Changes touching this path

• the attestation lane has one machine row, and it says whether the listing is raw or folded. loot manifest and loot notes show gain --porcelain/--json through loot_cli::attestation_shape, one row for a lane record spelled once over the record rather than per verb: the change and the attester key as full hex, a closed kind word (role, landmark-note, landmark-retire, note, reserved), a note generation, an open flag set (removed, unprintable) and the payload last, marked R for manifest listing every record as held and F for notes show listing the trusted live register, with folded in --json; manifest also emits its grant book as G rows ahead of them, by the absorb precedent of #1837. what a role carries is read through a new loot_codec::reserved::ReservedRecord::parse that reads the envelope tag once, and render::role_display now matches on it without a wildcard instead of trying the landmark parser and then the note parser - the door #1850 asks for, built only as far as this row needs; a scratch variant fails to compile at both matches. only the notes show leaf takes the flags, and the writing leaves refuse them naming it. the prose of both verbs is byte-identical, measured against the v0.4.20 primary binary on one fixture, where both verbs refused a machine flag with unknown_flag, so no frozen row moved. PROSE_ONLY_CEILING comes down 53 to 51 as the #1519 entry paid, ADR 0066 tiers move 28 to 30 and 52 to 50 with the #1519 amendment marked paid, ADR 0023 gains the amendment recording the rows, flags and JSON fields, and CONTEXT.md the Attestation entry. red first, four ways: every row marked R reddens the shape pin, the notes pin and the spawned pin (6 passed, 2 failed; 2 passed, 1 failed); notes show building its rows from the raw lane reddens the notes pin and the spawned pin (7 passed, 1 failed; 2 passed, 1 failed); manifest dropping its grant book reddens the manifest pin (7 passed, 1 failed); and the door misreading the note tag reddens the codec pin (4 passed, 1 failed), five cli pins (4 passed, 5 failed) and two spawned pins (1 passed, 2 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3911 passed over 123 binaries, 7 ignored) (#1846) 5f1a824d · dbf3dbe6…
• the reserved-role envelope is read and written in one place, and loot tag reads its listing through the door. reserved.rs now owns SENTINEL and is_reserved_role (re-exported from landmark, so every path other crates use still resolves) and a crate-private envelope writer; ReservedRecord::parse strips the sentinel and splits the tag off once and hands the body to Landmark::from_body or Note::from_body, which parse only their own fields, and Landmark::parse and Note::parse are now the wildcard-free landmark and note arms of that parse rather than second readings of the envelope. tag.rs build_landmarks matches ReservedRecord::parse without a wildcard instead of Landmark::parse plus is_reserved_role, so a scratch variant fails to compile there as at render, attestation_shape and the two per-type views (E0004, checked and reverted). Note::parse is not made stricter. a table test freezes the pre-#1850 landmark and note parsers as an oracle and runs every role joined from twelve fields up to five deep through Landmark::parse, Note::parse and ReservedRecord::parse, green before the move and after it, and a second pin spells out the role bytes both records write. red under mutation: the empty-name check dropped from the landmark body (2 passed, 1 failed), the door matching the note tag case-insensitively (2 passed, 1 failed), and the envelope writer appending a sentinel (1 passed, 2 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3925 passed over 123 binaries, 7 ignored) (#1850) fcd4a153 · dbf3dbe6…diff
• sweep 3 fix-up over #1849, #1850 and #1853. the afk-loop sweep states one rule for a declined blocker, admitting the ticket for the scope that survives and naming the declined part, or excluding it with the declined blocker as the failing condition when nothing survives, and names the 100-comment cap of gh issue list, with gh issue view as the full read. the executor pin now edits a merge target through the real verb and reads both parents back, and it fails when a minting Refit variant goes undriven: executor_pin records each variant it sees through a wildcard-free match, and the test destructures that record without a rest pattern. plan_move and plan_reorder ask the draft rule of move_edges and reorder_edges, the derivations minted_edges declares, instead of their own copies; MintedEdge names the edge tuple; the Reopen comment says first parent; counts beside growing sets in refit.rs, landmark.rs, CONTEXT.md and the skill point at the set instead; the range-diff Handle control names the type the compile_fail probe imports. declined: a MintedEdge struct, since readers destructure the tuple and a struct adds no invariant, and a shallower reserved-role oracle, measured at about half a second, since four fields deep builds no landmark and fails its own class count (0 passed, 1 failed). red with the every-parent fix undone, the merge-target case (0 passed, 1 failed); red under mutation: a dropped duplicate case (0 passed, 1 failed), move_edges keeping the source on its old parent (0 passed, 2 failed), an undestructured Seen field (E0027), and the Handle type renamed (1 passed, 1 failed). no migration, no wire or format byte moves, and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3925 passed over 123 binaries, 7 ignored) (#2057) 9634e655 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.