Changes touching this path

• verbs/: seam scaffold + the repo family (init/clone/config) (#661) 28849eaa · dbf3dbe6…
• verbs/attest: manifest/attest/buoy (#661) d1122e4b · dbf3dbe6…diff
• emit_snapshot calls verbs in-process; test-support feature retired (#661) 8033f451 · dbf3dbe6…diff
• a named landmark stops needing a format major to carry its message, because a landmark IS an attestation under a reserved role envelope the signature already covers — and that is also what keeps a retirement from eating the thing it retires, since the attestation log is keyed by (change, attester, role) and writing both under one role made the retirement silently REPLACE the attestation rather than record beside it (#1508) 2d06014f · dbf3dbe6…diff
• a flags value stops being read as a flag, because `FlagSpec::given` asks in flag position the way `positionals` already does and every verb-local scan in both binaries is deleted behind a census that refuses the shape — which is what had `loot tag -m "-d"` signing a retirement, `loot describe -m "--no-snapshot"` silently skipping the capture, and `loot-first land --allow-publish "--skip-tests"` skipping the gate that is its whole job (#1612) b40e1843 · dbf3dbe6…diff
• tag and buoy stop disagreeing about whether a landmark is live, and the disagreement turns out to have been built by a sentence that was true of the resolver and read as true of the verb: both module docs said buoy is untouched by construction, which holds for loot_core buoy resolve and is false of the verb the operator runs, so the fix is entirely in what buoy consults and resolve is not changed by one line. a retirement annotates and never withdraws - that was already decided rather than open, since ADR 0025's #1508 amendment calls a retirement advisory, and four recorded facts each independently forbid withdrawal: there is no trustworthy order to withdraw by because newest is topological precisely since authored_at is advisory and never an ordering input; the attestation log is keyed by change, key and name so re-attesting after a retirement is a no-op, which would make retire the one permanently destructive verb on an append-only lane by a route that deletes no byte; buoy trusts peer-registry union self, so under withdrawal any registered peer could silently un-name somebody else's landmark; and the result would be the mutable ref that ADRs 0022 and 0025 exist to reject. so buoy now reports the retirement it already resolved through, in all three formats, additively - the B row and the human answer line are byte-identical to their pre-fix selves and the porcelain contract pin stayed green through a revert that reddened three others, which is the additive claim proving itself. an un-retired control runs in the same test so both-mention-retirement cannot pass on a verb that always mentions it, and four independent reverts were each proved red including one dropping the trust gate, which surfaced a stranger's validly signed retirement. no record is deleted or rewritten, so #1508's AC3 stands and its pin passes unchanged; the false sentence is narrowed at both copies rather than deleted, naming resolve as its subject (#1611) ac8ee01f · dbf3dbe6…diff
• nearest-landmark naming lands, and the one real trap in this ticket is that distance is not well defined on a DAG: the number printed is the count of changes reachable from the selector and not from the landmark, which is what git rev-list counts for landmark..selector, and it is not a path length - pinned over a diamond where one input reads 5 as a count, 3 as the shortest path and 4 as the longest, because a straight-line fixture cannot tell the three apart and would have pinned nothing. the briefing had this backwards: git describe does not count the longest path, its number is the cardinality of the same set difference, so taking the count here agrees with git rather than departing from it. a shortest path would call you 2 changes past a landmark that fifty changes have landed on top of, and a count is the size of a set, so nothing in it depends on a traversal order or on a clock - which matters on a lane where authored_at is advisory and never an ordering input. the candidate set is deliberately not the one loot buoy resolves: buoy keeps only the maximal attested change per name, so running nearest over that answer would report no landmark for every change below the tip of a name that has moved, when an older v1.0 is exactly what a change under the newer one comes after - so attested applies the same three ADR 0025 filters across every non-reserved role and skips the maximality reduction, and that split is pinned by asserting both halves in one test. ties are refused rather than broken: two landmark NAMES at the minimum distance exit 3 and are named, the ground ADR 0025 already refuses an ambiguous buoy on, while one name on two tied changes is not ambiguous at all, since every tied change renders the identical string and there is nothing to pick between. three things were widened rather than copied - the ancestor walk now has one home in buoy::ancestors, reached by the maximality reduction, by the new distance and by Workspace::ancestors_of, where there were about to be three walks; the three attestation filters are one predicate; and --dirty asks the same reflected-tree question the converge chokepoint and bisect start already ask. --nearest is the first valued flag this verb has ever had, so the door hands it the token that follows and loot buoy --nearest --dirty would have resolved a selector spelled --dirty, silently dropping the marker: refused by name, the remedy config --get landed, with the door handing the flag over asserted as the control. no landmark anywhere in the ancestry falls back to the short version id and still exits 0, because an answer was produced rather than withheld. (#1509) b7b0b031 · dbf3dbe6…diff
• loot notes lands as a SECOND WRITER ON THE ATTESTATION LANE rather than as a record type of its own, so AC3 and AC6 arrive FREE and the wire does not move: a note is an attestation carrying a reserved role, the sibling of #1508 landmark record in the namespace the TAG field was shaped to admit, so every shipped reader parses the bytes, FORMAT_MAJOR does not move and NO RELAY OR FORGE REDEPLOY IS OWED. the visibility rule is the decision and it is DERIVED rather than chosen: the attestation lane carries no key and no grant list and rides the bundle beside the change it names, so a note audience is EVERY HOLDER OF THE CHANGE including a relay holding no content key - on a wholly-Internal change that audience can already open every byte, so no text ABOUT it can tell them anything new, and that implication FAILS THE INSTANT one path is Restricted or Embargoed. so the verb REFUSES on a change recording any path sealed narrower than Internal and names the paths, while Published PASSES because it is Internal plus world, a WIDER audience. inherit was rejected on its own terms - a Change HAS NO SINGLE VISIBILITY, that is the founding sentence of the glossary, so inheriting means a key granted to the INTERSECTION of holders which goes stale on every grant and maroon - and own-visibility was rejected because it is the only option that can OVER-disclose, making the safe answer an operator choice every time on an append-only already-delivered lane. an allow-leak hatch was declined because it would consent to nothing enforceable. the gate is the unconditional FIRST STATEMENT of the write path above a match exhaustive over the three writing ops, so a fourth does not COMPILE until it has an arm, and the limit is stated rather than implied: the check is at WRITE time, a path demoted afterwards leaves the note standing, and burn is the verb for that. seventeen mutations, each red with the count read, and both risky pins carry POSITIVE CONTROLS - the version-id pin mints a real version three lines below the assertion that notes did not, and the visibility pin has a peer who provably CANNOT open the sealed object reading the note in the clear beside it, each half the control for the other. a smoke run caught a defect this change had introduced rather than inherited: a multi-line note broke the attested-by line at column zero, so the cut is made AT THE DOOR, which covers a multi-line tag message that was latent and never exercised (#1519) 0ec3069f · dbf3dbe6…diff
• the note rule moves to the LANE WRITE SEAM and stops being a property of one verb: Workspace::attest takes a Record rather than a role string, so there is NO OTHER WAY TO SPELL A ROLE IT ACCEPTS, and two wildcard-free matches answer for every variant - role mints the string and refuses an operator one in the reserved namespace, prose declares the free-text payload and Some IS the gate. adding a fifth variant produces TWO compile errors, one per match, which is the obligation put where a list cannot be forgotten. all three doors were REPRODUCED FIRST and a FOURTH was found that no ticket named - tag --retire -m writes the operator reason to the same lane - which is why the repair is a seam rather than three verbs remembering. door one is REACHABLE rather than theoretical: unwrap_or_default meant an unreadable tree read as NO SEALED PATHS and allowed the write, and a shallow position supplies one, because HEAD~n walks one parent edge past the oldest change HELD and resolves onto a FRONTIER ID - signed, named as a parent, not held - so the gate now fails CLOSED and names fetch --deepen. door two leaked real bytes end to end: notes add refused, then attest with a reserved-shape role exited 0 and show printed the secret on a Restricted change. and ADR 0025 had that door WRITTEN DOWN AS AN ACCEPTED COST, saying a user who reaches past the verb can still attest the sentinel and the signature binds it to their key - the hole was documented as the price of the encoding, and it was a DEFECT rather than a cost, because the role parses back as a note, renders as one and rides the bundle as one. tag -m is GATED rather than excepted, and the line is KEY VERSUS PAYLOAD: a landmark name is a namespace key a reader re-types and matches by equality, so gating it would take ADR 0018 sign-off and ADR 0025 resolver down on every change in a repo with one sealed path, while a message, a reason and a note body are prose ABOUT one change content. that refuses tag -m in THIS repo, where .lootattributes seals a path on every change, and the bare name, the bare retirement, buoy and attest all still work. eight mutations with counts read, and mutation three is the argument: neutering the seam reddens three pins while #1519 OWN PIN STAYS GREEN, which is why the first gate could not see any of this (#1847) 93cc4944 · dbf3dbe6…diff
• the note rule is a refusal on a LOCAL WRITE and the documents now say so in the first sentence a reader meets, because the claim that it is a property of the LANE was false in the direction nobody had checked: ingest inserts on att.verify alone, so a peer prose about a sealed change is stored and printed while the IDENTICAL TEXT FROM THE LOCAL OPERATOR ON THE IDENTICAL CHANGE IS REFUSED. that was built end to end rather than argued - a peer DagRepo not running the seam, a real sync bundle, apply_bundle, and the secret read back in the clear. gating ingest is REJECTED on four counts and the first two decide it: a drop destroys the local holder ONLY EVIDENCE OF A DISCLOSURE THAT ALREADY HAPPENED, at the one party who can act on it with burn, re-seal or rotate, and the remote author already had the plaintext so refusing un-tells nobody; and it would make the lane contents READER-DEPENDENT, where membership today is a property of the BYTES - a signature verifies or it does not, the same answer at every reader - so one peer would keep what its neighbour drops, the dropper would stop forwarding, and the lane would PARTITION. the third count is that it is not even COMPUTABLE where the ingest happens: the attestation loop runs BEFORE change nodes enter the graph, so a first-delivery record has no tree, and a gate that fails closed would refuse the ORDINARY case. the note codec header carried the sharpest error, since that module is the DECODER and a claim that such records cannot exist is exactly backwards there. and tag partial write is made UNREPRESENTABLE rather than documented: attest_all judges every record - role minted, prose gated - and only THEN records them all and persists once, so an annotated create is TWO RECORDS AND ONE ACT and the pre-check is DELETED rather than marked load-bearing. it had been copied from the notes verb along with the sentence saying deleting it costs a message and never the rule, which is true of a verb that writes ONCE and false of one that writes twice - the refusal now leaves NOTHING behind, not even the landmark, verified end to end at 0 landmarks. four mutations with counts read, and the ingest pin fails on its LOCAL-WRITE CONTROL half when the local gate is neutered, so both directions are live in one test (#1855) 2bc8c51a · dbf3dbe6…diff
• the verb that reads two books stops returning after the first: manifest returned no grants recorded BEFORE it ever called all_attestations, so every repo that tagged a release without sharing a sealed path read as though it held no attestations at all - confirmed by a real run rather than by reading, a scratch repo with one tag and no grant printing nothing from manifest while tag list showed the landmark and its note. the attestation read is hoisted ABOVE the empty-grants branch, so that branch OWN WORDING now depends on it, and the grant table moves into the else. three states where there were two: no grants and no attestations says exactly that in one sentence, no grants but attestations present prints the block under the same first line, and grants present prints both. the landmark naming from #1508 becomes reachable in BOTH states that have attestations, so a record renders as a named landmark carrying its note rather than as a raw envelope. grant-table bytes and attestation-block bytes are unchanged - what changed is REACHABILITY. the neighbouring class was checked rather than assumed: this verb had exactly ONE return, the other five in the file are refusals with nothing downstream to skip, and the sibling empty-early-returns across the CLI - grants peek, purges, shortlog, oplog, lane sweep and view - are each single-book verbs whose early return skips only the rendering of the same empty thing. manifest was the only verb reading two independent books. and the run caught a VACUOUS PIN OF ITS OWN, one level inside the defect it was fixing: the first empty-case test asserted a constant AGAINST ITSELF, green for any wording whatsoever, so the mutation collapsing the two empty states came back GREEN at 8 passed 0 failed and proved nothing - both tests now assert the LITERAL strings, that mutation is red at 7 passed 1 failed, and the reason is recorded beside them so the next reader does not rewrite it back. four mutations with counts read, and the three surfaces that describe this verb - the usage line, the README and the docs page - now agree with what it actually does (#1610) 21edfeb8 · dbf3dbe6…diff
• the caller count is DELETED rather than corrected, because changing two to three leaves a number a FIFTH caller falsifies and the next reader writes this ticket again - the shape the previous commit had just fixed, re-created one commit later, which is the #1553-into-#1554 recurrence with the doors swapped. both surfaces now state the PROPERTY and name no count: the function tallies nothing, counting an object read is the CALLER job, only one door does it, and one of the callers structurally CANNOT, because loot-net declares no loot-count dependency at all. a census is built where a census can be honest: it derives every call site from source across the workspace with line-comments stripped and the needle assembled at runtime so the file cannot match itself, and asserts a SET EQUALITY of file and occurrences rather than a count or a non-zero - so a new, moved or door-changed call site reddens with a message naming the decision the change owes - plus a second test that fails if loot-net ever gains the counting dependency. and what the census deliberately does NOT do is stated in its own header rather than discovered later: it does not derive TALLY-STATUS, because whether a call site tallies is a property of its ENCLOSING FUNCTION and no text scan takes that scope honestly - a line window reads past short functions and stops short inside long ones - so a guard that read complete and was not would be one more instance of the class it exists to catch. tally-status stays prose; what the census closes is the door that let the prose go stale. the false universal is restated rather than weakened: every-read-out-of-the-object-directory-comes-through-here was false, since a verify scan reads bare and pack files live in that directory and are opened raw - so the sentence now names the property that actually carries the gate, that no COUNTED door reads out of the object directory, with the counted doors enumerated. that is not weaker for gating, because only a counted read can move the number, and raw reads existing is precisely WHY they cannot disturb it. the same false universal was then found on two further surfaces the ticket had not named, and fixed there too. the glossary sentence becomes GENERATED and is held to the gate own membership by a new pin, with the stale second sentence DELETED rather than corrected and the pin own limit stated in both the file and the test. the ADR summary states the property instead of a number, its compiled-out bullet is emitted one per counter row, and its both-counters line is scoped to the object pair. five mutations with counts read - and the last two are EACH OTHER discrimination, one reddening the glossary while the signals table stays green and the other the reverse, which is what shows the second doc pin is not a duplicate of the first (#1903) c0678a74 · dbf3dbe6…diff
• a verb arm now receives the argv door answer instead of the raw slice: VerbRun takes an Admitted value, the rebased tail bound to the spec of the row it was dispatched from, and its readers are the only way in, so argv[0] or argv.first() in an arm fails to compile (both planted, read as E0608 and E0599). spec_of is test-only and its 104 production lookups read through the admitted spec; six of the seven raw-index arms (bundle, grant-status, embargo-status, attest, resolve, completions) read positionals through the door and relay reads its leading word through a named exception; subcommand families resolve their leaf into a new Admitted, and bisect and buoy are handed one ahead of the table. the two named exceptions, leading_word for relay and bisect and pass_through_tail for the bisect run command, plus the one process argv read, are held to a named set of functions by a new census that went red on a planted leading_word read in cmd_bundle, and the source walker consumer header now counts it. refusals and output are unchanged by every suite and by a read of each migrated arm, with one exception found on the way: resolve with a trailing --tool and no command read --tool as the file and now refuses with the usage line, pinned by a new test. CONTEXT.md gains the Admitted argv term; loot-first keeps its own spec_of and DECLARED_READS is untouched (#1929) d92e95f2 · dbf3dbe6…diff
• the attestation lane has one machine row, and it says whether the listing is raw or folded. loot manifest and loot notes show gain --porcelain/--json through loot_cli::attestation_shape, one row for a lane record spelled once over the record rather than per verb: the change and the attester key as full hex, a closed kind word (role, landmark-note, landmark-retire, note, reserved), a note generation, an open flag set (removed, unprintable) and the payload last, marked R for manifest listing every record as held and F for notes show listing the trusted live register, with folded in --json; manifest also emits its grant book as G rows ahead of them, by the absorb precedent of #1837. what a role carries is read through a new loot_codec::reserved::ReservedRecord::parse that reads the envelope tag once, and render::role_display now matches on it without a wildcard instead of trying the landmark parser and then the note parser - the door #1850 asks for, built only as far as this row needs; a scratch variant fails to compile at both matches. only the notes show leaf takes the flags, and the writing leaves refuse them naming it. the prose of both verbs is byte-identical, measured against the v0.4.20 primary binary on one fixture, where both verbs refused a machine flag with unknown_flag, so no frozen row moved. PROSE_ONLY_CEILING comes down 53 to 51 as the #1519 entry paid, ADR 0066 tiers move 28 to 30 and 52 to 50 with the #1519 amendment marked paid, ADR 0023 gains the amendment recording the rows, flags and JSON fields, and CONTEXT.md the Attestation entry. red first, four ways: every row marked R reddens the shape pin, the notes pin and the spawned pin (6 passed, 2 failed; 2 passed, 1 failed); notes show building its rows from the raw lane reddens the notes pin and the spawned pin (7 passed, 1 failed; 2 passed, 1 failed); manifest dropping its grant book reddens the manifest pin (7 passed, 1 failed); and the door misreading the note tag reddens the codec pin (4 passed, 1 failed), five cli pins (4 passed, 5 failed) and two spawned pins (1 passed, 2 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3911 passed over 123 binaries, 7 ignored) (#1846) 5f1a824d · dbf3dbe6…diff
• every place that repeats a stop now says what --continue will and will not do, and an F row carries the role as it was signed. resume::continue_clause is the one wording, read through ways_out, once_resolved and stop_advice by the stops, by the in-progress note status and conflicts print (which said only --continue once loot conflicts is empty), by the wrong-verb refusal (which said --continue finishes it), by apply-patch (whose own copy never said its clean paths stay unwritten), and by the apply and merge stops, which now name both ways out without the disclaimer, the reason written at stop_advice. a census in resume.rs refuses a production line of loot-cli outside that module that spells --continue, USAGE lines carrying USAGE_NOTE excepted, and its first run caught the move --before USAGE line paraphrasing the note without its disclaimer, which every_stopping_verb_documents_one_resume_sentence misses because it reads one line per verb. the note fold carries each live record role as signed (loot_core::note::LiveNote), so notes show --json role is the signed bytes for a generation spelled +2 where it was re-encoded as 2; every other row byte is pinned unchanged through the spawned binary, ADR 0023 records the amendment, and Note::parse is not made stricter, since this repo lane held no records to measure and refusing would reclassify signed records held elsewhere. manifest prose names an attester through attestation_shape::attester_name, the naming its JSON used, so the own key stops printing as hex there; unprintable is one const in delta_shape; ADR 0066 says notes stands for notes show; the ChangeGraph insert doc states its rule instead of a caller list; Pathspec::matches names the crate-private policy items instead of linking them, which removes five cargo doc warnings. declined: compile_fail,E0624, measured inert on the pinned stable toolchain (a probe edited to E0599 stayed green) and honoured only under RUSTC_BOOTSTRAP=1, the reason written at the probe. red first: the new pins failed before the fix (resume 21 passed, 2 failed; attestation_machine_shape 3 passed, 1 failed; apply_patch 12 passed, 1 failed); with the fixes undone in two rounds, the in-progress note, apply-patch copy, apply advice, re-encoded role and hex naming redden the census (1267 passed, 1 failed), apply_patch (12 passed, 1 failed), attestation_machine_shape (2 passed, 2 failed) and resume (21 passed, 2 failed), and the fold re-encoding, the old wrong-verb sentence and the old merge sentence redden the codec pin (158 passed, 1 failed), the census (1267 passed, 1 failed), attestation_machine_shape (3 passed, 1 failed) and resume (22 passed, 1 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite ran 3917 tests over 122 binaries with 7 ignored, and all passed but concurrent_stage_of_same_address_does_not_tear, an os error 5 in untouched persist_codec code that passed on a loot-core rerun (637 passed) and three times alone (#2052) d5fad7c8 · dbf3dbe6…diff
• the reserved-role envelope is read and written in one place, and loot tag reads its listing through the door. reserved.rs now owns SENTINEL and is_reserved_role (re-exported from landmark, so every path other crates use still resolves) and a crate-private envelope writer; ReservedRecord::parse strips the sentinel and splits the tag off once and hands the body to Landmark::from_body or Note::from_body, which parse only their own fields, and Landmark::parse and Note::parse are now the wildcard-free landmark and note arms of that parse rather than second readings of the envelope. tag.rs build_landmarks matches ReservedRecord::parse without a wildcard instead of Landmark::parse plus is_reserved_role, so a scratch variant fails to compile there as at render, attestation_shape and the two per-type views (E0004, checked and reverted). Note::parse is not made stricter. a table test freezes the pre-#1850 landmark and note parsers as an oracle and runs every role joined from twelve fields up to five deep through Landmark::parse, Note::parse and ReservedRecord::parse, green before the move and after it, and a second pin spells out the role bytes both records write. red under mutation: the empty-name check dropped from the landmark body (2 passed, 1 failed), the door matching the note tag case-insensitively (2 passed, 1 failed), and the envelope writer appending a sentinel (1 passed, 2 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3925 passed over 123 binaries, 7 ignored) (#1850) fcd4a153 · dbf3dbe6…diff
• attest_all no longer has a fallible step that can fail part-way through its write loop. the keypair lookup and the signing move into the judging phase, and the write is one call to a new DagRepo::add_attestations, which verifies the whole batch before storing any of it, so a refusal leaves memory as it was found and not only disk. the old loop fetched the keypair and verified record by record, and only the unreached persist kept an earlier record off disk. the sentence saying nothing can reach the lane one record at a time is restated in workspace.rs, verbs/attest.rs and CONTEXT.md, since attest is public and is that slice with one record. the tag seam pin now also reads the store back after the refused act. red before the fix, the engine batch pin with record-as-you-verify (0 passed, 1 failed); red under mutation: the batch verifying only its first record (0 passed, 1 failed), and attest_all recording each record as it is judged (0 passed, 1 failed, on the in-memory assertion while the disk read-back stayed green). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3926 passed over 123 binaries, 7 ignored) (#1861) 4dbc7c83 · dbf3dbe6…diff
• buoy joins the dispatch table and bisect is left alone on the early path with the only reason that is still its own: #1764 made an output shape able to carry its own exit code, which was the whole of why buoy was dispatched ahead of COMMANDS, so the arm is gone and cmd_buoy returns a shape like every other verb. emit::Buoy reads ADR 0025 exit codes off the BuoyVerdict it already holds, one arm per row of that table, so the rendered answer and the code are one decision and the empty porcelain of the none row cannot come apart from its 2; buoy --nearest carries its code as a value on the message instead, having collapsed to one token with no structure to read an outcome back off; and buoy_write is deleted rather than moved, because the dispatcher outcome was already byte-for-byte the same #870 rule about a reader that left early. everything that walked the table and the buoy spec separately now walks the table alone — the telemetry note_dispatched call, the machine-output census, the verb census, the documented-flag census, the template-flag census, help_for and the completion list — and nothing is counted twice: the telemetry report is asserted to say buoy once, the table is asserted to declare no name twice, the offered completion names are asserted to hold each name once, and the census sum is now an equality with the table rather than the table plus one. going through the argv door means declaring an arity, so exactly one invocation moved: loot buoy reviewed junk refuses by name and exits 1 where an open claim used to drop the word and resolve for reviewed, which is #1562 reaching a verb that had been standing outside the gate enforcing it. every code is pinned through the spawned binary in tests/buoy_exit.rs, each outcome in every rendering it accepts. red under mutation, counts read each time: the verdict codes flattened to zero (buoy_exit 4 passed and 2 failed, emit_snapshot 12 passed and 1 failed), Message::coded discarding the code it is handed (loot-cli lib 1334 passed and 1 failed, buoy_exit 5 passed and 1 failed), the early telemetry call put back beside the one in the table (telemetry 2 passed and 1 failed, reporting buoy three times for two runs), buoy pushed onto the completion list beside its own row (loot-cli bin 125 passed and 1 failed, buoy_exit 5 passed and 1 failed), the row declared twice (loot-cli bin 121 passed and 5 failed), the row declining its arity again (loot-cli bin 123 passed and 3 failed, buoy_exit 5 passed and 1 failed), and the census sum left at the table plus one (loot-cli bin 125 passed and 1 failed). ADR 0025 records where each code now comes from and the one that moved, ADR 0076 closes the open work it had recorded and narrows the early-dispatch path to bisect, ADR 0066 moves the split inside its dispatched total, and CONTEXT.md stops naming buoy beside bisect. no migration, no wire or format byte moves and no host behaviour moves, so this owes no deploy. the workspace suite is green (4058 passed over 129 binaries, 8 ignored) (#1976) fa68a7d3 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.