Changes touching this path

• loot-site map #204: buildable spec + ADR 0037 (#211), installer integrity research (#221) Assembles the loot-site map into docs/specs/loot-site.md (the hand-off spec for loot.millerbyte.com), docs/adr/0037-loot-product-site-and-install.md (the product-site + install decision; renumbered from 0036 which the harbor took), and docs/research/windows-installer-integrity.md (the #221 TLS-only + attestations decision). Break-glass direct commit — the primary loot state is mid-reconcile (diverged heads from the #229 harbor land); the next ferry ingests this. c5e7f70a · dbf3dbe6…
• docs(spec): loot-site v1 matrix records the 5 native triples v0.1.0 actually shipped (#258) The spec still chartered six triples including native win-arm64, which the shipped dist-workspace.toml now contradicts — #258 dropped aarch64-pc-windows-msvc at the cut (dist 0.32 cross-builds it via cargo-xwin, where ring's ARM assembly won't compile). Nothing user-facing is wrong yet only because the site isn't built. Section 5 is the source the Install page's all-platforms listing gets authored from, so left stale it would produce a false native-win-arm64 download claim. Record what shipped, why, and that arm64 Windows is served via the ps1 installer's x64 emulation fallback rather than a native build — with the explicit constraint that the Install page must not promise a native win-arm64 download until #270 lands. Left docs/research/release-engineering-install-one-liner.md alone: it is a historical research artifact recording what was surveyed at the time, not a live promise. Refs #258, #270. 3333976a · dbf3dbe6…diff
• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. 1931146c · dbf3dbe6…diff
• primary catch-up: checkout at the #291 squash (site/ scaffold) folded for the drift reconcile (#297) e6f7079a · dbf3dbe6…diff
• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) (#291) * Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. Landed via break-glass git branch: the loot-native lane land was blocked by two live shared-store bugs (review-ferry folds a described WIP into a reconcile finalize; describe/status disagree on the working change under concurrent sessions) - tickets to follow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apply #291 review findings Cache only successful upstream responses in the installer proxy (a transient GitHub failure must not be CDN-cached for 5 minutes); extract the install one-liners to one shared module (three copies drifted apart otherwise); fix the vite.config "fully static" comment and spec SS0 framing to name the two server-route exceptions; tighten the .lootattributes rationale (the interim manual deploy is gated by .vercelignore, not the GitHub projection); drop the cargo-culted overrides block (its pins targeted server deps the site lacks). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> 231eb5f8diff
• resolve conflict at docs/specs/loot-site.md 0ee48cfb · dbf3dbe6…diff
• the repo never goes public, so the anonymous download path moves to R2 (#652) #652 recorded a gate: flipping this repo public discloses sealed docs/pitch/zk-host.md through PR #161 surviving refs/pull/161/head, verified live 2026-07-30. Re-swept today across 321 PR head refs (up from 242), two ways -- still exactly one carrier, unchanged. But the gate own remedy needs GitHub Support, is not self-service, and has no date. ADR 0045 stops waiting. The repo stays private permanently, and the anonymous artifact path moves to Cloudflare R2 at dl.millerbyte.com instead. Attestations are out rather than deferred; sha256 is the integrity story by decision. Build: #806 DNS zone move, #807 R2 artifacts, #808 installer retarget and the smoke test back on, #809 the Install page attestation claim. ADR 0037 is superseded in two places and docs/specs/loot-site.md in three, marked in place with dated blocks. The comments that called #652 a temporary gate now say permanent, and CONTEXT.md no longer calls the GitHub mirror public. 9a04ab6f · dbf3dbe6…diff
• the ADR 0045 markers now carry the day they were actually written (#652) The supersession blocks landed in de79d39 were dated 2026-08-05. The work happened on 2026-08-07 -- the date was taken from surrounding context rather than from the clock. Ten markers across four files, including the two read-date citations on the Cloudflare documentation that settled the subdomain-setup and r2.dev questions, where when it was read is the whole point of recording it. Corrected: ADR 0045 (3), ADR 0037 supersession blocks (3), docs/specs/loot-site.md amendments (3), CONTEXT.md correction note (1). Untouched: the six other 2026-08-05 entries in CONTEXT.md, which belong to ADR 0044, ADR 0046, #39 and #621 and are correctly dated. 80d4409e · dbf3dbe6…diff
• the ADR 0045 markers go back to 2026-08-05, which was right the first time (#652) 2f3c162 moved ten dated markers from 2026-08-05 to 2026-08-07 on the theory that they recorded the wrong day. They did not. de79d39, the commit carrying them, is stamped 2026-08-06T05:02:51Z -- which is 2026-08-05 23:02 local, and this repo dates its markers in local time. Two other landings from the same hour agree: ADR 0046 (f3f8a3d, 05:23Z) and the ADR 0015 amendment for #621 (f88cf89, 05:33Z) both read 2026-08-05 in CONTEXT.md. The 39-hour gap between that land and the correction was real elapsed time inside one session, not a clock defect -- a land taken immediately after the gap stamped within 22 seconds of the OS clock. The three doc files are restored byte-identical to the blobs de79d39 landed. CONTEXT.md keeps everything other sessions have added since; only its one date line reverts. 97218886 · dbf3dbe6…diff
• the install page verifies integrity, not provenance, and every link on it resolves anonymously (#809) 9f40928f · dbf3dbe6…diff
• the one app serves from the VPS, and loot.millerbyte.com flips to it (#752) ca5f93ec · dbf3dbe6…diff
• the landing hero becomes the receipt: one published object rendered as the ciphertext this host stores beside the plaintext a key opens, live from the forge, and no panes at all rather than invented ones (#1046) c729cf41 · dbf3dbe6…diff
• every compiled-in and current-tense loot host moves to loot.build (map #2412, ADR 0099): loot --help names security@loot.build and https://loot.build/trust, ALPHA_PROMISE_URL is https://loot.build/install and the telemetry DEFAULT_ENDPOINT https://loot.build/api/telemetry, so the next release carries them; the site install one-liners, R2_BASE and HOP_BASE (https://dl.loot.build, https://loot.build/dl), the metrics SITE_SCOPE and own-host referrer, the disclosure links on trust, terms, privacy and known-issues, and the install, quickstart and guides pages follow, with the privacy and terms markers moved to 25 September 2026 and re-pinned since readers see the new address; README, CONTEXT.md (the forge door now forge.loot.build), the release checklist, site CI and test fixtures follow, and the two specs carry a note instead of a partial rewrite. the destination census gains build in WEB_TLDS, without which security@loot.build would be invisible to its bare-host clause, and exempts the two shipped lines that tld makes read as hosts (state.build, r.build()) by their exact text; ADR 0074 section 9 says twelve-entry to match. 37 lines still name millerbyte.com outside ADR bodies, evidence, research and scratch, each kept on purpose: dated history, millerbyte.com the site and its @millerbyte/ui tokens, the two noted specs, and relay-era tooling with no successor host, filed as #2438. census red with build dropped from WEB_TLDS, restored; site gate 819 passed and within budget; workspace suite 4559 passed over 142 binaries, 13 ignored (#2418) c5663115 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.