Changes touching this path

• the land gate stops watching only what a run produces and starts watching what it does, because two work counters now ride the untimed batch it was already measuring so they cost no fixture, no repetition and no workload_id move and orphan no baseline, while the twelve opt-in timings stay ungated on the argument that a timing is dropped by the load policy exactly on the busy machine a land runs on, and the count feature stays off by default because turning it on in a manifest was measured to change the loot.exe a plain workspace build produces (#1602) f641ea1d · dbf3dbe6…
• the perf skill index stops stating a gated status that nothing checked, because the work-counters row now carries a sentence generated from Work::ALL and gate::COUNTERS rather than one written by hand, which is how it came to read not recorded and not gated for a whole land after #1602 gated two of them in the very commit that corrected three other passages of the same file, and the four claims from the same arc that outran their code are fixed at both copies each: the loot-count module doc now carries the amendment ADR 0073 made to its verbatim twin in ADR 0072, ADR 0072 counts five counters beside a list of five and states the allocator split without a count at all, a fabricated test citation gives way to the test that really pins the gated id, and the land-time on-cost in ADR 0073 is about 56 microseconds derived from the table 80 lines below it rather than 2.8 (#1629) f5a642e0 · dbf3dbe6…diff
• the negotiation walk stops re-probing an address once per change that references it, and the spelling that does it is not the one the ticket proposed: a change carries its whole tree (#288), so offered_objects probed the store 218,000 times to produce 935 distinct addresses on a 436-path 500-change fixture, 99.6 percent of it redundant, and the gated point decomposed to 2,328 of its 2,928 object_gets being negotiation alone. The skip is a probed set rather than the ticket body's addrs.contains, because addrs holds only the ACCEPTED set: a withheld (#891), burned or in-flight address is Err on every occurrence, never enters addrs, and would keep paying the full per-change cost - which is also the one case where the probe is a failed file read rather than a memo hit. That difference is not an argument, it is a test: weakening the skip to the ticket's spelling leaves the offer pin green and fails an_address_the_store_does_not_hold_is_refused_once_not_once_per_change at 55 gets where 32 are owed, which is the number its own message predicts. bundle_impl memoises exactly the two address-scoped facts, whether the store can produce it and whether it is ANYONE-granted, and that second one is what kills the per-occurrence linear grant_ids scan; vis and bytes_ride are occurrence-scoped and stay in the loop, and hoisting the Embargoed gate into the memo - the plausible over-reach, and the one a reviewer would have to rule out - was proved red by a peer receiving ciphertext it can never open. locally_missing_objects carries the same shape and is deliberately scoped out rather than folded in: its probe is ObjectStore::contains, which carries no loot_count tally at all, so this ticket's own named signal is structurally blind to it, and under the rule that a change measuring flat does not land it needs an index-probe counter before it needs an edit. The producer spelling is untouched throughout (#1565), so the first probe of every address is unchanged and this is not the contains swap #1559 measured and refused. object_gets falls 2,928 to 743, -74.62 percent against a predicted -74.6, while object_disk_reads stays flat at 200 and offer_addresses, offer_addresses_delta1 and offer_bytes are byte-identical, which is the pin that the answer did not change rather than merely got cheaper. ADR 0073's present-tense cell reading 2,928 on the gated fixture is repointed to name docs/benchmarks/series as the owner of the current figure rather than deleted, and its dated evidence blocks are left exactly as taken (#1701) Perf-Baseline: reset #1701 dedupes the negotiation walk's per-occurrence store probes, so object_gets drops 2,928 to 743 with every artifact counter and every negotiation counter unmoved f3cdd5b2 · dbf3dbe6…diff
• loot ferry parses both policy files once per commit instead of once per changed path, and the instrument had to be built before the fix because PolicyLoads sat on Attributes::load while both ferry doors call parse, so the counter read a structural zero over this whole path and would have read zero after the fix too - a 0-valued counter being indistinguishable from one watching code that does not run. The tally moves to Attributes::parse and Ignore::parse_recorded rather than being routed through a counted door, because the fix itself removes those door calls: a counter on them would read zero afterwards, which is the same blindness relocated. That changes what the counter MEANS, from policy file reads to policy re-derivations, so all three existing pins were re-read rather than adjusted until green - status moves 2/3 to 3/4 with the +1 being its single Ignore::load now counted, and the point is that the GROWTH half passed untouched (narrow equals wide) while only the constant moved, so the test is re-pinned and not re-decided; the tier-exclusion test is still green because the in-process tier links loot-core and never loot-cli, so ADR 0073's exclusion needs no re-taking; and lane_new_sweep's note that policy_loads is one per read_tree_at is repointed to two, since read_tree_at calls both loads. The instrument was proved non-vacuous against the UNFIXED code first, at 18, 66 and 258 parses over four commits of two, eight and thirty-two changed paths, which is exactly 2 plus 2 times commits times width; after, it is 2 plus 2 times commits, so 258 falls to 10 at width 32 and stays 10 as width grows. The most useful thing learned here is a red proof that inverts an assumption: blinding the instrument by putting the tally back on load makes the counter read a constant 1 everywhere, so the constancy pin passes AND the parses-greater-than-zero guard passes, and only the GROWTH assertion catches it - a positive-value pin does not protect against a blinded instrument, which is what ADR 0072's controls bullet credited it with, and that bullet is corrected rather than left standing. This ticket's own wall clock does not reproduce and is corrected rather than repeated: the removed re-parse is 4.63 microseconds per path in release against this repo's real policy files, not 22.0, so a full-history ferry is about 1.9 seconds rather than 8,819 milliseconds - 22.0 is close to the debug reading of 31.53, so the hunt appears to have measured a debug build, and a figure taken under a different build is not a smaller version of the same number. ignored_under is deleted rather than kept as a pure forward once the parse is hoisted, and ADR 0028 is amended because it argued its delete-arm decision partly on an Ignore::parse per deleted path, a cost that no longer exists - the decision stands on the attribution argument, which was load-bearing anyway. seal_under takes a parsed Attributes and narrows pub to pub(crate) since Attributes is crate-private, and its doc said it keeps the bridge from re-parsing the policy twice per path, which was true about the wrong unit: it halved a cost that should never have been per-path. One honest regression is recorded rather than hidden: a deletions-only commit now costs 2 parses where it cost 0, because the hoist is unconditional (#1704) 1822132f · dbf3dbe6…diff
• the open two biggest arms become COUNTABLE, so a regression in them can fail a land instead of passing all three checks: store.rs held no instrumentation whatsoever, no Work, no tally, no bump - and that NEGATIVE was re-verified before anything was built on it, because a negative that has quietly become false is exactly how this class of blindness starts. every line number had moved and every one is re-derived: the graph read at 2200 rather than 1993, the keyring read at 2228 rather than 2019, the two call sites at 4467 and 4510 rather than 3468 and 3502. the unit is READS, one counter rather than a pair, and the reasoning is recorded rather than assumed. a byte count is NOT 0%-gatable here, being a function of fixture contents and encoding, so every format change would fail a land for a reason its author cannot act on - and tolerancing it instead re-creates precisely the load-sensitive alarm ADR 0073 rejected the timings for. at this seam a byte count would also be blind to its own stated reason, since the lazy half of #1536 already landed and read_graph_required still reads the file WHOLE while deferring the per-change manifests, so bytes READ did not move for #1536 and will not, while bytes DECODED are a different counter at a different seam whose value depends on which manifests a verb happens to touch. the object pair precedent does not transfer either: those are two because a MEMO sits between them, and nothing analogous splits a metadata read. disjointness is BUILT rather than assumed, because object files are whole files in the store too - the object store now reads through its own door, same body, same retry budget, no tally - and the two of that door four sites which tally NOTHING today are named in the code and deliberately left alone, since closing that gap would move an already-gated number. the tally sits OUTSIDE the retry loop, because inside it would count attempts and read 1 idle against 17 busy, and that placement is pinned DETERMINISTICALLY rather than by timing luck, since an absent path walks the whole budget by construction. the structural-zero bar is met by SHAPE rather than by not-zero: across a tenfold fixture the object counters go 60 to 600 and 20 to 200 while the store counter STANDS STILL AT 24 - per-open and not per-object - and no tally left on the object door, nor one that had picked up a per-path read, can produce that pair of lines. four mutations with counts read, and the discrimination one is a discrimination rather than a constant because it ALSO fails the excluded-counters pin, catching it from both directions. the gate was then run for real in a release build: exit 0, the workload id UNMOVED so no baseline is orphaned, and the new metric absent from the baseline, so the first armed land records it and the land after that is armed. and ADR 0073 consequence clause is amended exactly where it read as full coverage, with the correction stated in as many words, alongside its table row, its status header, and six other surfaces carrying the same claim (#1662) 904f6996 · dbf3dbe6…diff
• the caller count is DELETED rather than corrected, because changing two to three leaves a number a FIFTH caller falsifies and the next reader writes this ticket again - the shape the previous commit had just fixed, re-created one commit later, which is the #1553-into-#1554 recurrence with the doors swapped. both surfaces now state the PROPERTY and name no count: the function tallies nothing, counting an object read is the CALLER job, only one door does it, and one of the callers structurally CANNOT, because loot-net declares no loot-count dependency at all. a census is built where a census can be honest: it derives every call site from source across the workspace with line-comments stripped and the needle assembled at runtime so the file cannot match itself, and asserts a SET EQUALITY of file and occurrences rather than a count or a non-zero - so a new, moved or door-changed call site reddens with a message naming the decision the change owes - plus a second test that fails if loot-net ever gains the counting dependency. and what the census deliberately does NOT do is stated in its own header rather than discovered later: it does not derive TALLY-STATUS, because whether a call site tallies is a property of its ENCLOSING FUNCTION and no text scan takes that scope honestly - a line window reads past short functions and stops short inside long ones - so a guard that read complete and was not would be one more instance of the class it exists to catch. tally-status stays prose; what the census closes is the door that let the prose go stale. the false universal is restated rather than weakened: every-read-out-of-the-object-directory-comes-through-here was false, since a verify scan reads bare and pack files live in that directory and are opened raw - so the sentence now names the property that actually carries the gate, that no COUNTED door reads out of the object directory, with the counted doors enumerated. that is not weaker for gating, because only a counted read can move the number, and raw reads existing is precisely WHY they cannot disturb it. the same false universal was then found on two further surfaces the ticket had not named, and fixed there too. the glossary sentence becomes GENERATED and is held to the gate own membership by a new pin, with the stale second sentence DELETED rather than corrected and the pin own limit stated in both the file and the test. the ADR summary states the property instead of a number, its compiled-out bullet is emitted one per counter row, and its both-counters line is scoped to the object pair. five mutations with counts read - and the last two are EACH OTHER discrimination, one reddening the glossary while the signals table stays green and the other the reverse, which is what shows the second doc pin is not a duplicate of the first (#1903) c0678a74 · dbf3dbe6…diff
• the five-blind-instruments claim was recorded NOWHERE, and three sites cited an ADR that does not carry it - so the roster is derived from in-tree evidence and recorded ONCE, a five-row table whose rows are ticket, instrument, what it could not see, and the in-tree doc that records it. four of the rows came from a fixture doc that already named them, and the fifth from the counter crate description of a control that blessed a shape reading the tree ZERO times. and ONE NIGHT is wrong too: landing times on main put four of them across 2026-09-05 between 01:37 and 06:16 and the fifth at 14:00 THE SAME DAY, so it is one RUN rather than one night, which is what a sibling comment already called it. the count FIVE now appears in exactly one sentence, directly above its own table, where it is derivable as the row count - every other site states the property and cites the heading, carrying NO number of its own. that is the house answer this run reached two commits earlier: name the instances and stop counting. re-grepping found the same defect well beyond the three sites the ticket named - two more uncited fives, one of them attributing the finding to THIS run, three more citations of an ADR 0072 controls section that does not exist, and two comments reading three shipped instruments where a fourth had landed between the last two they name. the pin is what makes it hold: the citations must RESOLVE, so the heading must exist exactly once in the named ADR, the count word must equal the table row count with each ticket appearing once, and all six citing files must name the heading while NONE carries a count of its own - with the heading and the needle assembled at runtime so the file cannot satisfy the scan with its own constants. six mutations, each at ten passed and one failed, including a CONTROL that removes the whitespace-flattening and goes red, which proves the match is not trivially contiguous since three of the six citations wrap across comment lines. two of the six are each other DISCRIMINATION, one reddening only the count arm and the other only the citer arm. and what the pin does NOT do is stated in its own header rather than found out later: it does not check that the five rows are TRUE, each being a ticket and a code site checkable only by hand, and its citer list is hand-maintained, because deriving it by scanning would invert the check and wrongly demand a citation from the one site this ticket said to leave alone (#1664) 6a9d9cac · dbf3dbe6…diff
• the harness gains the dimension that dominated it, and the axis is PROVED against the binary that carried the cost rather than added after the fix and trusted: a clone at the parent commit, running the same fixture through the same timed call, reads 171.0, 388.8 and 870.6 ms at 218, 436 and 872 paths a change where the lane reads 10.5, 18.0 and 35.4 - so the axis MOVES, 16.3 then 21.4 then 24.6 times, and the pre-fix side grows 2.27 then 2.24, linear in the axis, which is the changes-times-paths term. at 436 by 1024 it is 0.87 microseconds an entry against the ~1.02 implied by the original 507 ms over 494,810 entries, so the fixture STANDS IN for the real open rather than gesturing at it. the GRAPH_LOAD question is MEASURED rather than assumed, and the ticket own correction is confirmed while its stronger framing is refuted: at its pinned width the parent binary reads 155.6 ms against the lane 9.7, a sixteen-fold step, so that half WOULD have moved - its weakness is MAGNITUDE and FRAMING, 200 paths against this repo ~436 average and an id_key that presents it as graph load, not structure. only REPO_OPEN is structurally blind, because depth one pins the dimension at its identity value and one change cannot observe a quantity summed across the graph at any width. the control has three arms and none is implied by another - floors, then INTERCEPT on what the opened graph actually binds, then RESPONSE, where the same generator at HALF the declared breadth must carry exactly that many fewer entries - and the response arm is the one a count cannot supply, since a fixture pinned at one width passes the intercept whenever the flag happens to name that width. that independence is MEASURED and not argued: a discrimination pair reddens one arm each, and a diagnostic re-order shows the first mutation still trips the intercept when the response arm is asked first. the after column is deliberately NOT called flat, because it is not: 1.73 then 1.95, since a wider manifest is more bytes to FRAME even when nothing decodes them, and the row doc says so. the negative control the comment supplied is taken and then made DETERMINISTIC rather than left as a timing - a topology-only walk holds node count, parent edges and head count IDENTICAL across a doubling that moves the open by 97 percent. no counter is folded in, because #1662 is the counter half of this territory and the two are alternatives to choose between. and the blind-instrument roster is deliberately NOT given a row: that table is scoped to one run and says so, so the new kind joins the paragraph already carrying the later members, leaving the count sentence and its pin untouched (#1670) 5334741c · dbf3dbe6…diff
• three sweeps running, the commit that DELETES an asserted-complete list writes a new one in the sentence that replaces it - so the recurrence itself is recorded as a named shape rather than fixed a fourth time and forgotten: the replacement is where the next list gets written, because the author is mid-sentence explaining what the true set IS. and this change caught itself committing the class TWICE while writing, which is the evidence rather than an embarrassment - an amendment draft saying the page said twelve in FOUR places where it was five, and a draft of the replacement paragraph writing six of the NINETEEN artifacts. both numbers are gone. the six-item metadata list becomes the PROPERTY: the set is the StoreArtifact trait, RepoStore::read routes every implementor through one door, and what keeps the conclusion true as the set GROWS is each impl path resolving to a named file under the store root - verified across all nineteen, none into the object directory. the conclusion that carries the 0% gate is kept verbatim, because it was never the wrong part. a THIRD copy of that enumeration, which the ticket did not name, was found and folded in. the twelves take a RULE rather than a sweep: drop the numeral where the sentence is a present-tense claim about the current table, KEEP it where the sentence narrates what ADR 0073 decided or refused as an EVENT. fifteen sites fixed, six deliberately LEFT - including the ADR title, which is the name the decision was accepted under, and a dated amendment recording what one mechanical edit touched, since correcting THAT is precisely the defect this ticket warns about. one of the twelves was already off by one and now states the property instead. the durable guard refuses a cardinal standing before opt-in halves across derived directories, and its LIMITS are in its own header rather than discovered later. the mutation that matters most is M2: writing todays CORRECT number, fourteen, is still RED, which is what stops the next reader fixing it to a value that expires. and the control that mattered is M3: the first draft tokenized raw text, so a count split by an 80-column comment wrap read clean - it PASSED OVER ITS OWN DOC COMMENT, which was quoting the offending phrase - and with the comment-marker strip removed and the defect still in place the pin goes GREEN, which is what proves the strip load-bearing rather than decorative. the fourth count of the roster population is deleted and all three of its escape routes closed, and the ADR stops citing a miscounting line as its authority for the run-versus-night correction, making the landing times the authority and citing that line only for the NAME. the negative-control heading is narrowed to what was actually measured, on the fixture rather than on the metric, and the two unreconciled readings of one measurement are reconciled once - where the ticket own framing was itself slightly off, since the two are the same commit pair measured in two sessions (#1907) b781aefd · dbf3dbe6…diff
• the trait surface stops being a second materialize loop and becomes a one-line adapter over the walk loot surface runs, so a withheld object no longer fails it and the land gate counters fixture now measures that walk: the two promoted walks share one classifier deciding which failed reads are invisibility and which are faults, a burned read kept distinct because the surface walk labels it rather than counting it as sealed. a new test drives a withheld object through the trait and went red with object not found before the change, and red again when the adapter was reverted or the classifier arm broken. every gated counter reads the same before and after on the gated fixture, as expected for a fixture with no view and every object held. the 1703 sentence calling the gate a different loop is corrected to what it still cannot see, and the stale two-of-five counts in measure.rs, work_counters.rs and the ADR 0073 heading are replaced by what defines each set rather than a new number (#1927) f930875a · dbf3dbe6…diff
• the Admitted and VerbRun docs and CONTEXT.md stop saying every argv reader goes through the spec: the readers that parse positionals and flags do, the consents and relay keys now say on their own docs that they scan argv by flag name, and the named exceptions lose their count and point at the census, as bisect dispatch now does. the stale arity-census counts in main.rs and loot-core flags.rs are gone, and the owed-arity rule is one function that the top-tier census and the counting pin both call, and each still went red when burn was re-opened. the flag census and the Admitted census now share one src walk keyed by relative path, and the Admitted census went red on planted leading_word reads in cmd_bundle and verbs/mod.rs, naming the second by its path. the surface.rs privacy argument now matches Repo::surface reaching the walk unpromoted, CONTEXT.md and the resolve comment stop calling its refusal the usage line, the Verb and pick.rs doc comments are separated so rustdoc keeps them apart, and two rewrap leftovers are fixed (#1939) 7b04e214 · dbf3dbe6…diff
• the policy counter is renamed PolicyParses and policy_parses because it has counted parses since #1704, and the policy.rs block and the ADR 0073 row now point at the variant doc instead of restating why; no stored perf record carried the old key, because the gate does not record this counter. PUSH_SHAPE_DEPTH, OFFER_GUARD_DEPTH and MISSING_DEPTH are literals rather than aliases because their reasons have diverged, and each is still 128. ride_entry takes one RideState instead of three maps, while the one_pass_bundle oracle keeps its own transcribed walk and memo so the byte-identity test still compares two walks, and still went red when the key arm was disabled. the gated counters read 743, 200 and 24 before and after (#1718) bbd04ef4 · dbf3dbe6…diff
• a deposit plan builds the tree it ships once instead of once per custody lane, and the first act had to be an instrument that could see the difference: no counter a land can read moved over a repeated whole-graph pass, so Work::GraphSorts now tallies ChangeGraph::in_order and is gated at 0% beside the object pair and store_file_reads, reading 8 on the gated fixture and one string across the drift pin repetitions. THE TICKET ASKED FOR THE TALLY TO REUSE Work::TreeWalks INSIDE finalized_tree and for ADR 0073 to re-decide that exclusion, and that was refused rather than followed: tree_walks counts a whole-tree FILESYSTEM walk of a working tree and this is a graph pass, and the in-process tier links loot-core and never loot-cli while nothing in loot-core outside its own tests calls the deposit lanes, so a tally there would have read zero on that tier anyway and the pin would have stayed green while its stated reason went false. the exclusion therefore stands unmoved on its own measurement, and the ADR records the trigger that did not fire rather than a re-decision it did not force. measured in the counter and not in wall clock: a forge plan over a fixture carrying an embargoed path, a Restricted path and the Internal default read 3 sorts before and 1 after, a relay plan 2 before and 1 after, the three lanes now taking the finalized tree as an argument plan_deposits builds once. the tips membership test inside that build became a set lookup rather than a Vec scan, which no counter can see and which is named as such rather than claimed. red under mutation, counts read each time: the shared build removed so each lane derives its own again failed the new pin (0 passed and 1 failed, graph_sorts 3 against 1, and with the forge arm relaxed the relay arm failed at 2 against 1), the tally dropped from in_order failed the anti-vacuity pin (10 passed and 1 failed) and the new pin (0 passed and 1 failed), and graph_sorts dropped from gate::COUNTERS failed four at once (7 passed and 4 failed), each restored to 11 and 1 passed. the two generated membership sentences in CONTEXT.md and HUNT-PERF.md are pasted by hand as their pins demanded, the hand-written workspace width in verbs/mod.rs moves to 390, the visibility census gains the two argument bindings the by-reference lanes create, and a count in loot-count that was wrong in the commit that wrote it is replaced by the property. no migration, no wire or format byte moves and no host behaviour moves, so this owes no deploy, though the gate records a new metric from the next land. the workspace suite is green (4174 passed over 132 binaries, 8 ignored) (#2225) fe6a089f · dbf3dbe6…diff
• the sentence written to replace a deleted list names the definer instead of counting, and the fix-up is read back under the rule it enforces: ADR 0073 said the gated work counters were the object pair and a further one at each amendment since, which is false because the #1903 amendment added none, so the clause now names measure::WORK_COUNTERS and stops. every other count beside a set that can grow is replaced by what decides membership rather than by a corrected number - the first nine and the six artifact counters and the other three Work variants in gate::COUNTERS become every row WORK_COUNTERS does not name, the Tally Display doc shows one label=value per Work::ALL entry and an ellipsis instead of hand-listing the labels, the deposit lane counts point at kind.widens, and the landed proposal state points at store::ProposalState. THE SWEEP MISSED THREE COPIES OF ITS OWN ITEMS and they are corrected here too, because a corrected claim left standing in a second copy is how #1903 shipped one stale: the three lanes sentence in loot-core custody and again in its test, and the ADR 0075 three terminal states sentence duplicated in a forge server test. two code fixes ride along: #2174 landed the wire_state doc inside the propose withdraw doc comment, so the may_propose rationale documented the wrong function and the route documented nothing, and the stale-tip refusal was broken across source lines with no continuation, so an operator read the indentation of the source in the middle of the message. ONE ITEM IS CORRECTED RATHER THAN FOLLOWED: the ticket reads that literal as carrying a newline, and on the tree it is a single line carrying two runs of collapsed indentation, so the rendering defect is real and its shape is runs of spaces rather than a break. red under mutation, counts read each time: the continuations removed so the break rides in the string again failed the strengthened pin (0 passed and 1 failed, the panic printing the refusal across three lines), restored to 1 passed. the CONTEXT rewrap is a pure reflow, identical byte count and identical word stream, so the generated membership sentence and its pin are untouched. no migration, no wire or format byte moves and no host behaviour moves, so this owes no deploy. the workspace suite is green (4174 passed, 0 failed, 8 ignored) (#2234) f7721acb · dbf3dbe6…diff
• the attribution the #2223 refutation asserted is now measured and the conclusion stands, because a nested count region says which span the surviving reads belong to: with this body live the open inside vouch_if_on_disk reads 0 files over 200 paths, and with the ceiling in place that same span reads 199 on status and 200 on surface, so the reads move rather than go away and a header only body would add its own opens on top of them. the size axis gains the fourth column the ticket asked for and the effect does not run away with it: at 1 MB objects over a 210 MB store the ceiling leads by about 8.5 ms on either verb, under a fiftieth of the verb, against 14.24 and 20.91 and 69.00 and 455.60 ms for status and 16.67 and 22.92 and 67.37 and 461.02 for surface. THE 3.3x DISCREPANCY IS RECONCILED AND THE GUESS ABOUT IT WAS WRONG: the loose store weighs 213,800 and 3,285,800 and 26,223,400 bytes here, the three figures the ticket body records, to the byte, so both arms ran the same incompressible fixture and compressibility explains nothing; what differs is that the ticket timed the process, which reads 22.7 and 29.8 and 77.6 ms over these same fixtures and meets it at the two smaller sizes, while its largest reading of 226.2 ms reproduces in neither arrangement against seven repetitions spanning 69.00 to 71.96 ms and a first unwarmed reading of 71.13. so the 11x move it was filed on rests on one reading, and the move these fixtures carry over that range is about 3.4x. #2226 gains the depth axis its own cost model lives on, swept without touching MISSING_DEPTH so no fixture and no workload_id moves: at width 200 the walk is linear in depth over 1.16 and 4.66 and 18.49 and 74.04 ms at depths 8 and 32 and 128 and 512, the probe deleted binary reads 1.08 and 4.38 and 17.38 and 68.82, and the probe share does not move across that sweep, which it would not, because probes and manifest entries are both O(changes x paths). that doc now cites #2240, records what the half is, and says the probe is two map lookups rather than one. ONE SWEEP ITEM IS REFUTED RATHER THAN FIXED: the short line in gate.rs is not a rewrap leftover, it is short because the 33 character intra doc link after it does not fit at this column norm, and the same file carries a 44 column line for the same link higher up. the cheapest item had the only seam and it is pinned: the WORK_COUNTERS exclusion table read as the excluded variants and nothing else, which is the definer #2234 sent a reader to, and it is now read back against Work::ALL filtered by gate::COUNTERS. red under mutation, counts read each time: graph_sorts dropped from gate::COUNTERS failed the new pin (0 passed and 1 failed, three variants named against four owed), the PolicyParses row deleted failed it (0 passed and 1 failed, two against three), and the table header renamed so the scan reaches no rows failed the anti vacuity guard (0 passed and 1 failed), each restored to 1 passed and the file to 12 passed. the two ADR 0073 enumerations are deleted rather than corrected, the CONTEXT and gate paragraphs are reflowed with identical word streams, and no code outside a test changes, so this owes no deploy. the workspace suite is green (4178 passed over 133 binaries, 9 ignored) (#2242) d6bf7f55 · dbf3dbe6…diff
• the ADR 0073 consequence clause on what the work counters watch of the opt-in halves stops naming its members and names measure::WORK_COUNTERS instead, since #2225 gated graph_sorts and left the enumeration #1662 wrote naming less than the gate counts. the #1662 amendment quotation of that clause is left as written and marked as dated where it stands, and the status block records why for the next amendment: a quotation records what an amendment changed the text to on its date, and rewritten to agree with the present it would state something that amendment never said. the note under the clause says how it moved from #1662 to here. prose only with no behavioural seam, so there is no mutation proof; work_counters reads 12 passed before and after. the workspace suite is green (4262 passed over 136 binaries, 10 ignored) (#2238) bf9c6c26 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.