Changes touching this path

• the privacy notice stops saying a visitor address sits in the error log for the whole retention window, now that the box has reported otherwise: the site deploy of 2026-09-19 printed 18 error-log lines carrying a client field and none carrying an address, which is the non-vacuous outcome the ticket made a precondition, so the passages that name the error log are corrected rather than softened. the page still says the address IS written, because it is - the error log format is not configurable, so the address is removed after the fact rather than prevented - and it now says what removes it, the hourly loot-error-log-scrub timer in the scripts repo plus a strip and an outcome check on every deployment, and it keeps the unflattering half: an address written just after a run stays until the next one, so the window is up to about an hour rather than the retention window. the not-collected bullet stops asserting that the named exception is the whole of the set, and the retention paragraph keeps its claim for both logs while saying that what lasts that long in the error log is the line and not the address. the last-updated date moves to the day the wording changed. the pins move with it: the error-log pin now refuses the flattering draft review caught before publication, and three new ones pin the cadence, the window and the retention half. red under mutation, counts read each time: the page claiming no address is written (1 failed, 36 passed), the removal and window sentences deleted (2 failed, 35 passed), the period made vague (1 failed, 36 passed) and the retention clause deleted (1 failed, 36 passed). that third mutation first ran GREEN against a bare once-an-hour pin, because the summary database is parsed once an hour in another section, so the pin was tied to the sentence that does the removing before it was believed. no rust, no migration and no wire or format byte moves; the scrub this describes is already built and deployed, so what this owes is a site deploy to publish the wording. the site gate is green end to end (662 passed and 61 skipped over 60 files, 62 surfaces) and /privacy stays under its ceiling with nothing recorded (#1867) 6a1272b7 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.