Changes touching this path

• review sweep 1 fix-up over the native tracker lands #2424, #2427 and #2428 (map #2422): every write to a ticket is refused, naming loot adopt, when landed main holds the ticket in another space than this position reads it in and the fork point of the two does not, so a lane taken before a sibling moved a ticket into a group can no longer write a file sealed as the old space seals; a file in a group must be decided by a restricted= rule whose pattern begins with the group directory, so a broader restricted= rule above the group rule is refused naming both rules, or naming it and the line to add; a move from one group to another asks --allow-demote unless the first rules matching each old and new path are both restricted= and the new names are all among the old, and any pair the rules cannot compare asks too; loot ticket frontier emits an S row for each open ticket this identity cannot open, since its parent is withheld, never takeable and counted apart from the children in the human summary. ADR 0023 records the frontier S rows and the attachment object as shipped with author, the ticket.rs module doc stops saying a write deletes nothing, ADR 0098 status and section 8 and ADR 0028 say what #2425 built, and CONTEXT.md, the spec and ADR 0042 say what is built. red under nine named mutations, each restored: no landed-elsewhere check and no fork-point comparison (0 passed and 1 failed each, through a real land_pass from a sibling lane), no scope test on the restricted rule, no widening consent, source and target compared when the source rule is not restricted, no S row, closed sealed tickets kept, sealed rows counted takeable, and author dropped from the attachment object (37 passed and 1 failed each over the 38 ticket tests). cargo test green, 4644 passed over 143 binaries with 13 ignored (#2454) 4bc5a30a · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.