Changes touching this path

• ADR 0091 records what #2100 decided about pipelines and runners, grilled on 2026-09-20 against the tree: a runner is its OWN keypair under no account, because require_pusher accepts any live key of the owner account and the first draft would have made every runner a full pusher; its registration is a runner row outside the account tier, written by the forge from an envelope the namespace owner signed, which is the one proof this crate may act on where tests/account_tier.rs forbids an account write, so push and propose refuse the key by absence; loot runner add is the only enrolment verb and writes a home file, with --pubkey for a key minted in place and the custody cost stated; keys ride the ADR 0057 standing deposit widened to runners, per object address and never acked, so the forge ticket owes a reap rooted from live trees; a one-shot runner fetches one version through a new route that also serves the already-wrapped keys the forge holds for it and keeps no store, which removes the 55.8 MB per-job pull #2092 measured, while serve keeps a store; the on column names the tree a step judges, change or main, never the moment, on ADR 0085 rule; one job per version, trigger and kind under a runner-named lease, with the kinds declared in the push and propose envelopes because the forge holds the pipeline file as ciphertext and cannot read it; claim by poll with a content-free wake-up URL; trust defaults to members and a stranger is admitted by an owner attestation pipeline/approve; a runner signs passes only, one per job as pipeline/trigger/kind, because the attestation lane binds no timestamp and signed fails would leave unordered contradictions, so fails and durations are forge job rows; a sealed log tail rides BlobStore with --logs forge or local and a proposer never sees bytes; and pipeline run --version materializes a scratch tree under the resolve --tool invariants, chosen against the recommendation with the cost recorded. CONTEXT.md gains Pipeline, Runner and Job entries that state each property and name what defines each set rather than counting members. Nothing is built, no wire or format byte moves, no migration; the map #2099 tickets build what this decides (#2100) 590b39bc · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.