Changes touching this path

• membership authorizes ciphertext and a grant decrypts it, which is how a collaborator read arrives without resurrecting the repo-level Public/Private that ADR 0041 threw out: a repo_member row is repo-scoped AUTHORIZATION that moves sealed bytes and metadata, while what may actually be read stays path-scoped and decided by a grant, so a member row alone decrypts nothing and every tier stays sealed. Membership and granting are TWO acts and not one, because membership keys on clerk_user_id for ADR 0016 rotation where a grant keys on grantee_pubkey, and collapsing them is exactly how a repo-ACL fiction gets in. The producer inherits #753's boundary rather than arguing an exception - the site writes the row over a new narrow role, never from Rust - so account_tier.rs's assertion is unamended and no Rust producer ships here. Three of the ticket's own premises did not survive being checked. Its issue search is stale, returning twelve more tickets than the three it names, though the claim under it that no ticket owned the row held. The owner access class is NOT scoped to account_key: migration 0009's gate is a pubkey parameter and its views name account_key in no form, the account resolution being app-side, so a membership predicate is the FIRST join the read tier makes into the account tier rather than a widening of one that already exists, and that is why it graduates as a fourth role and a third barrier-view family rather than an OR. And #1043 is identity-agnostic in its unlock, keyring, CSP and presigner but not in its routes, which reach withOwnedRepo. Two defects in account_tier.rs's own header are repointed rather than deleted: its walk covers src plus migrations plus docs/sql/forge-schema.sql and NOT tests, where the prose read nothing in it of the whole crate, and that exclusion is forced rather than incidental - proved by running the file's own flattened and writes_found rules over itself, which reports six writes every one of them from its positive control. Its second sentence, that the trait has no method naming an account, has been false since MetadataStore::account_of arrived with #927 and meant writes. Graduated as #1725 the producer, #1726 the collaborator read class, #1727 the view invariant being scoped to forge_read_* by name so the eleven forge_owner_* views are unguarded and opt-in besides, and #1728 AccessClass::Member (#1639) 9fdaacab · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.