Changes touching this path

• grant promotes at the clock it grants at, and the conservative alternative turns out to be an ORDERING ARTIFACT rather than a policy: skipped_unheld recorded only whether some earlier command in the repo whole history happened to open a reader, so one input at one clock gave two answers, and no state anywhere expresses that a reader has revealed an embargo. the flush goes on grant first line and rotate_regrants inherits it BY CONSTRUCTION rather than by a second flush, because it reads no content key except through self.grant - so the two cannot drift apart the way four hand copies of one body did. grant_sealed gets NOTHING and the ticket premise is refuted there: its keyring-OR-escrow lookup is already order-independent, which is why its pin was the one GREEN BEFORE THE FIX, and that measurement is recorded rather than a flush added to make the set look uniform. the eager direction, promoting a not-yet-due key, is not expressible through this seam because a flush IS the reveal gate applied - Escrow::flush now >= reveal_at is sealed::open own comparison. what WOULD be a hole is an escrow FALLBACK that skips the gate, which grant_sealed has deliberately for ADR 0027 timed deposit and grant must never copy, since a tag-1 bundle is a plaintext key in a file. the cost is asymmetric and lands on rotation: a grant dropped from the loot id rotate wave is access PERMANENTLY LOST, and the report line about what the outgoing key can no longer read was false for a due embargo. three pins, ONE REPO PER ARM because Escrow::flush promotes EVERY due entry and a second embargoed path in one repo makes the second arm vacuous - the trap #1485 hit - and both clocks pinned on each, since a fix that reveals early is worse than the bug. four mutations make the case: deleting the flush reddens grant AND rotate, which is what proves the by-construction inheritance, and giving grant the escrow fallback reddens the CONTROL arms instead. the caller list on flush_due_keys stops being a hand-written count and becomes a membership rule with a grep census, which is what kept it right while it gained a caller (#1488) 1d44cc64 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.