Changes touching this path

• loot split, squash, resolve, absorb and a duplicate of the working change run the signing gates loot new runs over what they sign, where they signed content out of the working change with none: through the 0.4.25 binary split, squash, a resolve after a stopped squash --into on the home position, and duplicate of the working change each signed a .env an ungated capture sealed internal by fallthrough, and a peer holding no grant read SECRET=1 with exit 0, while absorb signed a hunk published with no --allow-publish when it folded into an ancestor that published a path the anchor no longer does. Workspace::signing_gates_over is the recorded arm of signing_gates over any tree a signature carries, judging its entries whose object is not the anchor object at that path. the refit executor asks it before any arm writes, of what each plan declares through Refit::signs_unsigned, a wildcard-free match beside Refit::minted_edges, so a new refit does not compile until it says what it signs out of unsigned content; absorb seals every version first, judges the re-sealed entries, then records; resolve builds the resolution with DagRepo::prepare_resolution, judges its tree and records it with record_resolution, so a refusal leaves the conflict standing and the squash stop flow still works on clean content. the five verbs take --allow-reveal, --allow-publish and --allow-lockout as loot new does. ADR 0038 gains a #2471 amendment naming what stays open, and CONTEXT.md and the help say so. pinned through the binary, red first: 4 passed and 4 failed over the eight smoke pins. red under named mutations, each restored: no gate at the refit executor (6 passed and 3 failed over the nine smoke pins), split declaring nothing, split declaring its remainder, squash declaring nothing, duplicate ignoring an unsigned source, absorb unjudged, resolve unjudged, and resolve dropping the consent (8 and 1 each), and resolve recording before the gate, which the smoke pins cannot see (9 and 0) and a workspace pin can (0 and 1). no format, wire or migration byte moves, so this owes no deploy. cargo test green, 4697 passed over 142 binaries with 13 ignored (#2471) 8b0d1c6d · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.