Changes touching this path

• GitMirror: the bridge owns its own layout (#665) b0461c4c · dbf3dbe6…
• a change records when it was authored, so a projected commit stops reading '6 years ago' on GitHub (ADR 0043) loot changes carried no timestamp, so the git bridge fabricated one: BASE_EPOCH + generation, one second per ancestor depth from a 2020 epoch. All 526 commits sat inside seven minutes of September 2020. Earlier repairs (#626's floor, the missing-generation refusal) fixed ORDERING and never touched the absolute date, which is why this kept coming back. ADR 0028 inherited the no-timestamp constraint rather than choosing it. The real reason is upstream: a version id is blake3 over authored content, and a clock inside that hash gives two peers different ids for identical content, destroying the dedup and convergence of ADR 0001/0004. So authored_at rides the label seam ADR 0029 already cut for change_id -- covered by the finalize signature (no relay can restamp it) but never folded into the version id. The wasm golden vectors prove the separation held: FROZEN_VERSION_ID, FROZEN_OBJ_ADDR and FROZEN_SIGN are byte-identical, and only the version marker and one presence byte moved. Advisory, and never an ordering input: a self-reported clock is a claim, not evidence (ADR 0025). in_order/ids_topo, buoy and path_touch.ordinal are all untouched, the forge indexes nothing on it, and the projection floors it past every git parent so ancestry holds whoever's clock is wrong. Format v11: additive for readers (a v<=10 change decodes as None and an absent timestamp adds nothing to the signed message, so every existing signature still verifies), breaking for writers, so loot-cli and loot-forge go to 0.4.0 in lockstep. Forge migration 0004 stores it as bigint, not timestamptz -- signed data must round-trip bit-exact or pullers reject the change. Only new work gets real dates. Every commit on main predates v11, main is push-fast-forward-only, and backfilling would fabricate the very claim this replaces. Perf-Baseline: reset the change body grew one presence byte, plus eight where a timestamp is present, so bundle_bytes/store_bytes/wire_bytes step once at the v11 boundary eaa56d99 · dbf3dbe6…diff
• the mirror is pinned byte-faithful where it is opened: core.autocrlf=false at every bootstrap, and only a correction says so (#934) 52df4cb8 · dbf3dbe6…diff
• the second machine's bridge stops being frozen: ferry learns landed main from the checkout, and adopt says when its answer is stale (#1000) 93bce6cc · dbf3dbe6…diff
• deleting a named read on Workspace stops being free, because the 377 places that reached past it into the engine and the store now go through those faces instead — repo() no longer exists, store() is module-private, and the three extracted children share their fixtures by name rather than through the parent's private test module (#1411) c454db04 · dbf3dbe6…diff
• the fourth review sweep finds an enumeration asserted as exhaustive for the fifth time in one run, and the repair puts the RULE where the list was: two questions rather than a set of verb names. what does the key HOLD - a key the graph recorded as a change AUTHOR is mailmapped, while an attester, grantor, grantee, custody holder, manifest signer or admitted pusher holds a capability AT THE MOMENT IT IS PRINTED, and an alias there is a display that reads like an authorization claim. and where do the BYTES LAND - a mailmap is local display state, so it may reach a RENDERING and never an artifact whose bytes are hashed or re-ingested as a record. the second clause exists because of a site NEITHER the ticket nor a grep over the helper would have reached: git_mirror author_identity resolves a key the graph recorded as a change author and does not call that helper at all, so question one alone says mailmap it - and that would make a git mirror commit SHAs depend on a LOCAL UNTRACKED DISPLAY FILE, so two machines reading one repo would build two histories. applying the ticket rule mechanically would have INTRODUCED that defect, which is why the rule ships with two clauses and that site is named as its proof. of the four sites the ticket listed, three are mailmapped and tag is NOT: every key handed to that closure is an ATTESTER, the same key attester_trust decides the listing with, and that is the direction where a wrong call is security-shaped, so it stays put with the reason at the site and a pinned positive control. the four were four hand copies of one function body, which is HOW they drifted without anyone choosing to, and the body is now spelled once so there is no ladder left to copy. the grouping table is DELETED rather than narrowed: the enum grows ALL and a name round trip, parse SEARCHES that list and the refusal joins it, so the accepted set and the advertised set are one list read twice and the eighth vacuous pin becomes UNREACHABLE rather than watched - its replacement is pinned against an INDEPENDENT oracle, the hand written usage line read from source in another compilation unit, so a variant the parser accepts and the usage never mentions now reddens. AGENTS.md gains the class and explicitly NO guard, and the no-guard half is EVIDENCED rather than preferred: the census one would naturally write, over that helper call sites, would have caught four of the five instances and MISSED the git mirror - a guard that reads complete and is not would be one more instance of the class it exists to catch (#1832) 0cd1d291 · dbf3dbe6…diff
• the catch-up stops leaving its own consequence to a runbook the reader may never have loaded: adopt now prints the git step IT JUST CREATED, and only when it actually moved the tree and the checkout is measurably behind - naming the paths it wrote, which is exactly the set needing the proof. the ancestry is judged on the LOOT GRAPH through the mark map rather than by asking git, because git cannot answer it: the checkout has not fetched the landed commit. there are two arms by position, since which git command is correct depends on where HEAD is, and neither arm ever recommends git before a catch-up, because git-first WEDGES the primary and loot-side-first is and stays the order. and the land closing note is narrowed so its final word about the primary cannot read as being about the checkout: it now says which thing the fast-forward moves, says HEAD does not move with the dock, and names the verb that says the rest. the finding that changed the procedure is bigger than the ticket: the skill had the FETCH AFTER THE PROOFS, and a land pushes main FROM THE MIRROR, while the only fetches a land runs in the checkout are its pre-land drift and ADR guards - so at the exact moment an operator needs this procedure their origin/main is stale by that very land, every landed path reads as differing, and the freshly landed perf point does not resolve at all. followed literally the skill produced the precise wrong conclusion it exists to prevent, so the fetch is hoisted with the reason recorded, and the printed block fetches first by construction. twelve mutations with counts read, of which two are worth the reading. the tenth is a CONTROL: the skill quote wraps across two indented lines, so with the whitespace flattening removed the citation pin reddens over LAYOUT rather than over words, which is what makes the flattening load-bearing rather than decorative. and the fifth is the one to learn from - the lane guard test PASSED WITH THE GUARD DELETED, because the lane was silent for an unrelated reason, landed main having been recorded on the primary so the lane lineage-filtered graph had never seen it and the ancestry answered false. a pass that survives deleting the thing under test is not a pass, so the arrangement was rebuilt with landed main recorded THROUGH the lane and two explicit preconditions proving the lane reaches the checkout and can answer the ancestry at all - after which the same mutation reddens. what is NOT done is said rather than implied: a bare ferry still says nothing about git, its catch-up being a different path, so the note claims only the dock for it; the block deliberately stays silent on a repeat adopt, because its claim is that THIS run wrote over your tree and a no-op cannot make that claim; and none of this was reproduced live (#1679) c8ebe232 · dbf3dbe6…diff
• the condition that could not be false is gone, and so is the pair that made it possible: merged stops being a FIELD set by hand at three construction sites and becomes a DERIVED method over the one bit that decides it, so the two cannot disagree - unrepresentable rather than guarded. eighteen reads follow it, and eight of those were conjunctions that are now TAUTOLOGIES, reduced to one term rather than left standing to read as two conditions. the test was rebuilt by moving a DIFFERENT AXIS, because a second catch-up can never reach the block at all: the fixture now puts a real second commit on the checkout main, so the DOCK is still behind and the catch-up genuinely runs, writes the tree and reaches the block, while the CHECKOUT is level and the block declines - and deleting the predicate reddens two tests. the DISCRIMINATION is the part worth reading: under that same mutation the OLD test stays GREEN, which is precisely the defect this ticket describes, demonstrated rather than asserted. the printed recipe stops handing the operator a command that ERRORS. the tree delta now returns what was WRITTEN and what was REMOVED apart, and a removal gets a tree read for its proof, because there is no file to hash, and a checkout for its repair - placed BEFORE the merge, since restoring the file is what lets the merge run at all. the plumbing needed a pin of its own, and that is proved rather than assumed: folding removals back into the written set reddens the workspace pin while the rendering pin stays GREEN. the off-main arm gains its PROOF and withholds only its REMEDY, and says that it withholds it and why, because the byte comparison does not turn on where HEAD is while the repair does - with that limit stated in the same list the module other limits live in, rather than left for a reader to discover. the section this run added about careful sentences gets its own grammar fixed, a stray fragment from an earlier draft removed and a clause given its missing object - and NO count added, with a number that was being carried forward replaced by the property, consecutive sweeps each turning one up. the only-shorthand claim is narrowed at all three sites to the width of the check that backs it, which is a claim about ONE declaration and nothing wider. and the tenth copy of the short-hash helper becomes one, with the unguarded universal above it replaced by what it actually is and an explicit note of what it does not cover (#1911) 53ede622 · dbf3dbe6…diff
• a const inserted BETWEEN a doc block and its function had silently stolen two of them, and the consts move above the blocks so each documents its own subject again: diff_spec gets back the section recording that diff is a POINT VERB AT EACH ENDPOINT - the deliverable of the very ticket whose edit displaced it - and archive gets back its omit-versus-refuse argument, its two inherited limits and its pathspec section. each const gains a doc about ITSELF, saying what the string holds and who interpolates it, which is the shape the two siblings that were already right had. a THIRD site of the same shape was found by sweeping for it rather than by assuming the two were all, and it is from August rather than from this run. the nothing-catches-this claim is MEASURED rather than asserted: re-inserting the defect gives zero build warnings, zero rustdoc diagnostics at the site and a fully green suite, because intra-doc links still resolve. and the guard question is answered honestly as REVIEW rather than a gate - the mechanical heuristic yields seventeen candidates workspace-wide, all seventeen were READ, and exactly ONE was real, so a gate built on it would ship sixteen hand-maintained exemptions of noise, which is the roster class this run has been burned by five sweeps running. the sha-shortening item finishes the EXTRACTION rather than fixing the sentence, and on evidence found before deciding: one arm of the same enum already called the helper while another sliced flat, two arms of one message shape disagreeing about the same value. the doc stops saying every, states the property, names what each of the two sweeps covered, names the non-scope, and says OUTRIGHT that nothing enforces the scope - a hand-written slice still compiles and review is all there is - with its surviving headline claim, a prefix and never a panic, pinned for the first time. and the ticket OWN PREMISES were refuted twice, which is the part worth carrying forward. the diff exemption was DEAD rather than load-bearing: deleting it leaves the test green, and an instrumented run prints diff answering thirty-six bytes, because loot diff leaves the second endpoint at the pending state and an empty WORKING CHANGE is not an empty DELTA - so it is deleted rather than justified, with the reason recorded at the site. and the claim that all twenty-five selector-taking verbs read the selector HEAD is false, because edit refuses it through a THIRD resolver - measured against the built binary, and now pinned with a control rather than left as prose. the unpublished figure behind a 215-millisecond claim is rounded to the table rather than published unmeasured, and the removals proof gives BOTH its outcomes a meaning, pinned by a mutation whose sibling stays GREEN (#1917) 0ad19cad · dbf3dbe6…diff
• tickets never reach git main (ADR 0098 section 8, map #2422): the ferry leaves every path under tickets/ out of each projected tree at every tier, set aside before the tier is asked so a sealed tickets/security path is not reported as an omitted sealed path, and drops any the git parent carries. a change whose projection repeats its one git parent tree and which writes a ticket path against one of its loot parents is commitless: it is marked at that parent commit and makes none, after the git parents are reduced so a merge with a commitless ticket change stands at the code commit in either order, while a sealed-only change still commits as before. one sha can now stand for several changes and change_for answers with the latest mark; the refs phase marks the change main moves to last, so mirror_main_change, adopt and the ticket harbor tip read a ticket-only land as landed, and the marks file keeps its format by writing the earlier marks at a sha before the latest, which older readers parse as the same map. the ingest leaves a git-side ticket path out with a note rather than refusing it, a review round of tickets alone is still made with no diff and a note saying why, and loot-first land lets through a land whose tip stands at main with no commit of its own, which the #195 guard refused. ADR 0028 records how it is built and its limits (a trailer rebuild loses commitless marks, a second machine learns such a land late), CONTEXT.md gains Commitless change and workflow.md the land case. red under sixteen named mutations, each 0 passed and restored, 1 failed unless noted: the ticket set-aside removed, the parent strip removed, both at once (2 failed), never commitless (3 failed), a commitless change left unmarked, refs not marking the anchor latest, the ingest taking tickets in, the land predicate skipping its trailer check, no parent reduction, writes_tickets asking the first parent only, the review note dropped, a text-prefix ticket path, the encode dropping earlier marks (seen in loot-core and through a re-ferry), the latest written first, and the land guard branch removed. cargo test green, 4614 passed over 142 binaries with 13 ignored (#2425) f305ece5 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.