Changes touching this path

• Spec the jj-ergonomics trio: ADRs 0029/0030/0031 (#138) (#141) * Dogfood drive: log day 2 (clean bridge day, 2/5) Day 2 was a git-clean day: the CA epic close-out had landed on main via PRs, so the ferry carried it across (4 commits ingested, 0 conflicts, 0 projected back; 146 objects pushed, resumable). Record the day in the drive log + evidence table (2/5). Also fix loot-day.ps1 doubling the "ferry:" prefix in the logged line (loot's own output already carries it). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Spec the jj-ergonomics trio: ADRs 0029/0030/0031 (#138) The hand-off deliverable of wayfinder map #132. Folds the three design decisions (#134/#135/#136) and the prototype's validated verb surface (#137) into three implementation-ready ADRs: - 0029 stable change-ids — durable random change_id beside the content version id; signature binds version_id ‖ change_id; divergence is a first-class data state; letters-vs-digits display; FORMAT_MAJOR 5→6. - 0030 implicit auto-snapshot + reconciled verb surface — snapshot on mutating verbs only; status read-only (-m dropped); new mints+prints the next change id; columnar log/status; divergent-change marker + `loot abandon`; demotion guard travels on the implicit snapshot; never signs. - 0031 operation log & undo — view-only undo over an append-only graph; op log grows on undo (redo); grant/maroon/pull-grants/push are non-undoable barriers; keyring/manifest/escrow/purges never touched; local-only .loot/ops. Points CONTEXT.md's out-of-scope note at the spec. Implementation graduates to a follow-on build map. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> 4403ce13
• Merge branch 'main' of https://github.com/Connor-Miller/loot 2f8096b7 · dbf3dbe6…diff
• a change records when it was authored, so a projected commit stops reading '6 years ago' on GitHub (ADR 0043) loot changes carried no timestamp, so the git bridge fabricated one: BASE_EPOCH + generation, one second per ancestor depth from a 2020 epoch. All 526 commits sat inside seven minutes of September 2020. Earlier repairs (#626's floor, the missing-generation refusal) fixed ORDERING and never touched the absolute date, which is why this kept coming back. ADR 0028 inherited the no-timestamp constraint rather than choosing it. The real reason is upstream: a version id is blake3 over authored content, and a clock inside that hash gives two peers different ids for identical content, destroying the dedup and convergence of ADR 0001/0004. So authored_at rides the label seam ADR 0029 already cut for change_id -- covered by the finalize signature (no relay can restamp it) but never folded into the version id. The wasm golden vectors prove the separation held: FROZEN_VERSION_ID, FROZEN_OBJ_ADDR and FROZEN_SIGN are byte-identical, and only the version marker and one presence byte moved. Advisory, and never an ordering input: a self-reported clock is a claim, not evidence (ADR 0025). in_order/ids_topo, buoy and path_touch.ordinal are all untouched, the forge indexes nothing on it, and the projection floors it past every git parent so ancestry holds whoever's clock is wrong. Format v11: additive for readers (a v<=10 change decodes as None and an absent timestamp adds nothing to the signed message, so every existing signature still verifies), breaking for writers, so loot-cli and loot-forge go to 0.4.0 in lockstep. Forge migration 0004 stores it as bigint, not timestamptz -- signed data must round-trip bit-exact or pullers reject the change. Only new work gets real dates. Every commit on main predates v11, main is push-fast-forward-only, and backfilling would fabricate the very claim this replaces. Perf-Baseline: reset the change body grew one presence byte, plus eight where a timestamp is present, so bundle_bytes/store_bytes/wire_bytes step once at the v11 boundary eaa56d99 · dbf3dbe6…diff
• the docs gate themselves: a land refuses a link that resolves to nothing, five rotted ADR cross-links are fixed, every amended ADR warns in its status, and the artifact sweep retires with its producer 586e3260 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.