Changes touching this path

• the land gate gets the predicate it was specified without, and proposal-derived turns out to be the wrong concept: ADR 0075's #2162 amendment said the local land enforces attestations for a proposal-derived change and never defined it, which could not be built at all because loot-first reads no loot change author anywhere and the only author it sees is the GitHub PR login, the very field that amendment had to correct. ADR 0092 replaces the concept rather than implementing it, firing on a change whose author is not in the lander's own key set, the active signing key plus the rotation archive, because what a gate should care about is code the lander did not write and the route it arrived by is incidental, which also catches a colleague's change carried in with no proposal at all, the case ADR 0075 calls a feature. two predicates stay separate on purpose and each names its own question: carry_line asks may I re-author this and must compare the current key since a rotated key cannot sign, while the gate asks did I write this and spans every key the identity has used since a rotation does not make earlier work somebody else's, so a rotated operator's own change is Foreign to the carry and theirs to the gate, and the natural repair of unifying them breaks one caller in either direction. that same Foreign arm is what makes a verdict usable at a land at all, since an attestation binds a version and a foreign suffix is merged rather than replayed, so version ids survive where a replay would have detached every pass in silence and read as not yet verified. the judged set is the ancestor closure of the lane tip minus what main covers rather than carry_line first-parent chain, because a stack containing a merge of its own would otherwise smuggle unapproved work in on a second parent and report green. an absent author counts as foreign and that was already shipped. gating is the repo policy, declared per requirement in the LANDED .lootpipeline and defaulting to advisory, which is what makes the #2162 rule about reading the landed copy load-bearing rather than prudent, while detection is always on and the verdict line states foreign authorship so that advisory never becomes invisible. the predicate itself is not configurable, authorship being a fact rather than a preference. ADR 0091 section 6 is corrected in passing: its sentence that a change step judges the merged tree at a land is an intention, loot-first naming .lootpipeline nowhere and a land running the Land gate phase off the untracked .loot/gates instead. CONTEXT.md gains Foreign authorship, and #2178 is re-specified and shrinks. docs only: no code, no migration, no wire or format byte moves, so this owes no deploy (#2216) 3c7ce4b1 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.