Changes touching this path

• the dashboard stops sending a CSP written for a different shell, because that one directive rendered it BLANK for the operator while every gate stayed green: /metrics reused PRIVATE_HEADERS, whose reason applies here exactly - nginx proxy_cache sits in front with no proxy_cache_valid, so an operator document marked cacheable is one the edge can hand to somebody else - but the set also carries PRIVATE_CSP, and that forbids inline script. the private tier can afford that because its shell loads no inline and no foreign script, which is 930 decision 4 and the 753 route split. /metrics renders through the ORDINARY root, and TanStack Start ships its SSR hydration payload as an inline script tag. so the browser blocked it, React threw Invariant failed, and the page came up empty. METRICS_HEADERS keeps the half that was doing the work and drops the half that was never written for this shell: private no-store, frame-ancestors none as a CSP carrying only that directive so it constrains framing and says nothing about scripts, X-Robots-Tag noindex as a header rather than only the meta the route also emits, and no-referrer. PRIVATE_HEADERS goes back to naming only the private tier - widening its comment to cover two tiers was the wrong repair in the other direction - and now carries the warning that it is not reusable by a normally-rendered route, with the reason, so the next person tempted by the same reuse is told why it looks right and is not. ⭐ the finding worth keeping is about the INSTRUMENTS rather than the header. nothing in this repo could see it: the build passed, tsc passed, 416 tests passed and the byte budget passed, because no gate here executes a document against a content security policy. it took loading the page in a browser. the new test cannot execute a policy either, so it pins the incompatibility instead - this route CSP must not mention script-src at all, it must not be equal to PRIVATE_HEADERS, and the control asserts it still carries the no-store it exists for, since not constraining scripts is also satisfied by sending nothing. the guard earned itself immediately: it caught that I had changed the import and left headers colon PRIVATE_HEADERS at the call site, which typechecks and would have shipped the identical blank page a second time. the diagnosis is verified rather than assumed - a normally-rendered page in the built output carries exactly one inline script tag beside one with src, the src one allowed by self and the inline one being what the policy refused. and the failure itself is evidence the rest of the route is right: the operator got a DOCUMENT rather than the 404 an outsider gets, so the allowlist, the env plumbing and the container recreate were all already working (#1794) 79ee0753 · dbf3dbe6…
• the private shell stops dying a minute after /account: it authenticated with Clerk 60-second __session cookie while no Clerk JS ran on /private to refresh it, so every private call 401d and a reload wiped the vault. per the operator grill (ADR 0096, reversing #930 dec. 4), Clerk JS now runs on the private routes, loaded on demand behind PrivateGate so public pages carry none, under the strict nonce CSP widened only for Clerk (its frontend API host read out of the publishable key, img.clerk.com, the Turnstile and protect hosts, and worker-src blob: for its session timers) with the request nonce passed to ClerkProvider; every private call goes through one privateFetch that sends a Bearer from getToken and retries once with a fresh token, and /api/private/* no longer accepts the cookie; the vault is wiped only when Clerk reports signed out or a different user, or on Lock, and an HTTP status never wipes it; signed-out /private renders SignIn in place and returns to the requested URL, and the private bar gains Sign out beside Lock. the vault, private shell and CSP comments and CONTEXT.md now say what is true: the wrap key can decrypt, so any script on this origin can recover the seed, and the wrap protects it at rest; the boundary is this origin script set, loot code plus Clerk. tests for the CSP, bearer lane, retry and wipe triggers and the built server, each red under a named mutation and restored; site gate 804 passed, every surface lighter; a CSP-enforcing signed-out load renders SignIn with no violation and /why loads no Clerk; workspace suite 4549 passed. the operator live check closes the ticket (#2396) 25ab3fa8 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.