Changes touching this path

• a silent merge left one row reading its content at one key and its tier at another, and the fix is a function that cannot hold two keys: #1539 read the old side of a move at the key it had, ADR 0079 read the old side's tier at the row's path, the two changes rewrote the same three lines, and the converge took one line from each without conflicting - so content came from old_key while the tier came from delta.path, and for a renamed row the old side holds no entry at the new key. That made from_visibility None on every rename, and prev_visibility is None there too since rows fills it only under Modified, so both terms in the disclosure tally were empty and everything fell through to the destination's tier. Demonstrated rather than argued: before the fix, a path recorded restricted=connor and moved to a key the attributes call internal prints its recorded plaintext to stdout under a closing line naming no tier, which is ADR 0079 section 4's defect verbatim. The repair is not the one word it looks like. side_at takes a single key parameter and returns the side and its visibility together, and delta.path is not in scope inside it, so content at one key and tier at another stops being a mistake the function can make rather than one a comment asks it not to - reopening this would require deliberately widening the signature, which no textual merge can do by taking one line from each side because there are no longer two lines to take. The ticket's second half is not production-reachable and saying so is the more useful half of this report: an embargoed old side cannot become a move's source, because plan_moves fails closed on an object it cannot open and ADR 0007 means nobody can open an embargoed one, while the capture refuses to overwrite content it cannot see before that. The unreadable ladder was reached the only way it exists, by recording the move while the embargo has lapsed and reading the delta at a clock standing before the reveal, and a third test now asserts both guards so that if either is ever loosened the ladder shape becomes production and whoever loosened it is told. Two smaller framings were wrong too: a move that also changes tier is never recorded as a move at all, since plan_moves pairs only at an identical visibility, so the reachable shape is a move at one tier and then a dropped rule - which is how un-restricting actually works. And the existing tally test stayed green under a faithful revert, which is exactly why this landed silently in the first place (#1767) 796d7e87 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.