Changes touching this path

• shortlog grows -n, -e and --group, and the mailmap lands as a DISPLAY grouping whose boundary is three structural facts rather than a comment. it lives under .loot, which walk_stat skips at name == DOT BEFORE any ignore rule, so it cannot enter a tree, a change, a bundle or the git mirror and nothing arriving over a wire can write it. the module is pub(crate) in the loot-cli LIBRARY, while verification lives in loot-codec and loot-core and AccessClass and pusher admission live in loot-forge and loot-relayd - every one of those is a crate loot-cli DEPENDS ON, or one that does not depend on it, so the use does not compile there and making it compile means a DEPENDENCY CYCLE. and the type answers key to STRING and never key to key: there is no canonical-key operation and no iterator, so even an in-crate caller, where privacy does not help, cannot obtain the key behind a key. inside the CLI the scope is judged rather than maximised - grant-status, attest, custody and manifest deliberately KEEP the un-mailmapped resolver, because those columns name a key that HOLDS A CAPABILITY and an alias there would be a display that reads like an authorization claim. the rotation criterion takes the DOCS arm and the reason is sharper than the ticket knew: the keypair is ALREADY SWAPPED by the time the report renders, so a rotation that failed because a display file could not be written would report FAILURE OVER A COMPLETED ROTATION. the ritual prints the exact two-line entry at the moment the operator needs it, and a pin feeds that printed text back through the parser so it provably pastes. the file is untracked BY LAYOUT because display names in loot are LOCAL: .loot/peers is local, the ambient identity is local, and blame porcelain author column was frozen as the KEY precisely because two machines reading one repo render different words for one author. a TRACKED mailmap would make some labels repo-wide and leave the rest local, two authorities for one column, and would hand anyone who can land a change the power to relabel an author in everybody else log. one mutation could not be WRITTEN and that is the finding rather than a gap: routing the mailmap into the key column is not EXPRESSIBLE, since the resolver hands back str and String and exposes no key at all while the key columns take a 32 byte array, so a collapse mutation was substituted to prove those assertions are live and the inexpressibility is reported as the structural claim instead of as a green test. one behaviour change is deliberate: the default order flips to NAME order so that -n selects something, because an -n that named the only existing order would assert nothing. and two pre-existing guards caught real drift on the way - the documented-flag census tokenizes on whitespace and brackets only, so a dash-flag followed by a comma or a backtick in PROSE reads as a documented flag, and the verb-grep census needs its row on ONE line, so a wrapped row silently loses the count (#1531) cfaaad9f · dbf3dbe6…
• the fourth review sweep finds an enumeration asserted as exhaustive for the fifth time in one run, and the repair puts the RULE where the list was: two questions rather than a set of verb names. what does the key HOLD - a key the graph recorded as a change AUTHOR is mailmapped, while an attester, grantor, grantee, custody holder, manifest signer or admitted pusher holds a capability AT THE MOMENT IT IS PRINTED, and an alias there is a display that reads like an authorization claim. and where do the BYTES LAND - a mailmap is local display state, so it may reach a RENDERING and never an artifact whose bytes are hashed or re-ingested as a record. the second clause exists because of a site NEITHER the ticket nor a grep over the helper would have reached: git_mirror author_identity resolves a key the graph recorded as a change author and does not call that helper at all, so question one alone says mailmap it - and that would make a git mirror commit SHAs depend on a LOCAL UNTRACKED DISPLAY FILE, so two machines reading one repo would build two histories. applying the ticket rule mechanically would have INTRODUCED that defect, which is why the rule ships with two clauses and that site is named as its proof. of the four sites the ticket listed, three are mailmapped and tag is NOT: every key handed to that closure is an ATTESTER, the same key attester_trust decides the listing with, and that is the direction where a wrong call is security-shaped, so it stays put with the reason at the site and a pinned positive control. the four were four hand copies of one function body, which is HOW they drifted without anyone choosing to, and the body is now spelled once so there is no ladder left to copy. the grouping table is DELETED rather than narrowed: the enum grows ALL and a name round trip, parse SEARCHES that list and the refusal joins it, so the accepted set and the advertised set are one list read twice and the eighth vacuous pin becomes UNREACHABLE rather than watched - its replacement is pinned against an INDEPENDENT oracle, the hand written usage line read from source in another compilation unit, so a variant the parser accepts and the usage never mentions now reddens. AGENTS.md gains the class and explicitly NO guard, and the no-guard half is EVIDENCED rather than preferred: the census one would naturally write, over that helper call sites, would have caught four of the five instances and MISSED the git mirror - a guard that reads complete and is not would be one more instance of the class it exists to catch (#1832) 0cd1d291 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.