Changes touching this path

• one delta derivation had THREE spellings rather than the two the review named, and now has one producer: the surface plan, the uncaptured-paths filter and restore each built the same since-the-surface-target, walk-the-disk delta on its own - and restore doc claimed to share its base with the overwrite guard while nothing enforced it. the single place that picks the delta spec and the walk policy is now one function, and one producer picks the base and hands back base and delta together, with all three callers going through it. the vouching #1710 made into a type is UNTOUCHED: the trusted set still comes only from the live arm after its own successful read, and the producer merely passes it along, which its doc says. the store-memo cost argument is made to SURVIVE the store changing its mind rather than pinned. the bundle memo now holds only a yes-or-no answer per address and never the object, so a future bound or eviction on the store own memo cannot quietly turn it into whole-history ciphertext held for the length of a bundle. pinning the retention instead was refused, because it would fail a perfectly reasonable memory-pressure change for the wrong reason. the one path that would need bytes again now re-fetches them, and no caller reaches it today, since both passes decide to send bytes from the address alone - so if that ever changes, the cost appears as a get the counters can SEE rather than as memory nobody measures, and a new test drives that path directly. the gate reads no move on every gated counter, the probe pinning exactly one get per distinct address stays green, and the method-width tripwire moves by exactly one - where a first draft that added two was caught by the suite and a helper inlined. and the shared base is shown load-bearing rather than asserted: moving it off the surface target reddens ten tests, across the clobber guards, the due-embargo cases, a process-level bisect and the plan test (#1711) 53c0e176 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.