Changes touching this path

• SDK slice 3 (#425): typed error model on the write path Map relay/loot failures to typed LootError subclasses so callers branch on `code` instead of string-matching: - push(): a 401 from /stow (loot-net handle_stow -> unwrap_envelope maps a non-allow-listed key to BadSignature/UNAUTHORIZED) now throws AuthError (code "unauthorized") carrying the offending signing pubkey. The SDK signs every envelope in WASM, so a 401 means the key isn't enrolled. No pre-check, auto-enroll, or downgrade (#383) -- attempt and report. Other non-2xx and fetch failures stay TransportError. - Add ConflictError (code "conflict") to errors.ts and export it. It is NOT thrown: /stow is append-only and accepts concurrent forks without rejecting a moved parent (loot-core stow_accumulates_concurrent_forks_without_conflict), and capture-first push re-snapshots heads at push time so it never builds on a stale parent. Clean detection needs an optimistic-concurrency model slice 2's overlay doesn't carry -- deferred, documented, not faked. - AuthError gains an optional `pubkey` (hex) for the allow-list case. Seam 1: push-errors.behavior.test.ts drives a real relay seeded with a foreign key -> AuthError(unauthorized) with pubkey; an unreachable relay -> TransportError. tsc clean; vitest 12/12 (2 new + 10 existing). 565a0638 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.