ## Deferred design iterations
 
-The card window (05-card-window.md), toolbar (03-board-ui.md ▸ Toolbar), and styling controls (03-board-ui.md ▸ Styling ▸ Controls) each had their focused pass and are settled. The 2026-07-27 edition split (12-editions.md) added two deferred passes: the attachment-undo staging design and the EchoLedger foreign-undo bridge (both flagged in 13-native-undo.md), plus Teams' tracker integration (no design yet).
+The card window (05-card-window.md), toolbar (03-board-ui.md ▸ Toolbar), styling controls (03-board-ui.md ▸ Styling ▸ Controls), and comments (01 ▸ Enhanced schema + 05 ▸ The comments column — designed 2026-07-29, shipping post-2.0) each had their focused pass and are settled.
+
+**The authoritative list of open design passes is the findings board** (Lanework Redesign.kanban ▸ Issues to Resolve) — this section stopped enumerating by hand after drifting twice. Standing examples as of 2026-07-29: the attachment-undo staging design and the EchoLedger foreign-undo bridge (both flagged in 13-native-undo.md), Teams' tracker integration (no design yet), the fail-fast decision surface (01 ▸ Refuse), and the drop-release settle presentation (03 ▸ Motion — deliberately last in line).
 
 ## Wishlist
 

DESIGN/explorations/board-backgrounds-faceted.html

@@ -0,0 +1,542 @@
+<title>Board Backgrounds — Facets</title>
+<style>
+:root{
+  --paper:#FAFAF7;
+  --ink:#1D1C1A;
+  --ink-2:#6E6A63;
+  --line:#E4E1DA;
+  --chip:#F0EEE8;
+  --accent:#5B6E8C;
+  --paper-a85: rgba(250,250,247,.85);
+}
+@media (prefers-color-scheme: dark){
+  :root:not([data-theme="light"]){
+    --paper:#181715;
+    --ink:#ECEAE5;
+    --ink-2:#98938A;
+    --line:#2E2C28;
+    --chip:#242220;
+    --accent:#8FA3C0;
+    --paper-a85: rgba(24,23,21,.85);
+  }
+}
+:root[data-theme="dark"]{
+  --paper:#181715;
+  --ink:#ECEAE5;
+  --ink-2:#98938A;
+  --line:#2E2C28;
+  --chip:#242220;
+  --accent:#8FA3C0;
+  --paper-a85: rgba(24,23,21,.85);
+}
+
+*, *::before, *::after{ box-sizing:border-box; }
+
+body{
+  margin:0;
+  background:var(--paper);
+  color:var(--ink);
+  font-family:-apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif;
+  -webkit-font-smoothing:antialiased;
+}
+
+.wrap{ max-width:1240px; margin:0 auto; padding:0 32px 64px; }
+
+.page-head{ padding:32px 0 16px; }
+.page-head h1{ font-size:22px; font-weight:600; margin:0 0 6px; text-wrap:balance; }
+.page-head .subtitle{ font-size:13px; color:var(--ink-2); margin:0; max-width:760px; }
+
+.controlbar{
+  position:sticky; top:0; z-index:10;
+  display:flex; align-items:center; gap:20px; row-gap:10px; flex-wrap:wrap;
+  padding:12px 0;
+  background:var(--paper-a85);
+  -webkit-backdrop-filter:blur(8px);
+  backdrop-filter:blur(8px);
+  border-bottom:1px solid var(--line);
+  margin-bottom:28px;
+}
+.chipgroup{ display:flex; gap:6px; flex-wrap:wrap; }
+.chip{
+  font:inherit; font-size:12px; padding:5px 11px; border-radius:999px;
+  border:1px solid var(--line); background:var(--chip); color:var(--ink);
+  cursor:pointer; line-height:1.3;
+}
+.chip:hover{ border-color:var(--accent); }
+.chip.active{ background:var(--accent); border-color:var(--accent); color:var(--paper); }
+.chip:focus-visible{ outline:2px solid var(--accent); outline-offset:2px; }
+
+.toggle{ display:flex; align-items:center; gap:6px; font-size:12px; color:var(--ink); cursor:pointer; user-select:none; }
+.toggle input{ width:14px; height:14px; accent-color:var(--accent); }
+.toggle input:focus-visible{ outline:2px solid var(--accent); outline-offset:2px; }
+
+.gen-note{ font-size:12px; color:var(--ink-2); font-family:ui-monospace,"SF Mono",Menlo,monospace; }
+
+.recipe-box{ margin-bottom:40px; }
+.section-label{ font-size:11px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink-2); margin:0 0 10px; }
+.recipe-list{ display:grid; grid-template-columns:1fr 1fr; gap:7px 32px; margin:0; }
+.recipe-item{ display:flex; gap:6px; font-size:13px; line-height:1.5; }
+.recipe-item dt{ margin:0; font-weight:600; color:var(--ink-2); flex:0 0 auto; }
+.recipe-item dd{ margin:0; color:var(--ink-2); }
+@media (max-width:720px){ .recipe-list{ grid-template-columns:1fr; } }
+
+.family{ margin-bottom:44px; }
+.family h2{ font-size:15px; font-weight:600; margin:0 0 4px; }
+.family .recipe{ font-size:13px; color:var(--ink-2); margin:0 0 14px; max-width:820px; }
+
+.colheads{
+  display:grid; grid-template-columns:repeat(3, 1fr); gap:14px;
+  margin-bottom:8px;
+  position:sticky; top:56px; z-index:5;
+  background:var(--paper-a85);
+  -webkit-backdrop-filter:blur(8px);
+  backdrop-filter:blur(8px);
+  padding:4px 0;
+}
+.colheads span{
+  font-size:11px; font-weight:600; letter-spacing:.06em; text-transform:uppercase;
+  color:var(--ink-2);
+}
+.grid{ display:grid; grid-template-columns:repeat(3, 1fr); gap:14px; }
+@media (max-width:720px){
+  .colheads{ display:none; }
+  .grid{ grid-template-columns:1fr; }
+}
+
+.card{ cursor:pointer; }
+.frame{
+  aspect-ratio:16/10; border-radius:8px; border:1px solid var(--line);
+  overflow:hidden; background:var(--chip);
+}
+.frame svg, .lightbox-frame svg{ display:block; width:100%; height:100%; }
+.caption{ display:flex; justify-content:space-between; align-items:baseline; margin-top:6px; font-size:11px; gap:8px; }
+.caption .swatch-id{ font-family:ui-monospace,"SF Mono",Menlo,monospace; color:var(--ink); }
+.caption .note{ color:var(--ink-2); white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+
+.board-overlay{ display:none; }
+body.show-overlay .board-overlay{ display:inline; }
+
+.lightbox{
+  position:fixed; inset:0; z-index:100;
+  display:flex; flex-direction:column; align-items:center; justify-content:center; gap:14px;
+  background:rgba(0,0,0,.55);
+  opacity:0; pointer-events:none;
+  transition:opacity .12s ease;
+}
+.lightbox.open{ opacity:1; pointer-events:auto; }
+.lightbox-frame{
+  width:min(92vw, 1100px); aspect-ratio:16/10; border-radius:10px; overflow:hidden;
+  box-shadow:0 24px 60px rgba(0,0,0,.45);
+  background:var(--chip);
+}
+.lightbox-id{ font-family:ui-monospace,"SF Mono",Menlo,monospace; font-size:12px; color:#fff; }
+
+@media (prefers-reduced-motion: reduce){
+  .lightbox{ transition:none; }
+}
+</style>
+<div class="wrap">
+  <header class="page-head">
+    <h1>Board Backgrounds — Facets, round 2</h1>
+    <p class="subtitle">The triangle mesh swept on the full axis set: vertex count (columns), color count (mono · complementary duo · contrasting trio), tone, and saturation. Brightness stays a narrow per-triangle jitter around the tone base. Hue wheel narrowed to four representatives this round — amber, forest, sky, rose — the full wheel returns for finals. 3 color counts × 2 tones × 4 hues × 3 saturations × 3 densities = 216 swatches. Reroll to reseed geometry and color assignment under the same recipes.</p>
+  </header>
+
+  <div class="controlbar">
+    <div class="chipgroup" id="strategy-chips" role="group" aria-label="Color-count filter">
+      <button type="button" class="chip active" data-strategy="all" aria-pressed="true">All</button>
+      <button type="button" class="chip" data-strategy="mono" aria-pressed="false">Mono</button>
+      <button type="button" class="chip" data-strategy="duo" aria-pressed="false">Duo</button>
+      <button type="button" class="chip" data-strategy="trio" aria-pressed="false">Trio</button>
+    </div>
+    <div class="chipgroup" id="tone-chips" role="group" aria-label="Tone filter">
+      <button type="button" class="chip active" data-tone="all" aria-pressed="true">All</button>
+      <button type="button" class="chip" data-tone="light" aria-pressed="false">Light</button>
+      <button type="button" class="chip" data-tone="dark" aria-pressed="false">Dark</button>
+    </div>
+    <label class="toggle">
+      <input type="checkbox" id="overlay-toggle">
+      <span>Board overlay</span>
+    </label>
+    <button type="button" class="chip" id="reroll">↻ Reroll geometry</button>
+    <span class="gen-note" id="gen-note">gen 1</span>
+  </div>
+
+  <section class="recipe-box">
+    <p class="section-label">Recipe parameters</p>
+    <dl class="recipe-list">
+      <div class="recipe-item"><dt>Vertices</dt><dd>coarse 5×3 cells (~20 triangles) · medium 9×6 (~97) · fine 14×9 (~230), grid-jittered then Delaunay-triangulated</dd></div>
+      <div class="recipe-item"><dt>Colors</dt><dd>mono · duo = complement H+180° weighted 65/35 · trio = triad H±120° weighted 50/30/20, picked per triangle</dd></div>
+      <div class="recipe-item"><dt>Saturation</dt><dd>soft · mid · rich row bands, jittered ±15% per triangle</dd></div>
+      <div class="recipe-item"><dt>Brightness</dt><dd>narrow band — tone base (light ≈85–90%, dark ≈17–21%) ±4.5 per triangle; all hues in a swatch share it</dd></div>
+      <div class="recipe-item"><dt>Hue</dt><dd>amber 38° · forest 140° · sky 215° · rose 335° (±3° per triangle)</dd></div>
+      <div class="recipe-item"><dt>Randomness</dt><dd>geometry and per-triangle color assignment reseed on reroll; the swatch ID names the recipe</dd></div>
+    </dl>
+  </section>
+
+  <section class="family" data-strategy="mono" data-tone="light">
+    <h2>Mono — Light</h2>
+    <p class="recipe">One hue; only the brightness jitter draws the mesh. Rows: each hue at soft, mid, rich saturation.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-mono-light"></div>
+  </section>
+
+  <section class="family" data-strategy="duo" data-tone="light">
+    <h2>Duo — Light</h2>
+    <p class="recipe">Base hue plus its complement, weighted 65/35 — a dominant field with contrasting inclusions.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-duo-light"></div>
+  </section>
+
+  <section class="family" data-strategy="trio" data-tone="light">
+    <h2>Trio — Light</h2>
+    <p class="recipe">A contrasting triad (H, H+120°, H−120°) weighted 50/30/20 — closest in spirit to the low-poly reference.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-trio-light"></div>
+  </section>
+
+  <section class="family" data-strategy="mono" data-tone="dark">
+    <h2>Mono — Dark</h2>
+    <p class="recipe">The mono mesh on the dark base — facets catching light like slate.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-mono-dark"></div>
+  </section>
+
+  <section class="family" data-strategy="duo" data-tone="dark">
+    <h2>Duo — Dark</h2>
+    <p class="recipe">Complementary pair on the dark base; at low brightness the hue contrast turns ember-like.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-duo-dark"></div>
+  </section>
+
+  <section class="family" data-strategy="trio" data-tone="dark">
+    <h2>Trio — Dark</h2>
+    <p class="recipe">The triad on the dark base — stained glass at dusk.</p>
+    <div class="colheads"><span>Coarse</span><span>Medium</span><span>Fine</span></div>
+    <div class="grid" id="grid-trio-dark"></div>
+  </section>
+</div>
+
+<div class="lightbox" id="lightbox">
+  <div class="lightbox-frame" id="lightbox-frame"></div>
+  <div class="lightbox-id" id="lightbox-id"></div>
+</div>
+
+<script>
+(function(){
+  "use strict";
+
+  // ---------- seeded PRNG (same as sweep-1 gallery) ----------
+  function xmur3(str){
+    let h = 1779033703 ^ str.length;
+    for(let i=0;i<str.length;i++){
+      h = Math.imul(h ^ str.charCodeAt(i), 3432918353);
+      h = (h << 13) | (h >>> 19);
+    }
+    return function(){
+      h = Math.imul(h ^ (h >>> 16), 2246822507);
+      h = Math.imul(h ^ (h >>> 13), 3266489909);
+      h ^= h >>> 16;
+      return h >>> 0;
+    };
+  }
+  function mulberry32(a){
+    return function(){
+      let t = (a += 0x6D2B79F5);
+      t = Math.imul(t ^ (t >>> 15), t | 1);
+      t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+      return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+  }
+  function seededRng(id){
+    return mulberry32(xmur3(id)());
+  }
+
+  // ---------- helpers ----------
+  function mod360(h){ return ((h % 360) + 360) % 360; }
+  function clamp(v,min,max){ return v < min ? min : (v > max ? max : v); }
+  function hsl(h,s,l){ return "hsl(" + f1(mod360(h)) + "," + f1(clamp(s,0,100)) + "%," + f1(clamp(l,0,100)) + "%)"; }
+  function rnd(rng,min,max){ return min + rng() * (max - min); }
+  function rndInt(rng,min,max){ return Math.floor(rnd(rng,min,max+1)); }
+  function f1(n){ return n.toFixed(1); }
+
+  // ---------- Delaunay (Bowyer–Watson) ----------
+  function circumcircle(a,b,c){
+    const ax=a[0],ay=a[1],bx=b[0],by=b[1],cx=c[0],cy=c[1];
+    const d = 2*(ax*(by-cy)+bx*(cy-ay)+cx*(ay-by));
+    if(Math.abs(d) < 1e-9) return null;
+    const a2 = ax*ax+ay*ay, b2 = bx*bx+by*by, c2 = cx*cx+cy*cy;
+    const ux = (a2*(by-cy)+b2*(cy-ay)+c2*(ay-by))/d;
+    const uy = (a2*(cx-bx)+b2*(ax-cx)+c2*(bx-ax))/d;
+    const dx = ax-ux, dy = ay-uy;
+    return { x:ux, y:uy, r2:dx*dx+dy*dy };
+  }
+  function triangulate(points){
+    const pts = points.slice();
+    const st = pts.length;
+    pts.push([-3000,-3000],[3500,-3000],[240,3600]);
+    let tris = [{ i:[st,st+1,st+2], cc:circumcircle(pts[st],pts[st+1],pts[st+2]) }];
+    for(let pi=0; pi<st; pi++){
+      const p = pts[pi];
+      const bad = [];
+      for(let t=0;t<tris.length;t++){
+        const cc = tris[t].cc;
+        if(cc){
+          const dx = p[0]-cc.x, dy = p[1]-cc.y;
+          if(dx*dx+dy*dy < cc.r2) bad.push(tris[t]);
+        }
+      }
+      const edgeCount = new Map();
+      for(let b=0;b<bad.length;b++){
+        const idx = bad[b].i;
+        for(let e=0;e<3;e++){
+          const u = idx[e], v = idx[(e+1)%3];
+          const key = u < v ? u+"_"+v : v+"_"+u;
+          edgeCount.set(key,(edgeCount.get(key)||0)+1);
+        }
+      }
+      const badSet = new Set(bad);
+      tris = tris.filter(function(t){ return !badSet.has(t); });
+      for(let b=0;b<bad.length;b++){
+        const idx = bad[b].i;
+        for(let e=0;e<3;e++){
+          const u = idx[e], v = idx[(e+1)%3];
+          const key = u < v ? u+"_"+v : v+"_"+u;
+          if(edgeCount.get(key) === 1){
+            const cc = circumcircle(pts[u],pts[v],p);
+            if(cc) tris.push({ i:[u,v,pi], cc:cc });
+          }
+        }
+      }
+    }
+    const out = [];
+    for(let t=0;t<tris.length;t++){
+      const idx = tris[t].i;
+      if(idx[0] < st && idx[1] < st && idx[2] < st) out.push(idx);
+    }
+    return { pts: pts, tris: out };
+  }
+
+  // ---------- color ----------
+  // Weighted per-triangle hue pick; weights sum to 1.
+  function pickHue(rng, hueList){
+    let x = rng();
+    for(let i=0;i<hueList.length;i++){
+      if(x < hueList[i].w) return hueList[i].h;
+      x -= hueList[i].w;
+    }
+    return hueList[hueList.length-1].h;
+  }
+  function triangleColor(rng, hueList, spec){
+    const h = pickHue(rng, hueList) + rnd(rng,-3,3);
+    const s = spec.sat * rnd(rng,0.85,1.15);
+    const l = spec.lBase + rnd(rng,-spec.lJit,spec.lJit);
+    return hsl(h,s,l);
+  }
+
+  // ---------- facets generator ----------
+  // Points scatter beyond the 480x300 viewBox so the mesh covers the frame edge-to-edge.
+  function genFacets(rng, hueList, spec, density){
+    const pts = [];
+    const x0 = -36, y0 = -36, x1 = 516, y1 = 336;
+    const cols = density.cols, rows = density.rows;
+    const cw = (x1-x0)/cols, ch = (y1-y0)/rows;
+    for(let c=0;c<cols;c++){
+      for(let r=0;r<rows;r++){
+        pts.push([ x0 + (c + rnd(rng,0.08,0.92))*cw, y0 + (r + rnd(rng,0.08,0.92))*ch ]);
+      }
+    }
+    const mesh = triangulate(pts);
+    let s = '<rect width="480" height="300" fill="' + hsl(hueList[0].h, spec.sat, spec.lBase) + '"/>';
+    for(let t=0;t<mesh.tris.length;t++){
+      const idx = mesh.tris[t];
+      const a = mesh.pts[idx[0]], b = mesh.pts[idx[1]], c = mesh.pts[idx[2]];
+      const color = triangleColor(rng, hueList, spec);
+      const ptsAttr = f1(a[0])+","+f1(a[1])+" "+f1(b[0])+","+f1(b[1])+" "+f1(c[0])+","+f1(c[1]);
+      s += '<polygon points="' + ptsAttr + '" fill="' + color + '" stroke="' + color + '" stroke-width="0.7"/>';
+    }
+    return s;
+  }
+
+  // ---------- board overlay (same as sweep-1 gallery) ----------
+  function buildOverlay(rng, tone){
+    const laneFill = tone === "dark" ? "rgba(20,20,24,0.40)" : "rgba(255,255,255,0.38)";
+    const cardFill = tone === "dark" ? "#26262B" : "#FFFFFF";
+    const cardStroke = tone === "dark" ? "rgba(255,255,255,0.10)" : "rgba(0,0,0,0.08)";
+    const titleFill = tone === "dark" ? "rgba(22,22,26,0.55)" : "rgba(255,255,255,0.55)";
+    let g = '<g class="board-overlay">';
+    g += '<rect x="0" y="0" width="480" height="34" fill="' + titleFill + '"/>';
+    const laneX = [16,168,320];
+    for(let li=0; li<laneX.length; li++){
+      const lx = laneX[li];
+      g += '<rect x="' + lx + '" y="40" width="144" height="250" rx="8" fill="' + laneFill + '"/>';
+      let y = 48;
+      const count = rndInt(rng,2,4);
+      for(let c=0;c<count;c++){
+        const h = rnd(rng,26,44);
+        if(y + h > 282) break;
+        g += '<rect x="' + (lx+8) + '" y="' + f1(y) + '" width="128" height="' + f1(h) + '" rx="5" fill="' + cardFill + '" stroke="' + cardStroke + '"/>';
+        y += h + 8;
+      }
+    }
+    g += "</g>";
+    return g;
+  }
+
+  // ---------- registry ----------
+  const HUES = [
+    { code:"am", name:"amber",  h:38  },
+    { code:"fo", name:"forest", h:140 },
+    { code:"sk", name:"sky",    h:215 },
+    { code:"ro", name:"rose",   h:335 }
+  ];
+
+  const STRATEGIES = [
+    { id:"mono", hues:function(H){ return [{h:H, w:1}]; } },
+    { id:"duo",  hues:function(H){ return [{h:H, w:0.65},{h:H+180, w:0.35}]; } },
+    { id:"trio", hues:function(H){ return [{h:H, w:0.5},{h:H+120, w:0.3},{h:H-120, w:0.2}]; } }
+  ];
+
+  const DENSITIES = [
+    { id:"c", label:"coarse", cols:5,  rows:3 },
+    { id:"m", label:"medium", cols:9,  rows:6 },
+    { id:"f", label:"fine",   cols:14, rows:9 }
+  ];
+
+  // Saturation rows and brightness bases per tone. Rich rows get a touch of
+  // brightness headroom so the saturation actually shows.
+  const TONES = {
+    light: { lJit:4.5, levels:[ {label:"soft", sat:20, lBase:90}, {label:"mid", sat:42, lBase:88}, {label:"rich", sat:68, lBase:85} ] },
+    dark:  { lJit:4.5, levels:[ {label:"soft", sat:16, lBase:17}, {label:"mid", sat:34, lBase:19}, {label:"rich", sat:52, lBase:21} ] }
+  };
+
+  // ---------- lightbox ----------
+  let openState = null;
+  const lightbox = document.getElementById("lightbox");
+  const lightboxFrame = document.getElementById("lightbox-frame");
+  const lightboxId = document.getElementById("lightbox-id");
+
+  function openLightbox(svgEl, id){
+    openState = { svgEl:svgEl, parent:svgEl.parentNode, next:svgEl.nextSibling };
+    lightboxFrame.appendChild(svgEl);
+    lightboxId.textContent = id;
+    lightbox.classList.add("open");
+  }
+  function closeLightbox(){
+    if(!openState) return;
+    if(openState.next){
+      openState.parent.insertBefore(openState.svgEl, openState.next);
+    } else {
+      openState.parent.appendChild(openState.svgEl);
+    }
+    openState = null;
+    lightbox.classList.remove("open");
+  }
+  lightbox.addEventListener("click", function(e){
+    if(e.target === lightbox) closeLightbox();
+  });
+  document.addEventListener("keydown", function(e){
+    if(e.key === "Escape") closeLightbox();
+  });
+
+  // ---------- render ----------
+  let gen = 1;
+
+  function renderAll(){
+    closeLightbox();
+    const toneKeys = ["light","dark"];
+    for(let si=0; si<STRATEGIES.length; si++){
+      const strategy = STRATEGIES[si];
+      for(let ti=0; ti<toneKeys.length; ti++){
+        const tone = toneKeys[ti];
+        const toneSpec = TONES[tone];
+        const grid = document.getElementById("grid-" + strategy.id + "-" + tone);
+        grid.innerHTML = "";
+        // rows: hue × saturation; columns: density
+        for(let hi=0; hi<HUES.length; hi++){
+          for(let li=0; li<toneSpec.levels.length; li++){
+            const level = toneSpec.levels[li];
+            for(let di=0; di<DENSITIES.length; di++){
+              const density = DENSITIES[di];
+              const id = "facets-" + HUES[hi].code + "-" + strategy.id + "-" + density.id + "-" + tone.charAt(0) + (li+1);
+              const rng = seededRng(id + "/g" + gen);
+              const spec = { sat:level.sat, lBase:level.lBase, lJit:toneSpec.lJit };
+              const hueList = strategy.hues(HUES[hi].h);
+              const inner = genFacets(rng, hueList, spec, density);
+              const overlay = buildOverlay(rng, tone);
+              const svgMarkup = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 480 300" data-id="' + id + '">' + inner + overlay + "</svg>";
+
+              const card = document.createElement("div");
+              card.className = "card";
+
+              const frame = document.createElement("div");
+              frame.className = "frame";
+              frame.innerHTML = svgMarkup;
+              const svgEl = frame.firstElementChild;
+
+              const caption = document.createElement("div");
+              caption.className = "caption";
+              const idSpan = document.createElement("span");
+              idSpan.className = "swatch-id";
+              idSpan.textContent = id;
+              const noteSpan = document.createElement("span");
+              noteSpan.className = "note";
+              noteSpan.textContent = HUES[hi].name + " · " + level.label;
+              caption.appendChild(idSpan);
+              caption.appendChild(noteSpan);
+
+              card.appendChild(frame);
+              card.appendChild(caption);
+              card.addEventListener("click", function(){ openLightbox(svgEl, id); });
+
+              grid.appendChild(card);
+            }
+          }
+        }
+      }
+    }
+    document.getElementById("gen-note").textContent = "gen " + gen;
+  }
+
+  // ---------- filters ----------
+  let activeStrategy = "all", activeTone = "all";
+  const strategyChips = document.querySelectorAll("#strategy-chips .chip");
+  const toneChips = document.querySelectorAll("#tone-chips .chip");
+
+  function applyFilters(){
+    const sections = document.querySelectorAll(".family");
+    for(let i=0;i<sections.length;i++){
+      const sec = sections[i];
+      const strat = sec.dataset.strategy, tone = sec.dataset.tone;
+      const visible = (activeStrategy === "all" || activeStrategy === strat) && (activeTone === "all" || activeTone === tone);
+      sec.style.display = visible ? "" : "none";
+    }
+  }
+  strategyChips.forEach(function(chip){
+    chip.addEventListener("click", function(){
+      strategyChips.forEach(function(c){ c.classList.remove("active"); c.setAttribute("aria-pressed","false"); });
+      chip.classList.add("active");
+      chip.setAttribute("aria-pressed","true");
+      activeStrategy = chip.dataset.strategy;
+      applyFilters();
+    });
+  });
+  toneChips.forEach(function(chip){
+    chip.addEventListener("click", function(){
+      toneChips.forEach(function(c){ c.classList.remove("active"); c.setAttribute("aria-pressed","false"); });
+      chip.classList.add("active");
+      chip.setAttribute("aria-pressed","true");
+      activeTone = chip.dataset.tone;
+      applyFilters();
+    });
+  });
+  document.getElementById("overlay-toggle").addEventListener("change", function(e){
+    document.body.classList.toggle("show-overlay", e.target.checked);
+  });
+  document.getElementById("reroll").addEventListener("click", function(){
+    gen++;
+    renderAll();
+  });
+
+  renderAll();
+})();
+</script>

DESIGN/explorations/board-backgrounds-gallery.html

@@ -0,0 +1,755 @@
+<title>Board Background Swatches</title>
+<style>
+:root{
+  --paper:#FAFAF7;
+  --ink:#1D1C1A;
+  --ink-2:#6E6A63;
+  --line:#E4E1DA;
+  --chip:#F0EEE8;
+  --accent:#5B6E8C;
+  --paper-a85: rgba(250,250,247,.85);
+}
+@media (prefers-color-scheme: dark){
+  :root:not([data-theme="light"]){
+    --paper:#181715;
+    --ink:#ECEAE5;
+    --ink-2:#98938A;
+    --line:#2E2C28;
+    --chip:#242220;
+    --accent:#8FA3C0;
+    --paper-a85: rgba(24,23,21,.85);
+  }
+}
+:root[data-theme="dark"]{
+  --paper:#181715;
+  --ink:#ECEAE5;
+  --ink-2:#98938A;
+  --line:#2E2C28;
+  --chip:#242220;
+  --accent:#8FA3C0;
+  --paper-a85: rgba(24,23,21,.85);
+}
+
+*, *::before, *::after{ box-sizing:border-box; }
+
+body{
+  margin:0;
+  background:var(--paper);
+  color:var(--ink);
+  font-family:-apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif;
+  -webkit-font-smoothing:antialiased;
+}
+
+.wrap{ max-width:1240px; margin:0 auto; padding:0 32px 64px; }
+
+.page-head{ padding:32px 0 16px; }
+.page-head h1{ font-size:22px; font-weight:600; margin:0 0 6px; }
+.page-head .subtitle{ font-size:13px; color:var(--ink-2); margin:0; }
+
+.controlbar{
+  position:sticky; top:0; z-index:10;
+  display:flex; align-items:center; gap:20px; row-gap:10px; flex-wrap:wrap;
+  padding:12px 0;
+  background:var(--paper-a85);
+  -webkit-backdrop-filter:blur(8px);
+  backdrop-filter:blur(8px);
+  border-bottom:1px solid var(--line);
+  margin-bottom:28px;
+}
+.chipgroup{ display:flex; gap:6px; flex-wrap:wrap; }
+.chip{
+  font:inherit; font-size:12px; padding:5px 11px; border-radius:999px;
+  border:1px solid var(--line); background:var(--chip); color:var(--ink);
+  cursor:pointer; line-height:1.3;
+}
+.chip:hover{ border-color:var(--accent); }
+.chip.active{ background:var(--accent); border-color:var(--accent); color:var(--paper); }
+.chip:focus-visible{ outline:2px solid var(--accent); outline-offset:2px; }
+
+.toggle{ display:flex; align-items:center; gap:6px; font-size:12px; color:var(--ink); cursor:pointer; user-select:none; }
+.toggle input{ width:14px; height:14px; accent-color:var(--accent); }
+.toggle input:focus-visible{ outline:2px solid var(--accent); outline-offset:2px; }
+
+.section-label{ font-size:11px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--ink-2); margin:0 0 10px; }
+
+.axes{ margin-bottom:40px; }
+.axes-list{ display:grid; grid-template-columns:1fr 1fr; gap:7px 32px; margin:0; }
+.axis{ display:flex; gap:6px; font-size:13px; line-height:1.5; }
+.axis dt{ margin:0; font-weight:600; color:var(--ink-2); flex:0 0 auto; }
+.axis dd{ margin:0; color:var(--ink-2); }
+@media (max-width:720px){ .axes-list{ grid-template-columns:1fr; } }
+
+.family{ margin-bottom:40px; }
+.family h2{ font-size:15px; font-weight:600; margin:0 0 4px; }
+.family .recipe{ font-size:13px; color:var(--ink-2); margin:0 0 14px; max-width:820px; }
+
+.grid{ display:grid; grid-template-columns:repeat(auto-fill, minmax(260px,1fr)); gap:14px; }
+
+.card{ cursor:pointer; }
+.frame{
+  aspect-ratio:16/10; border-radius:8px; border:1px solid var(--line);
+  overflow:hidden; background:var(--chip);
+}
+.frame svg, .lightbox-frame svg{ display:block; width:100%; height:100%; }
+.caption{ display:flex; justify-content:space-between; align-items:baseline; margin-top:6px; font-size:11px; gap:8px; }
+.caption .swatch-id{ font-family:ui-monospace,"SF Mono",Menlo,monospace; color:var(--ink); }
+.caption .note{ color:var(--ink-2); white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+
+.board-overlay{ display:none; }
+body.show-overlay .board-overlay{ display:inline; }
+
+.lightbox{
+  position:fixed; inset:0; z-index:100;
+  display:flex; flex-direction:column; align-items:center; justify-content:center; gap:14px;
+  background:rgba(0,0,0,.55);
+  opacity:0; pointer-events:none;
+  transition:opacity .12s ease;
+}
+.lightbox.open{ opacity:1; pointer-events:auto; }
+.lightbox-frame{
+  width:min(92vw, 1100px); aspect-ratio:16/10; border-radius:10px; overflow:hidden;
+  box-shadow:0 24px 60px rgba(0,0,0,.45);
+  background:var(--chip);
+}
+.lightbox-id{ font-family:ui-monospace,"SF Mono",Menlo,monospace; font-size:12px; color:#fff; }
+
+@media (prefers-reduced-motion: reduce){
+  .lightbox{ transition:none; }
+}
+</style>
+<div class="wrap">
+  <header class="page-head">
+    <h1>Board Background Swatches</h1>
+    <p class="subtitle">96 procedural candidates — base layer × filler layer. Toggle the board overlay to judge them under content.</p>
+  </header>
+
+  <div class="controlbar">
+    <div class="chipgroup" id="family-chips" role="group" aria-label="Family filter">
+      <button type="button" class="chip active" data-family="all" aria-pressed="true">All</button>
+      <button type="button" class="chip" data-family="whisper" aria-pressed="false">Whisper</button>
+      <button type="button" class="chip" data-family="confetti" aria-pressed="false">Confetti</button>
+      <button type="button" class="chip" data-family="aurora" aria-pressed="false">Aurora</button>
+      <button type="button" class="chip" data-family="contours" aria-pressed="false">Contours</button>
+      <button type="button" class="chip" data-family="drift" aria-pressed="false">Drift</button>
+      <button type="button" class="chip" data-family="bubbles" aria-pressed="false">Bubbles</button>
+      <button type="button" class="chip" data-family="terrazzo" aria-pressed="false">Terrazzo</button>
+      <button type="button" class="chip" data-family="graph" aria-pressed="false">Graph</button>
+      <button type="button" class="chip" data-family="waves" aria-pressed="false">Waves</button>
+      <button type="button" class="chip" data-family="dusk" aria-pressed="false">Dusk</button>
+      <button type="button" class="chip" data-family="starfield" aria-pressed="false">Starfield</button>
+      <button type="button" class="chip" data-family="slate" aria-pressed="false">Slate</button>
+    </div>
+    <div class="chipgroup" id="tone-chips" role="group" aria-label="Tone filter">
+      <button type="button" class="chip active" data-tone="all" aria-pressed="true">All</button>
+      <button type="button" class="chip" data-tone="light" aria-pressed="false">Light</button>
+      <button type="button" class="chip" data-tone="dark" aria-pressed="false">Dark</button>
+    </div>
+    <label class="toggle">
+      <input type="checkbox" id="overlay-toggle">
+      <span>Board overlay</span>
+    </label>
+  </div>
+
+  <section class="axes">
+    <p class="section-label">Axes</p>
+    <dl class="axes-list">
+      <div class="axis"><dt>Base</dt><dd>solid · linear 2/3-stop (angle) · radial/corner glow · soft-blob mesh</dd></div>
+      <div class="axis"><dt>Hue strategy</dt><dd>mono · analogous · complementary accent · multicolor</dd></div>
+      <div class="axis"><dt>HSB family</dt><dd>pastel · muted · deep/dark</dd></div>
+      <div class="axis"><dt>Filler shape</dt><dd>dots · rings · blobs/chips · capsules · triangles · plus-signs · contour lines · sine bands · grid</dd></div>
+      <div class="axis"><dt>Density</dt><dd>sparse → dense</dd></div>
+      <div class="axis"><dt>Size</dt><dd>uniform vs power-law</dd></div>
+      <div class="axis"><dt>Placement</dt><dd>uniform scatter · diagonal band · corner-weighted · grid-jitter</dd></div>
+      <div class="axis"><dt>Filler color</dt><dd>same-hue tint · accent hue · multicolor · alpha-only</dd></div>
+      <div class="axis"><dt>Opacity</dt><dd>whisper 4–10% → visible 15–25%</dd></div>
+      <div class="axis"><dt>Depth</dt><dd>crisp vs gradient-soft, layered sizes</dd></div>
+    </dl>
+  </section>
+
+  <section class="family" data-family="whisper" data-tone="light">
+    <h2>Whisper</h2>
+    <p class="recipe">A vertical pastel gradient ground carries roughly sixty faint dots at 6–10% opacity — the quietest family in the set.</p>
+    <div class="grid" id="grid-whisper"></div>
+  </section>
+
+  <section class="family" data-family="confetti" data-tone="light">
+    <h2>Confetti</h2>
+    <p class="recipe">A near-neutral ground is scattered with about seventy tiny circles, rotated squares and triangles across three related hues.</p>
+    <div class="grid" id="grid-confetti"></div>
+  </section>
+
+  <section class="family" data-family="aurora" data-tone="light">
+    <h2>Aurora</h2>
+    <p class="recipe">A flat pastel ground holds four to six large soft-edged gradient blobs that overlap and drift toward one corner, mesh-gradient style.</p>
+    <div class="grid" id="grid-aurora"></div>
+  </section>
+
+  <section class="family" data-family="contours" data-tone="light">
+    <h2>Contours</h2>
+    <p class="recipe">A flat ground is crossed by fourteen thin wavy horizontal lines built from summed sine harmonics, evoking topographic contours.</p>
+    <div class="grid" id="grid-contours"></div>
+  </section>
+
+  <section class="family" data-family="drift" data-tone="light">
+    <h2>Drift</h2>
+    <p class="recipe">A diagonal two-tone gradient ground carries rotated capsule shapes rejection-sampled into a diagonal band across the canvas.</p>
+    <div class="grid" id="grid-drift"></div>
+  </section>
+
+  <section class="family" data-family="bubbles" data-tone="light">
+    <h2>Bubbles</h2>
+    <p class="recipe">A top-left radial gradient ground carries a power-law scatter of circles — a few large, more medium, many small — mixing filled discs with stroked rings.</p>
+    <div class="grid" id="grid-bubbles"></div>
+  </section>
+
+  <section class="family" data-family="terrazzo" data-tone="light">
+    <h2>Terrazzo</h2>
+    <p class="recipe">A near-neutral ground is covered in about fifty-five small irregular polygon chips across four related colors, like stone terrazzo.</p>
+    <div class="grid" id="grid-terrazzo"></div>
+  </section>
+
+  <section class="family" data-family="graph" data-tone="light">
+    <h2>Graph</h2>
+    <p class="recipe">A pale ground is ruled into a 24px grid, with a few plus-mark intersections and small accent dots — graph paper.</p>
+    <div class="grid" id="grid-graph"></div>
+  </section>
+
+  <section class="family" data-family="waves" data-tone="light">
+    <h2>Waves</h2>
+    <p class="recipe">A horizontal gradient ground is layered with six translucent sine-wave bands, phase-shifted and stacked toward the bottom third like dunes.</p>
+    <div class="grid" id="grid-waves"></div>
+  </section>
+
+  <section class="family" data-family="dusk" data-tone="dark">
+    <h2>Dusk</h2>
+    <p class="recipe">A deep vertical gradient ground holds large soft gradient blobs and a faint horizon glow low in the frame — moody, no small shapes.</p>
+    <div class="grid" id="grid-dusk"></div>
+  </section>
+
+  <section class="family" data-family="starfield" data-tone="dark">
+    <h2>Starfield</h2>
+    <p class="recipe">A dark radial ground is scattered with about ninety tiny stars, a handful haloed and brighter, plus two faint nebula blobs.</p>
+    <div class="grid" id="grid-starfield"></div>
+  </section>
+
+  <section class="family" data-family="slate" data-tone="dark">
+    <h2>Slate</h2>
+    <p class="recipe">A flat dark ground carries the same wavy contour lines as Contours, with small accent dots resting on the lines — dark topographic.</p>
+    <div class="grid" id="grid-slate"></div>
+  </section>
+</div>
+
+<div class="lightbox" id="lightbox">
+  <div class="lightbox-frame" id="lightbox-frame"></div>
+  <div class="lightbox-id" id="lightbox-id"></div>
+</div>
+
+<script>
+(function(){
+  "use strict";
+
+  // ---------- seeded PRNG ----------
+  function xmur3(str){
+    let h = 1779033703 ^ str.length;
+    for(let i=0;i<str.length;i++){
+      h = Math.imul(h ^ str.charCodeAt(i), 3432918353);
+      h = (h << 13) | (h >>> 19);
+    }
+    return function(){
+      h = Math.imul(h ^ (h >>> 16), 2246822507);
+      h = Math.imul(h ^ (h >>> 13), 3266489909);
+      h ^= h >>> 16;
+      return h >>> 0;
+    };
+  }
+  function mulberry32(a){
+    return function(){
+      let t = (a += 0x6D2B79F5);
+      t = Math.imul(t ^ (t >>> 15), t | 1);
+      t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+      return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+  }
+  function seededRng(id){
+    const seed = xmur3(id)();
+    return mulberry32(seed);
+  }
+
+  // ---------- small helpers ----------
+  function mod360(h){ return ((h % 360) + 360) % 360; }
+  function hsl(h,s,l){ return "hsl(" + mod360(h) + "," + s + "%," + l + "%)"; }
+  function rnd(rng,min,max){ return min + rng() * (max - min); }
+  function rndInt(rng,min,max){ return Math.floor(rnd(rng,min,max+1)); }
+  function pick(rng,arr){ return arr[Math.floor(rng()*arr.length)]; }
+  function pad2(n){ return String(n).padStart(2,"0"); }
+  function f1(n){ return n.toFixed(1); }
+
+  function linGrad(id,x1,y1,x2,y2,stops){
+    let s = "";
+    for(let i=0;i<stops.length;i++){
+      s += '<stop offset="' + stops[i][0] + '" stop-color="' + stops[i][1] + '"/>';
+    }
+    return '<linearGradient id="' + id + '" x1="' + x1 + '" y1="' + y1 + '" x2="' + x2 + '" y2="' + y2 + '">' + s + '</linearGradient>';
+  }
+  function radGrad(id,cx,cy,r,stops){
+    let s = "";
+    for(let i=0;i<stops.length;i++){
+      const st = stops[i];
+      const op = st.length > 2 ? st[2] : 1;
+      s += '<stop offset="' + st[0] + '" stop-color="' + st[1] + '" stop-opacity="' + op + '"/>';
+    }
+    return '<radialGradient id="' + id + '" cx="' + cx + '" cy="' + cy + '" r="' + r + '">' + s + '</radialGradient>';
+  }
+
+  function triPoints(cx,cy,size,rotDeg){
+    const r = size * 0.7;
+    const rot = rotDeg * Math.PI / 180;
+    const pts = [];
+    for(let k=0;k<3;k++){
+      const a = rot + k*(Math.PI*2/3) - Math.PI/2;
+      pts.push(f1(cx + r*Math.cos(a)) + "," + f1(cy + r*Math.sin(a)));
+    }
+    return pts.join(" ");
+  }
+
+  // shared wavy-contour-line builder, used by "contours" and "slate"
+  function contourLines(rng,count,spacing,startY,stroke,opacity,widthAttr){
+    let out = "";
+    const allPoints = [];
+    for(let i=0;i<count;i++){
+      const baseY = startY + i*spacing;
+      const harmonics = rndInt(rng,2,3);
+      const comps = [];
+      let wsum = 0;
+      for(let k=0;k<harmonics;k++){
+        const c = { freq: rnd(rng,1,3), phase: rnd(rng,0,Math.PI*2), weight: rnd(rng,0.3,1) };
+        comps.push(c);
+        wsum += c.weight;
+      }
+      const amp = rnd(rng,6,14);
+      const pts = [];
+      for(let x=0;x<=480;x+=8){
+        let s = 0;
+        for(let k=0;k<comps.length;k++){
+          const c = comps[k];
+          s += c.weight * Math.sin(c.freq*(x/480)*Math.PI*2 + c.phase);
+        }
+        const y = baseY + amp*(s/wsum);
+        pts.push([x,y]);
+      }
+      allPoints.push(pts);
+      let d = "";
+      for(let p=0;p<pts.length;p++){
+        d += (p===0 ? "M" : "L") + f1(pts[p][0]) + "," + f1(pts[p][1]) + " ";
+      }
+      out += '<path d="' + d + '" stroke="' + stroke + '" stroke-width="' + widthAttr + '" fill="none" opacity="' + opacity + '"/>';
+    }
+    return { svg: out, lines: allPoints };
+  }
+
+  // ---------- board overlay (shared across all families) ----------
+  function buildOverlay(rng, tone){
+    const laneFill = tone === "dark" ? "rgba(20,20,24,0.40)" : "rgba(255,255,255,0.38)";
+    const cardFill = tone === "dark" ? "#26262B" : "#FFFFFF";
+    const cardStroke = tone === "dark" ? "rgba(255,255,255,0.10)" : "rgba(0,0,0,0.08)";
+    const titleFill = tone === "dark" ? "rgba(22,22,26,0.55)" : "rgba(255,255,255,0.55)";
+    let g = '<g class="board-overlay">';
+    g += '<rect x="0" y="0" width="480" height="34" fill="' + titleFill + '"/>';
+    const laneX = [16,168,320];
+    for(let li=0; li<laneX.length; li++){
+      const lx = laneX[li];
+      g += '<rect x="' + lx + '" y="40" width="144" height="250" rx="8" fill="' + laneFill + '"/>';
+      let y = 48;
+      const count = rndInt(rng,2,4);
+      for(let c=0;c<count;c++){
+        const h = rnd(rng,26,44);
+        if(y + h > 282) break;
+        g += '<rect x="' + (lx+8) + '" y="' + f1(y) + '" width="128" height="' + f1(h) + '" rx="5" fill="' + cardFill + '" stroke="' + cardStroke + '"/>';
+        y += h + 8;
+      }
+    }
+    g += "</g>";
+    return g;
+  }
+
+  // ---------- 12 families ----------
+  function famWhisper(rng,H,gid){
+    const baseId = gid + "-base";
+    let s = "<defs>" + linGrad(baseId,"0","0","0","1",[["0%",hsl(H,45,94)],["100%",hsl(H,40,88)]]) + "</defs>";
+    s += '<rect width="480" height="300" fill="url(#' + baseId + ')"/>';
+    let filler = "";
+    for(let i=0;i<60;i++){
+      const cx = rnd(rng,0,480), cy = rnd(rng,0,300), r = rnd(rng,2,5), op = rnd(rng,0.06,0.10);
+      filler += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="' + hsl(H,50,55) + '" opacity="' + op.toFixed(2) + '"/>';
+    }
+    return s + filler;
+  }
+
+  function famConfetti(rng,H,gid){
+    let s = '<rect width="480" height="300" fill="' + hsl(H,12,95) + '"/>';
+    const hues = [H, H+120, H+240];
+    let filler = "";
+    for(let i=0;i<70;i++){
+      const type = pick(rng,["circle","square","triangle"]);
+      const hue = pick(rng,hues);
+      const color = hsl(hue,55,55);
+      const size = rnd(rng,3,8);
+      const x = rnd(rng,0,480), y = rnd(rng,0,300);
+      const op = rnd(rng,0.10,0.16).toFixed(2);
+      if(type === "circle"){
+        filler += '<circle cx="' + f1(x) + '" cy="' + f1(y) + '" r="' + f1(size/2) + '" fill="' + color + '" opacity="' + op + '"/>';
+      } else if(type === "square"){
+        const rot = rnd(rng,0,360).toFixed(1);
+        filler += '<rect x="' + f1(x-size/2) + '" y="' + f1(y-size/2) + '" width="' + f1(size) + '" height="' + f1(size) + '" fill="' + color + '" opacity="' + op + '" transform="rotate(' + rot + ' ' + f1(x) + ' ' + f1(y) + ')"/>';
+      } else {
+        const rot = rnd(rng,0,360);
+        filler += '<polygon points="' + triPoints(x,y,size,rot) + '" fill="' + color + '" opacity="' + op + '"/>';
+      }
+    }
+    return s + filler;
+  }
+
+  function famAurora(rng,H,gid){
+    const corners = [[0,0],[480,0],[0,300],[480,300]];
+    const corner = pick(rng,corners);
+    const n = rndInt(rng,4,6);
+    let defs = "", circles = "";
+    for(let i=0;i<n;i++){
+      const r = rnd(rng,90,180);
+      const rx = rnd(rng,0,480), ry = rnd(rng,0,300);
+      const t = rnd(rng,0.3,0.7);
+      const cx = rx + (corner[0]-rx)*t;
+      const cy = ry + (corner[1]-ry)*t;
+      const offset = pick(rng,[-25,25]);
+      const gidL = gid + "-aur-" + i;
+      defs += radGrad(gidL,"50%","50%","50%",[["0%",hsl(H+offset,55,80),0.55],["100%",hsl(H+offset,55,80),0]]);
+      circles += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="url(#' + gidL + ')"/>';
+    }
+    let s = "<defs>" + defs + "</defs>";
+    s += '<rect width="480" height="300" fill="' + hsl(H,35,93) + '"/>';
+    return s + circles;
+  }
+
+  function famContours(rng,H,gid){
+    let s = '<rect width="480" height="300" fill="' + hsl(H,30,92) + '"/>';
+    const res = contourLines(rng,14,22,6,hsl(H,45,60),0.14,1.2);
+    return s + res.svg;
+  }
+
+  function famDrift(rng,H,gid){
+    const baseId = gid + "-base";
+    let s = "<defs>" + linGrad(baseId,"0","0","1","1",[["0%",hsl(H,40,93)],["100%",hsl(H+30,40,89)]]) + "</defs>";
+    s += '<rect width="480" height="300" fill="url(#' + baseId + ')"/>';
+    const a = 300, b = -480;
+    const denom = Math.sqrt(a*a + b*b);
+    let count = 0, tries = 0, filler = "";
+    while(count < 40 && tries < 2000){
+      tries++;
+      const x = rnd(rng,0,480), y = rnd(rng,0,300);
+      const dist = Math.abs(a*x + b*y) / denom;
+      if(dist < 90){
+        const len = rnd(rng,20,70), thick = rnd(rng,4,7);
+        const op = rnd(rng,0.08,0.14).toFixed(2);
+        filler += '<rect x="' + f1(-len/2) + '" y="' + f1(-thick/2) + '" width="' + f1(len) + '" height="' + f1(thick) + '" rx="' + f1(thick/2) + '" fill="' + hsl(H,45,60) + '" opacity="' + op + '" transform="translate(' + f1(x) + ' ' + f1(y) + ') rotate(-32)"/>';
+        count++;
+      }
+    }
+    return s + filler;
+  }
+
+  function famBubbles(rng,H,gid){
+    const baseId = gid + "-base";
+    let s = "<defs>" + radGrad(baseId,"0%","0%","100%",[["0%",hsl(H,45,95)],["100%",hsl(H,40,88)]]) + "</defs>";
+    s += '<rect width="480" height="300" fill="url(#' + baseId + ')"/>';
+    const groups = [[5,40,80,0.05],[15,12,30,0.08],[40,2,8,0.12]];
+    let filler = "";
+    for(let gi=0; gi<groups.length; gi++){
+      const n = groups[gi][0], rmin = groups[gi][1], rmax = groups[gi][2], op = groups[gi][3];
+      for(let i=0;i<n;i++){
+        const cx = rnd(rng,0,480), cy = rnd(rng,0,300), r = rnd(rng,rmin,rmax);
+        const ring = rng() < 0.4;
+        if(ring){
+          filler += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="none" stroke="' + hsl(H,50,55) + '" stroke-width="1.5" opacity="' + op + '"/>';
+        } else {
+          filler += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="' + hsl(H,50,55) + '" opacity="' + op + '"/>';
+        }
+      }
+    }
+    return s + filler;
+  }
+
+  function famTerrazzo(rng,H,gid){
+    let s = '<rect width="480" height="300" fill="' + hsl(H,10,94) + '"/>';
+    const colors = [hsl(H,45,60), hsl(H+40,40,55), hsl(H-40,40,50), hsl(40,8,55)];
+    let filler = "";
+    for(let i=0;i<55;i++){
+      const cx = rnd(rng,0,480), cy = rnd(rng,0,300);
+      const sides = rndInt(rng,5,7);
+      const rot = rnd(rng,0,Math.PI*2);
+      const color = pick(rng,colors);
+      const pts = [];
+      for(let k=0;k<sides;k++){
+        const ang = rot + k*(Math.PI*2/sides);
+        const r = rnd(rng,4,14);
+        pts.push(f1(cx + r*Math.cos(ang)) + "," + f1(cy + r*Math.sin(ang)));
+      }
+      filler += '<polygon points="' + pts.join(" ") + '" fill="' + color + '" opacity="0.18"/>';
+    }
+    return s + filler;
+  }
+
+  function famGraph(rng,H,gid){
+    let s = '<rect width="480" height="300" fill="' + hsl(H,25,96) + '"/>';
+    const pitch = 24;
+    const cols = Math.floor(480/pitch);
+    const rows = Math.floor(300/pitch);
+    let grid = "";
+    for(let c=0;c<=cols;c++){
+      const x = c*pitch;
+      grid += '<line x1="' + x + '" y1="0" x2="' + x + '" y2="300" stroke="' + hsl(H,35,65) + '" stroke-width="1" opacity="0.10"/>';
+    }
+    for(let r=0;r<=rows;r++){
+      const y = r*pitch;
+      grid += '<line x1="0" y1="' + y + '" x2="480" y2="' + y + '" stroke="' + hsl(H,35,65) + '" stroke-width="1" opacity="0.10"/>';
+    }
+    let plus = "";
+    for(let i=0;i<12;i++){
+      const gx = rndInt(rng,0,cols)*pitch, gy = rndInt(rng,0,rows)*pitch;
+      plus += '<line x1="' + (gx-4) + '" y1="' + gy + '" x2="' + (gx+4) + '" y2="' + gy + '" stroke="' + hsl(H,35,65) + '" stroke-width="1" opacity="0.25"/>';
+      plus += '<line x1="' + gx + '" y1="' + (gy-4) + '" x2="' + gx + '" y2="' + (gy+4) + '" stroke="' + hsl(H,35,65) + '" stroke-width="1" opacity="0.25"/>';
+    }
+    let dots = "";
+    const nd = rndInt(rng,3,4);
+    for(let i=0;i<nd;i++){
+      const gx = rndInt(rng,0,cols)*pitch, gy = rndInt(rng,0,rows)*pitch;
+      dots += '<circle cx="' + gx + '" cy="' + gy + '" r="3" fill="' + hsl(H,55,55) + '" opacity="0.35"/>';
+    }
+    return s + grid + plus + dots;
+  }
+
+  function famWaves(rng,H,gid){
+    const baseId = gid + "-base";
+    let s = "<defs>" + linGrad(baseId,"0","0","1","0",[["0%",hsl(H,38,94)],["100%",hsl(H,34,89)]]) + "</defs>";
+    s += '<rect width="480" height="300" fill="url(#' + baseId + ')"/>';
+    let filler = "";
+    for(let i=0;i<6;i++){
+      const baseline = 190 + i*18;
+      const amp = rnd(rng,10,24);
+      const freq = rnd(rng,1,2);
+      const phase = rnd(rng,0,Math.PI*2);
+      let d = "M0,300 ";
+      for(let x=0;x<=480;x+=12){
+        const y = baseline + amp*Math.sin(freq*(x/480)*Math.PI*2 + phase);
+        d += "L" + x + "," + f1(y) + " ";
+      }
+      d += "L480,300 Z";
+      filler += '<path d="' + d + '" fill="' + hsl(H,40,80) + '" opacity="0.10"/>';
+    }
+    return s + filler;
+  }
+
+  function famDusk(rng,H,gid){
+    const baseId = gid + "-base";
+    let defs = linGrad(baseId,"0","0","0","1",[["0%",hsl(H,35,16)],["100%",hsl(H,45,9)]]);
+    const n = rndInt(rng,4,5);
+    let blobs = "";
+    for(let i=0;i<n;i++){
+      const r = rnd(rng,90,180);
+      const cx = rnd(rng,0,480), cy = rnd(rng,0,220);
+      const offset = pick(rng,[-30,30]);
+      const gidL = gid + "-dusk-" + i;
+      defs += radGrad(gidL,"50%","50%","50%",[["0%",hsl(H+offset,55,35),0.5],["100%",hsl(H+offset,55,35),0]]);
+      blobs += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="url(#' + gidL + ')"/>';
+    }
+    const horizonId = gid + "-horizon";
+    defs += radGrad(horizonId,"50%","50%","50%",[["0%",hsl(H,50,30),0.45],["100%",hsl(H,50,30),0]]);
+    const horizon = '<ellipse cx="240" cy="270" rx="320" ry="70" fill="url(#' + horizonId + ')"/>';
+    return "<defs>" + defs + "</defs>" + '<rect width="480" height="300" fill="url(#' + baseId + ')"/>' + blobs + horizon;
+  }
+
+  function famStarfield(rng,H,gid){
+    const baseId = gid + "-base";
+    let defs = radGrad(baseId,"50%","50%","75%",[["0%",hsl(H,40,14)],["100%",hsl(H,45,7)]]);
+    let nebula = "";
+    for(let i=0;i<2;i++){
+      const cx = rnd(rng,0,480), cy = rnd(rng,0,300), r = rnd(rng,120,200);
+      const nId = gid + "-neb-" + i;
+      defs += radGrad(nId,"50%","50%","50%",[["0%",hsl(H+40,50,30),0.3],["100%",hsl(H+40,50,30),0]]);
+      nebula += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="url(#' + nId + ')"/>';
+    }
+    const brightIdx = new Set();
+    while(brightIdx.size < 8){ brightIdx.add(rndInt(rng,0,89)); }
+    let stars = "";
+    for(let i=0;i<90;i++){
+      const cx = rnd(rng,0,480), cy = rnd(rng,0,300);
+      if(brightIdx.has(i)){
+        const haloId = gid + "-star-" + i;
+        defs += radGrad(haloId,"50%","50%","50%",[["0%",hsl(H,30,88),0.9],["100%",hsl(H,30,88),0]]);
+        const r = rnd(rng,0.6,1.8);
+        stars += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="6" fill="url(#' + haloId + ')"/>';
+        stars += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="' + hsl(H,30,88) + '" opacity="0.9"/>';
+      } else {
+        const r = rnd(rng,0.6,1.8);
+        const op = rnd(rng,0.25,0.5).toFixed(2);
+        stars += '<circle cx="' + f1(cx) + '" cy="' + f1(cy) + '" r="' + f1(r) + '" fill="' + hsl(H,30,88) + '" opacity="' + op + '"/>';
+      }
+    }
+    return "<defs>" + defs + "</defs>" + '<rect width="480" height="300" fill="url(#' + baseId + ')"/>' + nebula + stars;
+  }
+
+  function famSlate(rng,H,gid){
+    let s = '<rect width="480" height="300" fill="' + hsl(H,18,13) + '"/>';
+    const res = contourLines(rng,14,22,6,hsl(H,35,55),0.12,1.2);
+    s += res.svg;
+    let dots = "";
+    for(let i=0;i<10;i++){
+      const li = rndInt(rng,0,res.lines.length-1);
+      const line = res.lines[li];
+      const pi = rndInt(rng,0,line.length-1);
+      const pt = line[pi];
+      const r = rnd(rng,2,3);
+      dots += '<circle cx="' + f1(pt[0]) + '" cy="' + f1(pt[1]) + '" r="' + f1(r) + '" fill="' + hsl(H,60,60) + '" opacity="0.5"/>';
+    }
+    return s + dots;
+  }
+
+  // ---------- registry ----------
+  const HUES = [
+    { name:"clay",   h:8   },
+    { name:"amber",  h:38  },
+    { name:"olive",  h:80  },
+    { name:"forest", h:140 },
+    { name:"teal",   h:175 },
+    { name:"sky",    h:215 },
+    { name:"iris",   h:262 },
+    { name:"rose",   h:335 }
+  ];
+
+  const FAMILIES = [
+    { id:"whisper",   tone:"light", gen:famWhisper },
+    { id:"confetti",  tone:"light", gen:famConfetti },
+    { id:"aurora",    tone:"light", gen:famAurora },
+    { id:"contours",  tone:"light", gen:famContours },
+    { id:"drift",     tone:"light", gen:famDrift },
+    { id:"bubbles",   tone:"light", gen:famBubbles },
+    { id:"terrazzo",  tone:"light", gen:famTerrazzo },
+    { id:"graph",     tone:"light", gen:famGraph },
+    { id:"waves",     tone:"light", gen:famWaves },
+    { id:"dusk",      tone:"dark",  gen:famDusk },
+    { id:"starfield", tone:"dark",  gen:famStarfield },
+    { id:"slate",     tone:"dark",  gen:famSlate }
+  ];
+
+  // ---------- render ----------
+  let openState = null;
+  const lightbox = document.getElementById("lightbox");
+  const lightboxFrame = document.getElementById("lightbox-frame");
+  const lightboxId = document.getElementById("lightbox-id");
+
+  function openLightbox(svgEl, id){
+    openState = { svgEl:svgEl, parent:svgEl.parentNode, next:svgEl.nextSibling };
+    lightboxFrame.appendChild(svgEl);
+    lightboxId.textContent = id;
+    lightbox.classList.add("open");
+  }
+  function closeLightbox(){
+    if(!openState) return;
+    if(openState.next){
+      openState.parent.insertBefore(openState.svgEl, openState.next);
+    } else {
+      openState.parent.appendChild(openState.svgEl);
+    }
+    openState = null;
+    lightbox.classList.remove("open");
+  }
+  lightbox.addEventListener("click", function(e){
+    if(e.target === lightbox) closeLightbox();
+  });
+  document.addEventListener("keydown", function(e){
+    if(e.key === "Escape") closeLightbox();
+  });
+
+  let renderedCount = 0;
+
+  function renderAll(){
+    for(let fi=0; fi<FAMILIES.length; fi++){
+      const fam = FAMILIES[fi];
+      const grid = document.getElementById("grid-" + fam.id);
+      for(let hi=0; hi<HUES.length; hi++){
+        const hue = HUES[hi];
+        const id = fam.id + "-" + pad2(hi+1);
+        const rng = seededRng(id);
+        const inner = fam.gen(rng, hue.h, id);
+        const overlay = buildOverlay(rng, fam.tone);
+        const svgMarkup = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 480 300" data-id="' + id + '">' + inner + overlay + "</svg>";
+
+        const card = document.createElement("div");
+        card.className = "card";
+        card.dataset.family = fam.id;
+        card.dataset.tone = fam.tone;
+
+        const frame = document.createElement("div");
+        frame.className = "frame";
+        frame.innerHTML = svgMarkup;
+        const svgEl = frame.firstElementChild;
+
+        const caption = document.createElement("div");
+        caption.className = "caption";
+        const idSpan = document.createElement("span");
+        idSpan.className = "swatch-id";
+        idSpan.textContent = id;
+        const noteSpan = document.createElement("span");
+        noteSpan.className = "note";
+        noteSpan.textContent = hue.name;
+        caption.appendChild(idSpan);
+        caption.appendChild(noteSpan);
+
+        card.appendChild(frame);
+        card.appendChild(caption);
+        card.addEventListener("click", function(){ openLightbox(svgEl, id); });
+
+        grid.appendChild(card);
+        renderedCount++;
+      }
+    }
+  }
+
+  // ---------- filters ----------
+  let activeFamily = "all", activeTone = "all";
+  const familyChips = document.querySelectorAll("#family-chips .chip");
+  const toneChips = document.querySelectorAll("#tone-chips .chip");
+
+  function applyFilters(){
+    const sections = document.querySelectorAll(".family");
+    for(let i=0;i<sections.length;i++){
+      const sec = sections[i];
+      const fam = sec.dataset.family, tone = sec.dataset.tone;
+      const visible = (activeFamily === "all" || activeFamily === fam) && (activeTone === "all" || activeTone === tone);
+      sec.style.display = visible ? "" : "none";
+    }
+  }
+  familyChips.forEach(function(chip){
+    chip.addEventListener("click", function(){
+      familyChips.forEach(function(c){ c.classList.remove("active"); c.setAttribute("aria-pressed","false"); });
+      chip.classList.add("active");
+      chip.setAttribute("aria-pressed","true");
+      activeFamily = chip.dataset.family;
+      applyFilters();
+    });
+  });
+  toneChips.forEach(function(chip){
+    chip.addEventListener("click", function(){
+      toneChips.forEach(function(c){ c.classList.remove("active"); c.setAttribute("aria-pressed","false"); });
+      chip.classList.add("active");
+      chip.setAttribute("aria-pressed","true");
+      activeTone = chip.dataset.tone;
+      applyFilters();
+    });
+  });
+  document.getElementById("overlay-toggle").addEventListener("change", function(e){
+    document.body.classList.toggle("show-overlay", e.target.checked);
+  });
+
+  renderAll();
+})();
+</script>

DESIGN/explorations/board-backgrounds.md

@@ -0,0 +1,72 @@
+# Board background image set — exploration notes
+
+Status: **sweep 1 + faceted gallery published, awaiting swatch review** (2026-08-07). Not a numbered design doc — this is working material for producing a set of bundled background images; the schema and rendering side is already settled in 03-board-ui.md § Styling ▸ Capabilities.
+
+## What this is
+
+A set of shippable background images for boards. The app side needs nothing new: `background: {image: <path>}` relative to the board root, drawn scaled-to-fill and cropped under the transparent title bar with the frosted strip (BoardBackdropImage.swift), decoded at a 3072px ceiling (`BoardBackdrop.maximumPixelSize`), no in-app editor — the raw file is the escape hatch. So the deliverable is purely the artwork: PNG files generated from procedural recipes.
+
+## The model
+
+Every background = **base layer × filler layer**.
+
+Axes swept or reserved:
+
+- **Base**: solid · linear gradient (2/3-stop, angle) · radial/corner glow · soft-blob mesh
+- **Hue strategy**: monochrome · analogous · complementary accent · multicolor
+- **HSB family**: pastel · muted/dusty · deep-dark
+- **Filler shapes**: dots · rings · blob chips · capsules · triangles · plus-signs · contour lines · sine bands · grid
+- **Density** sparse→dense; **size distribution** uniform vs power-law; **placement** uniform scatter · diagonal band · corner-weighted · grid-jitter
+- **Filler color**: same-hue tint · accent hue · multicolor · alpha-only; **opacity** whisper 4–10% → visible 15–25%; **depth** crisp vs gradient-soft, layered sizes
+
+Deliberately left out of sweep 1 (add to surviving families in sweep 2): grain/noise texture, two-layer depth (large blurred behind small crisp), clustered placement, outlined-only variants.
+
+## Sweep 1 — the gallery
+
+- **Artifact (preview)**: https://claude.ai/code/artifact/afa8f1d8-ded0-4d7b-9785-f4b7eb4f8008
+- **Generator source**: `board-backgrounds-gallery.html` (this folder) — single self-contained HTML, all swatches procedural SVG off a seeded PRNG (xmur3 + mulberry32, seeded from the swatch ID string), so IDs are stable references across reloads and rebuilds. To republish after edits: publish this file via the Artifact tool passing the URL above as `url` to keep the link.
+- **96 swatches** = 12 families × 8 hues. Hue wheel (shared by all families): clay 8° · amber 38° · olive 80° · forest 140° · teal 175° · sky 215° · iris 262° · rose 335°. IDs are `family-NN` (`aurora-05` = aurora × teal).
+- **Board overlay toggle** draws translucent lane plates + opaque card plates + title strip over every swatch — the judging condition, since real backgrounds sit under exactly that stack (lanes are a translucent quaternary wash, cards opaque plates).
+
+Families (1–9 light, 10–12 dark):
+
+| Family | Recipe |
+|---|---|
+| whisper | pastel vertical gradient + faint scattered dots — the quietest |
+| confetti | neutral ground + small multicolor shapes (H, H+120, H+240) |
+| aurora | 4–6 large soft radial-gradient blobs, mesh look |
+| contours | topographic wavy polylines, mono |
+| drift | diagonal band of −32°-tilted capsules over diagonal gradient |
+| bubbles | power-law circles/rings over corner glow |
+| terrazzo | irregular 5–7-gon stone chips, four colors |
+| graph | 24px graph-paper grid + plus-signs + accent dots |
+| waves | 6 layered sine dunes toward the bottom |
+| dusk | dark gradient, large glow blobs, horizon ellipse |
+| starfield | tiny stars w/ gradient halos + faint nebulae on dark radial |
+| slate | dark topographic lines + accent dots on flat dark ground |
+
+Rendering constraints baked into the generator (keep for sweep 2): no per-swatch SVG filters (all glow via radial gradients fading to alpha 0 — 96 filters would crawl), ≤~120 filler elements per swatch, gradient defs namespaced by swatch ID, light grounds ≥82% lightness / dark ≤20%.
+
+## Faceted gallery — user-designed originals (2026-08-07)
+
+Separate from the sweep-1 axes model: patterns designed to the user's own criteria — canvas tiled by shapes, per-shape **brightness jitter within a narrow band** doing the drawing, base brightness set by light/dark tone. Geometry is random on every render (that's part of the concept), so the gallery has a **Reroll** button; a swatch ID names the recipe, not a fixed layout.
+
+- **Artifact**: https://claude.ai/code/artifact/d27ad77f-9298-4cf1-9093-19d13a186752 (republished in place each round)
+- **Generator source**: `board-backgrounds-faceted.html` (this folder) — same seeded-PRNG + board-overlay-toggle infrastructure as sweep 1; seed = swatch ID + generation counter.
+- **facets**: grid-jittered dot scatter over an extended canvas → Bowyer–Watson Delaunay triangulation, each triangle stroked with its own fill color to kill antialiasing seams. Reference image: low-poly example on the Redesign board.
+- **bubbles**: same color logic on ~64 opaque circles, power-law radii, drawn large-first. **Set aside after round 1** ("we'll need more work on that") — round-1 recipe kept in git history of the generator file.
+
+**Round 2 (current, facets only)** — axes per the user: vertex count, color count, tone, saturation; brightness stays the narrow in-image jitter. 216 swatches = 3 color strategies × 2 tones × 4 hues × 3 saturations × 3 densities. Hue wheel narrowed to 4 representatives (amber/forest/sky/rose) to keep the cross reviewable; full wheel returns for finals.
+
+- Densities (columns): coarse 5×3 cells ≈20 triangles · medium 9×6 ≈97 · fine 14×9 ≈230.
+- Color strategies (sections): mono · duo = complement H+180° weighted 65/35 · trio = triad H±120° weighted 50/30/20, hue picked per triangle.
+- IDs `facets-<hue>-<strategy>-<density>-<tone><sat>`, e.g. `facets-sk-duo-f-l2` = sky duo fine light mid.
+- Jitters: hue ±3°, sat ±15%, brightness ±4.5 L around tone base (light 85–90, dark 17–21, rich rows get slight headroom shifts).
+
+**Shipped in-app (2026-08-07)**: the recipe is live in the board popover's Background tab (03-board-ui.md § Board popover ▸ Background tab) — Swift port in `Kanban/UI/Board/Backgrounds/`, rendered to a static `facets.png` at pick time (never a live view — the perf/sync ruling). One deliberate deviation from the gallery: the scatter grid gained a sacrificial boundary ring per density (coarse 7×5 @ margin 0.305, medium 10×7 @ 0.14, fine 15×10 @ 0.12 — interior cell size unchanged) because the gallery's fixed 0.075 margin let the ground notch the frame edge (coarse by up to 0.163 of the width — visible flat borders on the reviewed coarse swatches; medium 0.044, fine 0.004). Full-bleed coverage is now a tested invariant (`margin ≥ 0.92 × cell` both axes). Packaging question from sweep 1 is thereby answered for facets: generated on demand, not bundled.
+
+## Next steps
+
+1. Review with overlay on; pick surviving families / specific IDs and direction tweaks ("aurora but duskier", "contours denser").
+2. Sweep 2: deepen winners, add the reserved axes (grain, two-layer depth, clusters, outlines).
+3. Settle final recipes → render real PNGs at 3072px long edge (canvas render of the same recipes, or a small script) → decide packaging (bundled set offered how? templates carry them? drag-in only?) — packaging is an open question, nothing ruled yet.

DRAG-PERF-ANALYSIS.md

@@ -0,0 +1,94 @@
+# Drag/Drop Smoothness Analysis
+
+Where the drag experience actually spends its time, which pre-checks earn their place on the hot path and which don't, and where optimistic allowances are worth making. Written 2026-08-06 from a full read of the pipeline (`BoardDrops.swift`, `DragSession.swift`, `DragAutoScroller.swift`, `DropSlotMath.swift`, the commit path in `BoardStore.swift`, the watcher in `FolderWatcher.swift`) against the model in DRAG-REORDER.md and the measurements in RENDER-INSTRUMENTATION.md. This is an analysis document: findings are prioritized and sequenced but nothing here is implemented yet.
+
+The headline, stated up front: **the mid-drag hot path is already in good shape, and the felt latency lives almost entirely in the release.** The per-sample arithmetic is microseconds on any realistic board; the pause between mouse-up and the card being real is a 200ms debounce plus a whole-strip render pass, and one honesty bug can stretch a *failed* drop into a 1.5-second freeze. The biggest wins are not in doing less checking mid-drag — they are in making the echo arrive fast, making the landing frame cheap, and making the handoff structurally incapable of blinking.
+
+## Anatomy of a drag, as the profiler sees it
+
+**Pickup** (once per gesture): the handle's `.onDrag` closure guards `!isReadOnly, !isEditingInline`, resolves the dragged run's lanes with one O(board) scan, JSON-encodes the payload, and calls `DragSession.begin` — which freezes `cardHeights`/`laneUnits` (the only frozen geometry), clears the `RestingLayoutCache`, and arms the watchdog and the modifier-flip monitor. All synchronous, all trivial. The expensive thing that *also* happens at pickup is not the drag's fault: click-select precedes the drag, and a selection change re-runs **every card body on the board** (RENDER-INSTRUMENTATION.md — "Selection is O(board) in card bodies").
+
+**Per sample** (every `dropUpdated`, and again on every autoscroll frame that actually scrolled): `revalidateProposal()` — an O(lanes) `.contains(where:)` — then the shared retarget: cursor conversion, a `RestingLayoutCache` lookup (hit = a struct-equality key check), `DropSlotMath` zone arithmetic over one masonry column, and a `propose()` that early-outs when the slot didn't change. The strip-side retargets (`retargetLanes`, `retargetCardsFromStrip`) allocate a filtered lane array and a display-units array per sample — the one piece of per-sample work the cache does not cover. On a ≤12-lane board this whole chain is single-digit microseconds; at 120Hz it is not where frames go.
+
+**Release**: `commitDrop()` re-runs the guard ladder once (revalidate, this-board check, survivors, mixed-kind, the `TrashDrop.accepts` re-ask), dispatches to the store writer — a synchronous `performWrite` whose disk work is one `order`-field rewrite or one folder rename — and arms the **committed-overlay hold**: the board keeps drawing the proposed arrangement until the echo snapshot lands or `CommittedHold.timeout` (1.5s) gives up.
+
+**Echo**: `performWrite`'s bracket closes → `FolderWatcher.endBracket()` schedules the mandatory post-bracket reload → **200ms trailing debounce** → off-main tree walk (cheap; `ParseMemo` re-parses only the touched files) → main-actor `land()` with the animated snapshot assignment → `BoardView`'s `snapshotGeneration` watch calls `DragSession.handOff`, dissolving the hold.
+
+So the release pause = write (~1–10ms) + **200ms debounce (dominant)** + walk (a few ms warm) + apply/render. The `drop-release-pause` signpost measures exactly this span, and its healthy outcome today is bounded below by the debounce.
+
+## Findings, prioritized
+
+### P1 — Expedite the app-mediated echo (~180ms off every drop)
+
+The 200ms trailing debounce exists to coalesce foreign FSEvents bursts. But a drop commit is not a burst the watcher has to wait out — the store *knows* it just wrote, the bracket already owes exactly one delivery, and the user is staring at the gap. Add a surgical `FolderWatcher.expedite()`: if `bracketDepth == 0 && pendingOrigin != nil`, cancel the armed debounce and fire the owed delivery now. Expose it through the store and call it from `commitDrop()` right after the writer returns.
+
+This is deliberately **not** a shorter global debounce — `endBracket` serves every `performWrite` (card saves, inline edits, heals), and dropping the settled 200ms figure everywhere would turn write bursts into per-write walks. It is also **not** a violation of one-way flow: nothing mutates the snapshot from the write path; the delivery the bracket already owed just fires earlier, and the store still learns the new order by walking disk.
+
+Races, analyzed: our own FSEvents still in kernel flight arrive after the fast reload and schedule a `.foreign` delivery → one redundant memoized walk → value-equal → assignment skipped, `snapshotGeneration` unmoved, nothing visible. A foreign write landing between our write and the fast reload folds under the `.appMediated` label — the same accepted blur `WatchOrigin.merged` already documents. POSIX guarantees the walk sees the completed writes, because `performWrite`'s FileManager work returned before `expedite` was called. All benign; the cost is one extra no-op walk per drop.
+
+Expected result: `drop-release-pause` outcome `echo` at ~10–50ms instead of ~250–400ms. This also all but closes the rapid-successive-drag window (see P5). Tests: FolderWatcherTests additions (expedite fires the owed delivery once, respects open brackets, no-ops with nothing pending).
+
+### P2 — Honest failure path: don't arm a hold for a write that didn't happen
+
+`commitDrop()` arms `session.commit(into: store)` unconditionally (`BoardDrops.swift:978`), but the drop-path store methods return `Void` and swallow failure via `try? performWrite`. A *failed* write therefore posts its banner immediately — and then leaves the dropped arrangement frozen on screen for the full 1.5s `CommittedHold.timeout` before animating back. By this repo's own definition (`drop-release-pause` outcome `timeout` is "a bug, not a slow frame") and 03-board-ui.md § Motion's promise ("a failed write discards the proposal and the board animates back"), this is a bug, not a design.
+
+The fix is plumbing a fact the writers already compute: make `moveCards`, `copyCards`, `moveLanes`, `restoreLanes`, `receiveCards`, `receiveLanes`, `deleteByDrag`, `deleteLanesByDrag` return `@discardableResult Bool`; arm the hold only on `true`, else `cancelDrop()` — the immediate animated snap-back, banner already posted. A refused no-op arrangement also stops arming a pointless 1.5s hold, which de-noises the signpost and makes `CommittedHold`'s own doc comment ("every drop path refuses a no-op arrangement before it opens a write bracket") true end-to-end.
+
+### P3 — The headerInk hoist: make the landing frame cheap
+
+Every echo reload — the one *inside* the release window — currently re-runs every lane body on the board, because `LaneView.body → headerInk` reads `store.snapshot.background` and Observation tracks whole properties (RENDER-INSTRUMENTATION.md — "the lane gate is never asked on a snapshot change"). The fix is already designed there: resolve the ink once in `BoardView` and pass it down as a compared parameter, the way `slotWidth` and `columns` already are. The tripwire is armed: `theLaneCostFollowsTheBoard` fails in the good direction when this lands, and the container budget in `aOneCardEditIsNotAWholeBoardRebuild` drops from `laneCount` to the pathfinder's 4.
+
+This matters more once P1 lands: with the debounce gone, apply/render becomes the dominant share of the pause, and this is the cheapest way to shrink it. It also smooths the *other* moment the drag model cares about — a foreign reload landing mid-flight, where a whole-strip body storm currently rides the re-grounding.
+
+### P4 — Shadow identity handoff: the echo becomes a content swap
+
+Today the hold renders `DragShadow`s keyed `"shadow:\(index)"`, and the echo swaps a shadow-identity ForEach element for a card-identity element — an insert/remove, exactly the shape the create placeholder deliberately avoids ("a committed placeholder is already keyed by the arriving card's identity… the ForEach element is neither inserted nor removed — only its content changes", `LaneView.swift` at the placeholder). While the session is settled (`hold != nil`), key each held shadow slot by its member's `ItemID` — the session knows `members` in flatten order. The handoff then swaps content in place, structurally incapable of running the appear transition or a one-frame blink, under Reduce Motion or not.
+
+With P1 this largely answers 03-board-ui.md § Motion's reopened release-presentation question with the cheapest possible answer: **nothing moves at all** — the card face materializes in its slot ~30–60ms after mouse-up, under AppKit's own drag-image fade. (Shortening that fade is not reachable: SwiftUI's `.onDrag` never exposes the `NSDraggingSession`.) A brief landed-highlight pulse in the selection-wash vocabulary remains available as optional polish, but prototype it only after P1+P4 — the fast echo may make any additional presentation unnecessary.
+
+### P5 — Rapid successive drags: dissolved by P1, document only
+
+Drag #2's `begin()` clears drag #1's hold, and until the echo lands the board regresses to the stale arrangement — the just-dropped card visibly snaps back, then jumps forward mid-drag when the echo re-grounds the zones. Today that window is ~250–400ms and reachable by a fast user; after P1 it is ~30–60ms and effectively unreachable. `handOff` itself is race-free (all main-actor, root+generation-guarded hold, `expire` self-checks, `begin` cancels the timeout). No mechanism needed; note the residual micro-window in DRAG-REORDER.md when P1 lands.
+
+### M1 — Selection-gated card bodies: the pickup frame
+
+`CardFaceView.body` reads `store.selection`, so selecting one card re-runs all 180 faces — and pickup *is* a selection change, so this O(board) body storm lands on the exact frame the pickup lift starts. The fix is the design change RENDER-INSTRUMENTATION.md already names: each face takes its own selected-ness (and the selection count, for the badge) as compared parameters through `CardFaceView.==`, making a selection change cost only the faces whose state flipped. Preserve the counter-invariant (`selectionStillRepaints`: a selected card must still repaint) and update `ViewEquatableTests`' comparison list. This is the likeliest source of a *pickup* hitch on large boards — the O(board) payload scan is not (see the rejected list).
+
+### M2 — File-drop importable-count cache
+
+The Finder-drop path runs `FinderDrop.importableCount` **twice per sample** (`acceptsFileDrop`, then the shadow count), each doing UTType-database conformance checks per provider — the only genuinely non-trivial per-sample system call in any drag mode. Cache the count on `DragSession` beside `fileTarget`, computed on the first sample of a hover, cleared with the file target and the file watchdog, keyed defensively on provider count. The commit is unaffected (it counts resolved URLs, not providers).
+
+### M3 — Strip-side caches (allocation hygiene, lowest yield)
+
+`retargetLanes` and `retargetCardsFromStrip` allocate a filtered lane array and a display-units array per sample, and `revalidateProposal` scans lanes per callback. A sibling cache to `RestingLayoutCache` — same keying discipline, same session lifecycle — holding the display-units array, its hidden-filtered variant, and a lane-ID `Set` (making revalidation O(1)) removes all of it. Honest sizing: at ≤12 lanes this is microseconds; the value is allocation pressure and pattern consistency, not visible frames. Do it last, or not at all if profiling says done. The reactive alternative — invalidating the proposal from the `snapshotGeneration` watch instead of polling per sample — is not recommended: it trades a provably-cheap check for an ordering dependency, and the re-grounding contract ("at the top of every callback and again at release") is pinned in prose and behavior.
+
+### Wishlist — pre-flush the git seam at pickup
+
+`GitAutoCommitter.noteWillWrite()` is rare (only when the window holds an uncommitted foreign change) but is the single worst possible release stall when it fires: a synchronous stage/commit plus HEAD materialize plus loader walks, all before the drop's write. The optimistic allowance: when a drag **begins** on a board whose window `holdsForeignChanges`, kick the flush then — mid-drag reloads are already a designed-for scenario (the re-grounding trio), and the release then finds nothing to flush. Medium complexity; keep as a wishlist note until the stall is ever observed in a trace.
+
+## Rejected, with reasons
+
+These were analyzed and turned down; recorded so they aren't re-litigated.
+
+- **Full optimistic snapshot mutation at commit.** The `CommittedHold` already renders the proposed arrangement — members lifted, siblings reflowed, slot held — so the only perceptual delta versus mutating the snapshot is card-face-vs-shadow at the slot, which P1+P4 close for ~50ms of exposure. Breaking the one-way-flow invariant would buy that sliver at the price of reconcile-on-echo logic, snapshot rollback on write failure (the current failure story is trivially honest *because* the snapshot never lies), and re-deriving `EchoLedger`/`BoardDiff` semantics. The invariant stays.
+- **Incremental/targeted reload.** `ParseMemo` already makes the echo walk parse ~2 files; what remains is directory enumeration, deliberately never memoized because attachments and loose files don't touch `index.md`. A touched-lanes re-parse would fork "the snapshot is rebuilt purely from disk" into two code paths to save single-digit milliseconds. P1 removes 200ms; this would remove ~5.
+- **Async off-main `BoardWriter`.** Same-volume APFS renames and one-file order rewrites are sub-millisecond metadata ops; async buys nothing and costs the failure-after-hold problem — a banner about a drop the user watched succeed. If the one unbounded case (cross-board copy of a lane with heavy attachment trees) ever shows in a trace, handle that operation with a progress affordance, not the drop architecture.
+- **Collapsing the commit-time guard ladder.** It runs once per release — not on any frame path — and the `TrashDrop.accepts` re-ask exists because ⌥ can change after the proposal stood with no callback reporting it; removing it converts a promised copy into a delete. `ModifierFlipTests` pins this. Zero smoothness gain, real correctness risk.
+- **Dropping the commit no-op guard.** The `DropSlotMath.applied` recompute is once per release, ~30 comparisons, and is what keeps a drag that ends where it started from stamping `modified` and minting a git commit — a disk/history invariant, not a UI one.
+- **Indexing the pickup payload scan.** ≤360 iterations once per gesture, microseconds. A cardID→laneID index invalidated per snapshot buys nothing measurable; the pickup hitch, if felt, is M1's selection storm plus replica rendering.
+- **Caching `TrashDrop.accepts` per hover.** Six boolean clauses, no allocation, deliberately uncached for modifier freshness. Already free.
+- **Allocation-free `DropSlotMath` / caching `MasonryPlacement.frames`.** The frames depend on `placement.origin`, which moves with every autoscroll step — the registry's live placement is deliberately uncached ("derived at event time", four stores and a divide). Caching origin-relative frames and translating per sample is the same O(n) with more machinery, churning the most heavily tested pure math in the app.
+- **Gating the autoscroll retarget.** Already correct: `step()` returns before `didScroll` unless the clamped target moved > 0.01pt; frames where nothing scrolls cost one cursor conversion and an engagement test.
+
+## Validation
+
+No new instrumentation is needed; the existing instruments were built for exactly these claims.
+
+- **P1/P2**: the `drop-release-pause` signpost — healthy drops move from ~250–400ms `echo` to ~10–50ms; failed drops stop producing `timeout` outcomes at all.
+- **P3**: `theLaneCostFollowsTheBoard` fails in the good direction and gets rewritten to pin the fixed behavior; the container budget in `aOneCardEditIsNotAWholeBoardRebuild` tightens from `laneCount` to 4.
+- **M1**: `selectionStillRepaints` keeps its non-zero floor; a new budget pins selection cost to the flipped faces.
+- **M2/M3**: `RestingLayoutCacheTests`-style build/reuse counters on the new caches; `DropSlotMathTests`, `DragAutoScrollMathTests`, `ModifierFlipTests`, `DragWriteTests` all continue to pin the behavior none of this may change.
+
+## Sequencing
+
+P2 first (small, fixes a real bug, de-noises the signpost) → P1 (the latency win; validate with the signpost) → P3 (rides the same window; flips the tripwire) → P4 (handoff identity) — then reassess the open release-presentation question with the fast echo in hand before designing any pulse. M1 next if pickup hitches are felt on large boards; M2 with any file-drop work; M3 only if profiling still shows the strip allocations after everything above.

DRAG-REORDER.md

@@ -23,12 +23,18 @@ While a drag is in flight, the proposal (an insertion index) is computed geometr
 
 The proposal is a pure function of the cursor over these fixed zones. This is deliberately **not** derived from per-item hover events, which feed back off the very reflow they cause (items move under the cursor → a different item fires → the proposal moves again) and jitter. Because the zones are reconstructed analytically rather than measured, they do not move when the placeholder does.
 
-**The resting layout excludes the dragged run whatever the effective operation is.** A within-board ⌥-drag copies, and the originals really do stay — but ⌥ can be pressed and released mid-drag, and a layout that re-admitted the originals on every modifier flip would flap the whole board under the cursor. The dragged items are lifted out at pickup and stay out until release; the copy's originals reappear when the write lands. This is why the drop index means the same thing for `moveCards` and `copyCards` (see **The drop commits** below).
+**The resting layout follows the effective operation: a move lifts the dragged run out, a copy leaves it in.** 04-interactions.md says the originals stay for both copies — the within-board ⌥-drag and the cross-board default — so the source board draws what it will still hold: the originals stand in place, dimmed (`ClipboardTreatment.dimmedOpacity`, the same treatment a trash row being dragged out wears), and the shadow run opens beside them. A move's originals are lifted out at pickup and stay out until the echo lands. The single expression is `DragSession.hiddenMembers(onBoardRooted:)`, which every surface that builds a resting layout goes through.
+
+Pressing or releasing ⌥/⌘ mid-drag therefore reflows the source board **once**, and that one-shot reflow is the point rather than a cost: the modifier's whole job is to change what the drop will leave behind, and the board answering the question is the feedback being asked for. (This retires an earlier carve-out that lifted the run out for every operation to keep the board still. The stillness was real; it was bought by never answering the question.) The flip lands on the next `dropUpdated`, because that is where the operation is re-resolved — a modifier pressed with the mouse perfectly still waits for the next motion. Once a release has settled, the operation is frozen for the duration of the committed hold (`DragSession.resolveOperation` guards on `hold == nil`, exactly as `propose` does), so a settled copy keeps its originals on screen and a settled move keeps them lifted until the echo snapshot lands.
+
+The index-space consequence is real and is carried by the writers rather than papered over: **the drop index means different things for `moveCards` and `copyCards`**, and each one is counted in the layout its own gesture was showing. A move's index counts slots among the cards the run vacates; a copy's counts them among the lane's full rendered set, originals included. Neither writer has to guess — the operation picks the writer and the operation picked the layout — and a within-board ⌥-copy therefore lands exactly at the shadow's slot, including when the shadow sits below the dragged run in the same lane (see **The drop commits** below).
+
+Lanes get this for free and the invariant is worth stating: a within-board lane drag never resolves to `.copy` (⌥ is ignored there), so the strip's zones never see a re-admitted lane under the cursor; a **cross-board** lane copy re-admits the lane into the *source* strip while the cursor is over the foreign board, where none of the source strip's zones are being consulted. `moveLanes` and `receiveLanes` keep the index space they always had. The strip's lane rendering has no dim of its own, so a re-admitted lane reads as an ordinary lane rather than as the source of the drag — the card face and the trash rows are the only surfaces wearing that treatment today.
 
 Two stability rules on top:
 
 - **Exact-boundary tie** — a cursor resting on a boundary pixel keeps the current proposal when it adjoins that boundary; the shadow can never oscillate on a single pixel.
-- **Own-slot pickup** — zones derive from the resting layout, so picking an item up over its original spot proposes its own slot: a no-op, no reflow, and the store's commits refuse to write for it.
+- **Own-slot pickup** — zones derive from the resting layout, so picking an item up over its original spot proposes its own slot: a no-op, no reflow, and the store's commits refuse to write for it. The own slot is also **seeded at `begin`** (`DragSession.begin`'s `seed`), in the same transaction that lifts the run out, so "at drag start it replaces the item's original space" is true from the very first frame: without the seed the vacated gap closes un-animated and springs back open at the first `dropUpdated` — a shuffle carrying no information. The seed bypasses `propose` (a pickup is not a new landing spot, so no alignment tick), and the first real sample's re-propose of the same slot is the early-out's ordinary silence. A ⌥-pickup seeds nothing — a copy's resting layout keeps the originals in place, so there is no vacated space to hold, and the first sample answers as it always did.
 
 ## The lane strip's resting layout is arithmetic
 
@@ -69,7 +75,7 @@ Edge case: if a dead region is hovered with **no valid prior proposal** — a fr
 
 ## The card masonry (2D)
 
-A lane lays its cards out with `MasonryLayout`: card `i` goes to interior column `i % columnCount`, and each column stacks its cards top-aligned and independently, with no row alignment across columns (03-board-ui.md § Lane). Card widths are uniform — the column width — and heights vary, so the grid is genuinely two-dimensional and the span-cap applies on the vertical axis.
+A lane lays its cards out with `MasonryLayout`, dealing **column-major** (ruled 2026-07-31, replacing the pathfinder's round-robin): with `n` cards and `C` columns, `base = n / C` and the first `n % C` columns take one more, so column `c` holds the contiguous run `[start(c), start(c+1))` and logical order runs *down* each column before crossing to the next. Each column stacks its cards top-aligned and independently, with no row alignment across columns (03-board-ui.md § Lane). Card widths are uniform — the column width — and heights vary, so the grid is genuinely two-dimensional and the span-cap applies on the vertical axis.
 
 The resting grid is **re-run, not measured**: `MasonryPlacement.frames(heights:)` replays the same placement over the lane's rendered cards minus the dragged ones, from `(columnCount, columnWidth, spacing, heights)`. `MasonryLayout` itself places subviews through that one function, so the resting grid a drag reasons about and the grid SwiftUI draws cannot drift apart.
 
@@ -78,10 +84,10 @@ The resting grid is **re-run, not measured**: `MasonryPlacement.frames(heights:)
 Cursor → proposal, in three steps (`DropSlotMath.cardSlot`):
 
 1. **Column.** The interior columns' x-bands tile the lane's card area — column `c` plus half a spacing on each side — and the cursor's band picks `c`. Outside the outermost bands the cursor clamps inward, so the lane's padding and its header target the nearest column rather than nothing. Exact-boundary ties keep the current proposal's column, as in 1D.
-2. **Row.** Column `c`'s cards are logical indices `c, c + C, c + 2C, …`; their vertical extents feed the *same* 1D span-capped machinery the strip uses, with `draggedSpan` = the **first dragged card's frozen height** (the run's footprint at the landing spot; the remaining shadows stack below it, and the trigger rect that matters is the one the cursor is over). Dead regions hold, the tail slot below the column's last card is uncapped, and the region above the first card is uncapped.
-3. **Logical index.** Column `c`, row `r` is logical position `r · C + c`, clamped to the card count. The clamp is the only place the arithmetic bends: every column's tail slot maps at or past the end, so "below the last card of any column" is the end slot — appending — which is the honest reading, since a round-robin masonry has no landing spot below one column that is not simply the end.
+2. **Row.** Column `c`'s cards are the contiguous logical range `[start(c), start(c+1))`; their vertical extents feed the *same* 1D span-capped machinery the strip uses, with `draggedSpan` = the **first dragged card's frozen height** (the run's footprint at the landing spot; the remaining shadows stack below it, and the trigger rect that matters is the one the cursor is over). Dead regions hold, the tail slot below the column's last card is uncapped, and the region above the first card is uncapped.
+3. **Logical index.** Column `c`, row `r` is logical position `start(c) + r` — no clamp needed, since `r` never exceeds the column's own card count. A non-final column's tail slot is a **genuine mid-list position** (`start(c+1)`, immediately before the next column's first card); only the last column's tail is the end slot — appending. This is a landing spot the round-robin deal could not offer, where every column's tail collapsed to the end.
 
-The insertion index is therefore always a position in the lane's **logical card order**, which is what the store writes and what 10-accessibility.md's logical-order rule requires. A consequence worth stating out loud: because assignment to columns is round-robin, inserting at index `k` shifts every later card one position and therefore *across* columns. That reflow is the point — `MasonryLayout` is a `Layout` over a single `ForEach` precisely so those moves animate as positional slides rather than as remove/insert blinks.
+The insertion index is therefore always a position in the lane's **logical card order**, which is what the store writes and what 10-accessibility.md's logical-order rule requires. Because the columns re-deal on every count change, inserting at index `k` slides later cards down within their columns and moves at most one card across each column boundary — far gentler than the round-robin deal this replaced, which sent every later card sideways. `MasonryLayout` is a `Layout` over a single `ForEach` precisely so the moves that do happen animate as positional slides rather than as remove/insert blinks. One presentation consequence of the re-deal, accepted with the ruling: a *tail* proposal's shadow draws at the head of the **next** column — exactly where the card will sit once the columns re-deal around it — so the shadow is not always directly under the cursor; the drop still lands exactly where the shadows show.
 
 Everything else carries over unchanged: resting-layout reconstruction, boundary ties, own-slot no-op, uncapped terminal slots.
 
@@ -106,9 +112,11 @@ Two carve-outs:
 
 Geometry does not change across the boundary. The destination board's own resting layout answers the proposal, in the destination's own `standard` and gap; the arriving run's span is its unit counts measured against the destination's standard. What changes is only which commit runs and on which store — see below.
 
+**"Sampled every frame" means sampled on every drop callback, and drop callbacks arrive only while the mouse moves.** A modifier pressed against a perfectly still pointer therefore reaches nothing: the operation decides what the *source* board's resting layout holds (a copy leaves its originals standing — see Resting-layout zones), whether the trash column takes the drop at all, and which index space the shadows are counted in, and all three used to wait for the next twitch of the mouse. So a `.flagsChanged` watch runs for exactly the drag's lifetime — armed at `begin`, stopped at `end`, which is where every way a drag can finish already funnels — and publishes a counter; the board window under the cursor turns that counter back into **the one shared retarget** (`BoardDropContext.retargetAfterModifierFlip`), the same seam the autoscroll driver's every scroll step goes through. The flip carries no location and needs none: the retargets read the physical mouse, so a stationary pointer is simply the cursor they already read. The window that answers is the one whose surface resolved the standing proposal — recorded per retarget as a `LaneDropRegistry`, which is per board *window* — so a cross-board drag re-proposes against the board being hovered and never against the one it came from. A settled release ignores flips entirely, the same freeze the committed-overlay hold applies to `propose` and to the operation itself.
+
 ## The drop commits
 
-The commit is the store's, and it is one `performWrite` bracket per gesture whatever the set's size: one app-mediated reload, and (on git boards) one commit rather than N. Every one of them takes an index counted **against the destination's rendered items with the dragged run removed** — the resting layout's own convention, so the number the geometry produced is the number the writer consumes, unrewritten.
+The commit is the store's, and it is one `performWrite` bracket per gesture whatever the set's size: one app-mediated reload, and (on git boards) one commit rather than N. Every one of them takes an index counted **against the destination's rendered items as the resting layout showed them** — so the number the geometry produced is the number the writer consumes, unrewritten. For every move that means "with the dragged run removed"; for the within-board ⌥-copy it means "with the originals still there", because a copy leaves them there and the zones counted them (see **Resting-layout zones**). Cross-board arrivals never face the question: the destination never held the originals.
 
 | Gesture | Store method | Writer |
 | --- | --- | --- |
@@ -123,7 +131,7 @@ The commit is the store's, and it is one `performWrite` bracket per gesture what
 Three properties of that table are load-bearing:
 
 - **Ranks are inserted, never permuted.** A drop writes only the dragged items' `order` — the siblings' files are not touched, so `modified` (and a git commit) stays honest about what actually moved. `Ranks.insertionRanks(amongVisible:at:count:)` produces the N ranks the contiguous run needs; `nil` from it is the renumber trigger, exactly as an exhausted midpoint is everywhere else, and the fallback compacts the destination and places again (`moveLane`'s and `sortSelection`'s pattern).
-- **A copy's ranks are computed against the destination's *full* rendered set**, because the originals stay and a rank chosen in the gap the lifted originals vacated would collide with them. A move's are computed against the set the moving members vacate. One expression covers both: the ranks are placed among the rendered cards minus whatever will actually leave.
+- **A copy's ranks are computed against the destination's *full* rendered set**, because the originals stay and are still on disk holding their ranks. A move's are computed against the set the moving members vacate. One expression covers both: the ranks are placed among the rendered cards minus whatever will actually leave — which is also, exactly, the layout each gesture's zones were built over, so the index needs no translation on the way in.
 - **Cross-board writes are executed by the destination store**, inside *its* bracket. The source board's tree changes outside its own store's bracket, which is correct and needs no coordination: the source store's watcher sees a foreign change and reloads, which is what a foreign change is.
 
 Identity follows 01-storage-format.md exactly. A copy mints fresh UUIDs at every level and keeps `created` (a copy is a fork). A move keeps the UUID; only the **import boundary** remints, per folder, at the finest grain — a lane arriving with one colliding card is still a lane move with one reminted card.
@@ -176,12 +184,16 @@ The pointer may also sit outside the visible area and still drive it: generously
 
 Three constraints shape the driver, which is the session's half of the work:
 
-- **The pointer is the physical mouse**, partly for the general reason above, but mostly because drop callbacks only arrive while the mouse *moves*, and holding still against an edge is exactly the gesture that must keep scrolling. A ticking task plus `NSEvent.mouseLocation` needs no events at all.
+- **The pointer is the physical mouse**, partly for the general reason above, but mostly because drop callbacks only arrive while the mouse *moves*, and holding still against an edge is exactly the gesture that must keep scrolling. A frame clock plus `NSEvent.mouseLocation` needs no events at all.
 - **Every scroll step re-resolves the proposal.** The cursor is stationary in the lane's space while the *content* moves under it, so without this the shadow would freeze at whatever slot the last mouse movement proposed and the drop would land there. The lane's drop delegate and the autoscroll driver must go through one shared retarget, so they can never disagree.
 - **Termination is structural**, like the rest of the session lifecycle: the driver is a `.task(id:)` keyed on the session, so it is cancelled the moment the session ends — and the watchdog guarantees that flag clears no matter how the drag finished.
 
+The clock is the display's. Frames arrive from a `CADisplayLink` on whichever screen the lane is drawn on (`NSView.displayLink(target:selector:)`, bridged to an `AsyncStream` the `.task` above consumes), and each step integrates the gap between two `targetTimestamp`s, clamped at 50ms so a link resuming from an occluded window steps once rather than teleporting the lane. The 16ms `Task.sleep` loop this replaced had two defects that reach the user as judder: `Task.sleep` guarantees only a *lower* bound on the wake-up, and a fixed ~60Hz cadence beats against a 120Hz panel instead of landing on it. Both arrive at the shadow as well as at the content, because every scroll step drags a retarget behind it.
+
 The board strip itself has nothing to autoscroll: every lane is always visible (the window width divides across the lanes' width units) and the strip fills the window height, so there is no board-level scroller in either axis. The geometry above is axis-agnostic and would serve one unchanged if that ever changes.
 
 ## Adjacent interaction: the lane resize drag (not a drag session)
 
 Dragging a lane's trailing edge resizes it between whole unit counts — see `LaneResizeSession.swift` and `LaneLayoutMath`. It deliberately lives OUTSIDE the drag-session machinery above: the handle is a plain `DragGesture`, carries no drop target, and refuses to start while a card/lane session is in flight. Its layout trick inverts this document's premise: instead of reflowing siblings around a shadow, the session freezes the strip's standard width and resizes the *window* by one standard-plus-gap per snap tick, so every other lane keeps its exact pixels and the release settles the dragged lane into a slot that's already in place. Snapping is asymmetric ("shadow leads"): tick up the instant the live edge clears the inter-lane gap; tick down only after retreating 10pt back into it — the 10pt re-entry band is the only hysteresis, cousin to the dead-region hold above.
+
+It does borrow one thing from the machinery it lives outside: **the release gets its own hold** (`LaneWidthHold`). The release writes the new unit count, and that write takes the one-way flow's round trip, so a session that cleared there would hand the strip back to a standard divided from the already-grown window by the snapshot's still-stale unit total — a visible two-step, once into the wrong arrangement and again when the echo lands. So the frozen standard and the *written* unit count keep governing until the snapshot carries that width, with the same timeout-and-dissolve guarantee as the committed-overlay hold. The condition is the only real difference, and it follows from the subject: that hold stands in for an arrangement and any landing on the board retires it, while this one stands in for a value and only a landing that actually carries it will do.

Fixtures/Malformed/explicit-null-order.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -1,7 +0,0 @@
----
-schema: 1
-order:
-title: Lane With Null Order
----
-The hand-editor started the 'order' key and never gave it a value — reads
-as missing, not malformed.

Fixtures/Malformed/explicit-null-order.kanban/index.md

@@ -1,4 +0,0 @@
----
-schema: 1
-title: Board Is Fine
----

Fixtures/Malformed/many-defects.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Intact Card
+---
+Nothing wrong with this one. It is here so the broken sibling below is a *card* defect rather
+than the only thing in its lane.

Fixtures/Malformed/many-defects.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,8 @@
+---
+schema: 2
+kind: card
+order: 2048
+title: From A Newer Lanework
+---
+Defect #2: a schema newer than this app, below the root — the one `schema` rule the optional-key
+ruling left alone. Unfixable, so the surface offers only Skip.

Fixtures/Malformed/many-defects.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -1,5 +1,6 @@
 ---
 schema: 1
+kind: lane
 order: 1024
-title: Lane Is Fine
+title: Intact Lane
 ---

Fixtures/Malformed/many-defects.kanban/30000000-0000-4000-8000-000000000002/40000000-0000-4000-8000-000000000009/index.md

@@ -0,0 +1,8 @@
+---
+schema: 3
+kind: card
+order: 1024
+title: Hidden Behind The Broken Lane
+---
+Broken too, and deliberately *not* in the aggregate: its lane was skipped before this folder was
+ever listed. Fix the lane and the next walk reports this one.

Fixtures/Malformed/many-defects.kanban/30000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,10 @@
+---
+schema: 1
+kind: lane
+order: 2048
+title: A Lane That Will Not Parse
+labels: [red, green
+---
+Defect #3: unparseable YAML — an unterminated flow sequence, the same shape
+`unparseable-yaml.kanban` uses one level up. The card below is never enumerated: a broken lane
+takes its subtree with it, and repair-then-re-check is what reveals what it was hiding.

Fixtures/Malformed/many-defects.kanban/50000000-0000-4000-8000-000000000003/60000000-0000-4000-8000-000000000004/index.md

@@ -0,0 +1,7 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Last Card
+---
+The walk reaches here, which is the point: a defect in an earlier lane does not end the walk.

Fixtures/Malformed/many-defects.kanban/50000000-0000-4000-8000-000000000003/index.md

@@ -0,0 +1,6 @@
+---
+schema: 1
+kind: lane
+order: 3072
+title: Also Intact
+---

Fixtures/Malformed/many-defects.kanban/index.md

@@ -0,0 +1,8 @@
+---
+title: Many Defects
+created: 2026-07-31T09:00:00Z
+---
+The root's own `schema` is missing — the this-really-is-a-board gate, and defect #1.
+
+The walk does not stop here: lanes are enumerated by folder shape, so everything below is still
+read and reported in the same aggregate.

Fixtures/Malformed/missing-order-card.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000002/index.md

@@ -1,5 +0,0 @@
----
-schema: 1
-title: Card Missing Order
----
-No 'order' key — required on every card.

Fixtures/Malformed/missing-order-card.kanban/index.md

@@ -1,4 +0,0 @@
----
-schema: 1
-title: Board Is Fine
----

Fixtures/Malformed/missing-order-lane.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -1,5 +0,0 @@
----
-schema: 1
-title: Lane Missing Order
----
-No 'order' key — required on every lane.

Fixtures/Malformed/missing-order-lane.kanban/index.md

@@ -1,4 +0,0 @@
----
-schema: 1
-title: Board Is Fine
----

Fixtures/Malformed/non-numeric-order.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000002/index.md

@@ -1,7 +0,0 @@
----
-schema: 1
-order: banana
-title: Card With Non-Numeric Order
----
-'order' is present but not a number — malformed, not missing; the same
-loud rejection as a missing value.

Fixtures/Malformed/non-numeric-order.kanban/index.md

@@ -1,4 +0,0 @@
----
-schema: 1
-title: Board Is Fine
----

Fixtures/Malformed/skippable-defects.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001/index.md

@@ -0,0 +1,7 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Intact Card
+---
+Stays on the board whatever is skipped — a skip omits the item it names, never its siblings.

Fixtures/Malformed/skippable-defects.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,8 @@
+---
+schema: 2
+kind: card
+order: 2048
+title: From A Newer Lanework
+---
+Unfixable, so Skip is the only choice the surface offers for it. Skipped, the card leaves the
+board and this file stays on disk untouched.

Fixtures/Malformed/skippable-defects.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -1,5 +1,6 @@
 ---
 schema: 1
+kind: lane
 order: 1024
-title: Lane Is Fine
+title: Intact Lane
 ---

Fixtures/Malformed/skippable-defects.kanban/30000000-0000-4000-8000-000000000002/40000000-0000-4000-8000-000000000009/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Perfectly Fine, Behind A Broken Lane
+---
+Nothing at all is wrong with this card. It is never in the snapshot regardless: its lane is either
+a defect or a skip, and both take the subtree.

Fixtures/Malformed/skippable-defects.kanban/30000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,9 @@
+---
+schema: 1
+kind: lane
+order: 2048
+title: A Lane That Will Not Parse
+labels: [red, green
+---
+Unparseable YAML. Skipping it takes the whole lane out of the board — the intact card below
+included, which is the honest cost of the tolerance and why the notice names what left.

Fixtures/Malformed/skippable-defects.kanban/50000000-0000-4000-8000-000000000003/60000000-0000-4000-8000-000000000004/index.md

@@ -0,0 +1,7 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Last Card
+---
+Proof the walk kept going past the broken lane.

Fixtures/Malformed/skippable-defects.kanban/50000000-0000-4000-8000-000000000003/index.md

@@ -0,0 +1,6 @@
+---
+schema: 1
+kind: lane
+order: 3072
+title: Also Intact
+---

Fixtures/Malformed/skippable-defects.kanban/index.md

@@ -0,0 +1,11 @@
+---
+schema: 1
+title: Skippable Defects
+created: 2026-07-31T09:00:00Z
+---
+Every defect on this board is **below the root**, which is what makes it the skip channel's golden
+case: the root is never skippable, so a board whose only defects are skippable has to have an
+intact root.
+
+Skip both and it opens — without the broken lane, without the newer-schema card, and without the
+perfectly good card that lives under the broken lane.

Fixtures/README.md

@@ -15,25 +15,26 @@ Lane/card folder names are fixed literal lowercase-UUIDv4-shaped strings (never
 | `rich-board.kanban` | A full-breadth well-formed board: 2 lanes, 3 cards, bodies, styling (background/icon/iconColor/width), unknown + reserved frontmatter keys, `attachments/` and `comments/` with real content. Its `attachments/` also carries all four listing shapes — two ordinary files, a hidden one, and a subfolder with a file — so `Card.attachments`' flat rule (01-storage-format.md § Attachments) is asserted against a real tree. Also the board every `index.md` in the tree is round-tripped against. |
 | `interrupted-create.kanban` | The motivating skip-not-error case: a UUID-shaped lane folder and a UUID-shaped card folder, each with no `index.md` yet (folder created, write not yet landed). |
 | `non-uuid-strays.kanban` | Non-UUID-shaped folders at both lane and card depth, with and without `index.md` — name shape gates candidacy before the file is ever read. |
-| `stray-files.kanban` | Stray (non-directory) files at board, lane, and card level — never level candidates, never warned about. |
+| `stray-files.kanban` | Stray (non-directory) files at board, lane, and card level — never level candidates, never warned about. The **card-level** one (`scratch.md`) is also the loose-file carve-out's golden case: tolerated everywhere else, it is reported in `LoadResult.looseCardFiles` for the app to relocate into `attachments/` (01-storage-format.md § Fractal layout ▸ Rules, settled 2026-07-28). Detection is read-only, so the file stays put on disk. |
 | `tombstones.kanban` | A tombstoned lane and a tombstoned card, both still on disk and still in the snapshot, flagged (`isDeleted`) rather than removed. Also proves a tombstoned lane doesn't recursively flag its own un-deleted children. |
 | `duplicate-order-tie-break.kanban` | Three cards sharing one `order` in one lane, and two lanes sharing one `order` — both broken by folder name, ascending. |
 | `unknown-key-order.kanban` | Unknown/reserved frontmatter keys interleaved with schema-owned ones at board, lane, and card level — `document.unknownFields` must preserve exactly the order they were written in. |
-| `coercion.kanban` | Lenient-field coercion and fallback: wrong-type scalars that coerce (`title: 2048`, `iconColor: 42`, `background: 12345`, `width: "3"`) versus ones with no sensible reading that fall back to the default (`title: [a, b]`, `background: {x: 1}`, `width: 1.5`), plus a `deleted` with an unusable timestamp that still tombstones. |
+| `coercion.kanban` | Lenient-field coercion and fallback: wrong-type scalars that coerce (`title: 2048`, `iconColor: 42`, `width: "3"`) versus ones with no sensible reading that fall back to the default (`title: [a, b]`, `width: 1.5`, and `background: 12345` — a bare scalar, which `background` no longer has a reading for at all), plus `background: {x: 1}` — a legal mapping naming neither subkey, so no color and no trace — and a `deleted` with an unusable timestamp that still tombstones. |
 | `duplicate-top-level-keys.kanban` | A top-level key written twice — at board, lane (the strict `order` field), and card level. Last occurrence wins; **not** a fail-fast case (settled, newer than the original card text). Round-tripped to prove the earlier occurrence survives on disk, invisible only to reads. |
 | `board-level-deleted.kanban` | A board-level `deleted:` key — legal per the frontmatter table but meaningless; ignored + warned, rest of the board loads normally. |
+| `optional-keys.kanban` | `order` and `schema` optional below the board root (re-ruled 2026-07-31). One lane holds a ranked card plus every order-less shape — no key, an explicit null, `order: banana`, `order: .nan` — which all read as append-at-end in folder-name order; the strip holds a ranked lane, a `schema`-less one, and an order-less one. Also the golden case for the minimum agent card: a card whose whole frontmatter is a title. |
 
 ## Malformed/ — one board per fail-fast case
 
-Each board is minimal: one broken thing.
+Each board is minimal: one broken thing. The two multi-defect boards at the bottom are the deliberate exceptions — they exist precisely because the loader collects rather than stops (01-storage-format.md § Malformed input, settled 2026-07-31), which is a claim no one-broken-thing board can make.
 
 | Board | Case |
 |---|---|
 | `unparseable-yaml.kanban` | An unterminated flow sequence in the board's frontmatter. |
-| `missing-schema.kanban` | Board root `index.md` has no `schema` key. |
+| `missing-schema.kanban` | Board root `index.md` has no `schema` key — the **root only**; below it a missing `schema` reads as 1 (`Valid/optional-keys.kanban`). |
 | `schema-newer-than-app.kanban` | Board root `schema: 2`, newer than `BoardLoader.supportedSchema`. |
-| `missing-order-lane.kanban` | A UUID-shaped lane `index.md` with no `order` key. |
-| `missing-order-card.kanban` | A UUID-shaped card `index.md` with no `order` key. |
-| `explicit-null-order.kanban` | A lane's `order:` key present with no value — reads as missing, not malformed. |
-| `non-numeric-order.kanban` | A card's `order: banana` — present but not a number. |
 | `board-root-missing-index.kanban` | The board root folder itself has no `index.md`. |
+| `many-defects.kanban` | **The collect-all board.** A root with no `schema`, a card with `schema: 2`, and a lane whose frontmatter will not parse — three fail-fast classes on one board, reported as one `BoardLoadFailure` in walk order (root, then lanes by folder name with their cards inside them). The broken lane also holds a broken card, which is deliberately **not** in the aggregate: a broken lane takes its subtree with it, and the repair's re-check is what reveals what it was hiding. Two further lanes load fine, which is what proves the walk kept going. |
+| `skippable-defects.kanban` | **The skip channel's board.** `many-defects.kanban` minus the root defect — the root is never skippable, so a board whose defects are all skippable must have an intact root. Skip both (the newer-schema card and the unparseable lane) and it opens: without them, without the broken lane's own perfectly valid card (the subtree goes too), and with a `LoadWarning.userSkipped` per skip as the loud mark the opened board's notice is written from. |
+
+The four `order` boards that used to live here — `missing-order-lane`, `missing-order-card`, `explicit-null-order`, `non-numeric-order` — were retired on 2026-07-31, when `order` became optional below the board root. Their shapes all live on in `Valid/optional-keys.kanban` as coercion cases.

Fixtures/Valid/coercion.kanban/10000000-0000-4000-8000-000000000001/60000000-0000-4000-8000-000000000006/index.md

@@ -3,5 +3,6 @@ schema: 1
 order: 4096
 background: {x: 1}
 ---
-A mapping has no sensible string reading — malformed, falls back to no
-color.
+A mapping is a legal `background` — it carries `color` and `image` subkeys
+— but this one names neither, so there is no color to read and the card
+falls back to none.

Fixtures/Valid/coercion.kanban/10000000-0000-4000-8000-000000000001/70000000-0000-4000-8000-000000000007/index.md

@@ -3,3 +3,5 @@ schema: 1
 order: 5120
 background: 12345
 ---
+`background` is a mapping and only a mapping, so a bare scalar has no
+reading at all — malformed, no color, bytes preserved.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Ranked Card
+---
+The only card in this lane that says where it goes. Every sibling below reads as
+append-at-end, in folder-name order.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,6 @@
+---
+title: Minimum Agent Card
+---
+The whole legal minimum: one `mkdir` and one write, no `order` and no `schema`
+(08-agent-integration.md — "filing a card must need nothing but the schema").
+Reads as schema 1, at the bottom of the lane.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000003/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: card
+order:
+title: Null Order Card
+---
+The hand-editor started the key and never gave it a value — reads as missing,
+which below the root is the append-at-end reading.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000004/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: card
+order: banana
+title: Non-Numeric Order Card
+---
+Present but unusable — the same reading a missing key gets, recorded as a
+coercion with the text as written.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000005/index.md

@@ -0,0 +1,9 @@
+---
+schema: 1
+kind: card
+order: .nan
+title: Non-Finite Order Card
+---
+NaN has no place in the total order the tie-break and midpoint math assume, so
+it is unusable exactly like `banana` — a coercion since 2026-07-31, not a
+rejection.

Fixtures/Valid/optional-keys.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -0,0 +1,6 @@
+---
+schema: 1
+kind: lane
+order: 1024
+title: Ranked Lane
+---

Fixtures/Valid/optional-keys.kanban/30000000-0000-4000-8000-000000000003/20000000-0000-4000-8000-000000000009/index.md

@@ -0,0 +1,6 @@
+---
+schema: 1
+kind: card
+order: 1024
+title: Card In The Orderless Lane
+---

Fixtures/Valid/optional-keys.kanban/30000000-0000-4000-8000-000000000003/index.md

@@ -0,0 +1,6 @@
+---
+schema: 1
+kind: lane
+title: Orderless Lane
+---
+No rank at all: sorts right of every ranked lane in the strip.

Fixtures/Valid/optional-keys.kanban/40000000-0000-4000-8000-000000000002/index.md

@@ -0,0 +1,7 @@
+---
+kind: lane
+order: 2048
+title: Schemaless Lane
+---
+No `schema` below the root reads as 1 — the walk validating this file against
+schema 1 is what makes the reading reliable.

Fixtures/Valid/optional-keys.kanban/index.md

@@ -0,0 +1,8 @@
+---
+schema: 1
+kind: board
+title: Optional Keys
+---
+The board root keeps its `schema` — the this-really-is-a-board gate. Everything
+below it may leave `order` and `schema` out entirely (01-storage-format.md
+§ Frontmatter and § Ordering, re-ruled 2026-07-31).

Fixtures/Valid/rich-board.kanban/10000000-0000-4000-8000-000000000001/40000000-0000-4000-8000-000000000004/index.md

@@ -2,7 +2,7 @@
 schema: 1
 title: Wire up the loader's stray tolerance
 order: 2048
-background: coral
+background: {color: coral}
 icon: flag.fill
 iconColor: orange
 ---

Fixtures/Valid/rich-board.kanban/10000000-0000-4000-8000-000000000001/index.md

@@ -3,7 +3,7 @@ schema: 1
 order: 1024
 title: Doing
 width: 2
-background: '#3478F6'
+background: {color: '#3478F6'}
 icon: hammer.fill
 iconColor: blue
 ---

Fixtures/Valid/rich-board.kanban/20000000-0000-4000-8000-000000000002/index.md

@@ -2,6 +2,6 @@
 schema: 1
 order: 2048
 title: Done
-background: green
+background: {color: green}
 ---
 Completed work lives here until someone clears it out.

Fixtures/Valid/rich-board.kanban/index.md

@@ -5,7 +5,7 @@ title: "Rich Demo Board"
 created: 2026-07-01T09:00:00Z
 modified: 2026-07-26T16:41:38Z
 modified-by: claude
-background: "#1E1E1E"
+background: {color: "#1E1E1E"}
 icon: rectangle.stack.fill
 iconColor: purple
 

Kanban/App/AboutBox.swift

@@ -0,0 +1,25 @@
+import IndieAbout
+
+/// **The About box's configuration.**
+///
+/// **Dormant since the 2026-08-07 pivot** (12-editions.md ▸ PIVOT 2026-08-07 — git leaves the
+/// paywall): this box used to carry a second copyright line naming Lanework Pro, one of the three
+/// places 12's pre-pivot "Tier naming" section named the subscription. Git left the paywall, the
+/// base/Pro split is being re-decided, and until it's ruled, no surface in the app names or sells
+/// Pro — so the line comes out, and the box goes back to a plain, one-line copyright shown to
+/// everyone.
+enum AboutBox {
+
+    /// The About window's content: version/build/date from the stamped Info.plist
+    /// (`update_build_info.sh` — CFBundleVersion, BuildDate, BuildHash), the version line
+    /// opening the bundled CHANGELOG.md, and the bundled ISC LICENSE.md as the one document
+    /// link. Both documents are authored to the Apple inline-Markdown subset — see the files'
+    /// own single-line paragraphs.
+    static var configuration: AppInfoConfiguration {
+        AppInfoConfiguration(
+            copyrightText: "© 2026 rzen",
+            documents: [.license(extension: "md")],
+            changelogDocument: .changelog()
+        )
+    }
+}

Kanban/App/AppCommands.swift

@@ -279,8 +279,164 @@ struct DuplicateBoardCommand: View {
     }
 }
 
-/// The Cancel button's end of a running duplicate: the one piece of state the banner row's `cancel`
-/// closure and the copy task have to share.
+// MARK: - Save as Template
+
+/// File ▸ Save as Template — the board, into the user templates store (11-command-nexus.md: "Board
+/// window; 09-templates.md").
+///
+/// ### It is Duplicate's sequence with a different destination
+///
+/// 09-templates.md ▸ Save as Template states the rule and names Duplicate in the same breath: "**The
+/// copy is preceded by the close flush** … so the template never misses the last keystrokes; the same
+/// rule covers File ▸ Duplicate". So the shape here is `DuplicateBoardCommand`'s, step for step —
+/// flush, then a cancellable copy off the main actor under an in-progress row — and the differences
+/// are all in the engine (`TemplateEngine.saveAsTemplate(boardAt:titled:into:)`): the destination is
+/// the app-side template store rather than a sibling, `.git` and `.trash/` are dropped rather than forked, a
+/// collision auto-renames rather than failing, and a `template:` key lands on the copy.
+///
+/// **No save panel, ever.** The store is the app's own container — "friction-free sandbox writes, no
+/// location ceremony" (09 ▸ Storage) — so there is no location question to ask, and therefore no
+/// `.refused` outcome to answer: a permission failure writing inside our own container is an
+/// ordinary failure with an ordinary banner.
+///
+/// ### The ending that speaks is the quiet one
+///
+/// A duplicate opens in a window, so it announces itself. A template lands in a folder nobody is
+/// looking at, so this posts a **passive signpost** — the info tone's calm half (02-architecture.md
+/// § The banner surface: "Passive info rows rank last and may collapse — calm by design"). It names
+/// the template rather than only the board, because that is where a Finder-style auto-rename becomes
+/// visible: "Saved 'Roadmap' as the template 'Roadmap 2'" is the only place the user is told which
+/// one they just made. A cancel says nothing (the partial is gone, the duplicate rule verbatim), and
+/// a failure is the ordinary one-shot banner.
+///
+/// ### Validation is Duplicate's, minus 09's one carve-out
+///
+/// Board window only, and disabled under the read-only lock — with the exception 09 spells out and
+/// 02-architecture.md ▸ Live-reload resilience scopes: **under the unwritable-location lock alone it
+/// stays live**, because it "reads the board and writes the app-side store" (archiving the
+/// read-only DMG board being inspected is a legitimate errand), *unless* an open Edit or raw-source
+/// session holds unsaved content — content that lock's suspended saves cannot flush, and which the
+/// template would therefore silently miss. The other two locks disable it outright: a vanished root
+/// has nothing to copy, and a board whose last reload failed is a tree whose state is least known.
+///
+/// The focused-editor half of `acceptsBoardMutations` is kept in every branch, for
+/// `DuplicateBoardCommand`'s reason: an open inline title editor holds the one pending change no
+/// flush can reach, and a template taken mid-rename would miss the edit being made.
+struct SaveAsTemplateCommand: View {
+
+    let appModel: AppModel
+
+    @FocusedValue(\.boardStore) private var store
+    @FocusedValue(\.boardWindowRef) private var ref
+
+    private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "templates")
+
+    var body: some View {
+        Button("Save as Template") {
+            save()
+        }
+        .disabled(!canSave)
+    }
+
+    private var canSave: Bool {
+        guard let store, let ref else { return false }
+        return Self.allowsSave(
+            lock: store.readOnlyLock,
+            isEditingInline: store.isEditingInline,
+            hasUnsavedCardContent: appModel.hasUnsavedCardContent(for: ref)
+        )
+    }
+
+    /// The item's validation as a pure function of the three facts it turns on — extracted from
+    /// `canSave` so the carve-out can be tested at every combination rather than only through a
+    /// menu.
+    ///
+    /// The carve-out itself is 02-architecture.md ▸ Live-reload resilience, settled: under the
+    /// **unwritable-location lock alone** this stays live (copy-out is a read — archiving the
+    /// read-only DMG board being inspected is a legitimate errand), and it "gates on the hazard
+    /// itself, open sessions, not on lock provenance" — so an Edit or raw-source session holding
+    /// unsaved content disables it, whether the lock arrived at open or from the symmetric probe
+    /// mid-session, and nothing here asks which. The other two locks disable it outright.
+    nonisolated static func allowsSave(
+        lock: ReadOnlyLockReason?,
+        isEditingInline: Bool,
+        hasUnsavedCardContent: Bool
+    ) -> Bool {
+        guard !isEditingInline else { return false }
+        switch lock {
+        case .none:
+            return true
+        case .unwritableLocation:
+            return !hasUnsavedCardContent
+        case .vanishedRoot, .bracketedReloadFailed:
+            return false
+        }
+    }
+
+    private func save() {
+        guard canSave, let store, let ref else { return }
+        let name = AppModel.displayName(of: store)
+        let source = store.rootURL
+
+        Task { @MainActor in
+            let cancellation = DuplicateCancellation()
+            // Copy-shaped work, so the row carries Cancel — "remove the partial copy, nothing lost"
+            // (02 § The banner surface), which the engine honors by removing the partial store entry.
+            let operation = store.banners.beginOperation(
+                label: "Saving '\(name)' as a template…",
+                cancel: { cancellation.cancel() }
+            )
+            defer { store.banners.endOperation(operation) }
+
+            await appModel.flushPendingWork(for: ref)
+
+            // Cancelled during the flush: the copy never starts, rather than starting and being told
+            // to stop (`DuplicateBoardCommand.copy(_:titled:into:cancellation:)`'s guard, verbatim).
+            guard !cancellation.isCancelled else { return }
+
+            // Detached, for the two halves of Duplicate's reason: the copy is real I/O on a board
+            // that may carry a large `.git` — a spinner drawn by a blocked main thread is a still
+            // picture — and a detached task's cancellation is only ever this row's Cancel.
+            let task = Task.detached(priority: .userInitiated) {
+                try TemplateEngine.saveAsTemplate(boardAt: source, titled: name)
+            }
+            cancellation.attach(task)
+
+            do {
+                let landed = try await task.value
+                store.banners.postSignpost(
+                    Self.savedMessage(board: name, template: TemplateEngine.documentName(of: landed))
+                )
+            } catch TemplateEngine.Failure.cancelled {
+                Self.logger.notice("save as template cancelled — the partial template was removed")
+            } catch let TemplateEngine.Failure.failed(error) {
+                Self.logger.error("save as template failed: \(error.description, privacy: .public)")
+                store.banners.post(error)
+            } catch {
+                let write = BoardWriteError(
+                    operation: .saveAsTemplate(title: name),
+                    path: source.path,
+                    reason: .io(message: error.localizedDescription)
+                )
+                Self.logger.error("save as template failed: \(write.description, privacy: .public)")
+                store.banners.post(write)
+            }
+        }
+    }
+
+    /// The signpost's line. The template is named only when the store's collision ladder gave it a
+    /// different one — saying "Saved 'Roadmap' as the template 'Roadmap'" would be noise, while
+    /// leaving the rename unsaid would hide the one thing about this save the user could not predict.
+    static func savedMessage(board: String, template: String) -> String {
+        board == template
+            ? "Saved '\(board)' as a template"
+            : "Saved '\(board)' as the template '\(template)'"
+    }
+}
+
+/// The Cancel button's end of a running board copy — File ▸ Duplicate's and File ▸ Save as
+/// Template's alike: the one piece of state the banner row's `cancel` closure and the copy task have
+/// to share.
 ///
 /// **A main-actor box rather than a lock**, because there is nothing here to race over: the row's
 /// `cancel` is `@MainActor @Sendable`, and the task is created and attached on the same actor. The
@@ -316,18 +472,21 @@ private final class DuplicateCancellation {
 /// to a command — the thing 04's contract forbids.
 ///
 /// **The board scope reveals either side of the trash boundary and ignores every lock.** Reveal "is
-/// not edit-shaped and stays enabled on tombstoned selections" (04 ▸ The trash), and inspection is a
+/// not edit-shaped and stays enabled on trash selections" (04 ▸ The trash), and inspection is a
 /// read, so neither the read-only lock nor the focused-editor rule applies — the same posture the
 /// trash row's own Reveal takes. A selection whose ids resolve to no folders (one the next reload
 /// will drop) disables rather than falling back to the root: revealing the wrong thing is worse
 /// than nothing, and only a genuinely empty selection means "the board".
 ///
-// m6-card-window: the item's third scope — the card's folder, or the selected attachment's file
-// when the attachments section is focused — adds a focused value and a branch here; the two below
-// do not move.
+/// **The card-window scope is the third branch**, and it is the one the attachment row's context
+/// menu twins (11-command-nexus.md ▸ Context menus): "card window: the card's folder — the selected
+/// attachment's file instead when the attachments section is focused". The rule itself is
+/// `CardAttachments.revealURLs`, so the menu row and the row's own Reveal cannot disagree about what
+/// "the selected attachment" means.
 struct RevealInFinderCommand: View {
 
     @FocusedValue(\.boardStore) private var store
+    @FocusedValue(\.cardAttachments) private var attachments
     @FocusedValue(\.welcomeSelection) private var selection
 
     var body: some View {
@@ -338,14 +497,22 @@ struct RevealInFinderCommand: View {
     }
 
     /// What the item would reveal, and therefore whether it is enabled — one answer for both, the
-    /// codebase's usual shape. The board in front wins; the welcome branch stands when no board is.
+    /// codebase's usual shape. The board in front wins; the card-window branch stands when a card
+    /// window is; the welcome branch stands when neither is.
     private var urls: [URL] {
         if let store {
             let ids = store.selection.ids
             guard !ids.isEmpty else { return [store.rootURL] }
-            return TrashModel.paths(of: ids, on: store.selection.liveness, in: store.snapshot)
+            return ItemPath.resolve(ids, in: store.selection.container, snapshot: store.snapshot)
                 .map { $0.folder(under: store.rootURL) }
         }
+        if let attachments {
+            return CardAttachments.revealURLs(
+                cardFolder: attachments.cardFolder,
+                selectedURL: attachments.selectedURL,
+                isSectionFocused: attachments.isFocused
+            )
+        }
         guard let selection, selection.canReveal, let url = selection.url else { return [] }
         return [url]
     }

Kanban/App/AppDelegate.swift

@@ -16,6 +16,27 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "app-delegate")
 
+    /// Starts the Pro entitlement's transaction listener (12-editions.md ▸ The entitlement).
+    ///
+    /// **Here rather than in `AppModel.init`**, and the distinction matters: a unit-test host *is*
+    /// this app, so `KanbanApp.init()` and therefore `AppModel.init` run on every test launch
+    /// (`AppStateHome.isUnitTestHost`). Building the entitlement there costs one `UserDefaults` read;
+    /// acquiring a StoreKit listener there would give every test run a live `Transaction.updates`
+    /// subscription for no reason. Launch is the honest home for a listener, and this is the app's.
+    ///
+    /// It starts nothing the board-open path waits on: the listener writes cached facts that a
+    /// *later* composition may read, and never reaches into a session that is already open
+    /// (`ProEntitlement`).
+    ///
+    /// **The appearance override applies here too, for the same reason.** `AppearanceStore.init`
+    /// only reads; this is the one call that hands its answer to `NSApp` — the global side effect
+    /// `KanbanApp.init` must not carry, since a unit-test host runs that `init` on every launch
+    /// (`AppearanceStore.applyCurrent`).
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        appModel?.entitlement.start()
+        appModel?.appearance.applyCurrent()
+    }
+
     /// **The close is respected.** "Closing the last board window leaves the app windowless (menu bar
     /// alive)" — a document-shaped app whose windows are boards has no business quitting because the
     /// user tidied one away, and welcome is one Dock click or one menu item back.

Kanban/App/AppearanceCommands.swift

@@ -0,0 +1,36 @@
+import SwiftUI
+
+// MARK: - View ▸ Appearance
+
+/// View ▸ Appearance — Auto / Light / Dark (11-command-nexus.md ▸ View; 03-board-ui.md ▸ Toolbar).
+///
+/// **App-wide and always enabled**, unlike `ZoomCommands` beside it in the View menu: appearance is a
+/// preference about how *every* window in the app draws, welcome included, so this row needs no
+/// `@FocusedValue` scoping and no board window in front — `NewBoardCommand`'s posture (everywhere, no
+/// focus required) rather than `ZoomCommands`' (board windows only).
+///
+/// A `Picker` rather than three independent toggles: SwiftUI renders one placed directly in a
+/// menu-bar command group as a submenu — "Appearance" as its title, "Auto" / "Light" / "Dark" as its
+/// rows, a checkmark on whichever is selected — which is the three-way exclusive choice a trio of
+/// `Toggle`s cannot express (nothing stops more than one, or none, from reading as checked). `nil` is
+/// the Auto tag; `AppearanceStore.setOverride` is the single write path the board-toolbar item shares
+/// (`BoardZoomStore.step`'s rule — a toolbar item is a menu command with a different face, never a
+/// second implementation of it).
+struct AppearanceCommands: View {
+
+    /// A plain `let` rather than an `@Environment` read, `ZoomCommands`' reason: menu commands live in
+    /// the menu bar, outside every scene's environment; the row re-renders on a change because
+    /// `AppModel` is `@Observable` (`NewBoardCommand`'s pattern).
+    let appModel: AppModel
+
+    var body: some View {
+        Picker("Appearance", selection: Binding(
+            get: { appModel.appearance.override },
+            set: { appModel.appearance.setOverride($0) }
+        )) {
+            Text("Auto").tag(nil as AppAppearance?)
+            Text("Light").tag(AppAppearance.light as AppAppearance?)
+            Text("Dark").tag(AppAppearance.dark as AppAppearance?)
+        }
+    }
+}

Kanban/App/AppearanceStore.swift

@@ -0,0 +1,130 @@
+import AppKit
+import Observation
+
+// MARK: - AppAppearance
+
+/// The app-wide appearance override — Auto (follow system) / Light / Dark (11-command-nexus.md ▸
+/// View ▸ Appearance; 03-board-ui.md ▸ Toolbar).
+///
+/// There is no `.auto` case: following the system is the *absence* of an override, which is what makes
+/// "no stored key" the one honest spelling of it (`AppearanceStore`, `AppPreferences.appearanceKey`) —
+/// a third case would need its own reading of what it means to override with "don't override".
+public enum AppAppearance: String, CaseIterable, Sendable {
+    case light
+    case dark
+}
+
+// MARK: - AppearanceStore
+
+/// The app's one appearance override, app-wide and persisted (11-command-nexus.md ▸ View ▸ Appearance;
+/// 03-board-ui.md ▸ Toolbar).
+///
+/// `BoardZoomStore`'s shape exactly, and for its reasons. Two consumers need change notification a
+/// property wrapper in a view cannot give them: the board toolbar's picker item, whose checkmarks are
+/// read fresh whenever AppKit opens its menu rather than polled (`WindowToolbarController`), and the
+/// View-menu picker, which lives outside every scene's environment and reaches `AppModel` as a plain
+/// `let` the same way `ZoomCommands` reaches `zoom`. An `@Observable` object over an injectable
+/// `UserDefaults` is what serves both without either one mirroring the other's state.
+///
+/// ### Why not `@AppStorage`, like Show Comments
+///
+/// Show Comments has exactly one write path and exactly one thing reading it back — the checkbox
+/// itself. This preference has two independent controls that must never drift the way the toolbar's
+/// zoom buttons and the View-menu zoom rows must not (`BoardZoomStore.setLevel`'s rule), and the
+/// toolbar's is AppKit underneath — an `NSMenuToolbarItem` cannot bind to `@AppStorage` at all.
+///
+/// ### Why the write path applies live, unlike zoom's
+///
+/// A zoom level only ever feeds a board's own drawing, so persisting it is enough — the board reads it
+/// back through the environment. An appearance override is a statement about the whole app's chrome,
+/// every open window included, so the setter both persists *and* calls the apply seam in the same
+/// beat: there is no reload and no window that has to be told twice.
+@MainActor
+@Observable
+public final class AppearanceStore {
+
+    /// The current override. `nil` is Auto — the app follows the system appearance.
+    public private(set) var override: AppAppearance?
+
+    @ObservationIgnored
+    private let defaults: UserDefaults
+
+    /// The one seam that touches `NSApp` — injected so a test can prove the setter's whole contract
+    /// (persist, then apply) without a live application object, `BoardZoomStore.defaults`'s reason
+    /// turned toward AppKit rather than `UserDefaults`.
+    @ObservationIgnored
+    private let apply: (NSAppearance.Name?) -> Void
+
+    /// - Parameters:
+    ///   - defaults: the domain to persist in — injected for `BoardZoomStore`'s reason: a test holds
+    ///     its own rather than touching the developer's real appearance.
+    ///   - apply: what "make it so" means. Defaulted to the real thing; a test hands in a recording
+    ///     closure instead so it never touches `NSApp`.
+    public init(
+        defaults: UserDefaults = .standard,
+        apply: @escaping (NSAppearance.Name?) -> Void = { name in
+            NSApp.appearance = name.map { NSAppearance(named: $0) } ?? nil
+        }
+    ) {
+        self.defaults = defaults
+        self.apply = apply
+        // A string, not an enum-backed scalar: the key is absent for Auto (the remove-at-default
+        // idiom a default lane width and an empty rename already use), and any value that survives to
+        // here but is neither "light" nor "dark" — a hand edit, a future build's spelling read by an
+        // older one — degrades to Auto rather than refusing to resolve. `AppAppearance.init(rawValue:)`
+        // already answers `nil` for anything it does not recognise, so the lenient read costs nothing
+        // beyond the `flatMap`.
+        override = defaults.string(forKey: AppPreferences.appearanceKey).flatMap(AppAppearance.init(rawValue:))
+    }
+
+    // MARK: - The pure resolver
+
+    /// What an override means to AppKit — no `NSApp`, no live application, provable with nothing but
+    /// the enum (`BoardZoom.normalize`'s reason: the rule is a function, and the object around it is
+    /// only that function's persistence and observability).
+    ///
+    /// `nonisolated`, unlike everything else here: it touches no actor-isolated state, and marking it
+    /// so is what lets a plain (non-`@MainActor`) test call it directly, the same freedom
+    /// `BoardZoom.normalize` has by living outside `BoardZoomStore` entirely.
+    public nonisolated static func appearanceName(for override: AppAppearance?) -> NSAppearance.Name? {
+        switch override {
+        case .light: .aqua
+        case .dark: .darkAqua
+        case nil: nil
+        }
+    }
+
+    // MARK: - Writing
+
+    /// Sets the override, persists it, and applies it — the single write path the View-menu picker and
+    /// the board-toolbar item share (`BoardZoomStore.setLevel`'s rule: the two faces of one command
+    /// must never become two implementations of it).
+    ///
+    /// **Auto removes the key** rather than writing a third spelling of it: the preference is meant to
+    /// read as "no override on file" to anyone who inspects it, the same bargain a default lane width
+    /// and an empty rename already keep.
+    ///
+    /// **An unchanged value writes and applies nothing**, `BoardZoomStore.setLevel`'s own guard and for
+    /// the same load-bearing reason: `@Observable` notifies on every assignment, equal or not, so an
+    /// ungated write would invalidate every observer of `override` — the picker's checkmarks, the
+    /// toolbar controller's tracked validation — on a no-op, and hand the apply seam a repeat call for
+    /// nothing every one of its callers would have to tolerate.
+    public func setOverride(_ newValue: AppAppearance?) {
+        guard newValue != override else { return }
+        override = newValue
+        if let newValue {
+            defaults.set(newValue.rawValue, forKey: AppPreferences.appearanceKey)
+        } else {
+            defaults.removeObject(forKey: AppPreferences.appearanceKey)
+        }
+        apply(Self.appearanceName(for: newValue))
+    }
+
+    /// Re-applies the stored override — launch's whole job
+    /// (`AppDelegate.applicationDidFinishLaunching`). `init` above already read the value; this is the
+    /// method that hands it to AppKit, kept separate from `init` so building a store — including in a
+    /// test, including as `AppModel`'s own construction — is never itself a global side effect.
+    public func applyCurrent() {
+        apply(Self.appearanceName(for: override))
+    }
+}

Kanban/App/BoardDuplicator.swift

@@ -9,10 +9,10 @@ import Foundation
 ///   board, where identities could collide; a whole-board copy is a new namespace, and Duplicate's
 ///   fork-keeps-history guarantee requires it (copied `.git` history must keep naming the paths it
 ///   describes)".
-/// - **Tombstoned items are carried too** (03, settled): "Duplicate is a full fork, trash included —
-///   dropping them would leave the copy's working tree disagreeing with its own copied HEAD". This
-///   file does nothing to achieve that: a tombstone is a `deleted:` key inside a file, so a copy
-///   carries it by declining to be clever.
+/// - **`.trash/` is carried too** (03, settled, re-grounded 2026-07-28 for the materialized trash):
+///   "Duplicate is a full fork, `.trash/` included — dropping it would leave the copy's working tree
+///   disagreeing with its own copied HEAD". This file does nothing to achieve that: the trash is an
+///   ordinary folder under the root, so the tree walk carries it by declining to be clever.
 /// - **`.git` comes along** — a duplicate of a git board is a fork of its history — with only its
 ///   remote configuration stripped, which is m7's.
 /// - Timestamps, unknown keys, strays, `CLAUDE.user.md`, attachments: verbatim, for the same reason.
@@ -28,12 +28,10 @@ import Foundation
 /// sibling before dismissing the banner (the attachment partial-cleanup precedent): a cancelled
 /// duplicate never happened."
 ///
-/// So the walk *is* the promise: one `FileManager.copyItem` per file — bytes and their metadata
-/// copied by the file system, never re-encoded, symlinks copied as symlinks — folders recreated by
-/// hand, and a cancellation read **between** items, never mid-file (a copy interrupted inside a
-/// 200 MB pack file leaves rubble that is harder to reason about than one more file's wait). The
-/// entries of every folder are walked in name order, so the same cancellation removes the same
-/// partial tree every time and a failure names the same file twice running.
+/// The walk itself is `BoardTreeCopy`, shared with template instantiation (09-templates.md), which
+/// needs the same cancellable per-item copy of a whole board and differs only in what it excludes
+/// and whether folder attributes carry. Duplicate excludes **nothing** and carries **everything** —
+/// which is not a default taken but this flow's entire definition, stated in the call below.
 ///
 /// **The partial goes on both exits.** Cancel promises removal; a failure gets it too, because a
 /// half-copied board is pure residue — nothing was there before, so there is no true state for it to
@@ -42,11 +40,6 @@ import Foundation
 /// The one thing never removed is a destination this walk did not create — an existing name is the
 /// user's, and refusing to clobber it is the same stance `BoardWriter.createBoard` takes.
 ///
-/// The accepted cost of building folders by hand rather than handing the tree to one `copyItem`:
-/// **extended attributes on folders do not carry** (files keep theirs — each is still copied by
-/// `copyItem` — and POSIX permissions and timestamps are carried explicitly below). Nothing the app,
-/// the storage format, or git keeps lives in a folder xattr.
-///
 /// ### Not `@MainActor`
 ///
 /// Duplicating a board with a year of `.git` behind it is real I/O, and it runs while the original's
@@ -85,13 +78,6 @@ enum BoardDuplicator {
         case failed(BoardWriteError)
     }
 
-    /// Why a walk stopped and on which item — the recursion's private currency, converted to a
-    /// `Failure` (and the partial removed) the moment it surfaces.
-    private enum WalkStop: Error {
-        case cancelled
-        case failed(url: URL, error: any Error)
-    }
-
     // MARK: - Where the copy lands
 
     /// The Finder-style destination for duplicating `rootURL`: `"Board copy"`, then `"Board copy 2"`,
@@ -114,18 +100,40 @@ enum BoardDuplicator {
     /// the sandbox will not let us write is usually one we cannot list either, so the ladder simply
     /// finds no collision and suggests `"Board copy"` — the right pre-fill, arrived at honestly.
     static func copyDestination(for rootURL: URL) -> URL {
-        let parent = rootURL.deletingLastPathComponent()
-        let base = rootURL.deletingPathExtension().lastPathComponent
-        let ext = rootURL.pathExtension
+        uncollidedURL(
+            named: "\(rootURL.deletingPathExtension().lastPathComponent) copy",
+            extension: rootURL.pathExtension,
+            in: rootURL.deletingLastPathComponent()
+        )
+    }
 
+    /// **Finder's counting ladder, in one place**: `name`, then `name 2`, `name 3`, … counting up
+    /// from 2 against what is on disk at decision time, one collision at a time.
+    ///
+    /// Shared rather than spelled twice, because two flows want the same ladder from different
+    /// starting names: Duplicate seeds it with `"Board copy"` (above), and Save as Template seeds it
+    /// with the board's own name — 09-templates.md ▸ Save as Template's "**Store collisions
+    /// auto-rename, Finder-style** (`Board.kanban` → `Board 2.kanban`) — the 01 import precedent:
+    /// saving never overwrites an existing template and never refuses". One ladder, two seeds, so
+    /// the two can never disagree about what "Finder-style" means.
+    ///
+    /// The extension rides on the end (`Board copy.kanban`) and an extension-less board folder
+    /// simply has none to carry — both are shapes a board is allowed to be (01-storage-format.md
+    /// § Document packaging).
+    ///
+    /// `fileExists` is the one test, and it is true for a file as much as a folder: anything already
+    /// wearing the name blocks it, which is what keeps either flow from overwriting something. It is
+    /// a decision-time answer, not a reservation — the caller still creates the folder itself and
+    /// still fails rather than clobbers if the name was taken in between.
+    static func uncollidedURL(named base: String, extension ext: String, in parent: URL) -> URL {
         func candidate(_ name: String) -> URL {
             parent.appendingPathComponent(ext.isEmpty ? name : "\(name).\(ext)", isDirectory: true)
         }
 
-        var name = "\(base) copy"
+        var name = base
         var counter = 2
         while FileManager.default.fileExists(atPath: candidate(name).path) {
-            name = "\(base) copy \(counter)"
+            name = "\(base) \(counter)"
             counter += 1
         }
         return candidate(name)
@@ -214,13 +222,16 @@ enum BoardDuplicator {
         // ours to remove, and this is also where the sandbox says "not here" — the refusal the save
         // panel answers, raised before a single byte has been copied.
         do {
-            try createDirectory(at: destination)
+            try BoardTreeCopy.createDirectory(at: destination)
         } catch {
             throw failure(at: destination, error)
         }
 
         do {
-            try copyContents(of: rootURL, into: destination, isCancelled: isCancelled)
+            // No exclusions and folder attributes carried: a duplicate is a full fork — `.git`,
+            // `.trash/`, strays, modes and dates included (03; 01-storage-format.md § Fractal layout
+            // ▸ Rules, "Whole-board copies are the carve-out").
+            try BoardTreeCopy.copy(contentsOf: rootURL, into: destination, isCancelled: isCancelled)
         } catch {
             // Cancelled or failed, the partial sibling goes: the tree exists only because this call
             // made it, and half a board is not a state anything should have to render.
@@ -233,7 +244,7 @@ enum BoardDuplicator {
             }
         }
 
-        restoreAttributes(from: rootAttributes, onto: destination)
+        BoardTreeCopy.restoreAttributes(from: rootAttributes, onto: destination)
         // m7-git: strip the copy's remote configuration — "the duplicate keeps `.git` but has its
         // remote configuration stripped ... it must not silently push into the original's remote"
         // (03-board-ui.md). Remotes only: the repo-local `user.name`/`user.email` survives, so the
@@ -242,107 +253,6 @@ enum BoardDuplicator {
         return destination
     }
 
-    // MARK: - The walk
-
-    /// Copies everything inside `source` into the already-created `destination`, one item at a time.
-    ///
-    /// Name order, hidden entries included (no `.skipsHiddenFiles`): `.git`, `.DS_Store` and every
-    /// other dotfile are part of the fork, and a deterministic order is what makes a cancellation
-    /// reproducible.
-    ///
-    /// Each entry's type comes from `attributesOfItem`, which does **not** traverse symlinks — so a
-    /// link is copied as a link (by `copyItem`, which does not follow it either) rather than being
-    /// mistaken for the folder it points at and walked into.
-    private static func copyContents(
-        of source: URL,
-        into destination: URL,
-        isCancelled: () -> Bool
-    ) throws(WalkStop) {
-        let entries: [URL]
-        do {
-            entries = try FileManager.default.contentsOfDirectory(
-                at: source,
-                includingPropertiesForKeys: nil,
-                options: []
-            )
-        } catch {
-            throw .failed(url: source, error: error)
-        }
-
-        for entry in entries.sorted(by: { $0.lastPathComponent < $1.lastPathComponent }) {
-            // Between items, never mid-item: this is the whole of "checks cancellation between
-            // items", and the reason the copy is a walk at all.
-            if isCancelled() { throw .cancelled }
-
-            let attributes: [FileAttributeKey: Any]
-            do {
-                attributes = try FileManager.default.attributesOfItem(atPath: entry.path)
-            } catch {
-                throw .failed(url: entry, error: error)
-            }
-
-            let isDirectory = attributes[.type] as? FileAttributeType == .typeDirectory
-            let target = destination.appendingPathComponent(entry.lastPathComponent, isDirectory: isDirectory)
-
-            guard isDirectory else {
-                // Files, symlinks, and whatever else the file system holds: `copyItem` lands the
-                // bytes and the metadata that rides with them, byte-for-byte, unread.
-                do {
-                    try FileManager.default.copyItem(at: entry, to: target)
-                } catch {
-                    throw .failed(url: entry, error: error)
-                }
-                continue
-            }
-
-            do {
-                try createDirectory(at: target)
-            } catch {
-                throw .failed(url: entry, error: error)
-            }
-            try copyContents(of: entry, into: target, isCancelled: isCancelled)
-            restoreAttributes(from: attributes, onto: target)
-        }
-    }
-
-    /// Creates `url` as a plain directory, wearing the process's own default permissions until its
-    /// contents have landed (`restoreAttributes(from:onto:)` puts the source's back afterwards).
-    ///
-    /// **Default permissions first, the source's last**, because a folder is not only a thing being
-    /// copied but the thing being copied *into*: a source folder that is read-only, or unreadable,
-    /// would otherwise be reproduced as a destination this walk cannot write its own children into —
-    /// and, when something later fails, as a partial tree the cleanup cannot remove either. `cp -R`
-    /// defers the mode for the same reason.
-    ///
-    /// `withIntermediateDirectories: false` throughout: every parent either exists already (the walk
-    /// just made it) or is the one the user pointed at, and inventing a missing folder would be this
-    /// function deciding where a board lives.
-    private static func createDirectory(at url: URL) throws {
-        try FileManager.default.createDirectory(at: url, withIntermediateDirectories: false)
-    }
-
-    /// Puts a folder's POSIX permissions and its creation and modification dates back, **after** its
-    /// contents have landed — writing into a folder is itself a modification, and its mode may be
-    /// what stops the writing (above), so both wait for the subtree to be finished.
-    ///
-    /// Best effort by design: a volume that will not take a date back (or a file system with no
-    /// creation dates at all) is not a reason to fail a duplicate that otherwise worked, and neither
-    /// a folder's timestamp nor its mode is something the storage format reads.
-    private static func restoreAttributes(from attributes: [FileAttributeKey: Any], onto url: URL) {
-        var carried: [FileAttributeKey: Any] = [:]
-        if let permissions = attributes[.posixPermissions] {
-            carried[.posixPermissions] = permissions
-        }
-        if let created = attributes[.creationDate] {
-            carried[.creationDate] = created
-        }
-        if let modified = attributes[.modificationDate] {
-            carried[.modificationDate] = modified
-        }
-        guard !carried.isEmpty else { return }
-        try? FileManager.default.setAttributes(carried, ofItemAtPath: url.path)
-    }
-
     // MARK: - Classifying a refusal
 
     /// Whether `error` is the sandbox saying **not here** — the one failure 03 answers with a save

Kanban/App/BoardTemplate.swift

@@ -1,89 +1,190 @@
 import Foundation
 
-/// A board template — what File ▸ New Board… (⌥⌘N) instantiates (09-templates.md).
+/// One board template — **a schema-valid board folder that loaded** (09-templates.md ▸ Definition
+/// format: "A template is itself a board").
 ///
-/// ### One template today, and that is the shape of this card, not a shortcut
+/// ### There is no template model, only a board model
 ///
-/// 09 settles both the inventory (all ten pathfinder templates carry over) and the definition
-/// format, and the format is the interesting part: **a template is itself a board** — a schema-valid
-/// board folder in the app's resources, read by the same `BoardLoader`, its `index.md` supplying the
-/// display name (`title`), the picker blurb (the body), the icon, and the chooser position
-/// (`template.order`). None of that exists yet. What this card ships is the *entry point*: the
-/// chooser window, the save panel, and a real path from ⌥⌘N to an open board, with exactly one
-/// template behind it so that path is exercised rather than described.
+/// Everything the chooser shows and everything instantiation reproduces is read off the template
+/// board's own `index.md`, through the ordinary `BoardLoader`: `title` is the display name,
+/// `icon`/`iconColor` are the picker icon and what the new board inherits, the **body** is the
+/// blurb (which becomes the new board's description by simply being copied), and `template.order`
+/// is the chooser position. This type holds the loaded `BoardModel` and derives those from it — it
+/// stores no copies, so a template's identity can never drift from its file.
 ///
-// m9-templates: the inventory becomes a walk of `<bundle>/Templates/*.kanban` plus the user store in
-// Application Support, each folder loaded through `BoardLoader` — `name`/`blurb`/`icon` off the
-// template board's own `index.md`, order off its `template.order`, an unloadable user template still
-// listed (by folder name, marked unloadable, carrying the loader's specifics) but not instantiable.
-// `laneTitles` stops existing at that point: instantiation becomes a tree copy that skips tombstones,
-// mints fresh GUIDs, and stamps `created`/`modified` fresh (`BoardWriter.CopyStamps.born`), never
-// copying `.git`. The chooser's mini preview renders from the loaded `BoardModel` rather than from
-// these strings.
+/// That is 09's "dogfood" clause taken literally: "the template format *is* the board format — no
+/// second schema, no parallel Swift model to keep in sync". The pathfinder's Swift-struct catalog
+/// (and the `laneTitles` stub that stood in for it here) is exactly what this replaces.
+///
+/// ### A value you can hold is a template that loaded
+///
+/// The initializer is the load (`TemplateEngine.load(templateAt:origin:)`), so there is no
+/// "unloadable template" case in this type: an unloadable *user* template is a chooser row, not a
+/// template — 09 says it is "still listed — by folder name, marked unloadable, carrying the loader's
+/// fail-fast specifics — but can't be instantiated or previewed", and that listing is the chooser
+/// card's, built from the loader's error rather than from a half-built value of this type. Anything
+/// holding a `BoardTemplate` is therefore holding something instantiable.
 struct BoardTemplate: Identifiable, Sendable, Equatable {
 
-    /// The bundle folder name a real template would have (`basic.kanban` → `basic`) — 09 calls it
-    /// "the template's stable slug (tests, a11y ids)", so it is the identity here too.
-    let slug: String
+    /// Which store the template came from — 09's two tiers ("bundled templates by `template.order`,
+    /// then keyed user templates by `template.order`, then keyless user boards last"). Carried
+    /// rather than derived from the URL: the chooser's ordering and its Reveal in Finder affordance
+    /// both turn on the tier, and re-deriving it from a path prefix would be a second answer to a
+    /// question the discovery walk already answered.
+    enum Origin: Sendable, Equatable {
+        case bundled
+        case user
+    }
 
-    /// The chooser's display name — a real template's `title`.
-    let name: String
+    /// The template folder itself — `<app bundle>/Templates/basic.kanban`, or a folder in the user
+    /// store. The instantiation source, and the identity here.
+    let url: URL
 
-    /// The chooser's blurb — a real template's `index.md` body, which also becomes the new board's
-    /// description. Nothing is written from it yet: this card creates lanes, not board bodies.
-    let blurb: String
+    let origin: Origin
 
-    /// The board icon shown in the picker and inherited by the new board.
-    let icon: String
+    /// The template board as the ordinary loader read it. Instantiation does **not** use this — it
+    /// copies the tree on disk — but the chooser's mini per-lane preview renders from it, and every
+    /// derived property below reads it.
+    let model: BoardModel
 
-    /// The lanes to create, in order.
-    let laneTitles: [String]
+    /// A template is identified by where it lives: slugs are stable but not unique across the two
+    /// stores (a user template may legitimately be called `basic.kanban` too), and the chooser's
+    /// selection must never be ambiguous between tiers.
+    var id: String { url.path }
 
-    var id: String { slug }
+    /// The stable slug — 09: "The bundle folder name (`basic.kanban`) is the template's stable slug
+    /// (tests, a11y ids)". The extension is dropped because an extension-less board folder is
+    /// equally legal (01-storage-format.md § Document packaging) and `basic` is the name the design
+    /// uses.
+    var slug: String { url.deletingPathExtension().lastPathComponent }
 
-    /// The plain scaffold, and the one template that exists.
+    /// The display name: the board's `title`, falling back to the folder name — 01-storage-format.md
+    /// § Board naming's rule, unchanged, because a template is a board.
+    var name: String { model.title.value ?? slug }
+
+    /// The picker blurb — the template board's **body**, which is also what the instantiated board
+    /// carries as its description (09: the body is "shown in the picker *and* becoming the new
+    /// board's description"). Whitespace-trimmed for display only; the bytes on disk are copied
+    /// verbatim by instantiation and never touched here.
+    var blurb: String { model.document.body.trimmingCharacters(in: .whitespacesAndNewlines) }
+
+    /// The board icon shown in the picker and inherited by the new board — the lenient `icon` rule
+    /// (`ItemSymbol`), so a template naming a symbol this OS cannot draw shows the board default
+    /// rather than an empty box.
+    var icon: String { ItemSymbol.name(model.icon, fallback: ItemSymbol.board) }
+
+    /// The icon's palette tint, or `nil` for the chrome default — read raw, since `Palette` is the
+    /// one place a colour name is resolved.
+    var iconColor: String? { model.iconColor.value }
+
+    /// The chooser position — `template.order`, 09's **one** picker key and its only subkey.
     ///
-    // m9-templates: the bundled `basic.kanban` is 09's "plain To Do / Done scaffold" — two lanes,
-    // not these three. The third is here because a chooser preview with two lanes reads as a mistake
-    // and because this stub's whole job is to prove the create path; when the bundled template
-    // arrives it replaces this value wholesale and 09's inventory is the only source.
-    static let basic = BoardTemplate(
-        slug: "basic",
-        name: "Basic",
-        blurb: "Three lanes to move work through.",
-        icon: ItemSymbol.board,
-        laneTitles: ["To Do", "Doing", "Done"]
-    )
-
-    /// Every template the chooser offers, in chooser order.
-    static let all: [BoardTemplate] = [.basic]
-
-    // MARK: - Instantiation
-
-    /// Writes this template to `rootURL`: the board's `index.md`, then one lane per title, in order.
-    ///
-    /// **The board's title is the document name the user chose**, not the template's — 09
-    /// ▸ Instantiation says so, and 01-storage-format.md § Board naming is the reason: display name
-    /// and folder name start out matching, so a board called "Roadmap" on disk is called "Roadmap" in
-    /// its window title. An extension-less name is as legal a board as a `.kanban` one, so the
-    /// extension is stripped rather than required.
-    ///
-    /// Lanes land at `1024`, `2048`, `3072` without this function saying so: each `createLane` call
-    /// appends after the visible siblings the previous one left behind (`Ranks.append(toVisible:)`),
-    /// which is what makes the array's order the board's order.
-    ///
-    /// Separated from the panel and from the window flow deliberately — this is the whole of what
-    /// "instantiate a template" means on disk, and a test drives it against a temp folder without
-    /// going anywhere near `NSSavePanel`.
-    func instantiate(at rootURL: URL) throws(BoardWriteError) {
-        try BoardWriter.createBoard(at: rootURL, title: Self.documentName(of: rootURL))
-        for title in laneTitles {
-            _ = try BoardWriter.createLane(inBoard: rootURL, title: title)
+    /// Read out of the model's opaque `YAMLValue` rather than through a typed accessor, deliberately:
+    /// 09 keeps the key's shape open ("future subkeys possible"), and `BoardModel.template` is
+    /// carried raw for exactly that reason. `nil` covers every shape that is not a number under
+    /// `order` — a missing key, a hand-dropped board that never had one, a malformed value — which
+    /// is one case to the chooser: 09's keyless tier, sorted by display name.
+    var order: Double? {
+        guard case let .mapping(pairs) = model.template else { return nil }
+        guard let value = pairs.last(where: { $0.key == .string("order") })?.value else { return nil }
+        switch value {
+        case let .int(number): return Double(number)
+        case let .double(number): return number
+        default: return nil
         }
     }
 
-    /// The document name behind a chosen URL — `~/Boards/Roadmap.kanban` → `Roadmap`.
-    static func documentName(of rootURL: URL) -> String {
-        rootURL.deletingPathExtension().lastPathComponent
+    /// The template's lanes in display order, for the chooser's mini per-lane preview — a real
+    /// `BoardModel`'s lanes, not a list of strings the app maintains by hand.
+    var lanes: [Lane] { model.lanes }
+}
+
+// MARK: - A chooser row
+
+/// One row of the template chooser: **a template that loaded, or a folder that didn't**.
+///
+/// This is the either-shape 09-templates.md requires of the chooser and deliberately not of
+/// `BoardTemplate`:
+///
+/// > **One bad template never fails the chooser** (the user store is hand-editable, so a malformed
+/// > board there is one edit away): a user template the loader rejects is still listed — by folder
+/// > name, marked unloadable, carrying the loader's fail-fast specifics — but can't be instantiated
+/// > or previewed; fix the files and it comes back. (09 ▸ Why this format)
+///
+/// So the discovery walk answers with rows and `TemplateEngine.load` keeps answering with a
+/// `Result`: anything holding a `BoardTemplate` is still holding something instantiable, and the one
+/// place a failure is *rendered* is the one place that can carry it — the row.
+///
+/// **The unloadable half is a user-store shape only.** A bundled template that does not load is a
+/// build defect, logged and skipped (`TemplateEngine.bundledTemplates()`), because nobody looking at
+/// the chooser can fix an app's own resources.
+enum TemplateRow: Identifiable, Sendable {
+
+    case template(BoardTemplate)
+    case unloadable(Unloadable)
+
+    /// A store folder the loader rejected — the URL and the loader's error, whole and unreworded.
+    struct Unloadable: Identifiable, Sendable, Equatable {
+
+        let url: URL
+        let error: BoardLoadError
+
+        var id: String { url.path }
+
+        /// **The folder name, sans extension** — "the failed load can supply neither
+        /// `template.order` nor `title`, so the folder name is the only identity it has" (09
+        /// ▸ Storage). Spelled the way every other board display name falls back
+        /// (`AppModel.folderDisplayName(of:)`, `BoardTemplate.slug`), so a broken `Notes.kanban` and
+        /// a working one sort and read alike rather than differing by four characters.
+        var name: String { url.deletingPathExtension().lastPathComponent }
+    }
+
+    var id: String {
+        switch self {
+        case let .template(template): template.id
+        case let .unloadable(unloadable): unloadable.id
+        }
+    }
+
+    var url: URL {
+        switch self {
+        case let .template(template): template.url
+        case let .unloadable(unloadable): unloadable.url
+        }
+    }
+
+    /// The name the chooser shows and the keyless tier sorts by.
+    var name: String {
+        switch self {
+        case let .template(template): template.name
+        case let .unloadable(unloadable): unloadable.name
+        }
+    }
+
+    /// `template.order`, and **always `nil` for an unloadable row** — 09 sorts it with the keyless
+    /// tier for the reason that it has no key to read.
+    var order: Double? {
+        switch self {
+        case let .template(template): template.order
+        case .unloadable: nil
+        }
+    }
+
+    /// The template behind the row, or `nil` — the whole of "can't be instantiated or previewed",
+    /// expressed as the absence of the value both of those need.
+    var template: BoardTemplate? {
+        switch self {
+        case let .template(template): template
+        case .unloadable: nil
+        }
+    }
+
+    /// The failure behind the row, or `nil` — the other half of the same either, so a caller holding
+    /// an optional row can ask both questions without a nested `case .some(.unloadable(…))`.
+    var unloadable: Unloadable? {
+        switch self {
+        case .template: nil
+        case let .unloadable(unloadable): unloadable
+        }
     }
 }

Kanban/App/BoardTreeCopy.swift

@@ -0,0 +1,208 @@
+import Foundation
+
+/// The **board-scale tree copy**: a per-item file walk that checks cancellation between items,
+/// shared by File ▸ Duplicate (`BoardDuplicator`) and template instantiation (`TemplateEngine`).
+///
+/// ### Why the walk is a walk
+///
+/// 03-board-ui.md settles the shape for Duplicate and the reason generalizes to every copy of a
+/// whole board: "the copy runs as a per-item file walk that checks cancellation between items —
+/// **never one monolithic `copyItem`** — and Cancel removes the partial sibling before dismissing
+/// the banner (the attachment partial-cleanup precedent)". A monolithic `copyItem` is uncancellable
+/// and indivisible; a walk is both, and it is also the only shape that can *exclude* something
+/// (09-templates.md's `.git` and `.trash/`).
+///
+/// So the walk is the promise: one `FileManager.copyItem` per file — bytes and their metadata
+/// copied by the file system, never re-encoded, **symlinks copied as symlinks** (01-storage-format.md
+/// § Fractal layout ▸ Rules: "Copy flows copy the link itself, never its target: Duplicate, Save as
+/// Template, instantiation, cross-board copies … preserve the link verbatim") — folders recreated by
+/// hand, and a cancellation read **between** items, never mid-file (a copy interrupted inside a
+/// 200 MB pack file leaves rubble that is harder to reason about than one more file's wait). The
+/// entries of every folder are walked in name order, so the same cancellation removes the same
+/// partial tree every time and a failure names the same file twice running.
+///
+/// The accepted cost of building folders by hand rather than handing the tree to one `copyItem`:
+/// **extended attributes on folders do not carry** (files keep theirs — each is still copied by
+/// `copyItem`). Nothing the app, the storage format, or git keeps lives in a folder xattr.
+///
+/// ### What it does not do
+///
+/// It never creates the destination root, never removes a partial, and never classifies a failure.
+/// Those are the caller's, because they are exactly where the two flows differ: Duplicate answers a
+/// permission failure with a save panel, instantiation with a banner, and each owns its own cleanup
+/// promise. This type only knows how to move a tree, one item at a time, and where to stop.
+///
+/// ### Not `@MainActor`
+///
+/// Copying a board with a year of `.git` behind it is real I/O and runs off the main actor so an
+/// in-progress banner can actually spin (02-architecture.md § The banner surface). Safe by
+/// construction: it touches only the two URLs it is handed, and a board's security-scoped access is
+/// a process-wide grant, not a per-thread one.
+enum BoardTreeCopy {
+
+    /// Why a walk stopped and on which item — the recursion's currency, which each caller converts
+    /// into its own failure vocabulary the moment it surfaces.
+    enum Stop: Error {
+        case cancelled
+        case failed(url: URL, error: any Error)
+    }
+
+    /// Copies everything inside `source` into the already-created `destination`, one item at a time.
+    ///
+    /// Name order, hidden entries included (no `.skipsHiddenFiles`): `.DS_Store`, `.gitignore`,
+    /// `CLAUDE.user.md` and every other dotfile or stray is part of the copy — "the copy is literal
+    /// apart from the stated exclusions" (09-templates.md ▸ Save as Template) — and a deterministic
+    /// order is what makes a cancellation reproducible.
+    ///
+    /// `excludedTopLevelNames` is compared **lowercased against the top level only**, which is the
+    /// exclusions' actual scope rather than a shortcut: `.git` and `.trash/` mean something at a
+    /// board root and nowhere else (06-history-undo.md's nearest-`.git`-wins detection starts at the
+    /// board root; `BoardLoader.trashCandidates` looks in exactly one place), so a `.git` a template
+    /// author left inside a card folder is an ordinary stray and copies verbatim like any other.
+    ///
+    /// `carriesFolderAttributes` decides whether a recreated folder gets the source folder's POSIX
+    /// permissions and timestamps back once its contents have landed. Duplicate says yes — it is a
+    /// fork, down to the mode bits. Instantiation says no: a template folder is content the app
+    /// ships or the user dropped, and carrying a read-only mode (or a two-year-old date) out of it
+    /// would mint a board that is read-only, or born older than itself, from a copy whose whole
+    /// premise is "born today" (09-templates.md ▸ Instantiation).
+    ///
+    /// Each entry's type comes from `attributesOfItem`, which does **not** traverse symlinks — so a
+    /// link is copied as a link (by `copyItem`, which does not follow it either) rather than being
+    /// mistaken for the folder it points at and walked into.
+    static func copy(
+        contentsOf source: URL,
+        into destination: URL,
+        excludingTopLevel excludedTopLevelNames: Set<String> = [],
+        carryingFolderAttributes carriesFolderAttributes: Bool = true,
+        isCancelled: () -> Bool
+    ) throws(Stop) {
+        try copyContents(
+            of: source,
+            into: destination,
+            excluding: excludedTopLevelNames,
+            carryingFolderAttributes: carriesFolderAttributes,
+            isCancelled: isCancelled
+        )
+    }
+
+    /// The recursion. `excluded` is emptied one level down, which is what makes the exclusions
+    /// top-level-only without the walk having to count its own depth.
+    private static func copyContents(
+        of source: URL,
+        into destination: URL,
+        excluding excluded: Set<String>,
+        carryingFolderAttributes carriesFolderAttributes: Bool,
+        isCancelled: () -> Bool
+    ) throws(Stop) {
+        let entries: [URL]
+        do {
+            entries = try FileManager.default.contentsOfDirectory(
+                at: source,
+                includingPropertiesForKeys: nil,
+                options: []
+            )
+        } catch {
+            throw .failed(url: source, error: error)
+        }
+
+        // The one exclusion this walk makes without being asked (01-storage-format.md § Enhanced
+        // schema: `comments/.trash/` is "**stripped at every copy boundary** (clipboard staging,
+        // Duplicate, Save as Template) — a copy must not carry ghosts no window session will ever
+        // purge"). Unconditional because all three of this walk's callers *are* copy boundaries, and
+        // an opt-in flag would be three call sites agreeing to one rule instead of one rule.
+        //
+        // It is the one depth-sensitive exclusion, hence the parent check rather than a name in
+        // `excluded`: `.trash` at a board root is the board's own and carries or not per each flow's
+        // stated exclusions, while `.trash` inside a `comments/` is undo's backing store and never
+        // travels.
+        let isCommentThread = source.lastPathComponent.lowercased() == IntegrityRules.commentsFolderName
+
+        for entry in entries.sorted(by: { $0.lastPathComponent < $1.lastPathComponent }) {
+            guard !excluded.contains(entry.lastPathComponent.lowercased()) else { continue }
+            guard !isCommentThread
+                || entry.lastPathComponent.lowercased() != IntegrityRules.commentTrashFolderName
+            else { continue }
+
+            // Between items, never mid-item: this is the whole of "checks cancellation between
+            // items", and the reason the copy is a walk at all.
+            if isCancelled() { throw .cancelled }
+
+            let attributes: [FileAttributeKey: Any]
+            do {
+                attributes = try FileManager.default.attributesOfItem(atPath: entry.path)
+            } catch {
+                throw .failed(url: entry, error: error)
+            }
+
+            let isDirectory = attributes[.type] as? FileAttributeType == .typeDirectory
+            let target = destination.appendingPathComponent(entry.lastPathComponent, isDirectory: isDirectory)
+
+            guard isDirectory else {
+                // Files, symlinks, and whatever else the file system holds: `copyItem` lands the
+                // bytes and the metadata that rides with them, byte-for-byte, unread.
+                do {
+                    try FileManager.default.copyItem(at: entry, to: target)
+                } catch {
+                    throw .failed(url: entry, error: error)
+                }
+                continue
+            }
+
+            do {
+                try createDirectory(at: target)
+            } catch {
+                throw .failed(url: entry, error: error)
+            }
+            try copyContents(
+                of: entry,
+                into: target,
+                excluding: [],
+                carryingFolderAttributes: carriesFolderAttributes,
+                isCancelled: isCancelled
+            )
+            if carriesFolderAttributes {
+                restoreAttributes(from: attributes, onto: target)
+            }
+        }
+    }
+
+    /// Creates `url` as a plain directory, wearing the process's own default permissions until its
+    /// contents have landed (`restoreAttributes(from:onto:)` puts the source's back afterwards,
+    /// where the caller asked for them).
+    ///
+    /// **Default permissions first, the source's last**, because a folder is not only a thing being
+    /// copied but the thing being copied *into*: a source folder that is read-only, or unreadable,
+    /// would otherwise be reproduced as a destination this walk cannot write its own children into —
+    /// and, when something later fails, as a partial tree the cleanup cannot remove either. `cp -R`
+    /// defers the mode for the same reason.
+    ///
+    /// `withIntermediateDirectories: false` throughout: every parent either exists already (the walk
+    /// just made it) or is the one the user pointed at, and inventing a missing folder would be this
+    /// function deciding where a board lives.
+    static func createDirectory(at url: URL) throws {
+        try FileManager.default.createDirectory(at: url, withIntermediateDirectories: false)
+    }
+
+    /// Puts a folder's POSIX permissions and its creation and modification dates back, **after** its
+    /// contents have landed — writing into a folder is itself a modification, and its mode may be
+    /// what stops the writing (above), so both wait for the subtree to be finished.
+    ///
+    /// Best effort by design: a volume that will not take a date back (or a file system with no
+    /// creation dates at all) is not a reason to fail a copy that otherwise worked, and neither a
+    /// folder's timestamp nor its mode is something the storage format reads.
+    static func restoreAttributes(from attributes: [FileAttributeKey: Any], onto url: URL) {
+        var carried: [FileAttributeKey: Any] = [:]
+        if let permissions = attributes[.posixPermissions] {
+            carried[.posixPermissions] = permissions
+        }
+        if let created = attributes[.creationDate] {
+            carried[.creationDate] = created
+        }
+        if let modified = attributes[.modificationDate] {
+            carried[.modificationDate] = modified
+        }
+        guard !carried.isEmpty else { return }
+        try? FileManager.default.setAttributes(carried, ofItemAtPath: url.path)
+    }
+}

Kanban/App/BoardWindowHost.swift

@@ -15,9 +15,23 @@ import os
 /// it — is `BoardView`'s (03-board-ui.md); this file hands it the store and the window and stays out
 /// of the way.
 ///
+/// ### Every open passes through a loading state
+///
+/// The window appears **immediately** — welcome click, File ▸ Open…, Finder double-click,
+/// restoration alike — at its saved frame, its title carrying the registry record's cached name,
+/// and its content area holding `BoardLoadingView` until the first snapshot lands
+/// (02-architecture.md § Launch and window lifecycle, ruled 2026-07-29). The walk that produces
+/// that snapshot runs **off the main actor** (`BoardStoreRegistry.acquireOffMain`), so a board of
+/// any size opens as a live window rather than as a beachball, and every restored window walks
+/// independently of every other.
+///
+/// The window is therefore real, and closeable, before it has a store: ⌘W during the walk cancels
+/// it and closes the window. That is why `configureWindow` is in two halves — see
+/// `configureLoadingWindow(recordID:)`.
+///
 /// ### Failure opens welcome, on a row that already exists
 ///
-/// A board that will not load has nothing to show, so its window never appears. But its registry
+/// A board that will not load has nothing to show, so its window retires. But its registry
 /// record is created **before** the load runs (02-architecture.md § Per-board app state, "a first
 /// open that fails fail-fast still records"), so the failure that joins `AppModel.launchFailures`
 /// always has a recents row waiting for it — `WelcomeRow.derive` matches the two by path, uniform
@@ -29,6 +43,9 @@ struct BoardWindowHost: View {
     @Environment(AppModel.self) private var appModel
     @Environment(\.openWindow) private var openWindow
     @Environment(\.dismissWindow) private var dismissWindow
+    /// The transient search strip's arrival and departure has a reduced variant like every other
+    /// appearance in the app (10-accessibility.md; `Motion.transientSearchTransition`).
+    @Environment(\.accessibilityReduceMotion) private var reduceMotion
 
     /// The window's own controller — `@State` so it outlives body evaluations and so SwiftUI keeps it
     /// alive for exactly as long as this window exists.
@@ -41,8 +58,8 @@ struct BoardWindowHost: View {
     @State private var boardInfo = BoardInfoPresentation()
 
     /// This window's purge alert, open or not (03-board-ui.md § Trash). `@State` for `boardInfo`'s
-    /// reason and reaching the menu bar the same way: Delete Immediately and Empty Trash… are
-    /// menu-bar items, and a menu item cannot present anything of its own.
+    /// reason and reaching the menu bar the same way: File ▸ Delete (landing on a trash selection)
+    /// and Empty Trash… are menu-bar items, and a menu item cannot present anything of its own.
     @State private var trashConfirmations = TrashConfirmations()
 
     /// How Board ▸ Open Card reaches this window's card windows. `@State` for `boardInfo`'s reason,
@@ -56,10 +73,53 @@ struct BoardWindowHost: View {
     /// window's field.
     @State private var boardSearch = BoardSearchPresentation()
 
+    /// The pre-snapshot surface's grace clock (02 § Launch and window lifecycle). `@State` for
+    /// `boardInfo`'s reason — one per window, living exactly as long as the window.
+    @State private var loading = BoardLoadingIndicator()
+
+    /// The open walk, so ⌘W can cancel it by name rather than by waiting for SwiftUI's teardown to
+    /// get around to it.
+    @State private var openWalk = BoardOpenWalk()
+
+    /// This board's registry record, from the moment `recordOpen` mints it — which is what the
+    /// loading window's title reads (`Self.loadingTitle`). `nil` only for the one body evaluation
+    /// that precedes `start()`.
+    @State private var recordID: UUID?
+
+    /// This open's security-scoped access, claimed in `start()` and held until the session takes it
+    /// over or the open ends.
+    ///
+    /// `@State` rather than a local in `start()` because the decision surface outlives that call: a
+    /// repair *writes into the board*, and a scope released when `start()` returned would be released
+    /// exactly before the one write that needs it. Every exit balances it — the session adopts it,
+    /// or Cancel and the failure path stop it.
+    @State private var access: ScopedAccess?
+
+    /// Whether a person asked for this board (`OpenOrigin`) — claimed beside the access, and read by
+    /// exactly one branch: what a failed walk does.
+    @State private var origin: OpenOrigin = .attended
+
+    /// The board's URL as this open resolved it — the scoped one where there is one. Held for the
+    /// surface's sake, which re-walks and repairs against it long after `start()` has returned.
+    @State private var boardURL: URL?
+
+    /// **The repair bracket's ledger**, held between Repair and Open's writes and the store that the
+    /// following walk builds (`BoardRepairRun`, `EchoLedger.adopt`).
+    ///
+    /// It cannot live anywhere else: the repairs run before a store exists and the receipts have to
+    /// reach that store's ledger before `beginSession` composes a git board's committer, or the app's
+    /// own repair commits as `Lanework External`. (Pro's committer, until 12-editions.md ▸ PIVOT
+    /// 2026-08-07 made it every git board's.) Cleared once adopted.
+    @State private var repairLedger: EchoLedger?
+
     @State private var phase: Phase = .opening
 
     private enum Phase {
         case opening
+        /// **The walk refused and a person is looking at it** — the decision surface, in the loading
+        /// window's own content area (01-storage-format.md § Malformed input, settled 2026-07-31:
+        /// "the loading content transforms in place, never a sheet over a spinner").
+        case deciding(BoardDecisionSurfaceModel)
         case open(BoardStore)
         /// The load failed; this window is on its way out and must not try again.
         case failed
@@ -69,23 +129,58 @@ struct BoardWindowHost: View {
 
     var body: some View {
         content
-            .frame(minWidth: 640, minHeight: 400)
+            // Font-derived like everything else the board lays out (`BoardMetrics.windowMinimumSize`,
+            // 10-accessibility.md's full-relative-scaling rule): at a large system text size a
+            // 640×400 floor would be narrower than two lane headers, and "every lane is always on
+            // screen" would degrade into a strip of truncation.
+            //
+            // **The *system* size, not the zoomed one** (03-board-ui.md ▸ Layout — zoom: "Zoom never
+            // moves the window"). Zooming to 200% must not push a floor up under a window the user
+            // already sized: moving the window belongs to the right-edge lane drag alone, and a
+            // minimum that grew with the level would resize every open board from a menu item.
+            .frame(
+                minWidth: BoardMetrics.windowMinimumSize(bodyPointSize: BoardMetrics.bodyPointSize).width,
+                minHeight: BoardMetrics.windowMinimumSize(bodyPointSize: BoardMetrics.bodyPointSize).height
+            )
             .background(WindowAccessor(controller: windowController))
             .navigationTitle(windowTitle)
-            .task { await start() }
+            .task { await beginOpening() }
             .onDisappear { endSessionIfStillOpen() }
     }
 
     @ViewBuilder
     private var content: some View {
         switch phase {
-        case .opening, .failed:
-            // Nothing to render and nothing worth animating: this window either becomes a board in a
-            // moment or dismisses itself.
+        case .opening:
+            // **The pre-snapshot loading state** (02 § Launch and window lifecycle): empty for the
+            // grace, a centered spinner after it, never a skeleton. The board replaces it in place
+            // when `phase` becomes `.open` — a snap, which is what assigning outside `withAnimation`
+            // means here.
+            BoardLoadingView(indicator: loading)
+        case let .deciding(model):
+            // **In place.** The same content area the spinner was in, with no transition of its own:
+            // 02's snap, read for the surface that arrives instead of a snapshot.
+            BoardDecisionSurface(
+                model: model,
+                onRepairAndOpen: { repairAndOpen(model) },
+                onRecheck: { recheck(model) },
+                onCancel: { cancelDecision(model, closingWindow: false) }
+            )
+        case .failed:
+            // Nothing to render and nothing worth animating: this window is dismissing itself.
             Color.clear
         case let .open(store):
             VStack(spacing: 0) {
                 BannerStripView(rows: store.bannerRows) { store.banners.dismiss($0) }
+                // **⌘F's fallback**, and only that: the search field's home is the toolbar item
+                // (`BoardToolbar`), and this strip exists for the window where the user has taken
+                // that item out — "with the field removed from the toolbar, invoking it surfaces the
+                // field transiently until the search clears" (03-board-ui.md ▸ Toolbar). It sits
+                // directly under the title bar, where the item it stands in for would be.
+                if boardSearch.isTransient {
+                    BoardSearchBar(store: store, presentation: boardSearch)
+                        .transition(Motion.transientSearchTransition(reduced: reduceMotion))
+                }
                 // The window is handed to the board as a closure, not a value: `WindowAccessor`
                 // attaches after this body first runs, and the lane-resize drag needs the *live*
                 // window to grow at its right edge (03-board-ui.md § Lane).
@@ -98,23 +193,41 @@ struct BoardWindowHost: View {
                     openCard: openCard,
                     search: boardSearch
                 )
+                // **The zoom level enters here and nowhere else** (03-board-ui.md ▸ Layout — zoom).
+                // On `BoardView` rather than on the `VStack`, deliberately: the level is the *board's*
+                // ruler, so the banner strip and the transient search bar above it — chrome, not the
+                // board — stay at the system's size, as do the sheets and popovers this window hosts.
+                .environment(\.boardZoom, appModel.zoom.context)
             }
-            // **The board window's toolbar: the search field, nothing else** (03-board-ui.md ▸
-            // Toolbar, "trailing, the one default item; the titlebar stays clean"). It is a toolbar
-            // rather than a strip inside the content because that is where 03 puts it, and it hosts
-            // an `NSSearchField` rather than `.searchable` for the reasons `BoardSearchField`
-            // records — explicit first-responder control, and stock key behaviour.
+            // The transient strip's two dismissal inputs (`BoardSearchPresentation
+            // .transientPersists`): it stays while a query is filtering the board or while the field
+            // holds the keyboard, and goes when neither is true.
+            .onChange(of: store.searchQuery) { _, query in
+                boardSearch.dismissTransientIfCleared(query: query)
+            }
+            .onChange(of: boardSearch.isFocused) { _, _ in
+                boardSearch.dismissTransientIfCleared(query: store.searchQuery)
+            }
+            // **The window chrome follows the board's background** (03-board-ui.md § Styling ▸
+            // Capabilities): a board that paints one runs its content the full height of the frame
+            // under a transparent title bar, with `BoardView.boardBackground`'s frosted strip
+            // keeping the widget and the toolbar legible over it; a board that paints none keeps
+            // the standard chrome untouched.
             //
-            // m6-toolbar: the rest of 03's toolbar story is the customization card's — the
-            // Customize palette, the New Card / New Lane / Undo / Redo / Show Trash catalog, and
-            // with it ⌘F's transient surfacing of a *removed* field. That work replaces this
-            // declaration with an identified, customizable toolbar; the item itself does not move.
-            .toolbar {
-                ToolbarItem(placement: .primaryAction) {
-                    BoardSearchField(store: store, presentation: boardSearch)
-                        .frame(width: 220)
-                }
+            // Here rather than in `configureWindow` because it is not a wiring fact but a *live*
+            // one: `background` is hand-editable, the watcher reloads on a change to `index.md`, and
+            // the chrome has to follow the reading in both directions. `initial: true` because the
+            // first render is already a level, not a change — this is the board's first statement
+            // about its chrome, and the loading half deliberately made none
+            // (`HostedWindowController.extendsUnderTitlebar`).
+            .onChange(of: BoardBackdrop.isCustom(store.snapshot, root: store.rootURL), initial: true) { _, custom in
+                windowController.setExtendsContentUnderTitlebar(custom)
             }
+            // (**The board settings sheet was presented here** between 2026-07-31 and 2026-08-07,
+            // when the popover/sheet split was reversed: the sheet retired, its contents rehomed
+            // into the popover's Git tab, and this window has no modal configuration surface at all
+            // now — 03-board-ui.md ▸ Board settings sheet, marked retired.)
+            //
             // "The board in front", for the menu items that act on it (`LaneWidthCommands`), and
             // beside it the window's own popover flag, which is what File ▸ Board Info toggles, its
             // purge-alert host, which the trash's two confirmed commands raise, and its search
@@ -135,59 +248,152 @@ struct BoardWindowHost: View {
     /// Opens a card's window. `openWindow(value:)` with a ref that already has a window focuses it,
     /// so "at most one card window per card (reopen focuses)" needs no bookkeeping here
     /// (02-architecture.md § Windows).
-    private var openCard: (ItemID) -> Void {
+    private var openCard: @MainActor (ItemID) -> Void {
         { cardID in
             openWindow(id: WindowID.card, value: CardWindowRef(board: ref, cardID: cardID))
         }
     }
 
     private var windowTitle: String {
-        guard case let .open(store) = phase else { return "" }
+        guard case let .open(store) = phase else {
+            return Self.loadingTitle(
+                record: recordID.flatMap { appModel.boardRegistry.record(id: $0) },
+                url: ref.url
+            )
+        }
         return AppModel.displayName(of: store)
     }
 
+    /// What a window that has no snapshot yet is called — **the registry record's cached name**, the
+    /// same no-scan source the welcome row reads (02 § Launch and window lifecycle: "its chrome
+    /// carrying the registry record's cached title and icon"; § Per-board app state, "the welcome row
+    /// reads only the record — it never opens any board's `index.md`").
+    ///
+    /// Read back off the record rather than recomputed, so a board that has opened before shows the
+    /// title it is known by and a first-ever open shows the folder name — which is that record's
+    /// provisional display name, not a second rule. The `nil` fallback is the folder name anyway,
+    /// covering only the body evaluation that precedes `recordOpen`.
+    ///
+    /// Static and pure so the rule is checkable without a window (`BoardWindowHostTests`).
+    static func loadingTitle(record: BoardRecord?, url: URL) -> String {
+        record?.displayName ?? AppModel.folderDisplayName(of: url)
+    }
+
     // MARK: - Opening
 
+    /// Starts the open as a task of its own, so something can hold it.
+    ///
+    /// `.task` cancels on teardown but hands out no handle, and ⌘W during loading needs one *by
+    /// name* — the ruled cancel is an act of the user's, not a consequence of a window that has
+    /// already gone away (02 § Launch and window lifecycle). So the walk runs in a task `openWalk`
+    /// keeps, and the cancellation handler forwards `.task`'s own cancellation into it, leaving both
+    /// routes — the user's ⌘W and any teardown SwiftUI decides on — ending in the same `cancel()`.
+    private func beginOpening() async {
+        let walk = Task { await start() }
+        openWalk.adopt(walk)
+        await withTaskCancellationHandler {
+            await walk.value
+        } onCancel: {
+            walk.cancel()
+        }
+    }
+
     /// Acquires the board and starts its session, or fails it out to welcome.
     ///
     /// The order is load-bearing, and it now has one more step than the load itself does. Security-
     /// scoped access is claimed **before** anything else, because the record and the load both need
-    /// it. The registry record comes **before** `acquire` — "the registry record is created before
-    /// loading" (02 § Per-board app state) — so a fail-fast failure always has a row to land on;
-    /// `acquire`'s own first act is the tree walk, and a sandboxed read outside the claimed scope is
-    /// exactly the one that gets refused. `setOpenNow` comes **after** the load succeeds and after
-    /// the window has demonstrably opened — a flag set on a board that never appeared would hand the
-    /// next launch a restoration set describing a failure.
+    /// it. The registry record comes **before** the walk — "the registry record is created before
+    /// loading" (02 § Per-board app state) — so a fail-fast failure always has a row to land on, and
+    /// so the loading window has a name to wear; the walk's first act is a directory read, and a
+    /// sandboxed read outside the claimed scope is exactly the one that gets refused. `setOpenNow`
+    /// comes **after** the load succeeds and after the window has demonstrably opened — a flag set on
+    /// a board that never appeared would hand the next launch a restoration set describing a failure.
+    ///
+    /// **The walk is the one suspension here**, and everything before it is what makes the window
+    /// real while it runs: the record, the loading window's chrome, and the grace clock. Everything
+    /// after it is the snap.
     private func start() async {
         guard case .opening = phase else { return }
 
-        // Claimed even on the failure path: an unclaimed stash is a scope nobody balances.
-        let access = appModel.claimPendingAccess(for: ref)
-        let url = access?.url ?? ref.url
+        // Claimed even on the failure path: an unclaimed stash is a scope nobody balances. The origin
+        // rides along — one claim, one dictionary (`AppModel.claimPendingOpen`).
+        let claimed = appModel.claimPendingOpen(for: ref)
+        access = claimed.access
+        origin = claimed.origin
+        let url = claimed.access?.url ?? ref.url
+        boardURL = url
 
         // Record before load (settled, 02 § Per-board app state). `displayName` is omitted — an
         // existing record's cached title survives untouched, and a brand-new one takes the folder
         // name, both `recordOpen`'s own rule now. This is also this open's one bookmark mint: a
         // successful load below replaces the name through `syncDisplayState`, which never re-mints.
         let recordID = appModel.boardRegistry.recordOpen(of: url)
+        // Published to the view *before* the walk: this is what the title bar reads while loading.
+        self.recordID = recordID
 
+        // The window is on screen and the user can act on it from here on — placed where they left
+        // it, and closeable.
+        configureLoadingWindow(recordID: recordID)
+        loading.begin()
+
+        await attemptOpen(url: url, recordID: recordID, skipping: [])
+    }
+
+    /// **One walk, and what it lands in** — the loop Repair and Open and Re-check re-enter.
+    ///
+    /// It is a method rather than the tail of `start()` because the surface's two buttons "re-run the
+    /// whole walk" (01-storage-format.md § Malformed input) and must land in exactly the places this
+    /// lands: a clean walk proceeds into the ordinary open, and a walk that still refuses
+    /// re-aggregates into the *same* surface. Sharing the body is what makes "never a chained second
+    /// dialog" structural rather than remembered.
+    ///
+    /// - Parameter skipping: the surface's consented skips, empty on a first attempt. It reaches the
+    ///   walk *and* the store, which retains it for the session (`BoardStore.skippedPaths`).
+    private func attemptOpen(url: URL, recordID: UUID, skipping: Set<String>) async {
         let store: BoardStore
-        do throws(BoardLoadError) {
-            store = try appModel.storeRegistry.acquire(url)
+        do throws(BoardLoadFailure) {
+            guard let acquired = try await appModel.storeRegistry.acquireOffMain(url, skipping: skipping) else {
+                // ⌘W landed while the walk was running, and the walk has now finished into a result
+                // nobody wants (`acquireOffMain`, discard-on-completion). The window is already
+                // closing and the registry kept nothing, so the only thing left to balance is this
+                // open's scoped access. There is no open-now flag to clear: `setOpenNow` is below,
+                // after the load, so a cancelled open never set one — the very reason it lives there.
+                Self.logger.debug("board open cancelled during its walk")
+                loading.end()
+                releaseAccess()
+                return
+            }
+            store = acquired
         } catch {
-            Self.logger.error("board failed to open: \(error.description, privacy: .public)")
-            access?.stop()
-            phase = .failed
-            appModel.recordLaunchFailure(path: ref.path, message: error.description)
-            // The record above just changed the registry — welcome, about to appear, must not
-            // render the stale list `AppModel` cached before this open began, or the failure would
-            // fall through to the unmatched-failures list for want of a row that already exists.
-            appModel.refreshRecents()
-            openWindow(id: WindowID.welcome)
-            dismissWindow(id: WindowID.board, value: ref)
+            handleWalkFailure(error, url: url, recordID: recordID)
             return
         }
 
+        // **The window retired while this walk was in flight** — Cancel (or ⌘W) pressed during a
+        // Re-check, whose walk then landed successfully. The board must not open behind a window that
+        // has already gone to welcome, and the reference `acquireOffMain` took has to go back or the
+        // registry would hold a watcher for a board nobody is showing.
+        if case .failed = phase {
+            Self.logger.debug("a walk landed after the open was cancelled — releasing it")
+            appModel.storeRegistry.release(store)
+            releaseAccess()
+            return
+        }
+
+        loading.end()
+
+        // **The repair's receipts, into the board's own ledger — before the session composes**
+        // (01: "On Pro boards the repairs drop heal-marked receipts and commit separately as one
+        // repair commit" — every git board's since 12-editions.md ▸ PIVOT 2026-08-07, the sentence
+        // otherwise unchanged). `beginSession` is where that committer is built and started, and the
+        // committer harvests the ledger it is handed; receipts adopted after that line would be
+        // receipts the repair commit never sees, and the app's own repair would be authored
+        // `Lanework External`.
+        if let repairLedger {
+            store.echoes.adopt(repairLedger)
+            self.repairLedger = nil
+        }
+
         // The load succeeded — the frontmatter can be trusted now, so it replaces whatever
         // provisional or stale name the record above was carrying. Through `syncDisplayState`,
         // deliberately not a second `recordOpen`: this is a display-state refresh, not a second
@@ -201,30 +407,240 @@ struct BoardWindowHost: View {
         )
         appModel.boardRegistry.setOpenNow(id: recordID)
         appModel.beginSession(ref: ref, store: store, recordID: recordID, access: access)
+        // The session owns the balance from here (`AppModel.beginSession`), so this window must not
+        // stop it on any later path.
+        access = nil
         phase = .open(store)
 
         configureWindow(store: store, recordID: recordID)
+        postSkipNoticeIfNeeded(store: store, skipping: skipping)
 
         // "Opening a board from welcome closes welcome" (02 § Launch and window lifecycle). Harmless
         // when welcome is not open, which is the ordinary case.
         dismissWindow(id: WindowID.welcome)
     }
 
-    /// Wires the window: the saved frame on the way in, frame changes on the way back out, the
-    /// close interception that makes the flush unavoidable, and the title-bar widget.
-    private func configureWindow(store: BoardStore, recordID: UUID) {
-        // Filled in here rather than at declaration because the closure captures `openWindow`, an
-        // environment action; until the board has loaded there is also nothing for Open Card to act
-        // on, which is exactly what the item's `nil` check reads.
-        cardOpener.open = openCard
+    /// **The attendance branch** (01-storage-format.md § Malformed input, settled 2026-07-31): the
+    /// surface "appears on attended opens only … restoration failures keep the retire-to-welcome-row
+    /// landing".
+    ///
+    /// Three outcomes, and the third is the new one:
+    ///
+    /// - **A restored open retires**, exactly as it did before this milestone. Nobody is sitting in
+    ///   front of a launch that reopened four boards, and "launch never chains dialogs".
+    /// - **An attended open whose failure is environmental retires too** — a root that is gone, or a
+    ///   root that is a file. There is nothing on disk to repair, so a surface would offer the user a
+    ///   decision with no choices in it; welcome's row says the same thing in one line, which is
+    ///   where it belonged already. (The carve-out the ruling implies rather than states — Redesign
+    ///   Gap 87cd782a.)
+    /// - **Anything else transforms into the surface**, in place, in this window.
+    ///
+    /// A surface is *entered* rather than shown: it holds this window's access, its record, and its
+    /// URL for as long as the user is deciding, which is why none of the three is released here.
+    private func handleWalkFailure(_ error: BoardLoadFailure, url: URL, recordID: UUID) {
+        Self.logger.error("board failed to open: \(error.description, privacy: .public)")
 
+        // Retired while this walk ran (Cancel during a Re-check): the failure has already been
+        // recorded and the window is on its way out. A second `retire` would post the row twice.
+        if case .failed = phase { return }
+
+        guard Self.landing(for: error, origin: origin) == .decide else {
+            loading.end()
+            retire(message: error.description)
+            return
+        }
+
+        // Already deciding: this is a Re-check or a Repair and Open landing, and it re-aggregates in
+        // place — the same model, the same window, no second dialog.
+        if case let .deciding(model) = phase {
+            model.reaggregate(error)
+            model.isWorking = false
+            return
+        }
+
+        loading.end()
+        phase = .deciding(BoardDecisionSurfaceModel(failure: error, boardRoot: url))
+        // ⌘W now means Cancel (01: the surface's own exit), replacing the loading half's
+        // cancel-the-walk closure — a slot rather than a branch, `configureWindow`'s posture.
+        windowController.onCloseRequested = {
+            guard case let .deciding(model) = phase else { return }
+            cancelDecision(model, closingWindow: true)
+        }
+    }
+
+    /// Where a refused walk lands.
+    enum FailureLanding: Equatable {
+        /// Welcome, on the board's own recents row — today's landing, unchanged.
+        case retire
+        /// The decision surface, in this window.
+        case decide
+    }
+
+    /// **The attendance branch as a pure rule** — two facts in, one landing out, provable without a
+    /// window (`BoardDecisionSurfaceTests`).
+    ///
+    /// It is a static rather than an `if` inside `handleWalkFailure` because it is the ruling's own
+    /// sentence and the one thing about this milestone that a regression would make silently wrong:
+    /// a launch that started showing surfaces would chain dialogs across four restored boards, and an
+    /// attended open that stopped showing one would look exactly like the app before this milestone.
+    static func landing(for failure: BoardLoadFailure, origin: OpenOrigin) -> FailureLanding {
+        guard origin == .attended else { return .retire }
+        return isEnvironmental(failure) ? .retire : .decide
+    }
+
+    /// **Nothing on disk to repair** — the environmental carve-out's predicate.
+    ///
+    /// A single defect, and that defect is a fact about the *root itself* rather than about a file
+    /// inside it: `BoardLoader` throws these immediately, before any walk, precisely because there is
+    /// nothing to walk. The single-defect check is stated rather than assumed — the loader's
+    /// environmental throws are single by construction, and a future aggregate carrying one *among*
+    /// repairable defects should show the surface, because the rest of it is still actionable.
+    static func isEnvironmental(_ failure: BoardLoadFailure) -> Bool {
+        guard failure.defects.count == 1 else { return false }
+        switch failure.primary.reason {
+        case .unreadableRoot, .notADirectory:
+            return true
+        case .boardRootMissingIndex, .unparseableYAML, .missingSchema, .malformedSchema,
+             .schemaNewerThanApp, .missingOrder, .malformedOrder:
+            return false
+        }
+    }
+
+    // MARK: - The surface's three buttons
+
+    /// **Repair and Open**: apply every chosen fix in one write bracket, then re-run the whole walk
+    /// with the skip set (01-storage-format.md § Malformed input).
+    ///
+    /// The repairs are store-less by necessity and heal-marked by rule (`BoardRepairRun`); the walk
+    /// that follows is the ordinary one, so a clean result proceeds into the ordinary open and a
+    /// dirty one re-aggregates here. A repair that failed does not abort anything — the batch stops,
+    /// the failure shows on the surface, and the walk runs anyway, because "a partial repair simply
+    /// re-aggregates on the next walk".
+    private func repairAndOpen(_ model: BoardDecisionSurfaceModel) {
+        guard let url = boardURL, let recordID, !model.isWorking else { return }
+        model.isWorking = true
+        model.repairFailure = nil
+
+        let outcome = BoardRepairRun.apply(model.plannedRepairs, boardRoot: url)
+        model.repairFailure = outcome.failure
+        // Held for the store the walk below may build — see `repairLedger`. Merged with anything an
+        // earlier pass left, so two rounds of repair both reach the commit.
+        if let existing = repairLedger {
+            existing.adopt(outcome.ledger)
+        } else {
+            repairLedger = outcome.ledger
+        }
+
+        let walk = Task { await attemptOpen(url: url, recordID: recordID, skipping: model.skipSet) }
+        openWalk.adopt(walk)
+    }
+
+    /// **Re-check**: re-run the whole walk with the current skip set, changing nothing on disk
+    /// (01: "a disk changed underneath re-aggregates into the *same* surface with the fresh defect
+    /// list … a clean walk proceeds to the first snapshot").
+    private func recheck(_ model: BoardDecisionSurfaceModel) {
+        guard let url = boardURL, let recordID, !model.isWorking else { return }
+        model.isWorking = true
+        let walk = Task { await attemptOpen(url: url, recordID: recordID, skipping: model.skipSet) }
+        openWalk.adopt(walk)
+    }
+
+    /// **Cancel** — and ⌘W, which means exactly this while the surface is up (01: "**Cancel** aborts
+    /// the open: the window retires and the board lands row-level on welcome, record-before-load
+    /// unchanged").
+    ///
+    /// It is the failure path's own sequence, run against the aggregate the surface was showing: the
+    /// record was minted before the walk, so the row is already waiting for this message.
+    ///
+    /// - Parameter closingWindow: true when AppKit asked (⌘W), where the interception has to be
+    ///   released for the close to complete. The button's own press dismisses through SwiftUI.
+    private func cancelDecision(_ model: BoardDecisionSurfaceModel, closingWindow: Bool) {
+        // A walk may still be in flight behind the surface (Cancel during a Re-check). Its landing is
+        // guarded by `phase`, which this sets to `.failed`; cancelling as well means the open is not
+        // merely ignored but abandoned.
+        openWalk.cancel()
+        retire(message: model.failure.description)
+        if closingWindow {
+            windowController.closeAfterFlush()
+        }
+    }
+
+    /// The retire-to-welcome landing, in one place: the sequence a failed restore has always had, and
+    /// the sequence Cancel now shares with it.
+    private func retire(message: String) {
+        releaseAccess()
+        phase = .failed
+        // **The interception has to go with the phase.** `windowShouldClose` returns `false` whenever
+        // a closure is installed — that is how the close flush gets its turn — so a retired window
+        // whose closure had nothing left to do would *refuse every close request for the rest of the
+        // app's life*, quit included. There is nothing to intercept once this window is on its way to
+        // welcome: no store, no session, no decision.
+        windowController.onCloseRequested = nil
+        appModel.recordLaunchFailure(path: ref.path, message: message)
+        // The record minted before the walk just changed the registry — welcome, about to appear,
+        // must not render the stale list `AppModel` cached before this open began, or the failure
+        // would fall through to the unmatched-failures list for want of a row that already exists.
+        appModel.refreshRecents()
+        openWindow(id: WindowID.welcome)
+        dismissWindow(id: WindowID.board, value: ref)
+    }
+
+    private func releaseAccess() {
+        access?.stop()
+        access = nil
+    }
+
+    /// **The skip notice** (01: "the opened board carries a warning-tone notice naming the skipped
+    /// items, each with Reveal in Finder").
+    ///
+    /// Written from the walk's own `LoadWarning.userSkipped` entries rather than from the surface's
+    /// skip set, deliberately: what the notice owes the user is what actually left the board, and a
+    /// skip for a defect that repaired itself between the decision and the walk names nothing.
+    ///
+    /// **Only the open that carried the skips posts it.** A second window onto the same board
+    /// acquires the store that already exists, whose warnings still describe the first open — and a
+    /// notice repeated per window would be the app reporting one decision twice. `skipping` is
+    /// non-empty for exactly the open that made the decision.
+    private func postSkipNoticeIfNeeded(store: BoardStore, skipping: Set<String>) {
+        guard !skipping.isEmpty else { return }
+        let root = store.rootURL
+        let items = store.loadWarnings.compactMap { warning -> RevealTarget? in
+            guard case let .userSkipped(path) = warning else { return nil }
+            return RevealTarget(path: path, url: root.appendingPathComponent(path))
+        }
+        store.banners.postSkippedOnOpen(items)
+    }
+
+    /// **The half of the wiring a window needs before it has a board** — everything here is about
+    /// the *window*, and nothing here mentions the store, which is exactly the split
+    /// 02-architecture.md's loading state forces: this runs before the walk, and
+    /// `configureWindow(store:recordID:)` runs after it.
+    ///
+    /// Three things, and each is a rule from § Launch and window lifecycle:
+    ///
+    /// - **The saved frame**, so the window appears "at its saved frame" rather than at the system's
+    ///   cascade and then jumping to the user's place a second later.
+    /// - **The frame changes**, so a window the user moves *while it loads* is remembered. Not
+    ///   store-dependent and so not worth deferring — the alternative is a slow board's window whose
+    ///   move is silently discarded.
+    /// - **The close interception**, which is what makes ⌘W during loading mean anything at all. It
+    ///   is replaced wholesale by the flushing version once the board is open (see below); a single
+    ///   closure branching on `phase` would be the same thing spelled as a state read.
+    ///
+    /// The title bar keeps AppKit's own title display for now — the string is the record's cached
+    /// name (`windowTitle`) — and `hideTitle()` follows only once the board-popover widget is there
+    /// to say the name instead. Hiding it here would leave a loading window with no name anywhere in
+    /// its chrome, which is precisely what 02 asks the loading state to carry.
+    private func configureLoadingWindow(recordID: UUID) {
         windowController.onAttach = { window in
             guard let saved = appModel.boardRegistry.record(id: recordID)?.windowFrame else { return }
             window.setFrame(HostedWindowController.placementOnCurrentScreens(for: saved), display: true)
         }
-        // The window may already be attached — `viewDidMoveToWindow` fires well before this task's
-        // load returns — so the placement is applied directly too rather than waiting for a callback
-        // that has already happened.
+        // The window may already be attached — `viewDidMoveToWindow` fires before this task's first
+        // suspension — so the placement is applied directly too rather than waiting for a callback
+        // that has already happened. The closure stays installed either way: the controller re-fires
+        // it if SwiftUI swaps the provisional window for the real one (`HostedWindowController
+        // .detach`).
         if let window = windowController.window {
             windowController.onAttach?(window)
         }
@@ -236,12 +652,39 @@ struct BoardWindowHost: View {
             )
         }
 
+        windowController.onCloseRequested = {
+            // **⌘W during the walk** (02 § Launch and window lifecycle: "the walk is cancellable:
+            // ⌘W during loading cancels it and closes the window"). The window closes *now* — there
+            // is no store, so there is nothing to flush and nothing to wait for — and the walk's
+            // tail is wasted work we accept rather than thread a cancellation flag through the
+            // loader (`BoardStoreRegistry.acquireOffMain`, discard-on-completion).
+            //
+            // No open-now flag is cleared here because none was ever set: `setOpenNow` runs after
+            // the load, so a board that never finished loading is not in the restoration set. The
+            // ordinary user-close *does* clear it, in `AppModel.closeBoard`, which is the path the
+            // replacement closure below takes.
+            openWalk.cancel()
+            windowController.closeAfterFlush()
+        }
+    }
+
+    /// Wires the rest of the window, once there is a board to wire it to: the store's write-through,
+    /// the close flush, the undo stack, the title-bar widget and the toolbar.
+    ///
+    /// Everything here **carries the store or the session**, which is the whole reason it waits for
+    /// them; the window-level half ran before the walk (`configureLoadingWindow(recordID:)`).
+    private func configureWindow(store: BoardStore, recordID: UUID) {
+        // Filled in here rather than at declaration because the closure captures `openWindow`, an
+        // environment action; until the board has loaded there is also nothing for Open Card to act
+        // on, which is exactly what the item's `nil` check reads.
+        cardOpener.open = openCard
+
         // The registry's live write-through (02-architecture.md § Per-board app state) — wired
-        // the same way `onFrameChanged` just was: a closure that reaches into the registry,
-        // captured weakly on both sides so neither the store nor this closure's own home keeps
-        // the other alive past its window. `syncDisplayState` in `start()` already stamped the
-        // values current as of this open, so nothing is fired here immediately; this only fires
-        // on the reloads that follow.
+        // the way `onFrameChanged` was a moment ago in the loading half: a closure that reaches into
+        // the registry, captured weakly on both sides so neither the store nor this closure's own
+        // home keeps the other alive past its window. `syncDisplayState` in `start()` already
+        // stamped the values current as of this open, so nothing is fired here immediately; this
+        // only fires on the reloads that follow.
         store.displayStateDelegate = { [weak appModel, weak store] in
             guard let appModel, let store else { return }
             appModel.boardRegistry.syncDisplayState(
@@ -252,6 +695,10 @@ struct BoardWindowHost: View {
             )
         }
 
+        // **Replacing the loading half's cancel-and-close**: from here the window has a session, so
+        // a close is the flush (02 § Windows, "Close flushes") and the user-close that clears the
+        // open-now flag. A slot rather than a branch — `onCloseRequested` is one closure, and the
+        // window that owns it has moved on.
         windowController.onCloseRequested = {
             Task { @MainActor in
                 await appModel.closeBoard(ref: ref, cause: .userClose)
@@ -259,14 +706,68 @@ struct BoardWindowHost: View {
             }
         }
 
+        // This window's answer to "what does ⌘Z act on" (13-native-undo.md ▸ Rules; 06 ▸ Undo
+        // routing) — the *session's* stack, read afresh on every ask so a torn-down board answers
+        // nothing rather than a stack with no board behind it. The Edit menu's Undo/Redo rows and
+        // the toolbar's pair are nil-target `undo:`/`redo:`, so this one line is what lights them
+        // up: `NSWindow` validates and crosses them against exactly this manager.
+        windowController.windowUndoManager = { appModel.session(for: ref)?.undoManager }
+
         // The window-title widget (03-board-ui.md § Board popover) — **board windows only**, which
         // is why it is installed here rather than in `WindowAccessor`: welcome, the bootstrap and
         // card windows share that machinery and have no board to describe. It goes in after the
         // load rather than at attach because it carries the store; the controller installs it once,
         // whichever of the two arrives second.
+        //
+        // The git state comes from the **session**, which `start()` began a moment ago, rather than
+        // from the entitlement or the disk: a board's popover must describe the board as it opened
+        // (12-editions.md ▸ The entitlement, "an open board finishes with the provider it composed";
+        // 06-history-undo.md ▸ Rules, mode is an open-time fact). A `nil` session cannot happen on
+        // this path — `beginSession` precedes `configureWindow` — and reads as a board with no
+        // repository, which is the harmless direction.
+        //
+        // **The tier is no longer passed down** (12 ▸ PIVOT 2026-08-07): git is tier-independent, so
+        // every one of these surfaces reads the board's mode and nothing else. `BoardSession.tier`
+        // still exists and is still recorded — it just has no git-facing consumer here.
+        //
+        // The settings sheet used to adopt the same fact here, so its two doors could validate on it
+        // (2026-07-31 → 2026-08-07). The sheet is retired and the popover is the one configuration
+        // home, so the git state is handed to exactly one surface again — this widget — and the
+        // mid-session transition 06 sanctions (add-git flipping the mode) re-resolves the Git tab's
+        // postures under it live, with no second reader to disagree.
+        let session = appModel.session(for: ref)
         windowController.installTitlebarAccessory(
-            boardInfoTitlebarAccessory(store: store, recents: appModel.styleRecents, presentation: boardInfo)
+            boardInfoTitlebarAccessory(
+                store: store,
+                recents: appModel.styleRecents,
+                git: session?.git,
+                presentation: boardInfo
+            )
         )
+        // The widget above now says the board's name (and, on a git-mode board, its branch)
+        // itself, so the system title display would only repeat it — the card-window seam
+        // (`CardWindowHost.configureWindow`, `HostedWindowController.hideTitle`), applied here for
+        // the same reason. `.navigationTitle(windowTitle)` a few lines up in `body` is untouched —
+        // `window.title` keeps feeding the Window menu, Exposé, VoiceOver and restoration; only the
+        // title bar's own rendering of that string is suppressed.
+        //
+        // **After the load, and only after it**, which is why it is not in the loading half above:
+        // this line and the widget it defers to are one exchange, and a loading window that hid its
+        // title before the widget existed would carry no name at all — against 02's "its chrome
+        // carrying the registry record's cached title".
+        windowController.hideTitle()
+
+        // The board's customizable toolbar (03-board-ui.md ▸ Toolbar) — installed here for the
+        // accessory's reason exactly: it carries the store, and it is a board window's, not every
+        // hosted window's. Its search item is the search field's home, and it is what tells
+        // `boardSearch` whether that home still exists.
+        windowController.installToolbar(BoardToolbar.controller(
+            store: store,
+            search: boardSearch,
+            zoom: appModel.zoom,
+            appearance: appModel.appearance,
+            session: appModel.dragSession
+        ))
     }
 
     // MARK: - Closing
@@ -288,3 +789,33 @@ struct BoardWindowHost: View {
         }
     }
 }
+
+// MARK: - BoardOpenWalk
+
+/// The open walk's handle, held for exactly one reason: **⌘W during loading has to be able to cancel
+/// it** (02-architecture.md § Launch and window lifecycle).
+///
+/// A one-field box rather than the `Task` itself in `@State`, because the thing that cancels it is a
+/// closure the window controller holds (`onCloseRequested`) and the thing that fills it is the
+/// `.task` that starts the walk — two places that must agree on one task, which is what a reference
+/// type is. `@MainActor` like everything else on this path, so the box needs no synchronisation of
+/// its own.
+///
+/// Cancelling does not stop the walk (see `BoardStoreRegistry.acquireOffMain` for why the walk is
+/// deliberately not cooperatively cancellable). It stops the *open*: the task that would have
+/// adopted the result never does.
+@MainActor
+final class BoardOpenWalk {
+
+    private var task: Task<Void, Never>?
+
+    init() {}
+
+    func adopt(_ task: Task<Void, Never>) {
+        self.task = task
+    }
+
+    func cancel() {
+        task?.cancel()
+    }
+}

Kanban/App/ClipboardManifest.swift

@@ -3,15 +3,13 @@ import Foundation
 import UniformTypeIdentifiers
 
 // MARK: - The clipboard type
-
-extension UTType {
-
-    /// What a Lanework copy puts on the pasteboard under its own type — the JSON `ClipboardManifest`
-    /// (04-interactions.md ▸ Clipboard: "the pasteboard carries a JSON manifest + plain text").
-    /// Declared as an exported type in `Info.plist` beside the two drag types, for the same reason
-    /// those are: a payload nobody has declared is a payload the system will not carry.
-    static let laneworkClipboard = UTType(exportedAs: "dev.rzen.indie.kanban.clipboard")
-}
+//
+// `UTType.laneworkClipboard` — what a Lanework copy puts on the pasteboard under its own type, the
+// JSON `ClipboardManifest` below (04-interactions.md ▸ Clipboard: "the pasteboard carries a JSON
+// manifest + plain text"). Declared in `Info.plist` beside the two drag types, for the same reason
+// those are: a payload nobody has declared is a payload the system will not carry. The constant
+// itself lives with its two siblings in `PasteboardTypes.swift`, exported once by the app that
+// owns it.
 
 // MARK: - The manifest
 
@@ -19,17 +17,19 @@ extension UTType {
 ///
 /// **It is self-describing twice over**, and both halves earn their keep:
 ///
-/// - `copyID` ties the pasteboard to a staging directory — `<Application Support>/…/Clipboard/<copyID>/`,
+/// - `copyID` ties the pasteboard to a staging directory — `<Application Support>/Clipboard/<copyID>/`,
 ///   the full folder snapshots a paste reproduces byte-for-byte from — and to a pending cut. It is
 ///   also the whole of "the snapshot survives relaunch exactly as long as the pasteboard still points
 ///   at it": a sweep keeps the one directory this id names and collects every other.
-/// - Each `Entry` embeds the item's complete `index.md` text, so a paste still lands when the
-///   snapshot is missing or unreadable — "the staging-less fallback: content intact, attachments
-///   absent", announced by a banner rather than discovered later.
+/// - Each `Entry` embeds the item's complete `index.md` text as **identification metadata**
+///   (04-interactions.md ▸ Clipboard, re-ruled 2026-07-29): menu validation, the refusal's wording,
+///   and the plain-text flavor read it. It is emphatically **not** a materialization source — a paste
+///   whose staged snapshot is missing or unreadable refuses whole and writes nothing, because "an item
+///   arrives whole — index, attachments, loose files — or not at all".
 ///
-/// `kind` and `side` are the selection's own vocabulary (`SelectionKind`, `Liveness`) rather than
+/// `kind` and `container` are the selection's own vocabulary (`SelectionKind`, `ItemContainer`) rather than
 /// near-copies of it: a clipboard payload is a selection that was copied, and the cards-XOR-lanes and
-/// live-XOR-tombstoned invariants are exactly the ones those two types already carry. Their raw
+/// board-XOR-trash invariants are exactly the ones those two types already carry. Their raw
 /// spellings are pasteboard API — a manifest written before a quit is decoded after the relaunch.
 ///
 /// `entries` are in the order the copy read them — flatten order on the live side ("lane `order`,
@@ -53,7 +53,7 @@ public struct ClipboardManifest: Codable, Sendable, Equatable {
     public var boardRoot: String
 
     public var kind: SelectionKind
-    public var side: Liveness
+    public var container: ItemContainer
     public var entries: [Entry]
 
     /// One copied item: where its snapshot is staged, what it is called, and its bytes.
@@ -69,24 +69,33 @@ public struct ClipboardManifest: Codable, Sendable, Equatable {
         public var folder: String
 
         /// The title as written, or `nil` for an untitled item — "Untitled" is a rendering, never a
-        /// value (03-board-ui.md § Card face). Feeds the plain-text representation and the degraded
-        /// paste's banner.
+        /// value (03-board-ui.md § Card face). Feeds the plain-text representation and the refused
+        /// paste's banner, which names the offending entry from exactly this.
         public var title: String?
 
-        /// The complete `index.md` at copy time — the staging-less fallback's source bytes.
+        /// The complete `index.md` at copy time — **identification metadata, never materialized**
+        /// (see the type comment). Kept because it is what lets the app answer "what was on the
+        /// clipboard" without touching the staging store: the plain-text flavor and a refusal's wording
+        /// both come from here, and both have to work when the snapshot is exactly what is missing.
         public var index: String
 
         /// How many files the item's own `attachments/` held. Zero for a lane, which has none; a
         /// lane's attachments are its cards' and are counted there.
+        ///
+        /// Identification metadata like the rest of the entry. It used to feed the degraded paste's
+        /// loss accounting ("Pasted 'Fix login' without its 3 attachments"), which is retired with the
+        /// degraded paste itself — an item now arrives whole or not at all, so there is no partial
+        /// arrival left to count.
         public var attachmentCount: Int
 
         /// A **lane** entry's cards, index text and all — "a lane entry embeds its cards' too,
         /// attachment-less". Empty for a card entry.
         ///
-        /// **Live cards only**, which is not a shortcut: a lane *copy* strips tombstoned cards
-        /// (04-interactions.md ▸ Clipboard, ▸ The trash), and the fallback only ever materializes a
-        /// copy — a cut's move carries the real folder whole and never comes near this array. So the
-        /// embedded set is exactly what a fallback paste should produce.
+        /// **Exactly the lane's cards**, which needs no filter: "a lane carries exactly its cards —
+        /// the trash is board-level, so there is nothing lane-nested to strip or carry"
+        /// (04-interactions.md ▸ Drag and drop, resettled 2026-07-28). Like the lane's own `index`, the
+        /// cards' text is identification metadata: it describes what the copy held, and nothing
+        /// materializes from it.
         public var cards: [Card]
 
         /// One card inside a copied lane.
@@ -104,9 +113,9 @@ public struct ClipboardManifest: Codable, Sendable, Equatable {
             }
         }
 
-        /// Everything a fallback paste of this entry would leave behind — its own attachments plus,
-        /// for a lane, its cards'.
-        public var lostAttachmentCount: Int {
+        /// Every file this entry's subtree carried in an `attachments/` — its own plus, for a lane, its
+        /// cards'. Identification metadata; nothing gates on it since the degraded paste retired.
+        public var totalAttachmentCount: Int {
             attachmentCount + cards.reduce(0) { $0 + $1.attachmentCount }
         }
 
@@ -132,14 +141,14 @@ public struct ClipboardManifest: Codable, Sendable, Equatable {
         copyID: String,
         boardRoot: URL,
         kind: SelectionKind,
-        side: Liveness,
+        container: ItemContainer,
         entries: [Entry]
     ) {
         self.version = version
         self.copyID = copyID
         self.boardRoot = boardRoot.path
         self.kind = kind
-        self.side = side
+        self.container = container
         self.entries = entries
     }
 

Kanban/App/ClipboardStore.swift

@@ -12,10 +12,12 @@ import os
 ///
 /// The pasteboard carries a small JSON manifest plus a plain-text rendering; the *content* — whole
 /// folder trees, attachments and strays and all — is **staged** under
-/// `<Application Support>/<bundle id>/Clipboard/<copyID>/`, so a paste reproduces the item
-/// byte-for-byte across boards rather than reconstructing it from a summary. The manifest's embedded
-/// `index.md` per entry is the fallback when a snapshot is missing, and a fallback paste is **loud**:
-/// a banner names exactly what was lost.
+/// `<Application Support>/Clipboard/<copyID>/`, so a paste reproduces the item byte-for-byte across
+/// boards rather than reconstructing it from a summary. The manifest's embedded `index.md` per entry
+/// is **identification metadata only** — menu validation, the refusal's wording, the plain-text
+/// flavor — and never a materialization source: a paste whose staged snapshot is missing or
+/// unreadable **refuses whole and writes nothing** (04-interactions.md ▸ Clipboard, re-ruled
+/// 2026-07-29 — Finder's invariant: an item arrives whole or not at all).
 ///
 /// ### The staging lifecycle, settled
 ///
@@ -38,7 +40,7 @@ import os
 /// ⌘X stages, writes the pasteboard, and arms the source board's `transient.pendingCut` — the items
 /// dim in place. The cut is **armed** while the pasteboard still holds its `copyID`, the source store
 /// is still open, and the pending cut still names something; "deletion voids per item" needs no code
-/// here at all, because `TransientBoardState.resolve` already ejects a tombstoned or vanished member
+/// here at all, because `TransientBoardState.resolve` already ejects a member that moved to the trash or vanished
 /// on every reload, so "paste moves only the survivors" is the reload rule read at paste time.
 /// Voiding undims and downgrades the paste to a copy from staging.
 ///
@@ -102,22 +104,17 @@ public final class ClipboardStore {
 
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "clipboard")
 
-    /// `~/Library/Application Support/<bundle id>/Clipboard/`, beside the board registry — the same
-    /// container convention, for the same reason (02-architecture.md § Per-board app state, "App-wide
-    /// state has the same home").
+    /// `<Application Support>/Clipboard/`, beside the board registry — the same home, for the same
+    /// reason (`AppStateHome`; 02-architecture.md § Per-board app state, "App-wide state has the same
+    /// home").
     public static var defaultStagingRoot: URL {
-        let support = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first
-            ?? URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)
-                .appendingPathComponent("Library/Application Support", isDirectory: true)
-        let bundleIdentifier = Bundle.main.bundleIdentifier ?? "dev.rzen.indie.Kanban"
-        return support
-            .appendingPathComponent(bundleIdentifier, isDirectory: true)
-            .appendingPathComponent("Clipboard", isDirectory: true)
+        AppStateHome.directory.appendingPathComponent("Clipboard", isDirectory: true)
     }
 
     /// The app builds one of these with the system pasteboard and the real staging directory; a test
     /// passes its own of each, for the reason `BoardRegistry` takes a storage URL at all — injecting
-    /// them is how a suite stays out of Application Support *and* off the machine's one pasteboard.
+    /// them is how a suite stays out of the real Application Support home *and* off the machine's one
+    /// pasteboard.
     ///
     /// **The launch sweep is here** (04: "a sweep at launch and on each copy"): a fresh store reads
     /// the pasteboard once and collects every staged tree it no longer names, which is exactly the
@@ -174,9 +171,10 @@ public final class ClipboardStore {
     /// The order is the contract: capture from the snapshot (main actor, no I/O — every item's
     /// `index.md` is already parsed into the snapshot and `FrontmatterDocument.serialized()` returns
     /// it verbatim), schedule the snapshots behind it, then write the pasteboard, then sweep. The
-    /// pasteboard is written *before* the copies land, which is safe precisely because the manifest
-    /// carries the fallback text: a paste that somehow beat the chain would still materialize the
-    /// right items.
+    /// pasteboard is written *before* the copies land, which is safe because a paste **awaits the same
+    /// chain** (`paste(into:)`): it can never read a half-written snapshot, so it never sees a tree the
+    /// staging has not finished. This used to lean on the manifest's fallback text instead; with
+    /// refuse-don't-degrade the chain is the whole guarantee, and it is the stronger one.
     private func write(from store: BoardStore, cut: Bool) {
         guard let capture = Self.capture(selection: store.selection, snapshot: store.snapshot) else { return }
 
@@ -192,7 +190,7 @@ public final class ClipboardStore {
             copyID: copyID,
             boardRoot: store.rootURL,
             kind: capture.kind,
-            side: capture.side,
+            container: capture.container,
             entries: capture.subjects.map(\.entry)
         )
         guard let data = manifest.encoded() else { return }
@@ -209,7 +207,7 @@ public final class ClipboardStore {
             armedCut = ArmedCut(copyID: copyID, source: store)
             store.transient.pendingCut = ItemReferenceSet(
                 ids: Set(capture.subjects.map(\.id)),
-                liveness: capture.side
+                container: capture.container
             )
         }
         // "A sweep at launch and on each copy purges entries the pasteboard no longer references."
@@ -219,8 +217,9 @@ public final class ClipboardStore {
 
     // MARK: - Availability
 
-    /// Whether Edit ▸ Copy applies — a non-empty selection that still names something the board
-    /// renders, on either side of the live/tombstoned boundary.
+    /// Whether Edit ▸ Copy applies — a non-empty selection that still names something, in either
+    /// container ("⌘C copies a trash card — a live copy lands wherever pasted, like copying out of
+    /// Finder's Trash" — 04-interactions.md ▸ The trash).
     ///
     /// **The read-only lock deliberately does not close it**: "reading, selecting, searching and
     /// copying out all stay live" (02-architecture.md § The lock's scope) — a copy is a read. The
@@ -228,17 +227,28 @@ public final class ClipboardStore {
     /// the text (04 ▸ Grammar). The field consumes the selector natively, so this guard is belt over
     /// braces — but a board command that stayed armed under an editor would be exactly the kind of
     /// fall-through 04 is careful about.
+    ///
+    /// **A mixed trash selection closes it — this is one of the two exits the kind guard moved to**
+    /// (04-interactions.md ▸ The trash, ruled 2026-07-31 with kind-blind trash selection): "the
+    /// pasteboard's payload types are per-kind, so Cut and Copy grey out via ordinary menu validation
+    /// while a trash selection mixes kinds — no failed gesture, no beep". It is also what keeps
+    /// `capture`'s single `kind` honest: the manifest names one payload type, and a set spanning both
+    /// never reaches it.
     public func canCopy(from store: BoardStore) -> Bool {
         guard !store.isEditingInline else { return false }
+        guard !SelectionGrammar.mixesKinds(store.selection, in: store.snapshot) else { return false }
         return SelectionGrammar.kind(of: store.selection, in: store.snapshot) != nil
     }
 
-    /// Whether Edit ▸ Cut applies. Copy's conditions, plus the two a *move* adds: the board must
-    /// accept writes (a cut mutates its source), and the selection must be **live** — "⌘X is
-    /// disabled: the move-out vocabulary is Put Back or drag-to-restore, nothing else" (04 ▸ The
-    /// trash).
+    /// Whether Edit ▸ Cut applies. Copy's conditions plus the one a *move* adds: the board must
+    /// accept writes, since a cut mutates its source.
+    ///
+    /// **The trash no longer disqualifies it** (04-interactions.md ▸ The trash, resettled
+    /// 2026-07-28): "⌘X works — it was disabled under the tombstone model: cut in the trash, paste
+    /// into a lane is the keyboard-native restore, an ordinary folder move". So there is no
+    /// container clause here at all, which is the pivot showing up as a deleted line.
     public func canCut(from store: BoardStore) -> Bool {
-        canCopy(from: store) && !store.isReadOnly && store.selection.liveness == .live
+        canCopy(from: store) && !store.isReadOnly
     }
 
     /// Whether Edit ▸ Paste applies to `store`.
@@ -311,6 +321,24 @@ public final class ClipboardStore {
     /// **The armed cut is tried first and consumed on success** — "first armed paste MOVES the
     /// surviving originals … a second paste materializes copies from staging" — and everything else
     /// is the copy path, which is also where a voided cut lands.
+    ///
+    /// **A paste is a user-initiated creation, so it clears the destination's search**
+    /// (04-interactions.md § Search, stated by mechanism — "⌘N, Return-creation, the header button,
+    /// empty-space double-click, paste, and Finder file drops alike"). Cards and lanes alike — the
+    /// clipboard holds one or the other, and either arrives as an item the query may well not match.
+    /// Unqualified, too: 04 names the *mechanism*, so the armed cut's move clears exactly as the copy
+    /// does rather than earning a sub-rule for the one case where the items were already on this
+    /// board. It is cleared here rather than at ⌘V so the two staleness guards keep their meaning: a
+    /// paste the pasteboard moved under lands nothing, and so clears nothing.
+    ///
+    /// **A paste is an import boundary, so normalization applies** (04 ▸ Clipboard, settled
+    /// 2026-07-28 — 01-storage-format.md's loose-file carve-out): every arrival below passes
+    /// `normalizingLooseFiles: true`, so a loose file the staged snapshot faithfully carried beside
+    /// a card's `index.md` lands inside the pasted card's `attachments/`, Finder-renamed on
+    /// collision. Both branches and both operations, unqualified, because 04's sentence is
+    /// unqualified. Nothing is dropped and nothing is announced: the snapshot preserved the file,
+    /// the paste kept it, and it is where the schema says it belongs — the carve-out's notice is for
+    /// files the app moves *without* being asked, which is the loader's path, not this one.
     private func perform(_ manifest: ClipboardManifest, plan: Plan, into store: BoardStore) {
         refresh()
         // The pasteboard moved under this paste (another app copied while the chain settled): the
@@ -319,6 +347,7 @@ public final class ClipboardStore {
         guard payload?.copyID == manifest.copyID else { return }
 
         if let move = armedMove(for: manifest) {
+            store.transient.noteUserCreation()
             let sources = move.folders.map(BoardStore.ItemSource.folder)
             switch plan {
             case let .cards(target):
@@ -327,44 +356,47 @@ public final class ClipboardStore {
                     operation: .move,
                     toLane: target.laneID,
                     at: target.index,
-                    clearingTombstones: false
+                    normalizingLooseFiles: true
                 )
             case let .lanes(index):
-                store.receiveLanes(sources, operation: .move, at: index, clearingTombstones: false)
+                store.receiveLanes(
+                    sources,
+                    operation: .move,
+                    at: index,
+                    normalizingLooseFiles: true
+                )
             }
             consumeCut()
             return
         }
 
-        // The copy path — the staged snapshot per entry, or the embedded `index.md` where that
-        // snapshot is missing or unreadable. Mixed is legal and is the honest outcome of a partial
-        // staging failure: the entries that have snapshots arrive whole.
+        // **The copy path's preflight: refuse, never degrade** (04-interactions.md ▸ Clipboard,
+        // re-ruled 2026-07-29). Every entry must have its staged snapshot on disk *before* anything is
+        // materialized — the first one that does not refuses the whole paste, names itself from the
+        // manifest's metadata, and writes nothing at all. All-or-nothing for the whole paste, which is
+        // the copies-are-transactions posture (01-storage-format.md § Frontmatter) read one level up:
+        // the transaction is the gesture, not the entry.
         let stagingDir = stagingRoot.appendingPathComponent(manifest.copyID, isDirectory: true)
         var sources: [BoardStore.ItemSource] = []
-        var losses: [BannerCenter.AttachmentLoss] = []
         for entry in manifest.entries {
             let staged = stagingDir.appendingPathComponent(entry.folder, isDirectory: true)
-            if FileManager.default.fileExists(
+            guard FileManager.default.fileExists(
                 atPath: staged.appendingPathComponent(BoardLoader.indexFileName).path
-            ) {
-                sources.append(.folder(staged))
-                continue
-            }
-            sources.append(.text(index: entry.index, cards: entry.cards.map(\.index)))
-            // "A degraded paste is loud, never silent … a one-shot banner names exactly what was
-            // lost." An entry with no attachments lost nothing — its content is intact and its bytes
-            // are the source bytes — so it contributes no row.
-            if entry.lostAttachmentCount > 0 {
-                losses.append(BannerCenter.AttachmentLoss(
-                    title: entry.title,
-                    attachments: entry.lostAttachmentCount
-                ))
+            ) else {
+                // The offending entry, named — and the destination's search is left exactly as it was.
+                // "Any user-initiated creation on the board clears the query" (04 ▸ Search) is a rule
+                // about creations, and this paste created nothing; the preflight therefore runs *before*
+                // `noteUserCreation`, so a refusal costs the user neither content nor their filter.
+                store.banners.postRefusedPaste(title: entry.title, stagedAt: staged.path)
+                return
             }
+            sources.append(.folder(staged))
         }
+        store.transient.noteUserCreation()
 
-        // "⌘C strips `deleted:` at materialization" (04 ▸ The trash) — the trash's copy-out-only rule,
-        // and the one axis a paste varies that a within-board drop never does.
-        let clearingTombstones = manifest.side == .trashed
+        // A card copied out of the trash needs nothing done to it on arrival: it carries no
+        // `deleted:` key, because there is no such key any more (03-board-ui.md § Trash, resettled
+        // 2026-07-28). The tombstone era's strip-at-materialization axis is gone with it.
         switch plan {
         case let .cards(target):
             store.receiveCards(
@@ -372,17 +404,16 @@ public final class ClipboardStore {
                 operation: .copy,
                 toLane: target.laneID,
                 at: target.index,
-                clearingTombstones: clearingTombstones
+                normalizingLooseFiles: true
             )
         case let .lanes(index):
             store.receiveLanes(
                 sources,
                 operation: .copy,
                 at: index,
-                clearingTombstones: clearingTombstones
+                normalizingLooseFiles: true
             )
         }
-        store.banners.postDegradedPaste(losses)
     }
 
     /// The armed cut's surviving originals, in flatten order and as folders under the **source**
@@ -398,10 +429,11 @@ public final class ClipboardStore {
         let survivors = source.transient.pendingCut
         guard !survivors.isEmpty else { return nil }
 
-        // `TrashModel.paths` walks lanes in board order and each lane's cards in card order, which is
-        // the flatten order the drop commits insert in — and the pending cut is homogeneous by kind,
-        // so only one of its two branches ever contributes.
-        let folders = TrashModel.paths(of: survivors.ids, on: .live, in: source.snapshot)
+        // `ItemPath.resolve` walks the container in display order, which is the flatten order the
+        // drop commits insert in — and the pending cut is homogeneous by container, so it is asked
+        // for exactly the side the cut was made on. A cut made in the trash therefore hands the
+        // paste the trash folders it must move out, which is the keyboard restore (04 ▸ The trash).
+        let folders = ItemPath.resolve(survivors.ids, in: survivors.container, snapshot: source.snapshot)
             .map { $0.folder(under: source.rootURL) }
         guard !folders.isEmpty else { return nil }
         return (source, folders)
@@ -448,9 +480,18 @@ public final class ClipboardStore {
         let destination: URL
     }
 
-    /// Appends this copy's snapshots to the staging chain. Best-effort per item: one that fails to
-    /// copy simply falls back to the manifest's embedded `index.md` at paste time, which is the
-    /// degraded paste the banner already has words for.
+    /// Appends this copy's snapshots to the staging chain. Best-effort per item, and the *consequence*
+    /// of a failure changed with the refuse-don't-degrade ruling: an item whose snapshot never landed
+    /// makes the next paste **refuse whole**, naming it (`perform`'s preflight), rather than
+    /// materializing it hollow from the manifest's embedded `index.md`. Failing to stage is therefore
+    /// as loud as it should be, one gesture later.
+    /// **Staging is a copy boundary**, so `comments/.trash/` does not survive it (01-storage-format.md
+    /// § Enhanced schema: "stripped at every copy boundary (clipboard staging, Duplicate, Save as
+    /// Template)"). Stripped from the *snapshot* rather than skipped during it, because the snapshot is
+    /// one monolithic `copyItem` — and stripped through the Writer's own call so the rule is one
+    /// function (`BoardWriter.stripCommentTrash`), not a second reading of it here. Best-effort like
+    /// the copy above it: a snapshot that could not be tidied is still a snapshot, and the paste that
+    /// materializes from it strips again at its own boundary.
     private func stage(_ jobs: [StagingJob], into stagingDir: URL) {
         enqueue { [jobs, stagingDir] in
             guard (try? FileManager.default.createDirectory(
@@ -459,6 +500,7 @@ public final class ClipboardStore {
             )) != nil else { return }
             for job in jobs {
                 try? FileManager.default.copyItem(at: job.source, to: job.destination)
+                try? BoardWriter.stripCommentTrash(under: job.destination, operation: .copy(title: nil))
             }
         }
     }
@@ -478,14 +520,74 @@ public final class ClipboardStore {
         enqueue { await Self.prune(root, keeping: keep) }
     }
 
+    /// Where a tree goes to die: a hidden sibling inside the staging root, so a removal is **two
+    /// steps, the first of them atomic**.
+    ///
+    /// Hidden (`.`-prefixed) on purpose — `prune` lists with `.skipsHiddenFiles`, so this folder is
+    /// invisible to the sweep that owns it and can never be mistaken for a staged copy.
+    ///
+    /// `nonisolated` because `prune` is: the sweep runs off the main actor by design, and a constant
+    /// has no isolation to need.
+    private nonisolated static let sweepFolderName = ".sweeping"
+
+    /// The sweep, written **claim-then-delete** rather than delete-in-place.
+    ///
+    /// There is one app and macOS runs one instance of it, so this is not the concurrency guard it was
+    /// written as (12-editions.md ▸ App-side state, re-ruled 2026-07-30 — there is no sibling app to
+    /// race). It is kept because what it buys is cheap and still true of one process:
+    ///
+    /// 1. **The claim is a rename, and a rename is atomic.** A tree either leaves the staging root
+    ///    whole or stays there whole — it is never briefly *visible half-removed*, which is the one
+    ///    state a reader could misread. That covers a crash mid-delete, and it covers the developer's
+    ///    own second copy launched with `open -n`, which shares this container because it is the same
+    ///    app.
+    /// 2. **A missing entry means already swept, never an error.** Every failure here is swallowed:
+    ///    the listing is stale by the time it is walked, and a tree that vanished between the two is
+    ///    precisely the outcome asked for.
+    ///
+    /// Leftovers in `.sweeping/` are collected on the next pass. A crash between the rename and the
+    /// delete therefore costs disk until the next sweep, which is the same guarantee the staging store
+    /// already gives about its own orphans.
     private nonisolated static func prune(_ root: URL, keeping keep: String?) async {
+        let sweepFolder = root.appendingPathComponent(sweepFolderName, isDirectory: true)
+
         guard let entries = try? FileManager.default.contentsOfDirectory(
             at: root,
             includingPropertiesForKeys: nil,
             options: [.skipsHiddenFiles]
         ) else { return }
+
+        var claimed: [URL] = []
         for entry in entries where entry.lastPathComponent != keep {
-            try? FileManager.default.removeItem(at: entry)
+            // Created lazily: a sweep with nothing to collect must not leave a folder behind as proof
+            // it ran.
+            if claimed.isEmpty {
+                try? FileManager.default.createDirectory(at: sweepFolder, withIntermediateDirectories: true)
+            }
+            let claim = sweepFolder.appendingPathComponent(UUID().uuidString, isDirectory: true)
+            guard (try? FileManager.default.moveItem(at: entry, to: claim)) != nil else {
+                // Gone, or claimed by another pass. Either way it is not ours to delete and nothing
+                // is wrong.
+                continue
+            }
+            claimed.append(claim)
+        }
+
+        for claim in claimed {
+            try? FileManager.default.removeItem(at: claim)
+        }
+
+        // Anything a previous pass claimed and did not finish — a crash between the claim and the
+        // delete. Best-effort, and an empty or missing folder is nothing to do.
+        if let stragglers = try? FileManager.default.contentsOfDirectory(
+            at: sweepFolder,
+            includingPropertiesForKeys: nil,
+            options: []
+        ) {
+            for straggler in stragglers {
+                try? FileManager.default.removeItem(at: straggler)
+            }
+            try? FileManager.default.removeItem(at: sweepFolder)
         }
     }
 
@@ -512,77 +614,112 @@ public final class ClipboardStore {
     /// produces.
     struct Subject {
         let id: ItemID
-        let path: TrashModel.ItemPath
+        let path: ItemPath
         let entry: ClipboardManifest.Entry
     }
 
     /// The selection, resolved into copy subjects in the order the clipboard records them — or `nil`
-    /// when it names nothing the board renders on its own side.
+    /// when it names nothing its container holds.
     ///
-    /// **The order is `SelectionGrammar.order`'s**, which is already the right answer for all four
-    /// (side, kind) pairs: flatten order for live cards, left-to-right for live lanes, and the trash's
-    /// own deterministic sort for either kind of entry. Deriving it here would be a fifth definition
-    /// of an order the app already states once.
+    /// **The order is `SelectionGrammar.order`'s**, which is already the right answer for every
+    /// (container, kind) pair: flatten order for board cards, left-to-right for lanes, and the
+    /// trash's own rank order for its cards and its lane rows alike. Deriving it here would be a
+    /// second definition of an order the app already states once.
     ///
     /// **The index text comes from the snapshot, not from disk.** `FrontmatterDocument` edits by line
-    /// span, so `serialized()` on an untouched document returns the file's bytes exactly — which
-    /// makes the manifest's fallback text genuinely *the source bytes* while costing ⌘C no file I/O
-    /// at all, even for a lane carrying two hundred cards.
+    /// span, so `serialized()` on an untouched document returns the file's bytes exactly — which makes
+    /// the manifest's embedded text a faithful record of the item while costing ⌘C no file I/O at all,
+    /// even for a lane carrying two hundred cards. It is **identification metadata**, not a
+    /// materialization source (see the type comment): the refusal's wording and the plain-text flavor
+    /// read it, and nothing writes it.
     static func capture(
         selection: ItemReferenceSet,
         snapshot: BoardModel
-    ) -> (kind: SelectionKind, side: Liveness, subjects: [Subject])? {
+    ) -> (kind: SelectionKind, container: ItemContainer, subjects: [Subject])? {
         guard let kind = SelectionGrammar.kind(of: selection, in: snapshot) else { return nil }
-        let side = selection.liveness
-        let ordered = SelectionGrammar.order(of: kind, on: side, in: snapshot)
+        let container = selection.container
+        let ordered = SelectionGrammar.order(of: kind, in: container, snapshot: snapshot)
             .filter { selection.ids.contains($0) }
         guard !ordered.isEmpty else { return nil }
 
         var subjects: [ItemID: Subject] = [:]
-        for lane in snapshot.lanes {
-            if kind == .lane, Liveness(isDeleted: lane.isDeleted) == side {
+        func addCard(_ card: Card, at path: ItemPath) {
+            subjects[card.id] = Subject(
+                id: card.id,
+                path: path,
+                entry: ClipboardManifest.Entry(
+                    id: card.id.rawValue,
+                    folder: card.id.rawValue,
+                    title: card.title.value,
+                    index: card.document.serialized(),
+                    attachmentCount: card.attachments.count
+                )
+            )
+        }
+
+        switch container {
+        case .trash:
+            for card in snapshot.trash {
+                addCard(card, at: .trashCard(card.id))
+            }
+            // **A trashed lane row copies and cuts like any other lane** (04-interactions.md ▸ The
+            // trash: "a trashed lane pastes after the anchor lane (the lane-paste rule above,
+            // verbatim)"), which makes ⌘X here the keyboard-native restore at the lane level.
+            //
+            // **No `cards` in the entry, and that is the opaque unit showing through**: a trashed
+            // lane's subtree is deliberately not in the snapshot (`TrashedLane`), so there is nothing
+            // here to describe it with — and nothing is lost by that, because the manifest's embedded
+            // text is identification metadata only and the *content* comes from the staged folder,
+            // which is copied whole, cards and all. An entry that guessed at a card list would be the
+            // one place in the app claiming to know what an opaque unit holds.
+            for lane in snapshot.trashedLanes {
                 subjects[lane.id] = Subject(
                     id: lane.id,
-                    path: TrashModel.ItemPath(laneID: lane.id, cardID: nil),
+                    path: .trashLane(lane.id),
                     entry: ClipboardManifest.Entry(
                         id: lane.id.rawValue,
                         folder: lane.id.rawValue,
                         title: lane.title.value,
                         index: lane.document.serialized(),
-                        attachmentCount: 0,
-                        // Live cards only — a lane copy strips tombstoned cards, and the fallback
-                        // only ever materializes a copy (see `ClipboardManifest.Entry.cards`).
-                        cards: lane.cards.filter { !$0.isDeleted }.map { card in
-                            ClipboardManifest.Entry.Card(
-                                id: card.id.rawValue,
-                                title: card.title.value,
-                                index: card.document.serialized(),
-                                attachmentCount: card.attachments.count
-                            )
-                        }
+                        attachmentCount: 0
                     )
                 )
             }
-            // A tombstoned lane subsumes its subtree on both sides: its cards render nowhere live and
-            // have no trash row of their own, so they are nobody's copy subject.
-            guard kind == .card, !lane.isDeleted else { continue }
-            for card in lane.cards where Liveness(isDeleted: card.isDeleted) == side {
-                subjects[card.id] = Subject(
-                    id: card.id,
-                    path: TrashModel.ItemPath(laneID: lane.id, cardID: card.id),
-                    entry: ClipboardManifest.Entry(
-                        id: card.id.rawValue,
-                        folder: card.id.rawValue,
-                        title: card.title.value,
-                        index: card.document.serialized(),
-                        attachmentCount: card.attachments.count
+        case .board:
+            for lane in snapshot.lanes {
+                if kind == .lane {
+                    subjects[lane.id] = Subject(
+                        id: lane.id,
+                        path: .lane(lane.id),
+                        entry: ClipboardManifest.Entry(
+                            id: lane.id.rawValue,
+                            folder: lane.id.rawValue,
+                            title: lane.title.value,
+                            index: lane.document.serialized(),
+                            attachmentCount: 0,
+                            // Every card the lane has — "a lane carries exactly its cards", and the
+                            // trash is board-level, so there is nothing nested to strip
+                            // (04-interactions.md ▸ Drag and drop, resettled 2026-07-28).
+                            cards: lane.cards.map { card in
+                                ClipboardManifest.Entry.Card(
+                                    id: card.id.rawValue,
+                                    title: card.title.value,
+                                    index: card.document.serialized(),
+                                    attachmentCount: card.attachments.count
+                                )
+                            }
+                        )
                     )
-                )
+                    continue
+                }
+                for card in lane.cards {
+                    addCard(card, at: .card(lane: lane.id, id: card.id))
+                }
             }
         }
 
         let resolved = ordered.compactMap { subjects[$0] }
         guard !resolved.isEmpty else { return nil }
-        return (kind, side, resolved)
+        return (kind, container, resolved)
     }
 }

Kanban/App/CloseFlushCoordinator.swift

@@ -30,10 +30,35 @@ public enum BoardCloseCause: Sendable, Equatable {
 @MainActor
 public protocol CardSessionFlushing: AnyObject {
     func endSession() async
+
+    /// Whether this window is holding content the file does not have — a dirty Edit buffer, or an
+    /// open raw-source outlet that has been typed in.
+    ///
+    /// Beside `endSession()` because it is the same fact from the other end: this is what the flush
+    /// *would* write, asked before running it. Its one caller is File ▸ Save as Template's
+    /// validation, which under the unwritable-location read-only lock stays live only "unless an
+    /// open Edit or raw-source session holds unsaved content the suspended saves can't flush"
+    /// (02-architecture.md ▸ Live-reload resilience; 09-templates.md ▸ Save as Template) — a
+    /// template that silently missed those keystrokes would break 09's never-misses-keystrokes
+    /// guarantee, which outranks the item's availability.
+    var holdsUnsavedContent: Bool { get }
+
+    /// **This window's answers to the save-or-discard step** (06-history-undo.md ▸ Rules ▸ Undo
+    /// restore vs open Edit sessions; ▸ Branch switching), or `nil` for a window with nothing a
+    /// wholesale tree operation could disturb.
+    ///
+    /// Beside `holdsUnsavedContent` and deliberately not folded into it: that property answers "would
+    /// a *template copy* miss keystrokes", which is a read; this one carries the two writes — Save
+    /// All and Discard — that a restore or a branch switch needs the window to perform before it can
+    /// run on a settled tree. Same window, two different questions, and collapsing them would give
+    /// the settle step the draft-composer exemption `holdsUnsavedContent` deliberately makes.
+    var settlement: CardSessionSettlement? { get }
 }
 
 public extension CardSessionFlushing {
     func endSession() async {}
+    var holdsUnsavedContent: Bool { false }
+    var settlement: CardSessionSettlement? { nil }
 }
 
 // MARK: - CloseFlushCoordinator

Kanban/App/FutureCommands.swift

@@ -6,18 +6,22 @@ import SwiftUI
 ///
 /// 11-command-nexus.md's own contract runs both directions: "a command absent here doesn't exist, and
 /// adding one means adding a row here first" — so once a row *is* in the Nexus, shipping the window
-/// behind it is a validation-and-action change, not a menu change. `FutureCommand` (a `Button`) and
-/// `FutureToggleCommand` (a `Toggle`) below are that reading, applied: the row exists now, stably
-/// titled and stably chorded — `NSUserKeyEquivalents` already resolves it, so a user can remap it
-/// today — with validation pinned to `false` and the action a no-op until the milestone named at the
-/// call site fills both in. That milestone's whole diff then reads as "flip `.disabled`, fill the
-/// closure" rather than "add a menu item", which is also why every call site below carries the
-/// codebase's `mN-` marker for a component still owed.
+/// behind it is a validation-and-action change, not a menu change. `FutureCommand` below is that
+/// reading, applied: the row exists now, stably titled and stably chorded — `NSUserKeyEquivalents`
+/// already resolves it, so a user can remap it today — with validation pinned to `false` and the
+/// action a no-op until the milestone named at the call site fills both in. That milestone's whole
+/// diff then reads as "flip `.disabled`, fill the closure" rather than "add a menu item", which is
+/// also why every call site below carries the codebase's `mN-` marker for a component still owed.
 ///
-/// **The title never moves once a row ships**, disabled or not: a toggle wired live later must not
+/// **The title never moves once a row ships**, disabled or not: a command wired live later must not
 /// gain a second spelling on the way (04-interactions.md ▸ Configurable bindings — "toggles keep one
 /// stable title, checkmark state only" — which applies to a row that has not started ticking yet
 /// exactly as it does to one that has).
+///
+/// There was a `FutureToggleCommand` beside this — a disabled `Toggle` for a checkmark row — and it
+/// went with the last of its call sites (Raw Source, `RawSourceCommand`). Every row still owed is a
+/// plain command; a future checkmark row brings its scaffold back with it rather than keeping an
+/// unused one warm.
 struct FutureCommand: View {
     let title: String
     var key: KeyEquivalent?
@@ -32,59 +36,17 @@ struct FutureCommand: View {
     }
 }
 
-/// `FutureCommand`'s checkmark-state twin, for a row the Nexus already marks "(checkmark toggle)".
-///
-/// `isOn` is a constant `false` rather than real state: there is no session yet for a binding to
-/// read, which is exactly the disabled, unchecked state a not-yet-wired toggle should show.
-struct FutureToggleCommand: View {
-    let title: String
-    var key: KeyEquivalent?
-    var modifiers: EventModifiers = .command
-
-    var body: some View {
-        Toggle(title, isOn: .constant(false))
-            .keyboardShortcut(key.map { KeyboardShortcut($0, modifiers: modifiers) })
-            .disabled(true)
-    }
-}
-
-// MARK: - File ▸ Save as Template
-
-/// File ▸ Save as Template — no default chord (11-command-nexus.md; 09-templates.md).
-///
-// m9-templates: copies the open board into the user templates store, close-flushed first exactly as
-// Duplicate is (09 ▸ Save as Template: "The copy is preceded by the close flush"), `.git` stripped,
-// tombstones dropped, a `template:` key stamped. Validation will be `acceptsBoardMutations` plus 09's
-// one carve-out from the read-only lock — live under the unwritable-location state unless an open
-// Edit/raw-source session holds unsaved content — so it cannot simply borrow
-// `DuplicateBoardCommand`'s predicate outright.
-struct SaveAsTemplateCommand: View {
-    var body: some View {
-        FutureCommand(title: "Save as Template")
-    }
-}
-
-// MARK: - File ▸ Add Attachment…
-
-/// File ▸ Add Attachment… (⇧⌘A) — card window only (11-command-nexus.md).
-///
-// m6-card-window: the menu-bar twin of the attachments section's quiet add affordance
-// (05-card-window.md § Attachments) and of a whole-window Finder file drop. Validation will be scope
-// alone — a card window in front, the read-only lock aside — `BoardInfoCommand`'s shape for its own
-// scope-only item.
+// File ▸ Save as Template was the scaffold here and is now live, beside the command it mirrors
+// (`SaveAsTemplateCommand`, in `AppCommands.swift` next to `DuplicateBoardCommand`, whose flush →
+// cancellable copy → banner sequence it repeats with a different destination). The diff this file
+// predicts, once more: the title did not move, the chord stayed absent, the validation and the
+// action filled in — the last of them being 09's carve-out from the read-only lock, which is why it
+// could not simply borrow Duplicate's predicate.
 //
-// m5-context-menus, m6-card-window: the attachment row's own context menu is a second thing this
-// milestone owes — Open, Remove (system Trash), Reveal in Finder (11-command-nexus.md ▸ Context
-// menus' Attachment row), twinning the focused section's grammar keys (Return open / ⌫ remove — 05
-// ▸ Attachments) and Reveal in Finder's attachments-focused scope, exactly the way this milestone's
-// card and lane menus twin their own grammar and menu-bar commands: no new store method, no parallel
-// implementation. There is no row view to hang a `.contextMenu` off yet, so nothing scaffolds here
-// beyond this marker.
-struct AddAttachmentCommand: View {
-    var body: some View {
-        FutureCommand(title: "Add Attachment…", key: "a", modifiers: [.shift, .command])
-    }
-}
+// File ▸ Add Attachment… (⇧⌘A) was the scaffold here and is now live, beside the focused value it
+// reads (`AddAttachmentCommand`, in `CardAttachments.swift`) — the diff this file predicts: the
+// title and the chord did not move, the validation and the action filled in. The attachment row's
+// context menu (Open / Remove / Reveal in Finder) shipped with it, on the row view that now exists.
 
 // MARK: - Edit ▸ Find Next / Find Previous
 
@@ -92,14 +54,36 @@ struct AddAttachmentCommand: View {
 /// "disabled in the board window — board search is a live filter, not a cursor"
 /// (11-command-nexus.md).
 ///
-// m6-card-window: joins `FindCommand` in the Edit menu once the card window's find-in-text exists
-// (05-card-window.md). Both rows are unconditionally disabled here rather than reading `boardStore`
-// to prove "board window" disables them: there is no card-window find session anywhere yet for
-// either validation branch to check.
+/// ### They are live for exactly one find, and disabled for the others on purpose
+///
+/// The card window has three finds (`CardWindowFindRoute`), and two of them are **`NSTextFinder`**'s —
+/// the body's and an authoring editor's. `NSTextView` already answers ⌘G and ⇧⌘G through the responder
+/// chain, and an *enabled* menu item's key equivalent fires before the responder chain is consulted,
+/// so a row that claimed the chord unconditionally would break the stepping it exists to provide. So
+/// these validate on the **thread** find alone — the one find with no responder to fall through to,
+/// because its bar is the app's own — and stay disabled everywhere else, which lets the platform's
+/// stepping keep working where the platform owns the find.
+///
+/// `.disabled` on the rows rather than a guard in the action, for the reason every menu row here
+/// wears its validation: a key equivalent that fires and does nothing is a chord the user cannot tell
+/// from a broken one.
 struct FindSteppingCommands: View {
+
+    @FocusedValue(\.cardComments) private var comments
+
+    /// The row's validation, as a value a test can hold: the pane's find bar is up, which is the only
+    /// state in which this app owns ⌘G.
+    static func isEnabled(_ comments: CardComments?) -> Bool {
+        comments?.find.isShowing == true
+    }
+
     var body: some View {
-        FutureCommand(title: "Find Next", key: "g", modifiers: .command)
-        FutureCommand(title: "Find Previous", key: "g", modifiers: [.shift, .command])
+        Button("Find Next") { comments?.find.step(forward: true) }
+            .keyboardShortcut("g", modifiers: .command)
+            .disabled(!Self.isEnabled(comments))
+        Button("Find Previous") { comments?.find.step(forward: false) }
+            .keyboardShortcut("g", modifiers: [.shift, .command])
+            .disabled(!Self.isEnabled(comments))
     }
 }
 
@@ -108,15 +92,25 @@ struct FindSteppingCommands: View {
 /// View ▸ Edit Body (⌘E) / Raw Source (⌥⌘E) / History — the card window's three view-state rows
 /// (11-command-nexus.md).
 ///
-// m6-card-window: Edit Body and Raw Source are checkmark toggles reading the window's edit-mode
-// state ("Edit Body disables while Raw Source is active" — 05-card-window.md); History is a plain
-// command that focuses the sidebar's History section and disables outright on mode `none` /
-// repo-nested boards once that section exists (05-card-window.md, 07-sync-collab.md). All three are
-// unconditionally disabled here — there is no card-window mode state anywhere yet.
+/// **Edit Body and Raw Source are both live** (`EditBodyCommand`, `RawSourceCommand`, each beside the
+/// focused value it reads): the body column's Preview/Edit toggle, and the window-level outlet whose
+/// toggling-off *applies*. Each diff was the one `FutureCommand` promises — the title and the chord
+/// did not move, the validation and the action filled in — and the pair also carries the clause that
+/// joins them, "Edit Body disables while Raw Source is active" (05-card-window.md).
+///
+// m7-git: History is a plain command that focuses the sidebar's History section, and disables
+// outright on mode `none` / repo-nested boards once that section exists (05-card-window.md,
+// 07-sync-collab.md). It remains unconditionally disabled here — the sidebar reserves the section's
+// place (`CardWindowView.historySlot`) but draws nothing, so there is still no surface to focus.
+/// The comments pane's two rows join them (11-command-nexus.md lists Show Comments and Comments
+/// Beside Body between Edit Body and Raw Source): both are live, both are app-wide persisted bits,
+/// and both are scoped to the card window (`ShowCommentsCommand`, `CommentsBesideBodyCommand`).
 struct CardViewCommands: View {
     var body: some View {
-        FutureToggleCommand(title: "Edit Body", key: "e", modifiers: .command)
-        FutureToggleCommand(title: "Raw Source", key: "e", modifiers: [.option, .command])
+        EditBodyCommand()
+        ShowCommentsCommand()
+        CommentsBesideBodyCommand()
+        RawSourceCommand()
         FutureCommand(title: "History")
     }
 }

Kanban/App/PasteboardTypes.swift

@@ -0,0 +1,24 @@
+import Foundation
+import UniformTypeIdentifiers
+
+// MARK: - The family pasteboard types
+
+/// **The three drag and clipboard types the app owns**, declared once with `UTType(exportedAs:)` to
+/// match the `UTExportedTypeDeclarations` in `Kanban/Info.plist`. `exportedAs` is a claim of
+/// ownership the system checks against the running app's plist, and one app making it is the whole
+/// story — there is no importing sibling to keep in step (12-editions.md ▸ Distribution, re-ruled
+/// 2026-07-30: the types are "declared and exported once, by the one app — no ownership twins").
+///
+/// What each type *is* stays documented at its payload — `DragPayload` for cards and lanes,
+/// `ClipboardManifest` for the clipboard type.
+extension UTType {
+
+    /// A drag carrying board **cards** — see `DragPayload`.
+    static let laneworkCards = UTType(exportedAs: "dev.rzen.indie.kanban.cards")
+
+    /// A drag carrying board **lanes** — see `DragPayload`.
+    static let laneworkLanes = UTType(exportedAs: "dev.rzen.indie.kanban.lanes")
+
+    /// A Lanework copy's pasteboard manifest — see `ClipboardManifest`.
+    static let laneworkClipboard = UTType(exportedAs: "dev.rzen.indie.kanban.clipboard")
+}

Kanban/App/RestoreBootstrapView.swift

@@ -12,8 +12,9 @@ import os
 /// Window menu — whose only job is to run the pass and then dismiss itself. It exists for a few
 /// hundred milliseconds and never draws.
 ///
-/// It is presented **only** when there is something to restore (`KanbanApp` decides), so the ordinary
-/// launch-to-welcome path never creates it.
+/// It is presented at **every** launch — it is the app's one reliable presenter (see `KanbanApp`'s
+/// bootstrap scene for the macOS 26 behavior that forced this), so even the plain launch-to-welcome
+/// path runs through it: the pass finds nothing flagged and opens welcome itself.
 ///
 /// ### What the pass does
 ///
@@ -23,8 +24,18 @@ import os
 /// silent drop." Welcome comes up only if nothing was even attempted; a board that *was* attempted
 /// and then failed to load opens welcome from its own host, which is the same rule applied one layer
 /// down and keeps this pass from having to wait on loads it did not perform.
+///
+/// ### And one other pass, for the same reason
+///
+/// The accessibility audit suite's fixture board (`UITestLaunch`) is built and opened here too. It is
+/// the same job with a different source — filesystem work that must happen before the first real
+/// window, needing `openWindow` to finish — and giving it a second throwaway window would be a second
+/// copy of everything this file explains. Which pass runs is `plan`'s to say and nothing else's.
 struct RestoreBootstrapView: View {
 
+    /// Decided in `KanbanApp.init()`; this view only dispatches on it.
+    let plan: LaunchPlan
+
     @Environment(AppModel.self) private var appModel
     @Environment(\.openWindow) private var openWindow
     @Environment(\.dismissWindow) private var dismissWindow
@@ -53,14 +64,36 @@ struct RestoreBootstrapView: View {
 
     private func restore() async {
         // Captured directly rather than waiting for `CaptureOpenWindow`'s `onAppear`: this task is
-        // the app's first act, and `openBoard` needs the action now.
-        appModel.captureWindowActions(open: openWindow, dismiss: dismissWindow)
+        // the app's first act, and `openBoard` needs the action now. The count is a cold Finder-open
+        // that arrived before this window did — a board already on its way to the screen, which the
+        // pass below must count as an open or it would put welcome up beside the user's document.
+        let replayedOpens = appModel.captureWindowActions(open: openWindow, dismiss: dismissWindow)
 
-        var attempted = 0
+        switch plan {
+        case .uiTestFixture:
+            openFixtureBoard()
+        case .restoreBoards, .welcome:
+            // `.welcome` arrives here by design — this window presents at every launch, because it is
+            // the app's one reliable presenter (see `KanbanApp`'s bootstrap scene) — and the pass is
+            // its answer: nothing is flagged, so it shows welcome, which is what `.welcome` asked
+            // for.
+            restoreFlaggedBoards(openedAlready: replayedOpens)
+        }
+
+        dismissWindow(id: WindowID.restoreBootstrap)
+    }
+
+    private func restoreFlaggedBoards(openedAlready: Int) {
+        var attempted = openedAlready
         for board in appModel.boardRegistry.restorables() {
             switch board {
             case let .available(_, url):
-                appModel.openBoard(at: url)
+                // **The one restored open in the app** (01-storage-format.md § Malformed input, the
+                // decision surface): a board that fails here keeps today's retire-to-welcome-row
+                // landing — "launch never chains dialogs", and nobody is sitting in front of a
+                // restoration waiting to repair four boards at once. The row's retry click is the
+                // attended open that then shows the surface.
+                appModel.openBoard(at: url, origin: .restored)
                 attempted += 1
             case let .unavailable(record):
                 Self.logger.error("a flagged board could not be restored — its bookmark no longer resolves")
@@ -74,6 +107,34 @@ struct RestoreBootstrapView: View {
         if attempted == 0 {
             appModel.showWelcome()
         }
-        dismissWindow(id: WindowID.restoreBootstrap)
+    }
+
+    /// The UI suites' board: built here, opened through the same `openBoard` every other path uses,
+    /// so it registers, bookmarks and titles itself exactly like a board the user opened.
+    ///
+    /// **Which board is the launch arguments' to say** (`UITestLaunch.variant`), and this method does
+    /// not care: the malformed variant is built and opened exactly like the other two, and its
+    /// failure arrives one layer down as the *loader's*. It opens **attended**, like every other
+    /// board a person asks for, so its refusal transforms the loading window into the decision surface
+    /// (`BoardWindowHost.handleWalkFailure`) rather than retiring — which is precisely what the
+    /// fail-fast UI pass is there to see. Special-casing it here would replace the behaviour under
+    /// test with a behaviour about the fixture.
+    ///
+    /// **A failure to *build* lands on welcome as an ordinary launch failure**, with the fixture's own
+    /// path on it. That is deliberate: a suite whose fixture failed to build would otherwise audit an
+    /// empty screen and pass, which is the one outcome an accessibility gate must never produce.
+    private func openFixtureBoard() {
+        let variant = UITestLaunch.variant
+        do {
+            let url = try UITestLaunch.materializeFixtureBoard(variant)
+            appModel.openBoard(at: url)
+        } catch {
+            Self.logger.error("the UI-test fixture board could not be built: \(error.localizedDescription, privacy: .public)")
+            appModel.recordLaunchFailure(
+                path: UITestLaunch.fixtureBoardURL(for: variant).path,
+                message: "The UI-test fixture board could not be built: \(error.localizedDescription)"
+            )
+            appModel.showWelcome()
+        }
     }
 }

Kanban/App/SessionSettleGate.swift

@@ -0,0 +1,281 @@
+import AppKit
+import Foundation
+
+// MARK: - Vocabulary
+
+/// What the user chose at the save-or-discard step (06-history-undo.md ▸ Branch switching: "**Save
+/// All** ends every session with its normal commit …, **Discard** reverts buffers and uncommitted
+/// saves to HEAD, **Cancel** keeps the current branch and the sessions").
+public enum SessionSettleChoice: Sendable, Equatable {
+    case saveAll
+    case discard
+    case cancel
+}
+
+/// What the gate concluded — the only thing the operation behind it branches on.
+public enum SessionSettleOutcome: Sendable, Equatable {
+
+    /// Nothing needed settling, or everything did and did. The tree is settled; run.
+    case proceed
+
+    /// The user chose Cancel. "Cancel keeps everything" — nothing was written, nothing reverted.
+    case cancelled
+
+    /// **Save All met a raw-source buffer that would not validate.** "Since Apply validates, a buffer
+    /// that fails validation cancels the whole switch with focus on the offending window, nothing
+    /// half-switched" (06 ▸ Branch switching). The payload is that window's session id, already
+    /// focused by the gate.
+    case failed(String)
+}
+
+// MARK: - What one card window offers the step
+
+/// **A card window's three answers to the save-or-discard step**, handed over as closures.
+///
+/// A type of its own rather than three members on `CardSessionFlushing` because it is optional as a
+/// unit: a window with nothing settleable in it has no settlement, and the gate should not have to
+/// ask three questions to find that out. `nil` is also every window in a build with no card session
+/// at all, which is what the protocol's default supplies.
+@MainActor
+public struct CardSessionSettlement {
+
+    /// Whether this window is holding state a wholesale tree operation would disturb.
+    public let needsSettling: @MainActor () -> Bool
+
+    /// Ends the Edit session with its normal commit and *applies* the raw buffer. `false` means the
+    /// raw buffer failed validation.
+    public let saveAll: @MainActor () -> Bool
+
+    /// Reverts the Edit buffer and leaves raw source without writing.
+    public let discard: @MainActor () -> Void
+
+    public init(
+        needsSettling: @escaping @MainActor () -> Bool,
+        saveAll: @escaping @MainActor () -> Bool,
+        discard: @escaping @MainActor () -> Void
+    ) {
+        self.needsSettling = needsSettling
+        self.saveAll = saveAll
+        self.discard = discard
+    }
+}
+
+// MARK: - One settleable session
+
+/// **A card window, as the save-or-discard step sees it** — three closures and the card it is over.
+///
+/// A value of closures rather than a protocol over `CardWindowSession`, for `CloseFlushCoordinator`'s
+/// reason exactly: what this gate is *about* is a decision procedure, and a procedure written against
+/// a live window is verifiable only by running the app. The production values come from the card
+/// windows; a test builds them from a counter.
+@MainActor
+public struct SettleableSession {
+
+    /// The window's identity — `CardWindowRef.cardID` is what production passes. Opaque to the gate,
+    /// and only ever handed back to `focus`.
+    public let id: String
+
+    /// The **card's folder name** — its id, which is its folder on disk (01-storage-format.md).
+    ///
+    /// Matched component-wise against the paths a wholesale operation would write, which is what
+    /// makes the match survive a lane move: a card's own folder component never changes, only the
+    /// lane above it (`GitHistoryWalk.path(_:isInsideFolderNamed:)`, the same trick, same reason).
+    public let cardFolderName: String
+
+    /// Whether this session is holding state a wholesale tree operation would disturb: unsaved
+    /// keystrokes, an **open** Edit session whose ~700 ms saves are deliberately uncommitted, or a
+    /// raw-source outlet that is open at all.
+    public let needsSettling: @MainActor () -> Bool
+
+    /// **Save All** for this one session: end the Edit session with its normal commit, and *apply*
+    /// the raw buffer. `false` means the raw buffer failed validation — the whole operation is off.
+    public let saveAll: @MainActor () -> Bool
+
+    /// **Discard** for this one session: revert the buffer and leave raw source without writing. The
+    /// on-disk uncommitted saves are reverted by the operation itself, which is comparing this card's
+    /// folder against the working tree rather than against HEAD for exactly that reason
+    /// (`GitRestoreOperation.plan(at:target:excluding:reconciling:)`).
+    public let discard: @MainActor () -> Void
+
+    public init(
+        id: String,
+        cardFolderName: String,
+        needsSettling: @escaping @MainActor () -> Bool,
+        saveAll: @escaping @MainActor () -> Bool,
+        discard: @escaping @MainActor () -> Void
+    ) {
+        self.id = id
+        self.cardFolderName = cardFolderName
+        self.needsSettling = needsSettling
+        self.saveAll = saveAll
+        self.discard = discard
+    }
+}
+
+// MARK: - SessionSettleGate
+
+/// **The save-or-discard step**, as one reusable decision procedure (06-history-undo.md ▸ Rules
+/// ▸ Undo restore vs open Edit sessions; ▸ Branch switching).
+///
+/// ### One machinery, two callers, by design
+///
+/// 06 does not describe two gates. It describes the branch-switch step and then hands undo the same
+/// one by name: "When the diff *does* touch a session card, the restore **gates on the branch-switch
+/// save-or-discard step** (Branch switching below — Save All / Discard / Cancel, same machinery, same
+/// rationale)." So this object is written for both from the start; the undo provider is its first
+/// caller and the branch controls will be its second, passing the paths a checkout would write
+/// instead of the paths a restore would.
+///
+/// ### The diff decides whether it appears at all
+///
+/// "A restore materializes only the diff between the current tree and the target state, so a card
+/// whose open Edit session the diff doesn't touch is simply unaffected — its uncommitted ~700 ms
+/// saves and the stage-around rule continue undisturbed, and most undos never meet an editor at all."
+/// That is `settle(touching:)`'s first line, and it is why the gate takes paths rather than a
+/// yes/no: a modal that appeared on every ⌘Z because *some* window somewhere was in Edit would be a
+/// different, much worse feature.
+///
+/// ### Why the ask is a closure
+///
+/// Presenting three buttons is AppKit's job and cannot be asserted without a display. The rule this
+/// file exists to hold — which sessions are asked about, what each answer does to them, and that a
+/// failing raw buffer stops everything with focus on the offender — is decidable from values, so the
+/// presentation is a seam and the decision is testable.
+@MainActor
+public struct SessionSettleGate {
+
+    /// Every open card session on this board, read live: a window can open or close between the
+    /// moment an operation starts and the moment it asks.
+    public var sessions: () -> [SettleableSession]
+
+    /// Presents the three-button step and answers what the user chose.
+    public var ask: () async -> SessionSettleChoice
+
+    /// Brings one session's window forward — the "focus on the offending window" half of the
+    /// validation-failure rule.
+    public var focus: (String) -> Void
+
+    public init(
+        sessions: @escaping () -> [SettleableSession],
+        ask: @escaping () async -> SessionSettleChoice,
+        focus: @escaping (String) -> Void = { _ in }
+    ) {
+        self.sessions = sessions
+        self.ask = ask
+        self.focus = focus
+    }
+
+    // MARK: The decision
+
+    /// Settles whatever the operation's paths reach, and answers whether it may run.
+    ///
+    /// - Parameter paths: board-root-relative paths the operation would write.
+    public func settle(touching paths: Set<String>) async -> SessionSettleOutcome {
+        await decide(over: Self.reached(by: paths, among: sessions()))
+    }
+
+    /// **Settles every open session, whatever the operation writes** — the branch switch's gate
+    /// (06 ▸ Branch switching).
+    ///
+    /// The path filter above is the *restore's* narrowing and belongs to it alone: "a restore
+    /// materializes only the diff between the current tree and the target state, so a card whose open
+    /// Edit session the diff doesn't touch is simply unaffected". A branch switch has no such
+    /// property. It moves the whole tree at once, and the raw-source hazard 06 singles out — "an
+    /// unsettled raw buffer … its Apply later writes the *entire* pre-switch `index.md` byte-for-byte
+    /// onto the new branch's card" — is about the buffer belonging to the old branch, not about
+    /// whether the checkout happened to rewrite that card. So this asks about every session that is
+    /// holding something, and about no path at all.
+    public func settleAll() async -> SessionSettleOutcome {
+        await decide(over: sessions())
+    }
+
+    private func decide(over candidates: [SettleableSession]) async -> SessionSettleOutcome {
+        let candidates = candidates.filter { $0.needsSettling() }
+        guard !candidates.isEmpty else { return .proceed }
+
+        switch await ask() {
+        case .cancel:
+            return .cancelled
+
+        case .discard:
+            for session in candidates { session.discard() }
+            return .proceed
+
+        case .saveAll:
+            for session in candidates {
+                guard session.saveAll() else {
+                    // "Nothing half-switched": the sessions saved before this one are saved, which is
+                    // an ordinary Save and loses nothing, but the operation itself does not run.
+                    focus(session.id)
+                    return .failed(session.id)
+                }
+            }
+            return .proceed
+        }
+    }
+
+    /// **Which sessions a set of paths reaches** — pure, and the whole of "the diff touches a session
+    /// card".
+    ///
+    /// Component-exact folder matching, so a card whose id happens to be a prefix of another's cannot
+    /// drag that other card's window into the step.
+    public static func reached(
+        by paths: Set<String>,
+        among sessions: [SettleableSession]
+    ) -> [SettleableSession] {
+        guard !paths.isEmpty else { return [] }
+        return sessions.filter { session in
+            paths.contains { GitHistoryWalk.path($0, isInsideFolderNamed: session.cardFolderName) }
+        }
+    }
+}
+
+// MARK: - The presented step
+
+/// **The three buttons**, as an `NSAlert` — the production `SessionSettleGate.ask`.
+///
+/// One of 02-architecture.md's sanctioned modal moments, and it is modal for `DirtyBufferGuard`'s
+/// reason exactly: the operation behind it cannot proceed until the user has decided what happens to
+/// text no commit protects, and there is no non-modal shape for a question whose three answers are
+/// mutually exclusive and immediate.
+///
+/// The wording is 06's own vocabulary. The default is **Cancel**, deliberately: a Return pressed
+/// reflexively at a dialog nobody read must be the answer that changes nothing, and both other
+/// answers write.
+public enum SessionSettleStep {
+
+    public static let title = "Unsaved card edits"
+
+    public static let message = """
+        Restoring an earlier state would change cards you are editing. \
+        Save them, discard the changes, or cancel.
+        """
+
+    /// The same three buttons, asked for the other caller. **One sentence differs, deliberately**: the
+    /// consequence a user is deciding about is not the same one — a restore would change the cards
+    /// being edited, while a switch takes every card to a different branch — and a step that described
+    /// the wrong operation would be a worse modal than no wording at all.
+    public static let branchSwitchMessage = """
+        Switching branches would replace the cards you are editing. \
+        Save them, discard the changes, or cancel.
+        """
+
+    @MainActor
+    public static func ask(message: String = message) async -> SessionSettleChoice {
+        let alert = NSAlert()
+        alert.alertStyle = .warning
+        alert.messageText = title
+        alert.informativeText = message
+        // Order matters for the key equivalents AppKit assigns: the first button takes Return, so
+        // Cancel leads and the two writing answers follow. Escape reaches Cancel either way.
+        alert.addButton(withTitle: "Cancel")
+        alert.addButton(withTitle: "Save All")
+        alert.addButton(withTitle: "Discard")
+
+        switch alert.runModal() {
+        case .alertSecondButtonReturn: return .saveAll
+        case .alertThirdButtonReturn: return .discard
+        default: return .cancel
+        }
+    }
+}

Kanban/App/TemplateChooserView.swift

@@ -4,13 +4,40 @@ import os
 
 /// The template chooser — File ▸ New Board… (⌥⌘N), 09-templates.md's picker.
 ///
-/// ### Pages' shape, one card in it
+/// ### Pages' shape, over real board folders
 ///
-/// A grid of template cards, each showing a **mini per-lane preview** above its name, one selected
-/// at a time, with Cancel and Choose at the bottom (03-board-ui.md § Welcome screen & templates: "a
-/// Pages-style chooser with a mini per-lane preview per template"). The grid holds exactly one card
-/// today because exactly one template exists (`BoardTemplate`); everything about the layout is
-/// already the plural case, so the m9 inventory drops in without the surface changing shape.
+/// A grid of template cards, each showing a **mini per-lane preview** above its name, one selected at
+/// a time, with Cancel and Choose at the bottom (03-board-ui.md § Welcome screen & templates: "a
+/// Pages-style chooser with a mini per-lane preview per template"). The grid is filled by
+/// `TemplateEngine.chooserRows()` — the app bundle's `Templates/` folder, then the user store — each
+/// entry loaded through the ordinary `BoardLoader`, so name, blurb, icon and preview all come off the
+/// template board's own `index.md` rather than from a Swift catalog.
+///
+/// **The order is 09's, and it is the engine's** (09 ▸ Storage: "bundled templates by
+/// `template.order`, then keyed user templates by `template.order`, then keyless user boards last,
+/// sorted by display name"). This view renders the list it is handed and never re-sorts it.
+///
+/// ### One bad template never fails the chooser
+///
+/// A user-store folder the loader rejects is **listed anyway** — by folder name, marked unloadable,
+/// carrying the loader's fail-fast specifics, not previewable and not choosable (09 ▸ Why this
+/// format). The store is hand-editable, so a malformed board there is one edit away; a chooser that
+/// refused to open, or that silently dropped the row, would leave the user with no way to see which
+/// folder is broken or why. Selecting the row shows the loader's own sentence where a blurb would be.
+///
+/// ### Reveal in Finder, and how fresh the list is
+///
+/// 09 keeps the app-side store honest with "a **Reveal in Finder** affordance in the
+/// template chooser": the button beside the header, which **creates the store and then reveals it**
+/// (`TemplateEngine.createUserStore`) — the store's two minters are Save as Template and this, so a
+/// user who has never saved one still gets a folder to drop a board into rather than a Finder window
+/// full of nothing.
+///
+/// **The store is not watched** — 09 asks for a Reveal affordance, not a live folder — so the list is
+/// re-read on every presentation and again whenever the app comes back to the front. The second is
+/// the Reveal round trip made honest: the user reveals the folder, drops a board in, comes back, and
+/// the row is there. A folder dropped in with this window already frontmost appears on the next
+/// activation or the next opening, which is the documented minimum rather than an oversight.
 ///
 /// ### Choosing is three steps, and the middle one is a save panel
 ///
@@ -20,6 +47,13 @@ import os
 /// panel's suggested name"). The chooser stays open if the panel is cancelled — a cancelled location
 /// is not a cancelled choice.
 ///
+// m9-templates: the in-progress row with Cancel that copy-shaped work is owed (02-architecture.md
+// § The banner surface) still has nowhere to live here — this window has no banner surface, and the
+// board that would host one does not exist yet. The engine takes the cancellation seam
+// (`TemplateEngine.instantiate(…, isCancelled:)`) and this view runs the copy off the main actor, so
+// the row has something to spin over when the window grows a strip. Save as Template, whose copy
+// *does* have a board window behind it, already carries its row.
+///
 /// ### Failure is an alert here, deliberately
 ///
 /// Everywhere else in the app a failed write is a banner in the window that produced it
@@ -35,14 +69,52 @@ struct TemplateChooserView: View {
     @Environment(AppModel.self) private var appModel
     @Environment(\.dismiss) private var dismiss
 
-    @State private var selection: BoardTemplate.ID = BoardTemplate.basic.id
+    /// The chooser's rows — both tiers, in 09's order, re-read on presentation and on activation
+    /// (see the type's doc). `@State` rather than a computed property because discovery *loads every
+    /// template board*, and a computed one would re-run that on every SwiftUI rebuild.
+    @State private var rows: [TemplateRow] = []
+
+    @State private var selection: TemplateRow.ID?
+
+    /// Which tile holds the keyboard.
+    ///
+    /// **The grid's Full Keyboard Access wiring** (10-accessibility.md ▸ Full Keyboard Access: "every
+    /// control — … template chooser — is Tab-reachable"). Before this the tiles were bare
+    /// `onTapGesture`s: the chooser could be Tabbed as far as Cancel and Choose, but the *choice*
+    /// itself was pointer-only, so a keyboard user could only ever create the default template.
+    ///
+    /// Focus and selection are deliberately the same thing here, unlike the style editor's grids
+    /// where "selection is never implied by focus" because a well writes to disk. A tile writes
+    /// nothing — it names what Choose will act on — so moving focus onto one *is* choosing it, which
+    /// is how every list and icon grid on the system behaves.
+    @FocusState private var focusedRow: TemplateRow.ID?
 
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "templates")
 
-    private var selected: BoardTemplate? {
-        BoardTemplate.all.first { $0.id == selection }
+    /// The selected row, defaulting to the first — which is Basic, the bundled tier's lowest order,
+    /// so the chooser always opens with something choosable in hand.
+    private var selected: TemplateRow? {
+        rows.first { $0.id == selection } ?? rows.first
     }
 
+    // MARK: - Geometry
+    //
+    // Every figure the sheet lays out on, as a multiple of the body font — `BoardMetrics`' rule
+    // applied to a window rather than to the board (10-accessibility.md ▸ Text scaling & visual
+    // accommodations). At the standard 13pt body they reproduce the numbers the chooser has always
+    // drawn: a 620 × 480 sheet, a 20pt inset, and tiles at least 170 points across.
+
+    @MainActor private static var pointSize: CGFloat { BoardMetrics.bodyPointSize }
+
+    @MainActor static var windowWidth: CGFloat { BoardMetrics.em(47.7, bodyPointSize: pointSize) }
+    @MainActor static var windowHeight: CGFloat { BoardMetrics.em(37, bodyPointSize: pointSize) }
+    @MainActor static var inset: CGFloat { BoardMetrics.em(1.55, bodyPointSize: pointSize) }
+    @MainActor static var tileMinimumWidth: CGFloat { BoardMetrics.em(13, bodyPointSize: pointSize) }
+
+    /// The width the grid actually gets — the sheet minus its two insets. Used only by the arrow
+    /// handler, which needs a column count `.adaptive` never tells it.
+    @MainActor static var gridWidth: CGFloat { windowWidth - 2 * inset }
+
     var body: some View {
         VStack(spacing: 0) {
             header
@@ -51,51 +123,153 @@ struct TemplateChooserView: View {
             Divider()
             footer
         }
-        .frame(width: 620, height: 460)
+        // Font-derived, like every other frame in the app (10-accessibility.md ▸ Text scaling: "no
+        // fixed point sizes"). This is a *fixed* sheet — the user cannot resize their way out of a
+        // clipped one — so a 620×480 literal would put the header's two lines and the footer's blurb
+        // outside the window at a large system text size.
+        .frame(width: Self.windowWidth, height: Self.windowHeight)
+        .task {
+            rescan()
+            // Returning to the foreground is when a folder dropped into the revealed store becomes
+            // this window's problem — `ClipboardStore`'s activation observer, in the shape a view can
+            // hold: the sequence ends with the task, which ends with the window.
+            for await _ in NotificationCenter.default.notifications(named: NSApplication.didBecomeActiveNotification) {
+                rescan()
+            }
+        }
+    }
+
+    /// Re-reads both stores, keeping the selection if the row it named is still there.
+    private func rescan() {
+        rows = TemplateEngine.chooserRows()
+        if let selection, !rows.contains(where: { $0.id == selection }) {
+            self.selection = nil
+        }
     }
 
     // MARK: Header
 
     private var header: some View {
-        VStack(alignment: .leading, spacing: 2) {
-            Text("Choose a Template")
-                .font(.title3.weight(.semibold))
-            Text("Every template is an ordinary board — lanes and cards you can change afterwards.")
-                .font(.callout)
-                .foregroundStyle(.secondary)
+        HStack(alignment: .firstTextBaseline) {
+            VStack(alignment: .leading, spacing: 2) {
+                Text("Choose a Template")
+                    .font(.title3.weight(.semibold))
+                Text("Every template is an ordinary board — lanes and cards you can change afterwards.")
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+            }
+
+            Spacer(minLength: 16)
+
+            // 09's honesty affordance: the store is plain board folders, and this is where the user
+            // is shown that. It mints the folder on the way — see the type's doc.
+            Button {
+                revealUserStore()
+            } label: {
+                Label("My Templates", systemImage: "folder")
+            }
+            .help("Reveal your templates folder in the Finder. Any board folder you put there becomes a template.")
         }
-        .frame(maxWidth: .infinity, alignment: .leading)
-        .padding(20)
+        .padding(Self.inset)
     }
 
     // MARK: Grid
 
     private var grid: some View {
         ScrollView {
-            LazyVGrid(columns: [GridItem(.adaptive(minimum: 170), spacing: 20)], spacing: 20) {
-                ForEach(BoardTemplate.all) { template in
-                    TemplateCard(template: template, isSelected: template.id == selection)
-                        .onTapGesture { selection = template.id }
-                        // The list convention welcome's recents use, for the same reason: a
-                        // double click is how a chooser is answered without reaching for a button.
-                        .onTapGesture(count: 2) { choose() }
-                        .accessibilityAddTraits(template.id == selection ? [.isSelected] : [])
+            LazyVGrid(
+                columns: [GridItem(.adaptive(minimum: Self.tileMinimumWidth), spacing: Self.inset)],
+                spacing: Self.inset
+            ) {
+                ForEach(rows) { row in
+                    TemplateCard(row: row, isSelected: row.id == selected?.id)
+                        // A double click is how a chooser is answered without reaching for a
+                        // button (welcome's list convention). One recogniser branching on
+                        // `PointerClick.count`, never a second two-tap one — stacked, it delays
+                        // the single click by the whole double-click interval; simultaneous, it
+                        // still holds clicks on a view with no drag source (`PointerClick`). The
+                        // first click of the pair selects the tile, which is also what aims
+                        // `choose()` at the clicked row.
+                        .onTapGesture {
+                            if PointerClick.count > 1 { choose() } else { selection = row.id }
+                        }
+                        // **Tab-reachable, and a button to the accessibility tree** — the tile is
+                        // the chooser's one act of choosing, so it has to be a control rather than a
+                        // decorated rectangle that happens to answer clicks (10-accessibility.md ▸
+                        // Full Keyboard Access).
+                        .focusable()
+                        .focused($focusedRow, equals: row.id)
+                        .accessibilityAddTraits(row.id == selected?.id ? [.isButton, .isSelected] : [.isButton])
+                        // Space picks the focused tile — the keyboard face of the single click above.
+                        // Return is deliberately *not* handled here: it is the sheet's default action
+                        // (Choose), and a tile that swallowed it would leave a keyboard user focused
+                        // on their choice with no way to answer the chooser.
+                        .onKeyPress(.space) {
+                            selection = row.id
+                            return .handled
+                        }
                 }
             }
-            .padding(20)
+            .padding(Self.inset)
+            // The arrows walk the tiles — `StyleWellGrid`'s handler on the container, for its
+            // reason: a focused control does not consume arrow keys, so the press bubbles here and
+            // moving focus is all it does.
+            .onKeyPress(keys: [.leftArrow, .rightArrow, .upArrow, .downArrow], phases: .down) { press in
+                move(press.key)
+            }
         }
         .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
         .background(Color(nsColor: .controlBackgroundColor))
+        // Focus *is* selection in this grid (see `focusedRow`), so the two are kept in step in one
+        // direction only: moving focus names the choice, and a pointer click that named a choice
+        // leaves focus alone rather than yanking it out from under the keyboard.
+        .onChange(of: focusedRow) { _, focused in
+            guard let focused else { return }
+            selection = focused
+        }
+    }
+
+    /// One step per press, clamped at the ends rather than wrapped — `StyleWellGrid.move`'s rule,
+    /// for its reason: a grid whose last row is short would wrap into a hole.
+    ///
+    /// The vertical step is the grid's own column count, which `.adaptive` decides at layout time
+    /// and no one here can read. It is recomputed from the same two numbers the `GridItem` was built
+    /// from, so ↑/↓ land a row away rather than an arbitrary distance.
+    private func move(_ key: KeyEquivalent) -> KeyPress.Result {
+        guard !rows.isEmpty else { return .ignored }
+        let columns = max(1, Int(Self.gridWidth / (Self.tileMinimumWidth + Self.inset)))
+        let delta: Int
+        switch key {
+        case .leftArrow: delta = -1
+        case .rightArrow: delta = 1
+        case .upArrow: delta = -columns
+        case .downArrow: delta = columns
+        default: return .ignored
+        }
+        let current = rows.firstIndex { $0.id == (focusedRow ?? selected?.id) } ?? 0
+        let next = min(max(0, current + delta), rows.count - 1)
+        focusedRow = rows[next].id
+        return .handled
     }
 
     // MARK: Footer
 
+    /// The blurb — or, for an unloadable row, **the loader's own sentence**: fail-fast's specifics,
+    /// unreworded, in the place the description would have been. It is the whole of what the user
+    /// needs to go and fix the file.
     private var footer: some View {
         HStack(alignment: .firstTextBaseline) {
-            Text(selected?.blurb ?? "")
-                .font(.callout)
-                .foregroundStyle(.secondary)
-                .lineLimit(2)
+            if let unloadable = selected?.unloadable {
+                Label(BannerCenter.headline(for: unloadable.error), systemImage: "exclamationmark.triangle")
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            } else {
+                Text(selected?.template?.blurb ?? "")
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(2)
+            }
 
             Spacer(minLength: 16)
 
@@ -104,51 +278,86 @@ struct TemplateChooserView: View {
 
             Button("Choose") { choose() }
                 .keyboardShortcut(.defaultAction)
-                .disabled(selected == nil)
+                // An unloadable row "can't be instantiated or previewed" (09), which is this line.
+                .disabled(selected?.template == nil)
         }
-        .padding(20)
+        .padding(Self.inset)
+    }
+
+    // MARK: - Reveal
+
+    /// Creates the user store if it isn't there, then reveals it — 09's affordance, and one of the
+    /// store's two minters (`TemplateEngine.createUserStore`).
+    ///
+    /// A store that cannot be created is logged and *still* revealed at its parent by
+    /// `activateFileViewerSelecting`, which is the honest failure: something is wrong with
+    /// the app-side store, and the user is standing where they can see it.
+    private func revealUserStore() {
+        let store = TemplateEngine.userStore
+        do {
+            try TemplateEngine.createUserStore(at: store)
+        } catch {
+            Self.logger.error("could not create the user template store: \(error.localizedDescription, privacy: .public)")
+        }
+        NSWorkspace.shared.activateFileViewerSelecting([store])
     }
 
     // MARK: - Choosing
 
     /// Panel, instantiate, open — and only then dismiss, so a cancelled panel leaves the chooser
     /// exactly as the user left it.
+    ///
+    /// The copy runs in a detached task, `DuplicateBoardCommand`'s reasoning at a smaller scale: a
+    /// user template can be a real board with real attachments, and a main thread blocked inside a
+    /// tree copy is a frozen window. Detached rather than a child task so its cancellation is only
+    /// ever the one a Cancel affordance hands it, never something inherited.
     private func choose() {
-        guard let template = selected, let url = Self.chooseLocation(for: template) else { return }
+        guard let template = selected?.template, let url = Self.chooseLocation(for: template) else { return }
+        let title = TemplateEngine.documentName(of: url)
 
-        do {
-            try template.instantiate(at: url)
-        } catch {
-            Self.logger.error("template instantiation failed: \(error.description, privacy: .public)")
-            Self.present(error)
-            return
+        Task { @MainActor in
+            let outcome = await Task.detached(priority: .userInitiated) {
+                () -> Result<URL, TemplateEngine.Failure> in
+                do throws(TemplateEngine.Failure) {
+                    return .success(try TemplateEngine.instantiate(template: template, to: url, title: title))
+                } catch {
+                    return .failure(error)
+                }
+            }.value
+
+            switch outcome {
+            case .success:
+                dismiss()
+                // The ordinary open path, so the new board joins recents, gets its bookmark, and
+                // closes welcome on the way in exactly like a board opened from a row.
+                appModel.openBoard(at: url)
+            case .failure(.cancelled):
+                // Nothing was created and nothing failed, so nothing is said — the duplicate rule.
+                Self.logger.notice("template instantiation cancelled — the partial board was removed")
+            case let .failure(.failed(error)):
+                Self.logger.error("template instantiation failed: \(error.description, privacy: .public)")
+                Self.present(error)
+            }
         }
-
-        dismiss()
-        // The ordinary open path, so the new board joins recents, gets its bookmark, and closes
-        // welcome on the way in exactly like a board opened from a row.
-        appModel.openBoard(at: url)
     }
 
     /// The save panel — where the board goes and what it is called.
     ///
-    /// `"Untitled.kanban"` is the suggestion; the package extension is visible and editable, because
-    /// an extension-less board folder is equally legal (01-storage-format.md § Document packaging)
-    /// and deleting the suffix should therefore work rather than be silently undone.
-    ///
-    // m9-templates: 09 ▸ Instantiation seeds this name from the template's own title once templates
-    // have titles of their own ("Basic.kanban", "Bug Tracker.kanban"). With one stub template a
-    // suggestion of "Basic" would name the *template*, not the user's board, which is worse than
-    // Untitled.
+    /// **The suggestion is the template's own title** (`"Basic.kanban"`, `"Bug Tracker.kanban"`) —
+    /// 09 ▸ Instantiation: "seed the save panel's suggested name from the template title". Whatever
+    /// the user types instead becomes the new board's `title` as well as its folder name, so the two
+    /// start out matching (01-storage-format.md § Board naming). The package extension is visible and
+    /// editable, because an extension-less board folder is equally legal (§ Document packaging) and
+    /// deleting the suffix should therefore work rather than be silently undone.
     ///
     /// A name that already exists gets the panel's own replace prompt; agreeing to it does not delete
-    /// anything (the panel never does), so `BoardWriter.createBoard`'s refusal to clobber an existing
-    /// board is what the user sees — as an alert, naming the path. That is the honest outcome: this
-    /// flow is a *create*, and quietly replacing a board with an empty one is not a thing it should
-    /// be able to do.
+    /// anything (the panel never does), so the engine's refusal to clobber an existing board is what
+    /// the user sees — as an alert, naming the path. That is the honest outcome: this flow is a
+    /// *create*, and quietly replacing a board with an empty one is not a thing it should be able to
+    /// do.
     private static func chooseLocation(for template: BoardTemplate) -> URL? {
         let panel = NSSavePanel()
-        panel.nameFieldStringValue = "Untitled.kanban"
+        panel.nameFieldStringValue = TemplateEngine.suggestedFileName(for: template)
         panel.canCreateDirectories = true
         panel.isExtensionHidden = false
         panel.allowsOtherFileTypes = true
@@ -171,62 +380,133 @@ struct TemplateChooserView: View {
 
 // MARK: - Template card
 
-/// One template in the grid: its mini per-lane preview, its name, and the selection ring.
+/// One row in the grid: its preview, its name, and the selection ring — or, for a folder that did not
+/// load, the same frame with an unloadable badge where the preview would be.
+///
+/// The two cases share a frame deliberately: an unloadable template is **the same kind of thing** as
+/// the ones beside it, one edit away from working (09), so hiding it in a separate list would say the
+/// opposite of what 09 means by "still listed".
 private struct TemplateCard: View {
 
-    let template: BoardTemplate
+    let row: TemplateRow
     let isSelected: Bool
 
+    /// Increase Contrast, for the tile's frame below — 10-accessibility.md names both halves of it
+    /// ("strengthens borders and the selection indicator"), and this one shape is both
+    /// (`Accommodations`).
+    @Environment(\.colorSchemeContrast) private var contrast
+
+    private var pointSize: CGFloat { BoardMetrics.bodyPointSize }
+
+    private var cornerRadius: CGFloat { BoardMetrics.em(0.6, bodyPointSize: pointSize) }
+
     var body: some View {
-        VStack(spacing: 8) {
-            TemplatePreview(template: template)
-                .frame(height: 96)
-                .background(RoundedRectangle(cornerRadius: 8).fill(Color(nsColor: .textBackgroundColor)))
+        VStack(spacing: BoardMetrics.em(0.6, bodyPointSize: pointSize)) {
+            content
+                .frame(height: BoardMetrics.em(7.4, bodyPointSize: pointSize))
+                .frame(maxWidth: .infinity)
+                .background(RoundedRectangle(cornerRadius: cornerRadius).fill(Color(nsColor: .textBackgroundColor)))
                 .overlay(
-                    RoundedRectangle(cornerRadius: 8)
+                    RoundedRectangle(cornerRadius: cornerRadius)
                         .strokeBorder(isSelected ? Color.accentColor : Color(nsColor: .separatorColor),
-                                      lineWidth: isSelected ? 3 : 1)
+                                      lineWidth: Accommodations.borderWidth(isSelected ? 3 : 1, contrast: contrast))
                 )
 
-            Label(template.name, systemImage: template.icon)
+            Label(row.name, systemImage: icon)
                 .font(.callout)
                 .labelStyle(.titleAndIcon)
+                .lineLimit(1)
         }
         .contentShape(Rectangle())
         .accessibilityElement(children: .combine)
-        .accessibilityLabel(template.name)
-        .accessibilityHint(template.blurb)
+        .accessibilityLabel(row.name)
+        .accessibilityHint(hint)
+    }
+
+    @ViewBuilder
+    private var content: some View {
+        switch row {
+        case let .template(template):
+            TemplatePreview(template: template)
+        case .unloadable:
+            // No preview, because there is no board to preview — the badge says why the tile is
+            // empty rather than leaving it looking like a template with no lanes.
+            VStack(spacing: 6) {
+                Image(systemName: "exclamationmark.triangle")
+                    .font(.title2)
+                Text("Can't be read")
+                    .font(.caption)
+            }
+            .foregroundStyle(.secondary)
+        }
+    }
+
+    private var icon: String {
+        switch row {
+        case let .template(template): template.icon
+        case .unloadable: "exclamationmark.triangle"
+        }
+    }
+
+    private var hint: String {
+        switch row {
+        case let .template(template): template.blurb
+        case let .unloadable(unloadable): BannerCenter.headline(for: unloadable.error)
+        }
     }
 }
 
-/// The mini per-lane preview: one column per lane, each a title bar over a couple of card shapes.
+/// The mini per-lane preview: one column per lane, a tinted title bar over the lane's **own cards**.
 ///
-/// Deliberately abstract — no text, because the point is the *shape* of the board and legible lane
-/// names at this size are not available. It renders from `laneTitles` only for the count and the
-/// stable identity of each column.
+/// It renders **from the template's loaded `BoardModel`** (09-templates.md ▸ Why this format: "The
+/// picker's mini per-lane preview renders from a real `BoardModel` via the normal loader"), and every
+/// mark in it is read off that model rather than decorated in: the number of columns is the lane
+/// count, each column's tint is the lane's own `iconColor` through `Palette`, and the number of card
+/// shapes is how many cards the lane actually holds — templates "may contain starter cards", so a
+/// board with a "How this board works" card in its first lane looks different here from one without.
+///
+/// Deliberately **textless**: legible lane names are not available at this size, and the point of the
+/// preview is the shape of the board. A lane with no cards draws an empty column, which is the honest
+/// picture of an empty lane rather than a decorative one.
 private struct TemplatePreview: View {
 
     let template: BoardTemplate
 
+    /// How many lanes and cards a tile can show before the marks stop being distinguishable. A
+    /// template with more of either is truncated rather than shrunk to threads — the preview is an
+    /// impression, and every bundled template fits inside both.
+    private static let laneLimit = 6
+    private static let cardLimit = 4
+
+    private var pointSize: CGFloat { BoardMetrics.bodyPointSize }
+
     var body: some View {
-        HStack(alignment: .top, spacing: 6) {
-            ForEach(Array(template.laneTitles.enumerated()), id: \.offset) { index, _ in
-                VStack(spacing: 4) {
-                    RoundedRectangle(cornerRadius: 2)
-                        .fill(Color.accentColor.opacity(0.65))
-                        .frame(height: 5)
-                    // A descending number of cards, so the preview reads as work in flight rather
-                    // than as three identical columns.
-                    ForEach(0..<max(1, 3 - index), id: \.self) { _ in
-                        RoundedRectangle(cornerRadius: 3)
+        // Every mark is a fraction of the body font, like the tile that holds it — the preview is a
+        // miniature of the board, and the board scales (10-accessibility.md's full-relative-scaling
+        // rule). A fixed 5pt lane band inside a tile that grew would read as a hairline.
+        HStack(alignment: .top, spacing: BoardMetrics.em(0.4, bodyPointSize: pointSize)) {
+            ForEach(template.lanes.prefix(Self.laneLimit)) { lane in
+                VStack(spacing: BoardMetrics.em(0.3, bodyPointSize: pointSize)) {
+                    RoundedRectangle(cornerRadius: BoardMetrics.em(0.15, bodyPointSize: pointSize))
+                        .fill(Self.tint(of: lane))
+                        .frame(height: BoardMetrics.laneAccentBandHeight(bodyPointSize: pointSize))
+                    ForEach(0 ..< min(lane.cards.count, Self.cardLimit), id: \.self) { _ in
+                        RoundedRectangle(cornerRadius: BoardMetrics.em(0.25, bodyPointSize: pointSize))
                             .fill(.quaternary)
-                            .frame(height: 14)
+                            .frame(height: BoardMetrics.em(0.9, bodyPointSize: pointSize))
                     }
                     Spacer(minLength: 0)
                 }
             }
         }
-        .padding(10)
+        .padding(BoardMetrics.cardContentPadding(bodyPointSize: pointSize))
         .accessibilityHidden(true)
     }
+
+    /// The lane's palette tint, falling back to the accent colour — `Palette` is the one place a
+    /// colour name is resolved, and a lane that names none looks like the chrome default here exactly
+    /// as it does on a board.
+    private static func tint(of lane: Lane) -> Color {
+        (Palette.color(for: lane.iconColor) ?? .accentColor).opacity(0.65)
+    }
 }

Kanban/App/TemplateEngine.swift

@@ -0,0 +1,660 @@
+import Foundation
+import os
+
+/// The template engine — where templates live, and what "create a board from one" means on disk
+/// (09-templates.md).
+///
+/// ### The whole engine is the ordinary loader and the ordinary writer
+///
+/// A template is a board folder, so discovery is `BoardLoader.load` and instantiation is a tree copy
+/// plus the Writer's own remint-and-restamp machinery (`BoardWriter.remintDescendants`,
+/// `checkCopiedDescendantsAreStampable`, `applyCopyContract`, `stampCopiedDescendant`,
+/// `updateIndex`). There is no template schema, no template catalog in
+/// Swift, and no second copy path — which is 09's "dogfood" clause and 02-architecture.md's single
+/// write door, both held by having nothing here to hold them with.
+///
+/// ### What instantiation is
+///
+/// > copy the tree — **skipping `.trash/`** … — **mint fresh GUIDs** for every lane/card folder,
+/// > stamp `created`/`modified` fresh …, and **set the new board's `title` to the user-chosen
+/// > document name**. The `template:` key is kept — inert on an ordinary board. **`.git` is never
+/// > copied** … Beyond the `template:` residue, the result is indistinguishable from a hand-built
+/// > board. (09 ▸ Instantiation)
+///
+/// Five things follow, and each is the ordinary machinery pointed at a board root rather than a
+/// rule this file invents:
+///
+/// - **The two exclusions are top-level only** (`BoardTreeCopy`): `.git` and `.trash/` mean
+///   something at a board root and nowhere else. `.git` is skipped so an instantiated board is never
+///   silently in git mode (06-history-undo.md's no-silent-auto-init); its actual mode follows 06's
+///   nearest-`.git`-wins detection at the destination the save panel chose. `.trash/` is skipped
+///   because "a new board isn't born with trash".
+/// - **Everything else copies verbatim** — strays, `CLAUDE.user.md`, a seeded `.gitignore`,
+///   attachments, card bodies, unknown keys, line endings (09 ▸ Save as Template, "Strays copy
+///   through … *and* instantiation alike"), and **symlinks as symlinks**, never traversed
+///   (01-storage-format.md § Fractal layout ▸ Rules).
+/// - **Fresh identity at every level**: `remintDescendants` from the copied root renames every
+///   UUID-shaped folder it can reach, so no id survives from the template. Template GUIDs are inert
+///   anyway — "instantiation remints at its own boundary" (01 § Fractal layout ▸ Rules).
+/// - **Born today**: `CopyStamps.born` on every `index.md` — `created` *and* `modified` stamped from
+///   one `Date` for the whole tree, `modified-by` cleared as on any app-mediated write (01
+///   § Frontmatter). The stamps are frontmatter-level; **body bytes are never rewritten** (the
+///   round-trip guarantee — `updateIndex` edits by line span).
+/// - **The `template:` key rides along untouched**, because `updateIndex` preserves unknown keys by
+///   construction rather than by remembering to.
+///
+/// ### Two readings 09 does not spell out, taken here and stated
+///
+/// - **A legacy `deleted:` key in a hand-dropped template copies through.** 09's exclusions are
+///   `.git` and `.trash/` and stop there; the tombstone model is retired, so a stale `deleted:` is
+///   just a key in a file that copies verbatim. The migration has exactly one owner — "Legacy
+///   `deleted:` keys migrate on load-and-write, never destroy" (01 § Deletion), run by the store on
+///   the new board's first load — and stripping the key here would silently resurrect a card the
+///   template's author had deleted, while skipping the card would destroy content. Neither is this
+///   engine's call to make; copying honestly and letting the one migrator run is.
+/// - **Loose files beside a card's `index.md` are normalized on arrival.** 01's carve-out relocates
+///   them into `attachments/`, and 04-interactions.md ▸ Clipboard settled that an **import boundary**
+///   does it at write time rather than leaving it for the loader ("A paste is an import boundary, so
+///   normalization applies"). Instantiation is the same kind of boundary — the app is materializing
+///   the tree — so the new board lands already normalized instead of opening with a warning row
+///   about a mess the instantiation itself made. Board- and lane-level strays keep the verbatim
+///   posture, exactly as the carve-out is scoped.
+///
+/// ### What a save is
+///
+/// Save as Template is the same walk pointed the other way — a board copied *into* the store, minus
+/// the same two exclusions — plus one write the app owes: the `template:` key, stamped on the copy
+/// through `BoardWriter.updateIndex`. That write is the whole of "the app never stamps a key into
+/// store files it didn't write itself … the one writer of keyed files is Save as Template" (09
+/// ▸ Storage): discovery, listing and instantiation are all reads, so a hand-dropped board in the
+/// store can never gain a key by being looked at. See `saveAsTemplate(boardAt:titled:into:)`.
+///
+/// ### Atomicity: construct-then-clean, not stage-then-rename
+///
+/// "A half-instantiated board must never be left at the destination." Two ways to promise that, and
+/// the rename-into-place one is the wrong one here:
+///
+/// - A temp staged **beside** the destination is not reliably writable — the save panel's grant is
+///   the item the user named, not its parent (03-board-ui.md's own reasoning for why Duplicate's
+///   silent sibling can be refused at all), so staging there could fail for a destination that is
+///   perfectly writable.
+/// - A temp in `NSTemporaryDirectory()` may be on another volume, where `rename` degrades to a copy —
+///   a second full copy of the tree, and no atomicity in exchange (`BoardWriter.atomicReplace` keeps
+///   its temp in the same directory for exactly this reason; that trick does not survive being scaled
+///   to a folder the app may not write beside).
+///
+/// So the promise is kept the way `BoardWriter.copyItem` and `BoardDuplicator` keep it: **the
+/// destination is created by this call and removed by this call on every exit that is not a board**
+/// — cancellation and failure alike, "because a half-copied board is pure residue: nothing was there
+/// before, so there is no true state for a reload to show". The one thing never removed is a
+/// destination this call did not create: an existing name is the user's, and a create that clobbered
+/// one would be the create path silently deleting a board (`BoardWriter.createBoard`'s refusal, at
+/// folder scale).
+enum TemplateEngine {
+
+    private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "templates")
+
+    // MARK: - Where templates live
+
+    /// The store folder's name in both locations — the bundle's and the app's own.
+    static let storeFolderName = "Templates"
+
+    /// The bundled store: `<app bundle>/Contents/Resources/Templates/`, holding one board folder per
+    /// template (09 ▸ Definition format). `nil` only if the running bundle has no resources at all,
+    /// which is not a state a shipped app is in.
+    static var bundledStore: URL? {
+        Bundle.main.resourceURL?.appendingPathComponent(storeFolderName, isDirectory: true)
+    }
+
+    /// The user store: `<Application Support>/Templates/`, beside the board registry and the
+    /// clipboard's staging store — 09's settled location ("Application Support … inside the app
+    /// container — friction-free sandbox writes, no location ceremony"; 02-architecture.md
+    /// § Per-board app state, "App-wide state has the same home").
+    ///
+    /// This store needs none of the machinery the registry does: a template is a folder inside the
+    /// app's own container, so there is no bookmark to mint and nothing to grant. Spelled through
+    /// `AppStateHome` like every other app-wide store (`ClipboardStore.defaultStagingRoot`,
+    /// `BoardRegistry.defaultStorageURL`), so all three move together if the home ever does.
+    ///
+    /// **Named, never created here.** Discovery of a store that does not exist is an empty list, not
+    /// a directory the app made on the off-chance: the store is minted by the first Save as Template,
+    /// and by Reveal in Finder, both of which are 09's other cards.
+    static var userStore: URL {
+        AppStateHome.directory.appendingPathComponent(storeFolderName, isDirectory: true)
+    }
+
+    // MARK: - Discovery
+
+    /// The candidate template folders in a store, in folder-name order — every visible directory,
+    /// which is deliberately *not* narrowed to `.kanban`: "a board folder dropped in becomes a
+    /// template" (09 ▸ Storage), and an extension-less board folder is as legal as a suffixed one
+    /// (01-storage-format.md § Document packaging).
+    ///
+    /// Hidden entries and symlinks are excluded — `BoardLoader.directoryCandidates`, the loader's own
+    /// listing, so a `.DS_Store` is not a template and a link is never followed out of the store.
+    /// A missing store is an empty list.
+    static func templateFolders(in store: URL) -> [URL] {
+        (try? BoardLoader.directoryCandidates(in: store)) ?? []
+    }
+
+    /// Loads one template folder through the ordinary loader.
+    ///
+    /// The loader's error is handed back whole rather than reworded: the chooser's unloadable row
+    /// shows "the loader's fail-fast specifics" (09 ▸ Why this format), and a second taxonomy of
+    /// board problems is precisely what a files-first app must not grow.
+    ///
+    /// **One defect of the walk's aggregate — the first** (`BoardLoadFailure.primary`). The chooser's
+    /// unloadable row is one line about a folder the user is not being invited to repair: a template
+    /// store is picked from, not opened, and the decision surface exists for the board being opened.
+    /// Saying which thing is wrong first is the whole of what that row can act on.
+    static func load(templateAt url: URL, origin: BoardTemplate.Origin) -> Result<BoardTemplate, BoardLoadError> {
+        do {
+            let result = try BoardLoader.load(boardRoot: url)
+            return .success(BoardTemplate(url: url, origin: origin, model: result.model))
+        } catch {
+            return .failure(error.primary)
+        }
+    }
+
+    /// Every bundled template that loads, in chooser order.
+    ///
+    /// **A bundled template that does not load is a build defect, not a user's problem**, so it is
+    /// logged and skipped rather than surfaced: the unloadable-row treatment 09 specifies exists
+    /// because "the user store is hand-editable, so a malformed board there is one edit away" — an
+    /// app's own resources are neither hand-edited nor fixable by the person looking at the chooser.
+    /// The suite walks this same list and loads each folder, which is 09's "testable for free".
+    ///
+    /// Order is `template.order`, then display name for anything keyless — 09's chooser order for
+    /// the bundled tier.
+    static func bundledTemplates() -> [BoardTemplate] {
+        guard let store = bundledStore else { return [] }
+        var templates: [BoardTemplate] = []
+        for folder in templateFolders(in: store) {
+            switch load(templateAt: folder, origin: .bundled) {
+            case let .success(template):
+                templates.append(template)
+            case let .failure(error):
+                logger.error("bundled template \(folder.lastPathComponent, privacy: .public) failed to load: \(error.description, privacy: .public)")
+            }
+        }
+        return sortedForChooser(templates)
+    }
+
+    /// Every folder in `store` as a **chooser row** — loaded templates and unloadable ones alike,
+    /// in folder-name order (the caller sorts).
+    ///
+    /// This is 09's one-bad-template-never-fails-the-chooser clause, and it is the whole of it: the
+    /// walk cannot fail as a walk (a missing store is an empty list), and a folder the loader rejects
+    /// becomes a row carrying the error rather than an omission or a thrown failure. Nothing here
+    /// writes: **listing a store never stamps a key into it** — "a hand-dropped board is never
+    /// touched" (09 ▸ Storage).
+    static func rows(in store: URL, origin: BoardTemplate.Origin) -> [TemplateRow] {
+        templateFolders(in: store).map { folder in
+            switch load(templateAt: folder, origin: origin) {
+            case let .success(template):
+                .template(template)
+            case let .failure(error):
+                .unloadable(TemplateRow.Unloadable(url: folder, error: error))
+            }
+        }
+    }
+
+    /// The user tier, in 09's within-tier order — every board folder in the user store, whether or
+    /// not it loads and whether or not it carries a `template:` key ("a board folder dropped in
+    /// becomes a template — **no `template:` key required**").
+    static func userRows(in store: URL = userStore) -> [TemplateRow] {
+        sortedForChooser(rows(in: store, origin: .user))
+    }
+
+    /// **The chooser's whole list**, in 09 ▸ Storage's three-tier order:
+    ///
+    /// > Chooser order: bundled templates by `template.order`, then keyed user templates by
+    /// > `template.order`, then keyless user boards last, sorted by display name.
+    ///
+    /// The tiers are concatenated rather than sorted together, which is what makes "then" mean
+    /// *then*: a user template carrying `order: 1` still lists after every bundled one, because the
+    /// store it came from is the sort's outermost key. Within each tier the same two-step rule runs
+    /// (`sortedForChooser`), so the tier boundary is the only thing this function decides.
+    ///
+    /// **Re-read on every call**, and the chooser calls it on every presentation: the store is not
+    /// watched (09 asks for a Reveal in Finder affordance, not a live folder), so a board dropped in
+    /// while the chooser is open appears the next time the chooser is opened — or, since the drop
+    /// usually happens in the Finder window Reveal just opened, when the app comes back to the
+    /// front. `TemplateChooserView` wires both.
+    static func chooserRows(userStore store: URL = userStore) -> [TemplateRow] {
+        bundledTemplates().map(TemplateRow.template) + userRows(in: store)
+    }
+
+    /// 09's chooser order within one tier: keyed templates by `template.order`, then keyless ones by
+    /// display name. `localizedStandardCompare` for the names, the same Finder ordering every other
+    /// name listing in the app uses.
+    static func sortedForChooser(_ templates: [BoardTemplate]) -> [BoardTemplate] {
+        chooserSorted(templates, order: \.order, name: \.name)
+    }
+
+    /// The same rule over chooser rows, which is where it actually meets 09's keyless tier: an
+    /// unloadable row reports no order at all, so it sorts by folder name among the keyless boards
+    /// without this comparison having to know what an unloadable row is.
+    static func sortedForChooser(_ rows: [TemplateRow]) -> [TemplateRow] {
+        chooserSorted(rows, order: \.order, name: \.name)
+    }
+
+    /// The comparison itself, once: keyed before keyless, `order` ascending among the keyed, name
+    /// among the rest — and name as the tie-break between equal orders, so a hand-edited store with
+    /// two `order: 100`s still lists in a stable, explicable sequence.
+    private static func chooserSorted<Item>(
+        _ items: [Item],
+        order: (Item) -> Double?,
+        name: (Item) -> String
+    ) -> [Item] {
+        items.sorted { left, right in
+            switch (order(left), order(right)) {
+            case let (leftOrder?, rightOrder?):
+                leftOrder == rightOrder
+                    ? name(left).localizedStandardCompare(name(right)) == .orderedAscending
+                    : leftOrder < rightOrder
+            case (.some, .none):
+                true
+            case (.none, .some):
+                false
+            case (.none, .none):
+                name(left).localizedStandardCompare(name(right)) == .orderedAscending
+            }
+        }
+    }
+
+    // MARK: - Outcomes
+
+    /// The two ways instantiation ends without a board.
+    ///
+    /// **There is no `.refused` here**, unlike `BoardDuplicator`: this flow's destination came from
+    /// the save panel, and the panel's grant *is* the sandbox's answer — asking the same question
+    /// again would be a loop, so a permission failure is an ordinary failure with an ordinary
+    /// message (`BoardDuplicator.duplicate(boardAt:titled:into:)` takes the same position for the
+    /// same reason).
+    enum Failure: Error, Sendable, Equatable {
+        /// The user cancelled. The partial is already gone and there is nothing to report — the
+        /// duplicate rule, verbatim: a cancelled create never happened.
+        case cancelled
+
+        /// Anything else: a full disk, an unreadable template, a name already taken. The one-shot
+        /// banner's vocabulary (02-architecture.md § Write-failure surfacing), which the chooser
+        /// renders as an alert because a board that was never created has no window to carry a row.
+        case failed(BoardWriteError)
+    }
+
+    // MARK: - Instantiation
+
+    /// Creates a board at `destination` from `template`, titled `title`.
+    ///
+    /// `title` is the **user-chosen document name** (`documentName(of:)` off the save panel's URL),
+    /// never the template's: 09 ▸ Instantiation says so and 01-storage-format.md § Board naming is
+    /// the reason — display name and folder name start out matching. The template's own title is
+    /// what seeds the panel's *suggested* name, which is the chooser's end of the same sentence.
+    ///
+    /// `isCancelled` is read between items and nowhere else, defaulting to the ambient task's own
+    /// cancellation — so a caller cancels an instantiation the way it cancels anything else, and a
+    /// test can trip it deterministically at item *N* (`BoardDuplicator`'s seam, for its reasons).
+    /// 02-architecture.md's Cancel-on-safe-copies rule is *about* copy-shaped work like this; the
+    /// in-progress row that offers the button belongs to the chooser surface being built alongside
+    /// it, and this parameter is what it attaches to.
+    ///
+    /// Returns `destination` — the caller opens it through the ordinary open path, so a new board
+    /// registers, bookmarks and titles itself like any other.
+    @discardableResult
+    static func instantiate(
+        template: BoardTemplate,
+        to destination: URL,
+        title: String,
+        isCancelled: () -> Bool = { Task.isCancelled }
+    ) throws(Failure) -> URL {
+        let operation = WriteOperation.createBoard
+
+        func failure(at url: URL, _ message: String) -> Failure {
+            .failed(BoardWriteError(operation: operation, path: url.path, reason: .io(message: message)))
+        }
+
+        // **Refused, never clobbered**, and checked before anything is created so the cleanup below
+        // can never reach a destination this call did not make. The save panel's replace prompt
+        // grants access; it does not delete anything, so an occupied name arrives here intact and
+        // leaves that way (`BoardWriter.createBoard`'s stance, at folder scale).
+        guard !FileManager.default.fileExists(atPath: destination.path) else {
+            throw failure(at: destination, "something already exists here")
+        }
+
+        // Cancelled before it began is still cancelled — answered here so the empty destination
+        // never exists at all.
+        if isCancelled() { throw .cancelled }
+
+        do {
+            try BoardTreeCopy.createDirectory(at: destination)
+        } catch {
+            throw failure(at: destination, "could not create board folder: \(error.localizedDescription)")
+        }
+
+        do {
+            try copyTree(of: template, to: destination, isCancelled: isCancelled)
+            try mintIdentitiesAndStamps(at: destination, title: title, operation: operation)
+        } catch {
+            // Cancelled or failed, the partial goes — the whole of this call's atomicity, and the
+            // reason nothing half-made is ever left where the user pointed.
+            try? FileManager.default.removeItem(at: destination)
+            throw error
+        }
+
+        return destination
+    }
+
+    /// The copy half: the template's tree, minus the two board-root exclusions, with folder
+    /// attributes deliberately **not** carried (`BoardTreeCopy`'s flag documents why — a bundled
+    /// template's read-only mode must not mint a read-only board, and a board born today must not
+    /// wear the template's dates).
+    private static func copyTree(
+        of template: BoardTemplate,
+        to destination: URL,
+        isCancelled: () -> Bool
+    ) throws(Failure) {
+        do throws(BoardTreeCopy.Stop) {
+            try BoardTreeCopy.copy(
+                contentsOf: template.url,
+                into: destination,
+                excludingTopLevel: [BoardLoader.trashFolderName, ".git"],
+                carryingFolderAttributes: false,
+                isCancelled: isCancelled
+            )
+        } catch {
+            switch error {
+            case .cancelled:
+                throw .cancelled
+            case let .failed(url, underlying):
+                throw .failed(BoardWriteError(
+                    operation: .createBoard,
+                    path: url.path,
+                    reason: .io(message: "could not copy the template: \(underlying.localizedDescription)")
+                ))
+            }
+        }
+    }
+
+    /// The born half, on the tree already at the destination: fresh identities, fresh stamps, the
+    /// chosen title, and the loose-file normalization an import boundary owes.
+    ///
+    /// **An instantiation is a copy transaction**, which is `BoardWriter.copyItem`'s posture since
+    /// 2026-07-29 and for its reason: the whole tree is preflighted for stampability before a single
+    /// folder is reminted, and a template carrying one readable-but-uneditable card refuses the create
+    /// whole, naming that card (01-storage-format.md § Frontmatter: "preflights the entire subtree and
+    /// refuses whole, loudly, naming the offending item — never a partial copy, never a silently
+    /// unstamped descendant").
+    ///
+    /// This retired the former root-strict/descendants-lenient split, which copied such a card
+    /// byte-verbatim and skipped its stamp. Two things were wrong with the kindness: an unstamped
+    /// descendant keeps a `modified-by` naming somebody who never touched this board, and — since the
+    /// tracker sever joined the copy contract — a live `remote` claim on an object the new board has
+    /// no relationship with. "Proceed partially, lose a little" is never a verdict (01's leniency
+    /// doctrine).
+    ///
+    /// **The preflight runs on the destination, not the template**, deliberately: the copy has already
+    /// applied its top-level exclusions, so `.trash/`'s cards — which are not part of what a template
+    /// instantiates — cannot refuse a create they were never going to appear in. Nothing is lost by
+    /// preflighting a step later, because `instantiate`'s construct-then-clean removes the whole
+    /// destination on any throw (09-templates.md's atomicity).
+    private static func mintIdentitiesAndStamps(
+        at root: URL,
+        title: String,
+        operation: WriteOperation
+    ) throws(Failure) {
+        do throws(BoardWriteError) {
+            // Before the remint, so a refusal names folders by the paths the user's template actually
+            // has rather than by minted UUIDs they have never seen.
+            try BoardWriter.checkCopiedDescendantsAreStampable(of: root, operation: operation)
+
+            var materialized: [URL] = []
+            try BoardWriter.remintDescendants(of: root, collecting: &materialized, operation: operation)
+
+            // One `Date` for the whole tree, so the board and every item in it are born at the same
+            // instant rather than merely close (`BoardWriter.newDocumentText`'s convention).
+            let now = Date()
+            // `kind: .board` — an instantiated board's root is the one file whose kind position
+            // cannot answer, and this write is where a template's kind-less root gains it
+            // (`BoardWriter.updateIndex`'s on-touch backfill; no template migration, by design).
+            try BoardWriter.updateIndex(inItemFolder: root, kind: .board, operation: operation) { document in
+                // `.born` restamps `created`; the copy contract also severs the reserved tracker keys,
+                // which at board level is the `remote` a template could have carried in from the board
+                // it was saved from (01 ▸ Identity lifecycle, ruled 2026-07-29).
+                BoardWriter.applyCopyContract(to: &document, stamps: .born, now: now)
+                document.set(FrontmatterKeys.title, to: .string(title))
+            }
+            for folder in materialized {
+                try BoardWriter.stampCopiedDescendant(at: folder, stamps: .born, now: now, operation: operation)
+            }
+
+            // The import boundary's normalization, on the final paths. Lanes only: the carve-out is
+            // card-level and one level deep, so `normalizeLooseFiles(inLane:)` is the exact reach.
+            // The lane list is the loader's own level detection — `directoryCandidates` (hidden
+            // entries and symlinks already out) narrowed by the identity predicate — so a stray
+            // folder at board level is never descended into here either.
+            // **The seed, before the normalization it governs** (01-storage-format.md § Fractal
+            // layout ▸ Rules and 06-history-undo.md ▸ Repository hygiene, ruled 2026-07-31: every
+            // board carries a `.gitignore`, and an instantiated board is a board created today). A
+            // template that carries one of its own copies through and is honored — the seed writes
+            // only into a free name — which is 09-templates.md's "strays copy through" doing the
+            // right thing by itself; a template written before the ruling gains the seed here rather
+            // than a reload later, so the new board's very first walk has its noise gate.
+            try BoardWriter.seedGitignoreIfAbsent(atBoardRoot: root)
+
+            let lanes = ((try? BoardLoader.directoryCandidates(in: root)) ?? [])
+                .filter { BoardLoader.isUUIDShaped($0.lastPathComponent) }
+            for lane in lanes {
+                try BoardWriter.normalizeLooseFiles(inLane: lane)
+            }
+        } catch {
+            throw .failed(error)
+        }
+    }
+
+    // MARK: - Save as Template
+
+    /// The spacing between user templates' `template.order` values — the bundled store's own
+    /// spacing (100, 200, … 1000), so a hand-editor moving one template between two others has room
+    /// to write a number in the gap.
+    static let userOrderStep: Double = 100
+
+    /// The order the next Save as Template takes: **appended after existing user templates** (09
+    /// ▸ Save as Template), which is the highest `template.order` in the store plus one step.
+    ///
+    /// Read off the store's own rows rather than off a counter, because the store is hand-editable
+    /// and a counter would be a second opinion about it. Keyless boards contribute nothing — they
+    /// sort by name in their own tier and have no position to be appended after — and neither does
+    /// an unloadable folder, which has no key to read.
+    static func nextUserOrder(in store: URL = userStore) -> Double {
+        guard let highest = rows(in: store, origin: .user).compactMap(\.order).max() else {
+            return userOrderStep
+        }
+        return highest + userOrderStep
+    }
+
+    /// Creates the user store if it is not there, and answers it.
+    ///
+    /// **The store's two minters are Save as Template and Reveal in Finder** (see `userStore`, which
+    /// only names it): a store that exists because the app made it on the off-chance would be an
+    /// empty folder in the shared container for a user who never used the feature, while a Reveal
+    /// that opened nothing — or a save that failed because its own home was missing — would be the
+    /// app being pedantic about a directory it owns.
+    @discardableResult
+    static func createUserStore(at store: URL = userStore) throws -> URL {
+        try FileManager.default.createDirectory(at: store, withIntermediateDirectories: true)
+        return store
+    }
+
+    /// Copies the board at `rootURL` into the user templates store and answers where it landed —
+    /// 09 ▸ Save as Template, whose whole contract is the four rules below.
+    ///
+    /// - **`.git` and `.trash/` are dropped** — the same two top-level exclusions instantiation
+    ///   uses, for two different halves of one reason: a template is content, not history ("copying
+    ///   it would embed the board's full repo, every attachment version included, in the template
+    ///   store"), and a template is not a fork, so the board's trash is not part of what is being
+    ///   saved. This is where Save as Template and File ▸ Duplicate part company — Duplicate carries
+    ///   both, because a duplicate *is* a fork (03-board-ui.md).
+    /// - **Everything else copies verbatim**: "Strays copy through … `CLAUDE.user.md`, a seeded
+    ///   `.gitignore`, and other non-schema files carry through Save as Template *and* instantiation
+    ///   alike", along with GUIDs and timestamps — both inert, since instantiation remints and
+    ///   restamps at its own boundary.
+    /// - **A `template:` key is written on the copy** with an order appended after the existing user
+    ///   templates, overwriting a stale one the board carried in from its own instantiation.
+    /// - **Store collisions auto-rename, Finder-style**, never overwrite and never refuse
+    ///   (`BoardDuplicator.uncollidedURL(named:extension:in:)`, the ladder Duplicate seeds
+    ///   differently).
+    ///
+    /// **The close flush is the caller's**, not this function's: it needs a window session, and 09
+    /// states the rule where the command lives (`SaveAsTemplateCommand`, mirroring Duplicate's
+    /// sequence exactly).
+    ///
+    /// `isCancelled` is read between items and nowhere else — `BoardDuplicator`'s seam, and the
+    /// in-progress row's Cancel at the other end of it. Cancelled or failed, the partial store entry
+    /// goes: nothing was there before, so there is no true state for a half-copied template to be.
+    @discardableResult
+    static func saveAsTemplate(
+        boardAt rootURL: URL,
+        titled title: String?,
+        into store: URL = userStore,
+        isCancelled: () -> Bool = { Task.isCancelled }
+    ) throws(Failure) -> URL {
+        let operation = WriteOperation.saveAsTemplate(title: title)
+
+        func failure(at url: URL, _ message: String) -> Failure {
+            .failed(BoardWriteError(operation: operation, path: url.path, reason: .io(message: message)))
+        }
+
+        // The store is minted here — first save, first folder.
+        do {
+            try createUserStore(at: store)
+        } catch {
+            throw failure(at: store, "could not create the templates folder: \(error.localizedDescription)")
+        }
+
+        // **Read before the copy lands**, so the scan that decides "after the existing user
+        // templates" cannot see the template being appended and count it as existing.
+        let order = nextUserOrder(in: store)
+
+        let destination = BoardDuplicator.uncollidedURL(
+            named: rootURL.deletingPathExtension().lastPathComponent,
+            extension: rootURL.pathExtension,
+            in: store
+        )
+
+        // Cancelled before it began is still cancelled — answered before anything is created.
+        if isCancelled() { throw .cancelled }
+
+        do {
+            try BoardTreeCopy.createDirectory(at: destination)
+        } catch {
+            throw failure(at: destination, "could not create the template folder: \(error.localizedDescription)")
+        }
+
+        do {
+            try copyBoard(at: rootURL, into: destination, operation: operation, isCancelled: isCancelled)
+            try stampTemplateKey(at: destination, order: order, operation: operation)
+        } catch {
+            // The ladder made this name and this call made this folder, so removing it destroys
+            // nothing that was the user's — the instantiation cleanup's reasoning, at the store.
+            try? FileManager.default.removeItem(at: destination)
+            throw error
+        }
+
+        return destination
+    }
+
+    /// The copy half of a save: the board's tree minus the two exclusions.
+    ///
+    /// **Folder attributes are not carried** (unlike Duplicate, which forks them). The store is
+    /// specified as "plain board folders, hand-editable and agent-writable" (09 ▸ Storage), and the
+    /// one lock Save as Template stays live under is the *unwritable-location* one — a board on a
+    /// read-only DMG being archived (02-architecture.md ▸ Live-reload resilience). Carrying that
+    /// board's mode bits inward would mint a read-only template in the user's own store, which is
+    /// precisely the thing the store is not. Folder timestamps go with them and are inert: the
+    /// timestamps 09 keeps are the frontmatter's, and those ride inside files copied byte for byte.
+    private static func copyBoard(
+        at rootURL: URL,
+        into destination: URL,
+        operation: WriteOperation,
+        isCancelled: () -> Bool
+    ) throws(Failure) {
+        do throws(BoardTreeCopy.Stop) {
+            try BoardTreeCopy.copy(
+                contentsOf: rootURL,
+                into: destination,
+                excludingTopLevel: [BoardLoader.trashFolderName, ".git"],
+                carryingFolderAttributes: false,
+                isCancelled: isCancelled
+            )
+        } catch {
+            switch error {
+            case .cancelled:
+                throw .cancelled
+            case let .failed(url, underlying):
+                throw .failed(BoardWriteError(
+                    operation: operation,
+                    path: url.path,
+                    reason: .io(message: "could not copy the board: \(underlying.localizedDescription)")
+                ))
+            }
+        }
+    }
+
+    /// Writes `template: {order: N}` on the copy's own `index.md`, through the Writer's ordinary
+    /// `updateIndex` — the round-trip guarantee, the unknown-key preservation and the atomic replace
+    /// all come along, and the body (the board's description, which is about to be the chooser's
+    /// blurb) is never rewritten.
+    ///
+    /// ### On the copy, after it lands
+    ///
+    /// The only alternative — stamping the source board and copying the result — would write a
+    /// `template:` key into the user's *board*, which is not what was asked for. So the write
+    /// happens here, on a tree that is already in the store, and it needs **no write bracket**:
+    /// brackets exist to keep a watched board's live snapshot honest (02-architecture.md), and this
+    /// path is outside every watched board — the store is not watched and the source was only read.
+    ///
+    /// ### The whole mapping is rewritten, and that is 09's shape
+    ///
+    /// "**`order` (display position in the chooser) is its only subkey**" (09 ▸ Definition format),
+    /// so replacing the mapping loses nothing that can exist today; a stale order from the board's
+    /// own instantiation is overwritten, which is exactly what 09 asks for. If the key ever grows a
+    /// second subkey, this is the one place that has to learn to merge — nowhere else writes it.
+    private static func stampTemplateKey(
+        at root: URL,
+        order: Double,
+        operation: WriteOperation
+    ) throws(Failure) {
+        do throws(BoardWriteError) {
+            try BoardWriter.updateIndex(inItemFolder: root, kind: .board, operation: operation) { document in
+                document.set(BoardLoader.templateKey, to: .raw("{order: \(orderText(order))}"))
+            }
+        } catch {
+            throw .failed(error)
+        }
+    }
+
+    /// `100` rather than `100.0` for a whole number, so the file reads like the bundled templates'
+    /// own `template: {order: 100}` — the same rounding `FrontmatterValue` applies to a `.double`.
+    private static func orderText(_ order: Double) -> String {
+        order == order.rounded() && abs(order) < 1e15 ? String(Int64(order)) : String(order)
+    }
+
+    // MARK: - Naming
+
+    /// The document name behind a chosen URL — `~/Boards/Roadmap.kanban` → `Roadmap`.
+    ///
+    /// An extension-less name is as legal a board as a `.kanban` one (01-storage-format.md
+    /// § Document packaging, "Extension-less board folders still open"), so the extension is
+    /// stripped rather than required.
+    static func documentName(of destination: URL) -> String {
+        destination.deletingPathExtension().lastPathComponent
+    }
+
+    /// The save panel's suggested file name for a template — "seed the save panel's suggested name
+    /// from the template title" (09 ▸ Instantiation), with the package extension on the end so the
+    /// board is created as a `.kanban` document by default.
+    static func suggestedFileName(for template: BoardTemplate) -> String {
+        "\(template.name).kanban"
+    }
+}

Kanban/App/UITestLaunch.swift

@@ -0,0 +1,635 @@
+import Foundation
+import os
+
+// MARK: - The launch plan
+
+/// What the app does with its first run-loop turn — decided once, in `KanbanApp.init()`, and never
+/// re-derived (02-architecture.md § Launch and window lifecycle).
+///
+/// It exists because there are now **three** answers to "which window appears at launch", not two:
+/// welcome, the registry's restoration pass, and — for the accessibility audit suite
+/// (10-accessibility.md ▸ Verification) — a synthetic board the app builds for itself. A `Bool` held
+/// two of them; a third would have meant two booleans and an implicit precedence between them, which
+/// is exactly the shape that grows a launch bug nobody can reproduce.
+///
+/// The decision is a pure function of three facts, so it is provable without a `UserDefaults` domain,
+/// a live registry, or a running app — `AppModel.shouldRestoreAtLaunch`'s own reason for being pulled
+/// out of `App.init` in the first place, applied one level up.
+enum LaunchPlan: Equatable, Sendable {
+
+    /// Nothing to restore and no fixture asked for: the welcome window, which is the ordinary
+    /// first-launch and tidied-away case.
+    case welcome
+
+    /// The registry's flagged boards reopen (`BoardRegistry.restorables()`).
+    case restoreBoards
+
+    /// The UI-test fixture board is built and opened. See `UITestLaunch`.
+    case uiTestFixture
+
+    /// **The fixture wins outright**, and that is the whole precedence rule: a UI-test launch must
+    /// never reopen the developer's own boards, both because the audit needs a board whose contents
+    /// the test knows and because a test run has no business touching real documents.
+    static func decide(
+        isUITestFixtureLaunch: Bool,
+        restorePreference: Bool,
+        hasRestorables: Bool
+    ) -> LaunchPlan {
+        if isUITestFixtureLaunch { return .uiTestFixture }
+        return AppModel.shouldRestoreAtLaunch(
+            preference: restorePreference,
+            hasRestorables: hasRestorables
+        ) ? .restoreBoards : .welcome
+    }
+
+}
+
+// MARK: - UITestLaunch
+
+/// **The UI suites' boards**, and the launch arguments that ask for them — the accessibility audit's
+/// fixture (10-accessibility.md ▸ Verification: "Xcode's accessibility audit … runs in UI tests over
+/// every surface — board (trash shown and hidden), card window (Preview, Edit, raw source), welcome,
+/// template chooser, board popover") and, since the end-to-end pass, two more shapes that the audit
+/// never needed: a **large** board for reflow and launch cost, and a **malformed** one whose only job
+/// is to fail to load.
+///
+/// ### Why the app builds the board instead of being handed one
+///
+/// The obvious shape — the UI test writes a board to a temp folder and passes its path — **cannot
+/// work here, and the reason is the sandbox**. `Kanban.entitlements` grants
+/// `files.user-selected.read-write` and nothing else, so a path arriving on the command line is a
+/// path the app may not read: there is no open panel behind it and no bookmark for it. The app can
+/// only reach files it was granted, files it ships, and its own container.
+///
+/// So the flag carries no payload and the app builds the board **inside its own container**
+/// (`NSTemporaryDirectory()`, which sandboxes to `…/Containers/dev.rzen.indie.Kanban/Data/tmp`),
+/// through the ordinary `BoardWriter` — the app's single write door (02-architecture.md § Layering).
+/// Nothing here knows the storage format: it calls `createBoard`, `createLane`, `createCard`,
+/// `writeBody`, `importAttachments` and `deleteCardToTrash` exactly as the board window does, so the
+/// fixture is a board the app made, not a board a test file *believes* is well-formed. A format
+/// change that broke this would break the app first.
+///
+/// **The one deliberate exception is the malformed variant**, which builds its board through the very
+/// same door and then overwrites exactly one card's `index.md` with raw bytes. That write is the
+/// point of the variant — there is no Writer call that produces an unparseable file, and there should
+/// not be one — and it happens *last*, so everything around the broken file is still a board the app
+/// made.
+///
+/// ### It is inert without the flag
+///
+/// Every entry point below is reached only from `LaunchPlan.uiTestFixture`, and that case is reached
+/// only when `--ui-test-fixture-board` is on the command line. No document open, no URL scheme and no
+/// menu item can produce it; a shipped app never runs a line of this. It is compiled into the release
+/// binary anyway rather than hidden behind `#if DEBUG`, because the thing being audited must be the
+/// app that ships — an accessibility pass over a differently-compiled binary is a pass over a
+/// different app.
+///
+/// ### What the flag also switches off
+///
+/// **The registry and the clipboard's staging store move into the scratch directory** with the board.
+/// Without that, every audit run would stamp a temp folder into the user's real recents list
+/// (`BoardRegistry.defaultStorageURL`), where it would sit for good as an unavailable row pointing at a
+/// directory that no longer exists — and its launch sweep would collect the user's real staged copy
+/// (`ClipboardStore.defaultStagingRoot`). Tying them to the same flag rather than to separate
+/// arguments is deliberate: they are one decision — "this launch is synthetic" — and a second argument
+/// is a second chance to apply only half of it.
+///
+/// The honest residual: `UserDefaults` is **not** redirected, so an audit run can still write the
+/// three app-wide scalars (`AppPreferences`) into the real domain. They are a window size, a restore
+/// toggle this launch never consults, and the quick-style recents list — no documents, nothing
+/// destructive, and redirecting a defaults domain from inside the process is not something the
+/// platform actually supports. It is stated rather than fixed.
+enum UITestLaunch {
+
+    private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "ui-test-launch")
+
+    // MARK: - The flag
+
+    /// The launch argument every UI suite passes (`KanbanUITests/UITestSupport.swift`), on its own or
+    /// beside a variant flag. It means "this launch is synthetic" and nothing narrower — which board
+    /// is `FixtureVariant`'s to say.
+    ///
+    /// `--`-prefixed on purpose: a single-dash `-key value` pair is swallowed by `UserDefaults`'
+    /// `NSArgumentDomain` and would silently become a preference, which is precisely the kind of
+    /// side effect a test-only switch must not have.
+    static let fixtureFlag = "--ui-test-fixture-board"
+
+    /// Whether `arguments` asks for a fixture board — **pure**, so the rule is pinned by
+    /// `UITestLaunchTests` rather than by launching an app and looking.
+    ///
+    /// Exact match, not a prefix: `--ui-test-fixture-boards-elsewhere` is not this flag, and a
+    /// `hasPrefix` check that accepted it would be a launch switch with a fuzzy edge. That is also
+    /// why the variants below wear *sibling* flags rather than a `=value` suffix or a
+    /// `--flag value` pair — a suffix would demand exactly the prefix matching this rules out, and a
+    /// pair is the shape `NSArgumentDomain` swallows.
+    ///
+    /// **A variant flag on its own is enough**, which is belt over braces rather than a second
+    /// spelling: every call site passes `fixtureFlag` too (it is what "this launch is synthetic"
+    /// means), but a test bundle that passed only `--ui-test-fixture-large` must not get a launch
+    /// that reopens the developer's real boards into a scratch registry's blind spot.
+    static func isFixtureLaunch(arguments: [String]) -> Bool {
+        arguments.contains(fixtureFlag)
+            || FixtureVariant.allCases.contains { arguments.contains($0.flag) }
+    }
+
+    /// The running process's answer to the same question.
+    static var isFixtureLaunch: Bool {
+        isFixtureLaunch(arguments: ProcessInfo.processInfo.arguments)
+    }
+
+    // MARK: - The variants
+
+    /// **Which fixture board a launch asks for.** Three shapes, because the three suites that consume
+    /// them are asking three different questions:
+    ///
+    /// - `standard` — the audit's board (three lanes, six cards, a rich card, a trashed card). It is
+    ///   also the end-to-end suite's board: every golden flow is expressed against a shape small
+    ///   enough to state in a sentence, so an assertion about a lane's card count is readable.
+    /// - `large` — many lanes × many cards, for the masonry, the reflow, and the launch-cost
+    ///   measurements. Nothing about it is *interesting*; the point is that there is a lot of it.
+    /// - `malformed` — a well-formed board with exactly one unparseable card `index.md`, for the
+    ///   fail-fast pass (01-storage-format.md § Malformed input). It is the only variant whose
+    ///   *successful* materialization is expected to produce a *failed* load.
+    ///
+    /// The raw value is the flag's tail, so the flag and the case can never drift; the flag is
+    /// double-dashed for `fixtureFlag`'s reason and exact-matched for its reason too.
+    enum FixtureVariant: String, CaseIterable, Sendable {
+        case standard
+        case large
+        case malformed
+
+        /// The launch argument naming this variant. Paired with `fixtureFlag` at every call site.
+        var flag: String { "--ui-test-fixture-\(rawValue)" }
+
+        /// The board's title — and, through `fixtureBoardURL(for:)`, its folder name and its window
+        /// title, so a test can wait on `app.windows["Audit Board"]` and its neighbours.
+        ///
+        /// Distinct per variant on purpose: a suite that waited on the wrong title would otherwise
+        /// pass against the wrong board, and the malformed variant's whole assertion is that *no*
+        /// window by its name ever appears.
+        var boardTitle: String {
+            switch self {
+            case .standard: UITestLaunch.boardTitle
+            case .large: "Large Board"
+            case .malformed: "Malformed Board"
+            }
+        }
+    }
+
+    /// The variant `arguments` asks for — `standard` when none is named, which is what the audit
+    /// suite's bare `--ui-test-fixture-board` has always meant.
+    ///
+    /// **Declaration order breaks a tie**, so a launch naming two variants is deterministic rather
+    /// than dependent on argument order. Nothing produces that today; stating the rule is cheaper
+    /// than discovering it.
+    static func variant(arguments: [String]) -> FixtureVariant {
+        FixtureVariant.allCases.first { arguments.contains($0.flag) } ?? .standard
+    }
+
+    /// The running process's answer to the same question.
+    static var variant: FixtureVariant {
+        variant(arguments: ProcessInfo.processInfo.arguments)
+    }
+
+    // MARK: - The scratch directory
+
+    /// Everything a fixture launch writes, under one removable root inside the app's container.
+    ///
+    /// One folder rather than two loose paths so `prepareScratchDirectory()` can promise a clean
+    /// start with a single `removeItem` — a fixture board and a registry that disagreed about which
+    /// run they belonged to would be worse than either being stale.
+    static var scratchRoot: URL {
+        URL(fileURLWithPath: NSTemporaryDirectory(), isDirectory: true)
+            .appendingPathComponent("LaneworkUITestFixture", isDirectory: true)
+    }
+
+    /// Where the fixture launch's registry lives — beside the board rather than in Application
+    /// Support, which is the whole point (see the type's note).
+    static var registryStorageURL: URL {
+        scratchRoot.appendingPathComponent("board-registry.json", isDirectory: false)
+    }
+
+    /// Where the fixture launch's clipboard snapshots live, on the registry's terms: an audit run's
+    /// launch sweep would otherwise collect the developer's own staged copy. Redirected by the same
+    /// flag, because it is the same one decision.
+    static var clipboardStagingRoot: URL {
+        scratchRoot.appendingPathComponent("Clipboard", isDirectory: true)
+    }
+
+    /// A fixture board's own folder. `.kanban`-suffixed because a board the app made through the
+    /// ordinary create path is a document, and the audit should be looking at the shape a user's
+    /// board actually has (01-storage-format.md § Document packaging).
+    ///
+    /// One folder per variant, all under the one scratch root: the root is wiped per launch anyway,
+    /// so the separation buys nothing at runtime — it buys a *name*, which is what a suite waits on.
+    static func fixtureBoardURL(for variant: FixtureVariant) -> URL {
+        scratchRoot.appendingPathComponent("\(variant.boardTitle).kanban", isDirectory: true)
+    }
+
+    /// The audit fixture's folder — `fixtureBoardURL(for: .standard)`, kept as a name because that
+    /// board is the one every caller predating the variants meant.
+    static var fixtureBoardURL: URL {
+        fixtureBoardURL(for: .standard)
+    }
+
+    /// Wipes and recreates the scratch root, and answers the registry URL for the caller's convenience.
+    /// Called once, from `KanbanApp.init()`, **before** the model reads its registry — which is also why
+    /// the return value is discardable: that caller now names both redirected homes explicitly
+    /// (`registryStorageURL`, `clipboardStagingRoot`) rather than taking one of them from here.
+    ///
+    /// **Wiped rather than reused**: every audit test launches its own app instance, and an audit is
+    /// only meaningful against a board whose contents the test knows — a previous run's leftovers
+    /// (a card the test deleted, a lane it renamed) would make the next run's tree something nobody
+    /// wrote down. Removal failures are logged and swallowed: the create below will fail loudly and
+    /// visibly on welcome if the directory is genuinely unusable, and there is no launch this early
+    /// that an alert could belong to.
+    @discardableResult
+    static func prepareScratchDirectory() -> URL {
+        let root = scratchRoot
+        do {
+            try FileManager.default.removeItem(at: root)
+        } catch CocoaError.fileNoSuchFile {
+            // The ordinary first-run case, not a failure.
+        } catch {
+            logger.error("could not clear the UI-test scratch directory: \(error.localizedDescription, privacy: .public)")
+        }
+        do {
+            try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+        } catch {
+            logger.error("could not create the UI-test scratch directory: \(error.localizedDescription, privacy: .public)")
+        }
+        return registryStorageURL
+    }
+
+    // MARK: - The standard board's shape
+
+    /// The standard board's title — and, through `fixtureBoardURL`, its folder name and its window
+    /// title, so a test can wait on `app.windows["Audit Board"]`.
+    static let boardTitle = "Audit Board"
+
+    /// The lane titles, in board order. Three because the tree the audit walks should have more than
+    /// one container to walk *between*, and because the smoke script's cut-and-paste step needs a
+    /// destination lane that is not the source.
+    static let laneTitles = ["To Do", "Doing", "Done"]
+
+    /// The card titles, per lane, in card order.
+    ///
+    /// **The first lane is deliberately the crowded one.** Two of the audit's riskiest claims are
+    /// about a lane wide enough to lay its cards out in interior masonry columns — that VoiceOver
+    /// reads them by `order` and not column-major (10-accessibility.md ▸ Logical order), and that the
+    /// `accessibilitySortPriority`-inside-a-`Layout` mechanism holding that up actually survives — and
+    /// neither is observable in a lane with one card in it.
+    static let cardTitles: [[String]] = [
+        ["Draft the release notes", "Check the trash grammar", "Confirm the rotor jumps", "Ship the audit"],
+        ["Write the smoke script"],
+        ["Wire the launch fixture"],
+    ]
+
+    /// The card that gets the rich body, named by `(lane, card)` index — the one the card-window
+    /// audits open.
+    ///
+    /// It carries the structures 10-accessibility.md makes claims about ("Preview renders to the
+    /// accessibility tree as structured text — headings navigable by rotor, lists and tables read as
+    /// such; task-list checkboxes are real accessible checkboxes"), so the Preview audit has
+    /// something to audit and the Edit and raw-source audits open a document with real content in it
+    /// rather than an empty text view.
+    static let richCardIndex = (lane: 1, card: 0)
+
+    /// The rich card's body. Every element in it is one 10-accessibility.md names: two heading
+    /// levels for the rotor, a bulleted list, a task list (live checkboxes), a table, a fenced code
+    /// block, a link, and an image with alt text ("body images use Markdown alt text when present,
+    /// else the filename" — the file need not exist for the alt text to be the thing under audit).
+    static let richCardBody = """
+        ## What this card is for
+
+        It is the accessibility audit's specimen: every structure 10-accessibility.md makes a claim \
+        about appears once, so Preview has something to render into the tree.
+
+        ### Structures
+
+        - A bulleted list item
+        - A second one, with a [link](https://example.com) in it
+
+        - [ ] An unchecked task
+        - [x] A checked task
+
+        | Surface | Audited |
+        | --- | --- |
+        | Board | Yes |
+        | Card window | Yes |
+
+        ```swift
+        let audit = try app.performAccessibilityAudit()
+        ```
+
+        ![A diagram of the board's accessibility tree](attachments/tree.png)
+        """
+
+    /// The attachment the rich card carries, so the card face shows a paperclip, the card element's
+    /// value says "1 attachment" (`AccessibilityPhrases.cardValue`), and the card window's sidebar
+    /// has a real attachment row to audit.
+    static let attachmentName = "notes.txt"
+
+    private static let attachmentBody = """
+        The audit fixture's attachment. Its only job is to exist, so the attachments section has a row.
+        """
+
+    /// **The rich card's comment thread** — three comments, because the pane's accessibility audit
+    /// needs one of each shape 10-accessibility.md's comments row can take (▸ Comments: "each comment
+    /// is one flattened element — author, date, edited state, body").
+    ///
+    /// In order: an ordinary comment (author line, date, body), an **authorless** one (the date alone
+    /// carries the line — "missing renders unattributed", and no placeholder stands in for a name),
+    /// and one that has been **edited** (its author line ends "· edited", which is `modified`
+    /// differing from `created` and no extra field). Between them they cover every branch of
+    /// `CommentAuthorLine.text(author:timestamp:isEdited:)` that a written file can produce.
+    static let commentBodies = [
+        """
+        The audit's specimen thread. This one is ordinary: a name, a date, and a paragraph of \
+        Markdown with some *emphasis* in it.
+        """,
+        """
+        This one has no `author` key at all, so it renders unattributed — a date and a body, and no \
+        placeholder standing in for a name.
+        """,
+        """
+        And this one has been edited since it was posted, so its author line carries the edited marker.
+        """
+    ]
+
+    /// Which comment gets its `author` key removed, by index into `commentBodies`.
+    static let authorlessCommentIndex = 1
+
+    /// Which comment is edited after posting, by index into `commentBodies`, and what it is edited to.
+    static let editedCommentIndex = 2
+
+    static let editedCommentBody = """
+        And this one has been edited since it was posted, so its author line carries the edited \
+        marker — this sentence is the edit.
+        """
+
+    /// The card that is deleted into `.trash/`, named by `(lane, card)` index.
+    ///
+    /// A trash with something in it is the only way the trash-shown audit reaches the elements
+    /// 10-accessibility.md specifies for it — ordinary card elements whose context menu offers Delete
+    /// and Reveal in Finder and never Open. An empty column audits its own label and stops there.
+    static let trashedCardIndex = (lane: 0, card: 1)
+
+    // MARK: - The large board's shape
+
+    /// The large board's lanes and cards — **8 × 40**, which is 320 cards.
+    ///
+    /// The numbers are a budget, not a maximum. They are large enough that the two things the large
+    /// board exists to exercise actually happen — a lane wide enough to lay out in several interior
+    /// masonry columns has plenty to lay out, and the board's reflow, scrolling and select-all all
+    /// have real work to do — and small enough that materializing it (a folder and an `index.md` per
+    /// card, through the ordinary Writer) stays in the seconds a UI test can afford. Raising them is
+    /// a decision about how long every performance run takes; they are stated here so that decision
+    /// is made in one place.
+    static let largeLaneCount = 8
+    static let largeCardsPerLane = 40
+
+    static func largeLaneTitle(_ index: Int) -> String {
+        "Lane \(index + 1)"
+    }
+
+    /// A large-board card's title — unique across the whole board, and **deliberately of four
+    /// different lengths**.
+    ///
+    /// A wall of identical one-line cards would lay out as a perfect grid, which is exactly the case
+    /// masonry has nothing to do. Cycling the length gives the layout genuinely different card
+    /// heights to balance, so a reflow measured against this board is measuring the work the real
+    /// algorithm does.
+    static func largeCardTitle(lane laneIndex: Int, card cardIndex: Int) -> String {
+        let base = "Card \(laneIndex + 1)-\(cardIndex + 1)"
+        let tail = String(repeating: " with a longer title that wraps", count: cardIndex % 4)
+        return base + tail
+    }
+
+    // MARK: - The malformed board's shape
+
+    /// The malformed board's lanes and cards — small, because nothing about this variant is about
+    /// size. Two lanes so the tree has a shape at all, and two cards in the first so the broken one
+    /// has an intact sibling the loader walked past on its way to it.
+    static let malformedLaneTitles = ["Intact", "Also intact"]
+
+    static let malformedCardTitles: [[String]] = [
+        ["A good card", "The malformed card"],
+        ["Another good card"],
+    ]
+
+    /// Which card gets the raw overwrite, named by `(lane, card)` index.
+    static let malformedCardIndex = (lane: 0, card: 1)
+
+    /// A string appearing only in the malformed file, so a test can *find* that file on disk without
+    /// knowing the UUID the Writer minted for it — and then assert its bytes are exactly what were
+    /// written, which is the "nothing was silently repaired" half of fail-fast.
+    static let malformationMarker = "lanework-ui-test-malformed-fixture"
+
+    /// The bytes written over the doomed card's `index.md`.
+    ///
+    /// **The frontmatter opens a flow sequence and never closes it**, so the YAML between the
+    /// delimiters cannot parse — `BoardLoader` rejects the whole board with `.unparseableYAML` naming
+    /// this file, which is the failure the fail-fast pass is about. Everything else in the file is
+    /// well-formed on purpose: the delimiters are there, the body is ordinary text, and the two
+    /// required fields are present in spirit. The one thing wrong with it is the one thing under
+    /// test.
+    static let malformedIndexText = """
+        ---
+        schema: 1
+        title: The malformed card
+        order: [1024
+        ---
+
+        \(malformationMarker): this card's frontmatter opens a flow sequence and never closes it.
+        The loader must reject the whole board rather than repair, skip, or rewrite anything — and
+        these bytes must still be here, unchanged, after the app has refused to open the board.
+        """
+
+    // MARK: - Materialization
+
+    /// Builds the fixture board `variant` asks for and answers its URL — every write through
+    /// `BoardWriter`, in the order a user would have produced them, with the malformed variant's one
+    /// raw overwrite as the documented exception (see this type's note).
+    ///
+    /// Called from `RestoreBootstrapView` rather than from `KanbanApp.init()`: it is filesystem work,
+    /// and the launch path already has a place for filesystem work that has to happen before the
+    /// first real window (that view's whole reason for existing). A throw surfaces as a launch
+    /// failure on welcome — the same treatment a board that fails to restore gets — so a broken
+    /// fixture is visible rather than a suite that quietly audits an empty screen.
+    ///
+    /// **The malformed variant does not throw here.** Building it succeeds; *loading* it is what
+    /// fails, one layer up, through the ordinary board-window path — which is the whole point, since
+    /// a fixture that failed to build would surface a message about the fixture rather than the
+    /// loader's own sentence about the offending file.
+    static func materializeFixtureBoard(_ variant: FixtureVariant = .standard) throws -> URL {
+        switch variant {
+        case .standard: try materializeStandardBoard()
+        case .large: try materializeLargeBoard()
+        case .malformed: try materializeMalformedBoard()
+        }
+    }
+
+    /// The audit suite's board (see `boardTitle` and the constants above it).
+    private static func materializeStandardBoard() throws -> URL {
+        let root = fixtureBoardURL(for: .standard)
+        try BoardWriter.createBoard(at: root, title: boardTitle)
+
+        var laneURLs: [URL] = []
+        for title in laneTitles {
+            let id = try BoardWriter.createLane(inBoard: root, title: title)
+            laneURLs.append(root.appendingPathComponent(id.rawValue, isDirectory: true))
+        }
+
+        var cardURLs: [[URL]] = []
+        for (laneIndex, titles) in cardTitles.enumerated() {
+            var lane: [URL] = []
+            for title in titles {
+                let id = try BoardWriter.createCard(inLane: laneURLs[laneIndex], title: title)
+                lane.append(laneURLs[laneIndex].appendingPathComponent(id.rawValue, isDirectory: true))
+            }
+            cardURLs.append(lane)
+        }
+
+        let richCard = cardURLs[richCardIndex.lane][richCardIndex.card]
+        try BoardWriter.writeBody(inItemFolder: richCard, body: richCardBody)
+        try importFixtureAttachment(into: richCard)
+        try seedCommentThread(into: richCard, cardTitle: cardTitles[richCardIndex.lane][richCardIndex.card])
+
+        // The delete goes last so the trashed card's identity is one the lanes above have already
+        // finished with — and through the ordinary delete door, so `.trash/` ends up holding exactly
+        // what a user's ⌘⌫ would have put there: the `modified` stamp that positions it, its `order`
+        // riding along untouched.
+        let doomed = cardURLs[trashedCardIndex.lane][trashedCardIndex.card]
+        try BoardWriter.deleteCardToTrash(at: doomed, inBoard: root)
+
+        return root
+    }
+
+    /// The performance suite's board — `largeLaneCount` lanes of `largeCardsPerLane` cards, built
+    /// through the same three Writer calls the standard board uses and nothing else.
+    ///
+    /// No rich body, no attachment, no trashed card: every one of those is a *feature* the audit
+    /// wanted a specimen of, and this board is not about features. What it is about is quantity, and
+    /// quantity is the only thing that differs.
+    private static func materializeLargeBoard() throws -> URL {
+        let root = fixtureBoardURL(for: .large)
+        try BoardWriter.createBoard(at: root, title: FixtureVariant.large.boardTitle)
+
+        for laneIndex in 0 ..< largeLaneCount {
+            let laneID = try BoardWriter.createLane(inBoard: root, title: largeLaneTitle(laneIndex))
+            let laneURL = root.appendingPathComponent(laneID.rawValue, isDirectory: true)
+            for cardIndex in 0 ..< largeCardsPerLane {
+                _ = try BoardWriter.createCard(
+                    inLane: laneURL,
+                    title: largeCardTitle(lane: laneIndex, card: cardIndex)
+                )
+            }
+        }
+
+        return root
+    }
+
+    /// The fail-fast suite's board: an ordinary small board, with one card's `index.md` overwritten
+    /// by `malformedIndexText` **after** every Writer call has finished.
+    ///
+    /// The order is the whole design. Building first means the board around the broken file is one
+    /// the app made — right frontmatter, right ranks, right stamps — so the load that follows fails
+    /// for exactly one reason and the loader's sentence names exactly one file. Overwriting first, or
+    /// hand-writing the tree, would have produced a board whose *many* problems the loader would
+    /// report whichever it reached first.
+    ///
+    /// The write is `Data.write`, not `BoardWriter.atomicReplace`: the Writer refuses to produce a
+    /// file its own loader would reject, which is a guarantee worth keeping rather than a door worth
+    /// opening. This is the one place in the app that goes around it, and it is unreachable without
+    /// the launch flag.
+    private static func materializeMalformedBoard() throws -> URL {
+        let root = fixtureBoardURL(for: .malformed)
+        try BoardWriter.createBoard(at: root, title: FixtureVariant.malformed.boardTitle)
+
+        var cardURLs: [[URL]] = []
+        for (laneIndex, laneTitle) in malformedLaneTitles.enumerated() {
+            let laneID = try BoardWriter.createLane(inBoard: root, title: laneTitle)
+            let laneURL = root.appendingPathComponent(laneID.rawValue, isDirectory: true)
+            var lane: [URL] = []
+            for title in malformedCardTitles[laneIndex] {
+                let cardID = try BoardWriter.createCard(inLane: laneURL, title: title)
+                lane.append(laneURL.appendingPathComponent(cardID.rawValue, isDirectory: true))
+            }
+            cardURLs.append(lane)
+        }
+
+        let doomed = cardURLs[malformedCardIndex.lane][malformedCardIndex.card]
+            .appendingPathComponent(BoardLoader.indexFileName, isDirectory: false)
+        try Data(malformedIndexText.utf8).write(to: doomed, options: .atomic)
+
+        return root
+    }
+
+    /// Builds the rich card's thread **the way the composer does** — a draft saved, then posted, once
+    /// per body — so the fixture's `comments/` is a folder the app made: minted identities, the
+    /// `kind: comment` field table, `created`/`modified` restamped at the post.
+    ///
+    /// Two of the three then need a shape no gesture in the app produces, and each is applied
+    /// afterwards, narrowly:
+    ///
+    /// - **The edit** is an ordinary Writer call (`editComment`), which is exactly what an inline edit
+    ///   session's save does — so the edited marker in the fixture is the real mechanism, not a
+    ///   hand-set field.
+    /// - **The two frontmatter amendments** are raw writes, for the malformed variant's reason (see
+    ///   this type's note). Neither shape has a door in the app: it always writes the account's full
+    ///   name, and it cannot post a comment an hour ago. Both shapes are ordinary on disk, though —
+    ///   agents and tracker sync write comments with no `author` at all (01-storage-format.md ▸
+    ///   Enhanced schema), and every comment that has ever been edited was posted before it. Both go
+    ///   through `FrontmatterDocument`, so the rest of each file is byte-identical to what the Writer
+    ///   produced.
+    ///
+    /// The backdating is not decoration: `created` and `modified` serialize to the second, and a
+    /// comment posted and edited inside one second would render as **not** edited — the marker is
+    /// `modified` differing from `created` and no extra field (`Comment.isEdited`).
+    private static func seedCommentThread(into cardFolder: URL, cardTitle: String) throws {
+        var posted: [ItemID] = []
+        for body in commentBodies {
+            try BoardWriter.saveCommentDraft(inCard: cardFolder, body: body, cardTitle: cardTitle)
+            posted.append(try BoardWriter.postComment(inCard: cardFolder, cardTitle: cardTitle).id)
+        }
+
+        try BoardWriter.editComment(
+            at: CommentThread.commentFolder(posted[editedCommentIndex], inCard: cardFolder),
+            body: editedCommentBody,
+            cardTitle: cardTitle
+        )
+
+        try amendComment(posted[authorlessCommentIndex], inCard: cardFolder) { document in
+            document.remove(FrontmatterKeys.author)
+        }
+        try amendComment(posted[editedCommentIndex], inCard: cardFolder) { document in
+            document.set(FrontmatterKeys.created, to: .date(Date().addingTimeInterval(-3600)))
+        }
+    }
+
+    /// One comment's frontmatter, amended in place — the fixture's narrow way around the Writer, kept
+    /// to one function so both amendments share its round trip and neither invents a second one.
+    private static func amendComment(
+        _ id: ItemID,
+        inCard cardFolder: URL,
+        _ amend: (inout FrontmatterDocument) -> Void
+    ) throws {
+        let indexURL = CommentThread
+            .commentFolder(id, inCard: cardFolder)
+            .appendingPathComponent(BoardLoader.indexFileName, isDirectory: false)
+        var document = try FrontmatterDocument.parse(String(decoding: try Data(contentsOf: indexURL), as: UTF8.self))
+        amend(&document)
+        try Data(document.serialized().utf8).write(to: indexURL, options: .atomic)
+    }
+
+    /// Writes the attachment's source into the scratch root and imports it the way a Finder drop
+    /// would (`BoardWriter.importAttachments`), so the card ends up with a real `attachments/`
+    /// folder rather than a hand-placed file the loader would have to normalize.
+    private static func importFixtureAttachment(into cardFolder: URL) throws {
+        let source = scratchRoot.appendingPathComponent(attachmentName, isDirectory: false)
+        try attachmentBody.write(to: source, atomically: true, encoding: .utf8)
+        _ = try BoardWriter.importAttachments([source], intoCard: cardFolder)
+        try? FileManager.default.removeItem(at: source)
+    }
+}

Kanban/App/WelcomeView.swift

@@ -38,6 +38,20 @@ struct WelcomeView: View {
     /// Whether the recents list holds the keyboard, so Return can mean "open the selected row".
     @FocusState private var listFocused: Bool
 
+    // MARK: - Geometry
+    //
+    // Every figure this window lays out on, as a multiple of the body font — `BoardMetrics`' rule
+    // applied to the welcome window (10-accessibility.md ▸ Text scaling & visual accommodations). At
+    // the standard 13pt body they reproduce the numbers welcome has always drawn.
+
+    @MainActor static var pointSize: CGFloat { BoardMetrics.bodyPointSize }
+
+    @MainActor static var brandingColumnWidth: CGFloat { BoardMetrics.em(23, bodyPointSize: pointSize) }
+    @MainActor static var brandingInset: CGFloat { BoardMetrics.em(2.5, bodyPointSize: pointSize) }
+    @MainActor static var appIconSide: CGFloat { BoardMetrics.em(7.4, bodyPointSize: pointSize) }
+    @MainActor static var minimumWidth: CGFloat { BoardMetrics.em(58.5, bodyPointSize: pointSize) }
+    @MainActor static var minimumHeight: CGFloat { BoardMetrics.em(35.4, bodyPointSize: pointSize) }
+
     private var derivation: WelcomeRow.Derivation {
         WelcomeRow.derive(recents: appModel.recents, failures: appModel.launchFailures)
     }
@@ -49,16 +63,20 @@ struct WelcomeView: View {
     var body: some View {
         HStack(spacing: 0) {
             branding
-                .frame(width: 300)
+                .frame(width: Self.brandingColumnWidth)
                 .frame(maxHeight: .infinity)
-                .padding(32)
+                .padding(Self.brandingInset)
 
             Divider()
 
             recents
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
         }
-        .frame(minWidth: 760, minHeight: 460)
+        // Font-derived, like the board window's floor (10-accessibility.md ▸ Text scaling: "no fixed
+        // point sizes"): at a large system text size a 300-point branding column would clip the app
+        // name it exists to show, and a 760 × 460 floor would leave the recents list too narrow for
+        // the three lines each row carries. At the standard body size these are those numbers.
+        .frame(minWidth: Self.minimumWidth, minHeight: Self.minimumHeight)
         // The window has no title bar, so the background is the drag handle. `.gesture` rather than
         // `.highPriorityGesture`: a click on a row or a button belongs to the row or the button.
         .gesture(WindowDragGesture())
@@ -76,12 +94,16 @@ struct WelcomeView: View {
         VStack(alignment: .leading, spacing: 0) {
             Image(nsImage: NSApp.applicationIconImage)
                 .resizable()
-                .frame(width: 96, height: 96)
+                .frame(width: Self.appIconSide, height: Self.appIconSide)
                 .accessibilityHidden(true)
 
             Text("Lanework")
-                .font(.system(size: 34, weight: .light))
-                .padding(.top, 12)
+                // A **relative** style, not a 34pt literal — "relative text styles everywhere, no
+                // fixed point sizes" (10-accessibility.md ▸ Text scaling & visual accommodations).
+                // `.largeTitle` is the app name's register and it grows with the system text size;
+                // a fixed size would have stayed put while every line beneath it grew past it.
+                .font(.largeTitle.weight(.light))
+                .padding(.top, BoardMetrics.em(0.9, bodyPointSize: Self.pointSize))
 
             Text(versionSummary)
                 .font(.callout)
@@ -90,11 +112,11 @@ struct WelcomeView: View {
             Text("Folders and Markdown, on your terms.")
                 .font(.caption)
                 .foregroundStyle(.tertiary)
-                .padding(.top, 4)
+                .padding(.top, BoardMetrics.em(0.3, bodyPointSize: Self.pointSize))
 
-            Spacer(minLength: 24)
+            Spacer(minLength: BoardMetrics.em(1.85, bodyPointSize: Self.pointSize))
 
-            VStack(spacing: 8) {
+            VStack(spacing: BoardMetrics.em(0.6, bodyPointSize: Self.pointSize)) {
                 // The menu-bar twin of this button is File ▸ New Board… (⌥⌘N) — same action, and
                 // deliberately the same words, because a button and a menu item that differ read as
                 // two features.
@@ -216,7 +238,7 @@ struct WelcomeView: View {
             }
             .controlSize(.small)
         }
-        .padding(16)
+        .padding(BoardMetrics.em(1.25, bodyPointSize: Self.pointSize))
         .frame(maxWidth: .infinity, alignment: .leading)
     }
 
@@ -249,7 +271,7 @@ private struct WelcomeActionButton: View {
         Button(action: action) {
             Label(title, systemImage: systemImage)
                 .frame(maxWidth: .infinity, alignment: .leading)
-                .padding(.vertical, 2)
+                .padding(.vertical, BoardMetrics.em(0.15, bodyPointSize: WelcomeView.pointSize))
         }
         .buttonStyle(.bordered)
         .controlSize(.large)
@@ -271,9 +293,13 @@ private struct RecentBoardRow: View {
             // lenient-fallback shape every other icon site in the app uses (`ItemSymbol`,
             // `Palette`), applied here to the registry's cached string instead of a live snapshot.
             Image(systemName: iconName)
-                .font(.system(size: 22))
+                // Relative, like every other size in this window (10-accessibility.md's
+                // full-relative-scaling rule): `.title` is the register a 22pt glyph occupied at the
+                // standard text size, and the well around it is derived from the body font so the
+                // glyph never outgrows it.
+                .font(.title)
                 .foregroundStyle(iconTint)
-                .frame(width: 34, height: 34)
+                .frame(width: iconWell, height: iconWell)
                 .accessibilityHidden(true)
 
             VStack(alignment: .leading, spacing: 1) {
@@ -292,13 +318,19 @@ private struct RecentBoardRow: View {
 
             Spacer(minLength: 0)
         }
-        .padding(.vertical, 4)
+        .padding(.vertical, BoardMetrics.em(0.3, bodyPointSize: WelcomeView.pointSize))
         // Dimmed when the board cannot be reached — the row stays, with Forget, rather than
         // disappearing (02 § Graceful orphaning).
         .opacity(row.isAvailable ? 1 : 0.55)
         .accessibilityElement(children: .combine)
     }
 
+    /// The square the row's glyph sits in — font-derived so the icon column stays proportionate to
+    /// the three lines of text beside it at every system text size.
+    private var iconWell: CGFloat {
+        BoardMetrics.em(2.6, bodyPointSize: BoardMetrics.bodyPointSize)
+    }
+
     /// `row.icon`'s symbol if it names one this system can draw, the board default otherwise —
     /// `ItemSymbol.name(_:fallback:)`'s rule, restated for a plain cached string rather than a
     /// `FieldValue`: a record carries no `FieldValue`, so `missing`/`malformed`/`unrecognized`
@@ -347,10 +379,15 @@ private struct RecentBoardRow: View {
 
 /// The app's preferences (⌘, — 11-command-nexus.md).
 ///
-/// One control, which is the whole of v1: "Restore open boards at launch". The preference gates only
-/// whether the registry's open-now flags are *consulted* at launch — the flags themselves are
-/// maintained either way, which is what keeps crash recovery working for a user who has restoration
-/// turned off and then turns it back on.
+/// One section today: "Restore open boards at launch", whose preference gates only whether the
+/// registry's open-now flags are *consulted* at launch — the flags themselves are maintained either
+/// way, which is what keeps crash recovery working for a user who has restoration turned off and then
+/// turns it back on.
+///
+/// **The Pro section is dormant, not deleted** (12-editions.md ▸ PIVOT 2026-08-07 — git leaves the
+/// paywall): `ProSettingsSection` still exists and still compiles, but this scene no longer renders
+/// it — the base/Pro split is being re-decided, and until it's ruled, no surface in the app names or
+/// sells Lanework Pro.
 struct SettingsView: View {
 
     @AppStorage(AppPreferences.restoreOpenBoardsAtLaunchKey)
@@ -365,7 +402,10 @@ struct SettingsView: View {
             }
         }
         .formStyle(.grouped)
-        .frame(width: 420)
+        // Font-derived: this pane is `.fixedSize()`, so a 420-point literal would clip a footer
+        // sentence at a large system text size with no way to resize out of it
+        // (10-accessibility.md ▸ Text scaling).
+        .frame(width: BoardMetrics.em(32.3, bodyPointSize: BoardMetrics.bodyPointSize))
         .fixedSize()
     }
 }

Kanban/App/WindowAccessor.swift

@@ -56,6 +56,25 @@ final class HostedWindowController: NSObject, NSWindowDelegate {
     /// window that has nothing to flush.
     var onCloseRequested: (() -> Void)?
 
+    /// **The stack this window's ⌘Z crosses**, asked for afresh every time AppKit wants it —
+    /// 13-native-undo.md ▸ Rules' two levels (re-ruled 2026-07-31): a **board** window answers with
+    /// its session's stack, and a **card** window with its own, "standard per-window AppKit scoping".
+    ///
+    /// A closure rather than a stored manager for two reasons: a board window's session does not
+    /// exist yet when the window attaches, and it stops existing at teardown while the window is
+    /// still closing — answering `nil` then is what keeps a torn-down board's stack from being
+    /// reachable through a window that outlived it by a run-loop turn.
+    ///
+    /// `nil` on every window that has no stack of its own (welcome, the bootstrap, the template
+    /// chooser), which `BoardUndoRouting` reads as "the platform default".
+    var windowUndoManager: (() -> UndoManager?)?
+
+    /// The text manager this window hands back while a field editor holds the keyboard, and the one
+    /// it hands back when there is no board — 06-history-undo.md ▸ Undo routing, via
+    /// `BoardUndoRouting`. Created on demand, per window, which is what AppKit itself would have
+    /// done for a window whose delegate answered nothing.
+    private lazy var textUndoManager = UndoManager()
+
     /// Set by `closeAfterFlush()` so the re-entrant `windowShouldClose` lets the close through
     /// instead of starting a second flush.
     private var isFlushed = false
@@ -66,6 +85,48 @@ final class HostedWindowController: NSObject, NSWindowDelegate {
     /// constructor argument.
     private var titlebarAccessory: NSTitlebarAccessoryViewController?
 
+    /// This window's toolbar, once something has given it one — the board and card windows'
+    /// customizable toolbars (03-board-ui.md ▸ Toolbar). A slot for the accessory's reason: welcome
+    /// and the bootstrap window have none, and the two that do only learn what goes in it after
+    /// their board has loaded.
+    private var toolbarController: WindowToolbarController?
+
+    /// Whether this window's title is hidden from the title bar — **card and board windows**: the
+    /// card's name is shown as part of the card's body instead of the chrome (05-card-window.md ▸
+    /// Window), and the board's is said by the board-popover widget in the titlebar instead
+    /// (03-board-ui.md ▸ Board popover; `BoardWindowHost.configureWindow`). `nil` leaves AppKit's own
+    /// default (`.visible`) untouched — the restore-bootstrap window's posture, the one
+    /// `HostedWindowController`-hosted window with no opinion here, the same "nothing to do" posture
+    /// `titlebarAccessory` has on welcome (which never attaches a controller at all), the bootstrap
+    /// window, and now — for that slot specifically — card windows too.
+    ///
+    /// A slot, not a one-shot write, for the accessory and toolbar's own reason: the value has to
+    /// survive the provisional-window swap (`detach()`'s doc comment) and reapply itself when the
+    /// real window attaches, which a write made once at `onAttach` time would not survive if that
+    /// closure only fired for the provisional window. `NSWindow.title` itself is a different slot
+    /// entirely — SwiftUI's `navigationTitle` sets it directly, and it is left alone on purpose: the
+    /// Window menu, Mission Control/Exposé, VoiceOver and state restoration all read the string, not
+    /// what the chrome draws from it.
+    private var titleVisibility: NSWindow.TitleVisibility?
+
+    /// Whether this window's content runs the full height of the frame, under a transparent title
+    /// bar — **a board window carrying a custom background**, and nothing else (03-board-ui.md §
+    /// Styling ▸ Capabilities: the board's colour or image "paints the full window"; `BoardView
+    /// .boardBackground` draws the frosted strip that keeps the chrome legible over it).
+    ///
+    /// `nil` leaves AppKit's own posture untouched, exactly as `titleVisibility` does — the welcome,
+    /// bootstrap and card windows have no opinion, and neither does a board window while it loads
+    /// (the flag is driven off the snapshot, which does not exist yet). `nil` and `false` therefore
+    /// render identically; they differ only in whether this controller has *said* anything, which is
+    /// what keeps the loading half from having to state a default it does not own.
+    ///
+    /// A slot rather than a one-shot write, and **repeat-safe rather than install-once** — the
+    /// `hideTitle` pattern, for a stronger version of its reason: the value has to survive the
+    /// provisional-window swap (`detach()`), *and* it genuinely changes over a window's life. A
+    /// `background:` edited on disk reloads the snapshot, and the chrome follows it in both
+    /// directions.
+    private var extendsUnderTitlebar: Bool?
+
     private static let logger = Logger(subsystem: "dev.rzen.indie.Kanban", category: "window")
 
     // MARK: Attachment
@@ -84,14 +145,25 @@ final class HostedWindowController: NSObject, NSWindowDelegate {
         // After `onAttach`, so placement has already happened: an accessory handed over before the
         // window existed is installed here instead, and one handed over later installs immediately.
         addTitlebarAccessoryIfPossible()
+        applyToolbarIfPossible()
+        applyTitleVisibilityIfPossible()
+        applyTitlebarExtensionIfPossible()
     }
 
-    /// Puts the previous delegate back, and takes the titlebar accessory back out. Called when the
-    /// hosting view goes away; the delegate half is a no-op if something else has since taken the
-    /// delegate, because stomping a third party's would be the bug this whole file exists to avoid.
+    /// Puts the previous delegate back and takes the titlebar accessory and toolbar off the window —
+    /// **without discarding them**. The delegate half is a no-op if something else has since taken
+    /// the delegate, because stomping a third party's would be the bug this whole file exists to
+    /// avoid.
+    ///
+    /// The held chrome survives a detach deliberately: its lifetime is this controller's, not the
+    /// sensing view's. SwiftUI dismantles and re-makes the background representable while it moves a
+    /// scene's content into its final window (observed on macOS 26: install arrives before any
+    /// window, a dismantle follows, and only *then* does the real window attach) — so chrome
+    /// discarded here would never reach the window it was made for. `attach` reinstalls whatever is
+    /// held; a controller that is genuinely done takes its slots down with it.
     func detach() {
         removeTitlebarAccessory()
-        titlebarAccessory = nil
+        removeToolbar()
         guard let window, window.delegate === self else { return }
         window.delegate = previousDelegate
         self.window = nil
@@ -127,6 +199,92 @@ final class HostedWindowController: NSObject, NSWindowDelegate {
         window.removeTitlebarAccessoryViewController(at: index)
     }
 
+    // MARK: Toolbar
+
+    /// Gives this window its toolbar — **once**, `installTitlebarAccessory`'s rule and for its
+    /// reason: a host may configure itself more than once, and a second toolbar would replace the
+    /// first along with the search field the first was hosting.
+    ///
+    /// Installing before the window exists is legal — the toolbar is held and goes on at `attach`.
+    func installToolbar(_ controller: WindowToolbarController) {
+        guard toolbarController == nil else { return }
+        toolbarController = controller
+        applyToolbarIfPossible()
+    }
+
+    /// The window is SwiftUI's, and SwiftUI leaves `toolbar` alone for a scene that declares no
+    /// `.toolbar` modifier — which the board and card windows deliberately do not, since their
+    /// toolbars are `NSToolbar`s (see `WindowToolbarController` for why). The identity check is what
+    /// keeps a re-attach from replacing a live toolbar with itself and rebuilding every item.
+    private func applyToolbarIfPossible() {
+        guard let window, let toolbarController, window.toolbar !== toolbarController.toolbar else { return }
+        window.toolbar = toolbarController.toolbar
+        // The first honest answer to "what is installed", now that the toolbar has built its items
+        // from the saved configuration.
+        toolbarController.reportInstalledItems()
+        toolbarController.revalidate()
+    }
+
+    private func removeToolbar() {
+        guard let window, let toolbarController, window.toolbar === toolbarController.toolbar else { return }
+        window.toolbar = nil
+    }
+
+    // MARK: Title visibility
+
+    /// Hides this window's title from the title bar, leaving the toolbar exactly as it renders today
+    /// — the card-window seam (`CardWindowHost`, 05-card-window.md ▸ Window) and, since the
+    /// board-popover widget grew to say the board's name itself, the board-window one too
+    /// (`BoardWindowHost`, 03-board-ui.md ▸ Board popover). `window.title` is untouched by this call
+    /// on purpose; see the property's doc comment for why.
+    ///
+    /// Safe to call whenever the caller learns it wants this — before the window exists (the value is
+    /// held and applied at `attach`) or after (applied immediately) — and safe to call more than once,
+    /// unlike the accessory and toolbar slots: writing `NSWindow.titleVisibility` twice has no side
+    /// effect worth guarding against, so this is not an install-once seam.
+    func hideTitle() {
+        titleVisibility = .hidden
+        applyTitleVisibilityIfPossible()
+    }
+
+    private func applyTitleVisibilityIfPossible() {
+        guard let window, let titleVisibility else { return }
+        window.titleVisibility = titleVisibility
+    }
+
+    // MARK: Content under the title bar
+
+    /// Runs this window's content the full height of its frame, under a transparent title bar — or
+    /// puts the standard chrome back (see `extendsUnderTitlebar`).
+    ///
+    /// Safe whenever the caller learns the answer — before the window exists (held, applied at
+    /// `attach`) or after (applied now) — and safe to call repeatedly with the same value, which
+    /// matters more here than for `hideTitle`: the board window drives this off its snapshot, so it
+    /// is called on every reload that changes the reading and on plenty that do not.
+    ///
+    /// **Not undone at `detach`**, `titleVisibility`'s posture: the slot survives the provisional-
+    /// window swap and reapplies itself to whichever window attaches next, and a window that is
+    /// genuinely going away takes its chrome with it.
+    func setExtendsContentUnderTitlebar(_ flag: Bool) {
+        extendsUnderTitlebar = flag
+        applyTitlebarExtensionIfPossible()
+    }
+
+    /// The two AppKit knobs the effect needs, and they are one decision: `fullSizeContentView` is
+    /// what lets the content view reach under the title bar, and `titlebarAppearsTransparent` is
+    /// what stops the title bar from painting its own material over it. Either alone is a visible
+    /// half-state — an opaque bar over the board, or a board that stops at a bar that no longer
+    /// draws.
+    private func applyTitlebarExtensionIfPossible() {
+        guard let window, let extendsUnderTitlebar else { return }
+        window.titlebarAppearsTransparent = extendsUnderTitlebar
+        if extendsUnderTitlebar {
+            window.styleMask.insert(.fullSizeContentView)
+        } else {
+            window.styleMask.remove(.fullSizeContentView)
+        }
+    }
+
     /// Closes the window for real, after the flush has run. `performClose` rather than `close` so the
     /// standard path runs — SwiftUI's own delegate gets its callbacks, tabbing behaves — with the
     /// flag telling our own `windowShouldClose` to stand aside.
@@ -148,6 +306,29 @@ final class HostedWindowController: NSObject, NSWindowDelegate {
         return false
     }
 
+    /// The window-level half of 06-history-undo.md ▸ Undo routing (see `BoardUndoRouting`, which
+    /// owns the rule and the reasoning): this window's stack when the keyboard is on the content, a
+    /// text manager of this window's own while a field editor has it.
+    ///
+    /// **Answered here rather than forwarded**, unlike the proxy's other selectors, on the one
+    /// condition that this window has a stack: `responds(to:)` reports this method whatever the
+    /// previous delegate does, so a `nil` return would leave a window with *no* undo manager at all
+    /// rather than the one AppKit creates for a delegate that stays silent. A window with no stack
+    /// still defers to SwiftUI's delegate if it has an opinion.
+    func windowWillReturnUndoManager(_ window: NSWindow) -> UndoManager? {
+        let board = windowUndoManager?()
+        if board == nil, let previousDelegate,
+           previousDelegate.responds(to: #selector(NSWindowDelegate.windowWillReturnUndoManager(_:))),
+           let inherited = previousDelegate.windowWillReturnUndoManager?(window) {
+            return inherited
+        }
+        return BoardUndoRouting.undoManager(
+            isTextEditing: BoardUndoRouting.isTextEditing(window.firstResponder),
+            board: board,
+            textFallback: textUndoManager
+        )
+    }
+
     func windowDidMove(_ notification: Notification) {
         reportFrame()
         previousDelegate?.windowDidMove?(notification)

Kanban/App/WindowToolbar.swift

@@ -0,0 +1,565 @@
+import AppKit
+import Observation
+
+// MARK: - The vocabulary
+
+/// **A toolbar item's label is its menu row's title** (03-board-ui.md ▸ Toolbar): "Toolbar item
+/// labels match their menu-item titles exactly (Show Trash, Edit Body, Raw Source, …), minus any
+/// trailing ellipsis (macOS convention: "Add Attachment…" labels as Add Attachment) — one vocabulary
+/// everywhere, and the customize palette self-documents against the menus."
+///
+/// One function rather than a hand-written second spelling per item, because the failure this rule
+/// guards against is drift: a menu row renamed without its toolbar item is two names for one
+/// function, and the customize palette is precisely where a user compares the two.
+///
+/// The **one exception is Undo/Redo**, which is not expressible here and is not meant to be:
+/// `NSUndoManager` rewrites their menu titles as the stack changes ("Undo Move Card"), and a toolbar
+/// label does not track that — so those two items are built from a static label instead of from a
+/// menu title (`ToolbarItemSpec.staticLabel`).
+enum ToolbarVocabulary {
+
+    /// `menuTitle` minus one trailing ellipsis — the "…" character and the three-period spelling
+    /// alike, since a title is only ever written one of those two ways and both mean the same thing.
+    static func label(menuTitle: String) -> String {
+        var title = Substring(menuTitle)
+        if title.hasSuffix("…") {
+            title = title.dropLast()
+        } else if title.hasSuffix("...") {
+            title = title.dropLast(3)
+        }
+        while title.last == " " {
+            title = title.dropLast()
+        }
+        return String(title)
+    }
+}
+
+// MARK: - One item
+
+/// One toolbar item, as a value: its identity, its vocabulary, and what it does.
+///
+/// **It is a description, not a view.** The item's `NSToolbarItem` is built from this by
+/// `WindowToolbarController` — twice, in fact, since the customization palette holds its own copy of
+/// every item — so nothing here may be a control. Keeping it a value is also what makes the two
+/// things worth testing testable without a window: the label the vocabulary rule derives, and the
+/// predicates the item mirrors from its menu row (03 ▸ Toolbar: "every function they host already has
+/// a menu item + shortcut ... nothing below is anyone's only path").
+///
+/// The predicates are **the menu rows' own**, passed in by the catalogs — `EditBodyCommand.isEnabled`
+/// and `AddAttachmentCommand.isEnabled` are handed here verbatim rather than re-derived, which is the
+/// only way "the toolbar mirrors the menu" can stay true of code as well as of prose.
+@MainActor
+struct ToolbarItemSpec {
+
+    let identifier: NSToolbarItem.Identifier
+    let label: String
+    /// The SF Symbol the item draws. `nil` for the search item, whose field draws itself.
+    let symbol: String?
+    let behavior: Behavior
+
+    /// What the item *is*, which is also what kind of `NSToolbarItem` it becomes.
+    @MainActor
+    enum Behavior {
+        /// A push button: an action, and the predicate its menu row validates against.
+        case button(isEnabled: () -> Bool, perform: () -> Void)
+        /// A toggle showing on-state — Show Trash, Edit Body, Raw Source (03 ▸ Toolbar).
+        case toggle(isEnabled: () -> Bool, isOn: () -> Bool, setOn: (Bool) -> Void)
+        /// An action sent up the responder chain with no target of our own — **Undo and Redo**, which
+        /// is how their menu rows work too, so "matching their menu items" is one mechanism rather
+        /// than two (03 ▸ Toolbar; 06-history-undo.md).
+        case responderAction(Selector)
+        /// A search field in AppKit's own `NSSearchToolbarItem` — the board's search
+        /// (03-board-ui.md ▸ Toolbar). The item owns the field's layout, so `focusedWidth` is a
+        /// preference rather than a constraint: it is the width the field takes *when it has the
+        /// keyboard*, the resting width being the item's own.
+        ///
+        /// `make` is handed `true` when the field is bound for the toolbar itself and `false` when
+        /// it is the customization palette's copy, so only the real one claims window-scoped
+        /// wiring. `install` runs for that real item alone, and is where a caller wires the things
+        /// that need the *item* rather than the field — expanding it and putting the keyboard in it
+        /// is one call on `NSSearchToolbarItem`, and no field can make it.
+        case searchField(
+            focusedWidth: CGFloat,
+            make: (_ willBeInsertedIntoToolbar: Bool) -> NSSearchField,
+            install: (NSSearchToolbarItem) -> Void
+        )
+        /// A pull-down of mutually exclusive choices — **Appearance** (03-board-ui.md ▸ Toolbar): an
+        /// `NSMenuToolbarItem`, item image plus indicator, whose menu lists `options` in order.
+        /// `selected()` names the option index carrying the checkmark, read fresh whenever AppKit
+        /// opens the menu rather than polled — the same freshness every other menu row in the app
+        /// gets (`validateMenuItem(_:)`) — and `select(_:)` is a chosen row's whole action. The one
+        /// behavior with no `activate()` of its own: firing lives in the dropdown's rows, not in the
+        /// item itself, the way `responderAction`'s lives in the responder chain rather than here.
+        case picker(
+            options: [(title: String, symbol: String?)],
+            selected: () -> Int?,
+            select: (Int) -> Void
+        )
+    }
+
+    /// The vocabulary rule applied: an item that mirrors a menu row takes that row's title, minus a
+    /// trailing ellipsis.
+    static func mirroring(
+        menuTitle: String,
+        identifier: NSToolbarItem.Identifier,
+        symbol: String?,
+        behavior: Behavior
+    ) -> Self {
+        Self(
+            identifier: identifier,
+            label: ToolbarVocabulary.label(menuTitle: menuTitle),
+            symbol: symbol,
+            behavior: behavior
+        )
+    }
+
+    /// The Undo/Redo exception, and the search field (a control, not a command): a label written
+    /// here because there is no menu title to derive it from.
+    static func staticLabel(
+        _ label: String,
+        identifier: NSToolbarItem.Identifier,
+        symbol: String?,
+        behavior: Behavior
+    ) -> Self {
+        Self(identifier: identifier, label: label, symbol: symbol, behavior: behavior)
+    }
+
+    // MARK: State
+
+    /// The item's live enablement. Responder-chain items and the search item answer `true`: the
+    /// first is validated by the chain itself (which is the point of it), and the second has no
+    /// enablement of its own.
+    var isEnabled: Bool {
+        switch behavior {
+        case let .button(isEnabled, _): isEnabled()
+        case let .toggle(isEnabled, _, _): isEnabled()
+        case .responderAction, .searchField, .picker: true
+        }
+    }
+
+    /// The item's on-state, or `nil` for the items that have none.
+    var isOn: Bool? {
+        switch behavior {
+        case let .toggle(_, isOn, _): isOn()
+        case .button, .responderAction, .searchField, .picker: nil
+        }
+    }
+
+    /// Firing the item: a button performs, a toggle flips. A no-op for the kinds AppKit drives itself
+    /// or that fire from somewhere other than the item's own primary action (`.picker`'s dropdown
+    /// rows).
+    func activate() {
+        switch behavior {
+        case let .button(_, perform): perform()
+        case let .toggle(_, isOn, setOn): setOn(!isOn())
+        case .responderAction, .searchField, .picker: break
+        }
+    }
+}
+
+// MARK: - The toolbar
+
+/// A window's toolbar: **customizable, macOS-native, and never a function's only home**
+/// (03-board-ui.md ▸ Toolbar).
+///
+/// ### Why `NSToolbar` rather than SwiftUI's `.toolbar(id:)`
+///
+/// SwiftUI's customizable toolbar would answer most of 03's clauses, and it was the first choice.
+/// Four requirements sent this to AppKit instead, and each is normative rather than aesthetic:
+///
+/// - **⌘F has to know whether the search item is installed.** "With the field removed from the
+///   toolbar, invoking it surfaces the field transiently" (03) — a decision that needs to read the
+///   toolbar's *current* contents. `NSToolbar` publishes them (`items`, plus the will-add/did-remove
+///   delegate callbacks); SwiftUI's toolbar API has no such query, and reaching around it into the
+///   `NSToolbar` it happens to own means matching identifiers SwiftUI derives rather than ones this
+///   app spells.
+/// - **Undo and Redo have to reach the responder chain.** Their menu rows are the system's own —
+///   nil-target `undo:`/`redo:` — and "matching their menu items" (03) is literal here: a toolbar
+///   item with the same nil-target action validates and fires through exactly the same lookup, so
+///   the pair enables and disables with the menu rows by construction rather than by agreement,
+///   reading the board window's `BoardUndoManager` through `NSWindow`'s own validation
+///   (13-native-undo.md). A SwiftUI `Button` cannot express that.
+/// - **The search item is AppKit's own `NSSearchToolbarItem`**, hosting a real `NSSearchField` with
+///   explicit first-responder control, settled in m5 for reasons `BoardSearchFieldController`
+///   records (⌘F must focus it from a menu item; Escape in an empty field must hand the keyboard
+///   back to the strip). The item is where grow-on-focus, the cancel button's staging, and the
+///   overflow row all live, and it exists only in AppKit; a toolbar that already speaks AppKit
+///   hosts it directly.
+/// - **The window is already proxied.** `HostedWindowController` fronts SwiftUI's window delegate
+///   and installs the board's titlebar accessory; a toolbar is the same kind of thing hung on the
+///   same window, through the same install-once seam.
+///
+/// What the platform gives back, and what 03 asks for by name: right-click ▸ Customize Toolbar…,
+/// drag to rearrange, the system overflow, and the icon/text display options —
+/// `allowsUserCustomization` and `allowsDisplayModeCustomization` below are those two sentences.
+/// The user's arrangement persists through `autosavesConfiguration`, keyed on the toolbar's
+/// identifier, so it is per *window kind* (every board window shares one arrangement) exactly as
+/// Finder's is.
+///
+/// ### Validation is observed, not polled
+///
+/// AppKit validates visible items on its own schedule (`NSToolbarItem.autovalidates`), which is tied
+/// to user events. The state these items mirror can change without one — a foreign reload flipping
+/// the read-only lock, a raw-source Apply landing — so the controller *observes* every predicate it
+/// was given (`withObservationTracking`) and re-validates when any of them would answer differently.
+/// The two mechanisms are complementary: AppKit's covers the ordinary case, this covers the case
+/// where nothing the user did caused the change.
+@MainActor
+final class WindowToolbarController: NSObject, NSToolbarDelegate {
+
+    let toolbar: NSToolbar
+
+    /// The catalog, in palette order — every item the user may install (03: "Catalog (available via
+    /// Customize)").
+    private let specs: [NSToolbarItem.Identifier: ToolbarItemSpec]
+    private let catalog: [NSToolbarItem.Identifier]
+    private let defaults: [NSToolbarItem.Identifier]
+
+    /// Called with the identifiers the toolbar currently carries, whenever that set changes — the
+    /// board's search item is the one consumer (`BoardToolbar`), and 03's transient-⌘F clause is the
+    /// reason it exists.
+    var onInstalledItemsChanged: (([NSToolbarItem.Identifier]) -> Void)?
+
+    /// Set while a report is already scheduled, so a customization that removes and re-adds a dozen
+    /// items reports once.
+    private var isReportScheduled = false
+
+    init(identifier: String, specs: [ToolbarItemSpec], defaults: [NSToolbarItem.Identifier]) {
+        toolbar = NSToolbar(identifier: identifier)
+        catalog = specs.map(\.identifier)
+        self.specs = Dictionary(uniqueKeysWithValues: specs.map { ($0.identifier, $0) })
+        self.defaults = defaults
+        super.init()
+
+        toolbar.delegate = self
+        // 03's three customization sentences, in three lines: the palette and its drag-rearrange,
+        // the Show ▸ Icon and Text / Icon Only / Text Only popup, and the arrangement remembered
+        // across launches.
+        toolbar.allowsUserCustomization = true
+        toolbar.allowsDisplayModeCustomization = true
+        toolbar.autosavesConfiguration = true
+
+        trackValidationState()
+    }
+
+    /// Re-reads every item's state and pushes it into the toolbar. Called by the observation above
+    /// and worth calling directly after anything that installs the toolbar.
+    func revalidate() {
+        toolbar.validateVisibleItems()
+    }
+
+    // MARK: - Installed items
+
+    /// Reports the toolbar's current contents, coalesced onto the next turn: the delegate callbacks
+    /// fire *around* a change rather than after it (`toolbarWillAddItem` runs before the item joins
+    /// `items`), so the honest answer is only available once the run loop has come back around.
+    private func scheduleInstalledItemsReport() {
+        guard !isReportScheduled else { return }
+        isReportScheduled = true
+        Task { @MainActor [weak self] in
+            guard let self else { return }
+            isReportScheduled = false
+            onInstalledItemsChanged?(toolbar.items.map(\.itemIdentifier))
+        }
+    }
+
+    /// Reports the contents now that the toolbar is on a window — the initial answer, which no
+    /// delegate callback provides when the saved configuration happens to be empty.
+    func reportInstalledItems() {
+        scheduleInstalledItemsReport()
+    }
+
+    // MARK: - NSToolbarDelegate
+
+    func toolbarAllowedItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
+        catalog + [.space, .flexibleSpace]
+    }
+
+    func toolbarDefaultItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
+        defaults
+    }
+
+    func toolbar(
+        _ toolbar: NSToolbar,
+        itemForItemIdentifier identifier: NSToolbarItem.Identifier,
+        willBeInsertedIntoToolbar flag: Bool
+    ) -> NSToolbarItem? {
+        guard let spec = specs[identifier] else { return nil }
+        return makeItem(spec, willBeInsertedIntoToolbar: flag)
+    }
+
+    func toolbarWillAddItem(_ notification: Notification) {
+        scheduleInstalledItemsReport()
+    }
+
+    func toolbarDidRemoveItem(_ notification: Notification) {
+        scheduleInstalledItemsReport()
+    }
+
+    // MARK: - Item construction
+
+    private func makeItem(_ spec: ToolbarItemSpec, willBeInsertedIntoToolbar: Bool) -> NSToolbarItem {
+        switch spec.behavior {
+        case .button:
+            return makeButtonItem(spec)
+        case .toggle:
+            return makeToggleItem(spec)
+        case let .responderAction(selector):
+            return makeResponderItem(spec, selector: selector)
+        case let .searchField(focusedWidth, make, install):
+            return makeSearchItem(
+                spec,
+                focusedWidth: focusedWidth,
+                field: make(willBeInsertedIntoToolbar),
+                // The palette's copy is a picture of the item, not a second live one: it claims no
+                // window-scoped wiring, so it is handed none.
+                install: willBeInsertedIntoToolbar ? install : nil
+            )
+        case let .picker(options, _, _):
+            return makePickerItem(spec, options: options)
+        }
+    }
+
+    /// A plain bordered item, validated against its menu row's predicate.
+    private func makeButtonItem(_ spec: ToolbarItemSpec) -> NSToolbarItem {
+        let item = ValidatingToolbarItem(itemIdentifier: spec.identifier)
+        decorate(item, with: spec)
+        item.isBordered = true
+        item.target = self
+        item.action = #selector(itemFired(_:))
+        item.onValidate = { [weak item] in
+            item?.isEnabled = spec.isEnabled
+        }
+        return item
+    }
+
+    /// **Undo and Redo**: no target, so AppKit resolves and validates the action up the responder
+    /// chain — the same lookup their menu rows use, which is the whole of "matching their menu
+    /// items" (03 ▸ Toolbar). Deliberately *not* a `ValidatingToolbarItem`: the default validation
+    /// is precisely the behaviour wanted here.
+    private func makeResponderItem(_ spec: ToolbarItemSpec, selector: Selector) -> NSToolbarItem {
+        let item = NSToolbarItem(itemIdentifier: spec.identifier)
+        decorate(item, with: spec)
+        item.isBordered = true
+        item.target = nil
+        item.action = selector
+        return item
+    }
+
+    /// A toggle button showing on-state. A hosted `NSButton` rather than a plain item because
+    /// `NSToolbarItem` has no state of its own, and 03 asks for one explicitly ("Show Trash (toggle
+    /// state matching the View menu checkmark)", "Edit Body is a single toggle button (on-state in
+    /// Edit)").
+    private func makeToggleItem(_ spec: ToolbarItemSpec) -> NSToolbarItem {
+        let button = NSButton(frame: NSRect(x: 0, y: 0, width: 38, height: 24))
+        button.setButtonType(.pushOnPushOff)
+        button.bezelStyle = .toolbar
+        button.title = ""
+        button.imagePosition = .imageOnly
+        if let symbol = spec.symbol {
+            button.image = NSImage(systemSymbolName: symbol, accessibilityDescription: spec.label)
+        }
+        button.identifier = NSUserInterfaceItemIdentifier(spec.identifier.rawValue)
+        button.target = self
+        button.action = #selector(toggleFired(_:))
+        button.state = spec.isOn == true ? .on : .off
+        // A custom view carries its own accessibility, where a plain item inherits the toolbar
+        // item's label (10-accessibility.md: every control is named).
+        button.setAccessibilityLabel(spec.label)
+        button.toolTip = spec.label
+
+        let item = ValidatingToolbarItem(itemIdentifier: spec.identifier)
+        decorate(item, with: spec)
+        item.view = button
+        // A custom-view item is blank in the overflow menu without this, and the overflow is one of
+        // 03's clauses ("the system overflow").
+        item.menuFormRepresentation = menuFormRepresentation(for: spec)
+        item.onValidate = { [weak button] in
+            button?.isEnabled = spec.isEnabled
+            button?.state = spec.isOn == true ? .on : .off
+        }
+        return item
+    }
+
+    /// The board's search field in the item AppKit wrote for it.
+    ///
+    /// **No width constraint here.** `NSSearchToolbarItem` manages the field's layout, and its
+    /// header says custom width constraints "should not conflict with" the preferred width — so the
+    /// em-based figure is handed over as a *preference*, which the item applies "whenever it gets
+    /// the keyboard focus". The resting width is the item's own, and grow-on-focus is what that
+    /// pair of facts means on screen.
+    ///
+    /// **Neither the overflow row nor the visibility priority is written here, and both omissions
+    /// are decisions.** The item ships its own `menuFormRepresentation` — a row titled from `label`
+    /// carrying a live AppKit action that widens the window until the field is usable — where a
+    /// custom-view item ships a blank one that has to be replaced; assigning here (`nil` included)
+    /// destroys it. And its `visibilityPriority` already starts one step *above* `.high`, so the
+    /// nudge a custom-view item needs to stay out of the overflow would be a demotion here.
+    private func makeSearchItem(
+        _ spec: ToolbarItemSpec,
+        focusedWidth: CGFloat,
+        field: NSSearchField,
+        install: ((NSSearchToolbarItem) -> Void)?
+    ) -> NSToolbarItem {
+        let item = NSSearchToolbarItem(itemIdentifier: spec.identifier)
+        decorate(item, with: spec)
+        // Configured before assignment, as the item's header asks — with one exception the header
+        // does not name: assignment stamps the *item's* enablement onto the field, so a field the
+        // caller made inert (the customization palette's copy) comes back live. The caller's answer
+        // is the one that counts, so it is put back.
+        let isFieldEnabled = field.isEnabled
+        item.searchField = field
+        field.isEnabled = isFieldEnabled
+        item.preferredWidthForSearchField = focusedWidth
+        // **Escape is staged** (04-interactions.md ▸ Search, settled: "in a non-empty field it
+        // clears the query, focus staying in the field; in an empty field it returns focus to the
+        // board"). AppKit's default is for the cancel button to clear *and* resign, which collapses
+        // the first two steps of that staircase into one — so the field keeps the keyboard, and the
+        // second press is what hands it back (`BoardSearchFieldController`).
+        item.resignsFirstResponderWithCancel = false
+        install?(item)
+        return item
+    }
+
+    /// A pull-down of mutually exclusive options — **Appearance**, so far the one item of this shape.
+    ///
+    /// `selected`/`select` are deliberately not captured here: every row's action and every row's
+    /// validation re-fetch the spec fresh from `specs[identifier]` (`pickerItemFired(_:)`,
+    /// `validateMenuItem(_:)`), the same indirection `itemFired(_:)` and `toggleFired(_:)` already use
+    /// for their own specs — so a spec rebuilt between two menu presentations is never read stale.
+    private func makePickerItem(_ spec: ToolbarItemSpec, options: [(title: String, symbol: String?)]) -> NSToolbarItem {
+        let item = NSMenuToolbarItem(itemIdentifier: spec.identifier)
+        decorate(item, with: spec)
+        // "Pull-down: item image + indicator" — the item's own glyph draws at rest, the indicator
+        // chevron shows there is a menu, and the rows are what actually name Auto/Light/Dark.
+        item.showsIndicator = true
+
+        let menu = NSMenu()
+        for (index, option) in options.enumerated() {
+            let menuItem = NSMenuItem(
+                title: option.title,
+                action: #selector(pickerItemFired(_:)),
+                keyEquivalent: ""
+            )
+            menuItem.target = self
+            // The row's position in `options`, not an identifier of its own — `select(_:)` and
+            // `selected()` both speak in this same index, which is what lets one closure pair stand
+            // for every row rather than one closure per option.
+            menuItem.tag = index
+            menuItem.representedObject = spec.identifier.rawValue
+            if let symbol = option.symbol {
+                menuItem.image = NSImage(systemSymbolName: symbol, accessibilityDescription: option.title)
+            }
+            menu.addItem(menuItem)
+        }
+        item.menu = menu
+        return item
+    }
+
+    /// The three strings every item carries: the toolbar label, the palette label (the same string —
+    /// one vocabulary), and the tooltip, which is what a user of an icon-only toolbar reads.
+    private func decorate(_ item: NSToolbarItem, with spec: ToolbarItemSpec) {
+        item.label = spec.label
+        item.paletteLabel = spec.label
+        item.toolTip = spec.label
+        if let symbol = spec.symbol {
+            item.image = NSImage(systemSymbolName: symbol, accessibilityDescription: spec.label)
+        }
+    }
+
+    private func menuFormRepresentation(for spec: ToolbarItemSpec) -> NSMenuItem {
+        let menuItem = NSMenuItem(title: spec.label, action: #selector(menuFired(_:)), keyEquivalent: "")
+        menuItem.target = self
+        menuItem.representedObject = spec.identifier.rawValue
+        return menuItem
+    }
+
+    // MARK: - Actions
+
+    @objc private func itemFired(_ sender: NSToolbarItem) {
+        specs[sender.itemIdentifier]?.activate()
+    }
+
+    @objc private func toggleFired(_ sender: NSButton) {
+        guard let raw = sender.identifier?.rawValue else { return }
+        specs[NSToolbarItem.Identifier(raw)]?.activate()
+        // The state is the model's, never the click's: a toggle whose setter refuses (a validation
+        // failure keeping source mode open, say) must not look like it succeeded.
+        revalidate()
+    }
+
+    @objc private func menuFired(_ sender: NSMenuItem) {
+        guard let raw = sender.representedObject as? String else { return }
+        specs[NSToolbarItem.Identifier(raw)]?.activate()
+        revalidate()
+    }
+
+    /// A row in a `.picker` item's own dropdown — **Appearance**'s Auto/Light/Dark, fired straight
+    /// from the menu rather than through `itemFired(_:)`, since the item has no primary action of its
+    /// own (`ToolbarItemSpec.activate()` is a no-op for `.picker`).
+    @objc private func pickerItemFired(_ sender: NSMenuItem) {
+        guard let raw = sender.representedObject as? String,
+              let spec = specs[NSToolbarItem.Identifier(raw)],
+              case let .picker(_, _, select) = spec.behavior
+        else { return }
+        select(sender.tag)
+        revalidate()
+    }
+
+    /// The overflow menu's copy of an item validates like the item itself — including the checkmark,
+    /// which is where a toggle's on-state goes when the menu is its face (03 ▸ Toolbar: "the system
+    /// overflow") — and where a `.picker` row's checkmark goes too, against its own index rather than
+    /// against `isOn` (which answers `nil` for the whole item, having no single on-state to give).
+    @objc func validateMenuItem(_ menuItem: NSMenuItem) -> Bool {
+        guard let raw = menuItem.representedObject as? String,
+              let spec = specs[NSToolbarItem.Identifier(raw)]
+        else { return true }
+        if case let .picker(_, selected, _) = spec.behavior {
+            menuItem.state = selected() == menuItem.tag ? .on : .off
+            return true
+        }
+        if let isOn = spec.isOn {
+            menuItem.state = isOn ? .on : .off
+        }
+        return spec.isEnabled
+    }
+
+    // MARK: - Observed validation
+
+    /// Re-arms itself on every change: `withObservationTracking` is one-shot by design, so the
+    /// tracking closure reads every predicate again after each notification and starts a fresh
+    /// observation over whatever it read this time.
+    private func trackValidationState() {
+        withObservationTracking {
+            for spec in specs.values {
+                _ = spec.isEnabled
+                _ = spec.isOn
+            }
+        } onChange: { [weak self] in
+            // The notification arrives *before* the change lands, so the re-read is deferred by a
+            // turn — which is also what puts it back on the main actor.
+            Task { @MainActor in
+                guard let self else { return }
+                self.revalidate()
+                self.trackValidationState()
+            }
+        }
+    }
+}
+
+// MARK: - The validated item
+
+/// An `NSToolbarItem` whose validation is a closure over the predicate its menu row uses.
+///
+/// `NSToolbarItem`'s own `validate()` does nothing for an item with a custom view and asks the
+/// target for `validateToolbarItem:` otherwise; overriding it outright is what lets one mechanism
+/// serve both kinds — and what lets the two toggle-state reads (enabled, on) happen in the same
+/// pass, so an item can never show one of them stale.
+final class ValidatingToolbarItem: NSToolbarItem {
+
+    var onValidate: (() -> Void)?
+
+    override func validate() {
+        onValidate?()
+    }
+}