Changes touching this path

• the persisted plaintext digest is REFUSED, and the ceiling is the decisive half: the ticket estimated roughly 250 ms and the measurement says 43.9. two knowingly-wrong binaries from one tree differing only in the mechanism, interleaved, twelve runs a side over four rounds on an idle machine - every loose read deleted reads minus 43.9 ms, and the read replaced by one stat per path reads minus 22.3, with the sets DISJOINT in every round and the bands SUMMING to the region, 22.3 plus 21.6 against 43.9 end to end. the stat arm is the honest ceiling under the never-authoritative rule, so a SOUND index tops out at 22.3 ms against a tier spread of about 13, BEFORE it pays to read, parse, look up and rewrite itself - and the stat does not even buy equivalence, being blind to rotted FRAMING, which decode_object refuses today and which is can_open answering false. the ticket carried both answers already: three paragraphs above its own roughly-250 figure it quotes #1591 measuring the span at 207 ms with ZERO object reads, and that is the reading this reproduces. the custody argument was written FIRST, before any code, and refuses on five grounds of which the first and the fourth are each sufficient alone. can_open needs the seal own vis and the grant state, and vis sits OUTSIDE the content address - sealed.rs pins that appending the world grant must not move the address - so an index keyed by the address is a cache WHOSE KEY DOES NOT DETERMINE ITS VALUE, justifiable only by nothing rewrites a vis today, which is the reasoning the ticket itself forbids. invalidation splits in two: correctness is cheap and DESTRUCTION is not, because burn leaves the change graph, the ids, the signatures and the keyring untouched, so after a burn the key is still held and a surviving plaintext digest is a CONFIRM-A-GUESS ORACLE over exactly what the burn destroyed - and erasing it means rewriting the index in EVERY position and on every peer honouring a purge, which an older loot would silently not do. object_store had already refused this shape in the module that would host it: a burn whose two lists disagreed is ciphertext coming back from the dead. the rotted case is not a fourth way to guess but something worse, because the digest was recorded while the bytes were readable and so is still RIGHT - same_content would call a path clean out of the index while surface propagates HeldUnreadable for the same address in the same tree, one tree and two books, the class #1581 closed three commits ago. and ADR 0004 deleted this field once already, behind a guard that is a claim about the STRUCT, so it stays green while the forbidden thing moves into a sidecar file: a pin defeated by RELOCATION. so what lands is the decision as ADR 0086, a positive control proving a fixture reaches the code at exactly 2N+1 gets and N reads against 1 read on the ceiling build, and one glossary correction - and what does not land is any index. two citation corrections ride along: the expired-grant trap is #20 rather than #536, and that trap is already OUTSIDE can_open, asked beside it as an in-memory manifest lookup costing no read (#1595) d5f75151 · dbf3dbe6…
• the removal wait stops reading a FAILED SCAN as an absent file, and the hole was that ONE fallible answer served two callers needing opposite failure behaviour: the precondition, where false-on-failure makes the assert FIRE and is safe, and the exit, where it makes the wait STOP and is not. the scan now answers three ways rather than two - named, not named, or the scan did not run. NotFound stays not-named, because an absent directory naming nothing is a statement rather than a failure; every other error is an Err; and each caller decides explicitly, the precondition panicking with its own message about failing to establish its own precondition, and the exit leaving ONLY through a scan that RAN and did not name the address, waiting a transient error out on the same store budget the removal already followed one level up. flatten is GONE, and it matters at the exit for the same reason, one entry wide: the entry whose read failed may be the very address being waited on, so flatten reports not-named for a name the scan never reached. the proof is a REAL failing scan rather than a simulated one - a regular file standing where the objects directory goes is a genuine OS refusal, error 267, reachable with no second process - and the two arrangements are DISJOINT on one fixture: with the fixed exit it is 0 passed 4 failed naming that error, and with the pre-fix exit restored it is 4 passed 0 failed, which IS the quiet success, reproduced rather than argued. #1596 is otherwise untouched, same helper and same budget. the projection neither surface derived is settled by naming WHICH QUANTITY SCALES: the honest half, being the only arm a design satisfying the never-authoritative rule can reach - so 22.3 becomes about 223 at ten times the paths, on BOTH surfaces, with measured now separated from extrapolated, since the read COUNT is linear and pinned at three sizes while the TIME was measured at one. 223 is therefore the order of magnitude at which to re-open the question rather than a reading, and the other arm about 439 is named as explicitly not the number to quote. the pin the ADR claimed is now the pin the test asserts, strengthened rather than narrowed because the numbers had already been observed: the two-per-path-plus-one relation holds EXACTLY at all three sizes, run rather than trusted, 101 against 50, 401 against 200 and 1601 against 800 - with the per-path multiplier and the fixed overhead kept as SEPARATE constants, since two-N-plus-one and three-N agree only at one, and with the old greater-than line deliberately NOT kept beside it, because over the constants this file writes it is green whatever the code does. four prose corrections ride along: a step that stated the conclusion its own section refuses, a caveat a commit message claimed and no file carried, two runbook short forms stronger than the long form they point at, and a count of three defects that lists two - which STOPS COUNTING rather than inventing a third (#1899) a9018dad · dbf3dbe6…diff
• the adr 0004 guard stops being a claim about a struct and becomes a question asked of the repo on disk: the pin it left asserts that no field of SealedObject is a function of plaintext, which stays green over a store that has the deleted digest back beside the struct, and that is measured rather than argued, since with DagRepo::put appending blake3 of the plaintext to a file in .loot the pin reports 1 passed and 0 failed while the new census reports 4 passed and 2 failed. plaintext_equality_census records two worlds through the same verbs, one with two paths holding the same bytes and one with them holding different bytes of the same length, builds each world four times, and refuses a persisted difference its readings can see between them: structure cancels because both worlds record the same tree, randomness is filtered by keeping only what every build of a world agrees on, and the wall clock is blanked by value, because adr 0043 stamps a second per version and a gap between two builds read red on that second alone. it walks the repo root rather than a named place, so relocation is the thing it is aimed at, and it is a lower bound and not a proof: a token shorter than its window, an index encrypted per build, and any write path the fixture does not run (a push, a pack, the mirror, the forge and the wire) are outside what it has looked at, which the new adr 0004 amendment states before a reader meets either guard. three oracles are planted as standing controls, one per reading, each the shape of a proposal that has actually been made. red under mutation, counts read each time: the sidecar planted in DagRepo::put (the census 4 passed and 2 failed, the struct pin 1 passed and 0 failed beside it), the value reading removed (5 passed and 1 failed), the shape reading stripped of its lengths (5 passed and 1 failed), the repetition reading removed (5 passed and 1 failed), the walk stopped from recursing (2 passed and 4 failed) and the two worlds made identical (3 passed and 3 failed). adr 0086 gains a pointer where it records the proposal this gap would have waved through, and CONTEXT.md says what the new reading reaches. no migration, no wire or format byte moves and no host behaviour moves, so this owes no deploy. the workspace suite is green (4092 passed over 131 binaries, 8 ignored) (#1894) 327f63f8 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.