Changes touching this path

• the relay store goes behind a RelayStorage seam, the SigV4 driver moves to its own crate, and an object-store relay is a second deployable the CLI never ships (#38) 330df915 · dbf3dbe6…
• a bucket-backed relay reaps, because the anchor is when the bytes last landed in the store and the store is what answers it, and the reap itself moves behind the seam so the standing exemption is one rule both backends run (#1166) 39e1e1eb · dbf3dbe6…diff
• the tutorial interrupt red #1916 read as a removal that lied is a tree made again after the sweep: on the linux runner std remove_dir_all answers success only once the root is gone, the captured transcript prints the first prompt ahead of the handler line, and walk, still running on the main thread beside the handler, opened with a create_dir_all over alice that minted the root back before ask beat the heartbeat into it. two delays injected into that sequencing reproduced the red and its alice, heartbeat remnant on this desktop with confirm_gone in place, so that check alone would not have closed it; Sandbox::create now makes alice before the handler is armed, the same two delays pass, and a unit pin drives the sweep, the walk and the beat in that order. what stays open is said at the fix: other writers, the relay thread and the loot subprocesses among them, can still put a path back mid-step. the CI run recorded the two readings and not the sequencing, so the mechanism is established by reading and by the reproduction rather than observed there, and workflow.md stops calling the report and the look one moment. the loot-s3 client keeps its 60 s budget for want of any measured rate to its bucket, but a request that runs out now names it and what it covers, where reqwest said error sending request or error decoding response body with no word of a deadline. the sdk doc stops claiming the native policy: the formula is copied, native allows the send budget between answer chunks where the sdk allows idleMs, the rounding differs, wire.rs now points back at the copy, and the unit test reads the floor from its constant. smaller: the engine.rs verdict compares the band against the band, the measure.rs refusals state a property instead of counting callers, the fixture generator import note sits at the import, and transportFailure takes a role rather than a string. red under mutation, counts read each time: create_dir_all put back in walk (11 passed and 1 failed, holding alice and heartbeat), the s3 timeout naming removed (12 passed and 2 failed), the sdk upload rounded down (6 passed and 1 failed), each restored to 12, 14 and 7 passed. no migration and no wire or format byte moves; the forge and relay deployables word a timed out object store request differently once next deployed, and no code in the tree matches on that text, so this owes no deploy. the workspace suite is green (4192 passed over 133 binaries, 9 ignored) and the sdk suite is green (137 passed over 13 files) (#2254) bdeb6a0c · dbf3dbe6…diff
• loot-s3 gives an object-store request a budget that grows with its body in place of one 60 s deadline over the whole transfer. a get now reads its answer read by read, so the 60 s client timeout, renamed IDLE_BUDGET, bounds silence and not length: an answer that keeps arriving is read however long it takes, and one that stops fails after IDLE_BUDGET and names how many bytes it got. a request that sends a body is held, as its own request timeout, to upload_budget: IDLE_BUDGET plus the whole seconds of the body at UPLINK_FLOOR_BYTES_PER_SECOND, a copy of the native uplink floor of 256 KiB a second. reqwest blocking sends the body inside the one wait for the answer to begin, so an upload can have a deadline and not a silence limit, as in loot-net (#2079), and that reasoning is recorded at the code. the formula is copied from loot_net::wire::transfer_budget with pointers both ways rather than moved to loot-core or reached through a new loot-net edge: the copy drops the rounding that keys a connection pool and the cap a loot host enforces, bounds the send alone, and a shared home would tie the rate for a client link to a loot host to the rate for a server link to its bucket. no rate for that link was measured, since no script in the scripts repo measures one; the floor is the native choice, not a measurement. a timeout on each wait names its budget and what it covers. pinned over loopback peers: a large get that stalls mid-body, a get whose answer keeps arriving past the idle budget, a put the store reads slowly past it, a large put the store stops reading, and the formula on its own. red first (13 passed and 5 failed). red under mutation, counts read each time: the get read by one bytes() wait (17 passed and 2 failed), no deadline on a request with a body (17 and 2), the body earning nothing (16 and 3), the body capped at 64 MiB (18 and 1), part seconds rounded up (17 and 2), a deadline on every request (18 and 1), a read timeout not recognised (17 and 2), the put deadline not named (17 and 2), each restored to green (19 passed). no migration, no format byte and no published wording moves; loot-forge links loot-s3, so this is live once the forge is redeployed, and loot-relayd links it too but the relay the scripts repo deploys is loot serve, which does not. the workspace suite is green (4370 passed over 138 binaries, 12 ignored) (#2309) ac9b9c50 · dbf3dbe6…diff
• the review-sweep fix-up over #2308, #2310, #2311, #2312 and #2313. the lock note beside a failed test is said only on a Windows land: loot-hygiene failed_tests now takes whether the run was on Windows, since os error 5 and 32 are an I/O error and a broken pipe on macOS and Linux, and loot-first passes cfg!(windows); both answers are pinned on this host, red under mutation with counts read each time (recognised everywhere 2 passed and 1 failed, nowhere 0 and 3, loot-first passing false 1 and 4). the plain pre-land test finding now prints the re-run-first recovery the merged pass prints, for each gate row that runs programs and rides the merged pass, derived from the row and pinned whole (no triage 3 and 2, ignoring the merged pass or the row judgement 4 and 1 each, the order swapped 4 and 1). the timing line noun is a ServerKind enum whose relay and forge lines are pinned byte for byte (a misspelled noun 7 and 1), and the loot-s3 put refusal calls the idle duration the idle budget and keeps floor for the rate (the old word 18 and 1). tutorial.rs qualifies the #2311 halt as run on Windows and reasoned elsewhere, and a reap failure no longer prints could not run; ADR 0075 names the graph read by MetadataStore::repo_change_graph and its callers rather than a list that missed propose::admit; sync.rs states the store property the scoped forge offer rests on and what would break it, and its round-zero comments speak of the remote; land-change SKILL.md, workflow.md and ADR 0055 carry the re-run-first order and the Windows-only note. the (idle, uplink_floor) data clump in loot-s3 is left as it is. no migration, format byte or wire byte moves; the loot-first change is live once the primary release binaries are rebuilt. the workspace suite is green (4406 passed over 139 binaries, 13 ignored) (#2348) 77d9c94c · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.