Changes touching this path

• the negotiation walk stops re-probing an address once per change that references it, and the spelling that does it is not the one the ticket proposed: a change carries its whole tree (#288), so offered_objects probed the store 218,000 times to produce 935 distinct addresses on a 436-path 500-change fixture, 99.6 percent of it redundant, and the gated point decomposed to 2,328 of its 2,928 object_gets being negotiation alone. The skip is a probed set rather than the ticket body's addrs.contains, because addrs holds only the ACCEPTED set: a withheld (#891), burned or in-flight address is Err on every occurrence, never enters addrs, and would keep paying the full per-change cost - which is also the one case where the probe is a failed file read rather than a memo hit. That difference is not an argument, it is a test: weakening the skip to the ticket's spelling leaves the offer pin green and fails an_address_the_store_does_not_hold_is_refused_once_not_once_per_change at 55 gets where 32 are owed, which is the number its own message predicts. bundle_impl memoises exactly the two address-scoped facts, whether the store can produce it and whether it is ANYONE-granted, and that second one is what kills the per-occurrence linear grant_ids scan; vis and bytes_ride are occurrence-scoped and stay in the loop, and hoisting the Embargoed gate into the memo - the plausible over-reach, and the one a reviewer would have to rule out - was proved red by a peer receiving ciphertext it can never open. locally_missing_objects carries the same shape and is deliberately scoped out rather than folded in: its probe is ObjectStore::contains, which carries no loot_count tally at all, so this ticket's own named signal is structurally blind to it, and under the rule that a change measuring flat does not land it needs an index-probe counter before it needs an edit. The producer spelling is untouched throughout (#1565), so the first probe of every address is unchanged and this is not the contains swap #1559 measured and refused. object_gets falls 2,928 to 743, -74.62 percent against a predicted -74.6, while object_disk_reads stays flat at 200 and offer_addresses, offer_addresses_delta1 and offer_bytes are byte-identical, which is the pin that the answer did not change rather than merely got cheaper. ADR 0073's present-tense cell reading 2,928 on the gated fixture is repointed to name docs/benchmarks/series as the owner of the current figure rather than deleted, and its dated evidence blocks are left exactly as taken (#1701) Perf-Baseline: reset #1701 dedupes the negotiation walk's per-occurrence store probes, so object_gets drops 2,928 to 743 with every artifact counter and every negotiation counter unmoved f3cdd5b2 · dbf3dbe6…
• the fix-up a cross-ticket review sweep asked for, and both halves were the same defect wearing different clothes: a claim stated where nothing can check it. surface_with_report_reusing's doc said Workspace::surface_plan is the only caller and meets the precondition by construction, which was wrong twice - surface_plan calls it nowhere, being the PRODUCER of the set, and it lives in loot-cli while the door lives in loot-core, so the sentence named a function one crate away as a caller it is not. The door is also pub, which makes the only caller half unenforceable in principle rather than merely untrue today: a caller in any crate compiles without meeting anything. The replacement names the real set, verified by grep - surface_with_report passing an empty set, Workspace::surface_with_report_reusing as the one non-empty caller, and three in-module #1703 tests that hand-build the set, two of them naming a path the reader may not open, which are the standing demonstration that this walk will accept anything at all. A second sentence understated its own mechanism and is corrected in the same pass: surface_plan does not merely record which change it measured, SurfacePlan::already_on_disk_at COMPARES and returns an empty set on mismatch, so the same-change precondition does have an enforcing mechanism and it too is one crate away. That asymmetry is worth naming because it sizes #1710: the set-vouching half has no mechanism anywhere, the same-change half has one in the wrong place, and only one of them needs a type moved. No API changes here - making the door private is #1710 and is deliberately not smuggled in. The other half is three authored figures sitting inside the doc of prove_the_walk_repeats, the non-vacuity control this whole file rests on, saying 192 occurrences against 31 addresses and a 6.2x gap while the assertion below pinned none of them, so editing PATHS or CHANGES or EDITS left all three silently stale in the very place that exists to stop un-grounded claims. OCCURRENCES is now derived as CHANGES times PATHS, the bare literal 4 already in the assertion is named MIN_GAP, and the floor is a const assert that fails at COMPILE time before any fixture is built. Four arms proved it rather than argued it: the baseline reproduces 192 and 31 and 6.2x exactly, so the fixture being reasoned about is the one the old prose described; widening to twelve paths moves the figures to 372 and 42 and 8.9x with everything green, which is precisely the silent staleness that used to be possible; collapsing the gap to one path fails to compile with the floor's own message; and re-authoring OCCURRENCES back to 192 against twelve paths goes red at 288 versus 192. The module header's other readings are marked a dated reading that nothing asserts, following lane_new_sweep.rs, because they come from fixtures this file cannot see and deriving them here would be a second invented claim rather than a fix (#1709) 1b45fed0 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.