Changes touching this path

• loot new --no-snapshot runs the mis-seal gate over the working change it signs, where it judged the disk: a path an ungated capture recorded, such as the implicit capture of loot migrate or of apply-patch, and the disk then lost was signed unjudged and listed by the first-seal summary, and a .env signed internal with exit 0 through the 0.4.25 binary. under --no-snapshot the finalize seam now judges each path whose object is not the anchor object there, at the tier its seal records (Workspace::signed_provenance), and a .lootattributes rule consents only when it names the path and resolves to the Internal tier, since no capture runs to seal it as a restricted= rule says; the capturing path is unchanged. the ticket route, loot status, records no capture since its working row is a preview (#1669). the publish gate still reads the disk under --no-snapshot and is recorded open in an ADR 0038 amendment beside the decision; CONTEXT.md, the seal_gate and SealProvenance docs and the Workspace width move with it. pinned through the binary, red first: the no-snapshot pin failed and the capturing pin passed (1 passed and 1 failed). red under named mutations, each restored, over the three pins: the disk judged under --no-snapshot (1 passed and 2 failed), any naming rule taken as consent (2 and 1), no rule taken as consent (2 and 1), and the recorded change judged on a capture (2 and 1). no format, wire or migration byte moves, so this owes no deploy. cargo test green, 4649 passed over 143 binaries with 13 ignored (#2387) 6fd72f0c · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.