Changes touching this path

• the persisted plaintext digest is REFUSED, and the ceiling is the decisive half: the ticket estimated roughly 250 ms and the measurement says 43.9. two knowingly-wrong binaries from one tree differing only in the mechanism, interleaved, twelve runs a side over four rounds on an idle machine - every loose read deleted reads minus 43.9 ms, and the read replaced by one stat per path reads minus 22.3, with the sets DISJOINT in every round and the bands SUMMING to the region, 22.3 plus 21.6 against 43.9 end to end. the stat arm is the honest ceiling under the never-authoritative rule, so a SOUND index tops out at 22.3 ms against a tier spread of about 13, BEFORE it pays to read, parse, look up and rewrite itself - and the stat does not even buy equivalence, being blind to rotted FRAMING, which decode_object refuses today and which is can_open answering false. the ticket carried both answers already: three paragraphs above its own roughly-250 figure it quotes #1591 measuring the span at 207 ms with ZERO object reads, and that is the reading this reproduces. the custody argument was written FIRST, before any code, and refuses on five grounds of which the first and the fourth are each sufficient alone. can_open needs the seal own vis and the grant state, and vis sits OUTSIDE the content address - sealed.rs pins that appending the world grant must not move the address - so an index keyed by the address is a cache WHOSE KEY DOES NOT DETERMINE ITS VALUE, justifiable only by nothing rewrites a vis today, which is the reasoning the ticket itself forbids. invalidation splits in two: correctness is cheap and DESTRUCTION is not, because burn leaves the change graph, the ids, the signatures and the keyring untouched, so after a burn the key is still held and a surviving plaintext digest is a CONFIRM-A-GUESS ORACLE over exactly what the burn destroyed - and erasing it means rewriting the index in EVERY position and on every peer honouring a purge, which an older loot would silently not do. object_store had already refused this shape in the module that would host it: a burn whose two lists disagreed is ciphertext coming back from the dead. the rotted case is not a fourth way to guess but something worse, because the digest was recorded while the bytes were readable and so is still RIGHT - same_content would call a path clean out of the index while surface propagates HeldUnreadable for the same address in the same tree, one tree and two books, the class #1581 closed three commits ago. and ADR 0004 deleted this field once already, behind a guard that is a claim about the STRUCT, so it stays green while the forbidden thing moves into a sidecar file: a pin defeated by RELOCATION. so what lands is the decision as ADR 0086, a positive control proving a fixture reaches the code at exactly 2N+1 gets and N reads against 1 read on the ceiling build, and one glossary correction - and what does not land is any index. two citation corrections ride along: the expired-grant trap is #20 rather than #536, and that trap is already OUTSIDE can_open, asked beside it as an in-memory manifest lookup costing no read (#1595) d5f75151 · dbf3dbe6…
• the removal wait stops reading a FAILED SCAN as an absent file, and the hole was that ONE fallible answer served two callers needing opposite failure behaviour: the precondition, where false-on-failure makes the assert FIRE and is safe, and the exit, where it makes the wait STOP and is not. the scan now answers three ways rather than two - named, not named, or the scan did not run. NotFound stays not-named, because an absent directory naming nothing is a statement rather than a failure; every other error is an Err; and each caller decides explicitly, the precondition panicking with its own message about failing to establish its own precondition, and the exit leaving ONLY through a scan that RAN and did not name the address, waiting a transient error out on the same store budget the removal already followed one level up. flatten is GONE, and it matters at the exit for the same reason, one entry wide: the entry whose read failed may be the very address being waited on, so flatten reports not-named for a name the scan never reached. the proof is a REAL failing scan rather than a simulated one - a regular file standing where the objects directory goes is a genuine OS refusal, error 267, reachable with no second process - and the two arrangements are DISJOINT on one fixture: with the fixed exit it is 0 passed 4 failed naming that error, and with the pre-fix exit restored it is 4 passed 0 failed, which IS the quiet success, reproduced rather than argued. #1596 is otherwise untouched, same helper and same budget. the projection neither surface derived is settled by naming WHICH QUANTITY SCALES: the honest half, being the only arm a design satisfying the never-authoritative rule can reach - so 22.3 becomes about 223 at ten times the paths, on BOTH surfaces, with measured now separated from extrapolated, since the read COUNT is linear and pinned at three sizes while the TIME was measured at one. 223 is therefore the order of magnitude at which to re-open the question rather than a reading, and the other arm about 439 is named as explicitly not the number to quote. the pin the ADR claimed is now the pin the test asserts, strengthened rather than narrowed because the numbers had already been observed: the two-per-path-plus-one relation holds EXACTLY at all three sizes, run rather than trusted, 101 against 50, 401 against 200 and 1601 against 800 - with the per-path multiplier and the fixed overhead kept as SEPARATE constants, since two-N-plus-one and three-N agree only at one, and with the old greater-than line deliberately NOT kept beside it, because over the constants this file writes it is green whatever the code does. four prose corrections ride along: a step that stated the conclusion its own section refuses, a caveat a commit message claimed and no file carried, two runbook short forms stronger than the long form they point at, and a count of three defects that lists two - which STOPS COUNTING rather than inventing a third (#1899) a9018dad · dbf3dbe6…diff
• the five-blind-instruments claim was recorded NOWHERE, and three sites cited an ADR that does not carry it - so the roster is derived from in-tree evidence and recorded ONCE, a five-row table whose rows are ticket, instrument, what it could not see, and the in-tree doc that records it. four of the rows came from a fixture doc that already named them, and the fifth from the counter crate description of a control that blessed a shape reading the tree ZERO times. and ONE NIGHT is wrong too: landing times on main put four of them across 2026-09-05 between 01:37 and 06:16 and the fifth at 14:00 THE SAME DAY, so it is one RUN rather than one night, which is what a sibling comment already called it. the count FIVE now appears in exactly one sentence, directly above its own table, where it is derivable as the row count - every other site states the property and cites the heading, carrying NO number of its own. that is the house answer this run reached two commits earlier: name the instances and stop counting. re-grepping found the same defect well beyond the three sites the ticket named - two more uncited fives, one of them attributing the finding to THIS run, three more citations of an ADR 0072 controls section that does not exist, and two comments reading three shipped instruments where a fourth had landed between the last two they name. the pin is what makes it hold: the citations must RESOLVE, so the heading must exist exactly once in the named ADR, the count word must equal the table row count with each ticket appearing once, and all six citing files must name the heading while NONE carries a count of its own - with the heading and the needle assembled at runtime so the file cannot satisfy the scan with its own constants. six mutations, each at ten passed and one failed, including a CONTROL that removes the whitespace-flattening and goes red, which proves the match is not trivially contiguous since three of the six citations wrap across comment lines. two of the six are each other DISCRIMINATION, one reddening only the count arm and the other only the citer arm. and what the pin does NOT do is stated in its own header rather than found out later: it does not check that the five rows are TRUE, each being a ticket and a code site checkable only by hand, and its citer list is hand-maintained, because deriving it by scanning would invert the check and wrongly demand a citation from the one site this ticket said to leave alone (#1664) 6a9d9cac · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.