Changes touching this path

• a re-record that lowers a ceiling keeps the reason and appends the move instead of deleting the only record of why that surface costs what it does, the bookkeeping becomes a pure function, and twelve tests hold the branch that had none efbf9eb5 · dbf3dbe6…
• a raise appends its reason to the accumulated history instead of replacing it, which is the arm both ceiling raises actually took, and throwing the old rationale away becomes a deliberate --replace-reason rather than the default 2d293f04 · dbf3dbe6…diff
• the docs become fifty-six routed entries derived from one registry that the nav, the reading order, the search and the prerenderer all read, so those four can no longer drift apart the way ten hand-listed surfaces already had to be watched; the thirty-eight pages nobody has written yet are real bookmarkable URLs that say what they will cover and carry noindex until they earn a place in an index, rather than dead rows in a sidebar; and the byte gate learns to walk nested surfaces, which is the only reason the fifty-two new pages weigh anything at all instead of shipping past a gate that read one directory level (#1378) 424be083 · dbf3dbe6…diff
• the foreign grant stops applying itself, and that was a LIVE defect rather than a guard this ticket adds: pullMailbox indexed every verified blob alike and discarded the grantor pubkey, so a grant somebody else deposited in the mailbox was applied SILENTLY the first time any file at its address was opened - the exact opposite of #488's decision that nothing auto-applies. The mailbox is sorted BY GRANTOR now: a self-grant under ADR 0057 still goes straight into the key index, while anything signed by another key becomes an offer in a second map the decrypt path cannot reach, so the property is structural rather than a check somebody has to remember. Restoring the old line turns nine of sixteen cases red, headed by a stranger's key entering the key index, and the positive controls are what make locked a decision rather than a broken fixture: an accepted grant reads open with bytes equal to the content key, and a self-grant in the SAME pull still opens itself. The copy is asserted as RENDERED rather than as source, and the decline half is honest for a reason it states out loud - the only wire act that could take a grant out of your mailbox is an ack, and an ack would delete the blob for every other device you own, so this page does not have one - which is why declining revokes nothing and says so, against an absent-phrase list that refuses has been revoked and no longer has access. Expiry's first line is WELDED to the refusal constant rather than restating it, an expired offer stays visible after a refused accept, and a control files the same grant one second before it expires. The unprovisioned member tier is ASKED rather than remembered: the me route answers whether the read class is live and the browser tests that for exactly true, so a missing field lands on the arm that promises nothing, and the dark arm - the live one today - says the repo answers not yours as a 404 whether or not you have been added. Three things were found on the way and each is measured rather than argued. Importing the fingerprint helper dragged a curve library into the shared entry at eight kilobytes on every PUBLIC route, fixed by moving the function to the dependency-free module beside it. A lazy route was measured and REJECTED at 581 bytes against 270 eager, because the split chunk's manifest outweighs the code it saves, and that is recorded in the route so nobody fixes it back. And the byte record had to be raised, so the raise is SPLIT rather than apportioned: the same tree with this ticket removed already reads a thousand and thirty bytes over the recorded numbers on every surface, which is pre-existing shared-entry drift, where this page itself costs 270. The budget tool had a real bug that recording surfaced - its lowering note is anchored to the end of the line so a later lowering can replace its predecessor, but a raise appended after it buried the note out of that anchor's reach and the next lowering stamped a second one - fixed with a fixture that is red without it (#1640) 152d0635 · dbf3dbe6…diff
• site/test is type-checked by a project of its own that the site gate already runs, so a test that has drifted against the module it imports refuses a land instead of passing. tsc -b reached src through tsconfig.app.json and vite.config.ts through tsconfig.node.json, and site/test was in neither, so the gate ran those files and never checked them: a type error surfaced there only where it was also a runtime error. site/tsconfig.test.json is referenced from site/tsconfig.json, so npm run typecheck, inside npm run build, inside npm run gate, now reaches them. it is a separate project because vitest runs the tests on node while tsconfig.app.json holds src to an ES2020 browser floor, it includes src because src/routeTree.gen.ts carries the augmentation that types createFileRoute, and it sets allowJs because two tests import tools/budget.mjs; vitest.config.ts joins vite.config.ts in the node project. the first run was a survey and it was not clean: 8 errors over 5 files, every one fixed rather than suppressed, with no ts-expect-error owed and no option loosened. three fake MetricsWriters never learned the saltFor that #1620 added to the interface, private-diff built two outcomes on a LockReason of no-key the union does not contain, private-grants read .reason off a KeyLookup without narrowing to the arm that carries one, and budget-record read an optional reason as a string. proved live: a satisfies number[] on the cli-verbs row list is invisible to the runtime, 7 passed and exit 0 under vitest alone, while npm run gate exits 2 at npm run typecheck before vite build, the suite and the budget ever run. red under mutation: that same error with the new reference dropped is 0 errors and exit 0, saltFor dropped from a fake is 1 error, no-key put back is 2 errors, src dropped from the include is 1 spurious src error, allowJs dropped is 2 errors, the lib put back to ES2020 is 6 errors, and an Array.at added to src is 1 error from the app project, which still decides what src may use. the site gate is green end to end: 643 tests passed and 60 skipped over 52 files, 62 surfaces all under ceiling with nothing recorded. ADR 0071 gains the amendment and a corrected consequence, and CONTEXT.md its site gate line. no migration, no wire or format byte moves and no forge or relay byte moves, so this owes no deploy. the workspace suite is green (3952 passed over 122 binaries, 7 ignored) (#1877) 4290f819 · dbf3dbe6…diff
• a docs page fetches its own prose and no other page prose, where content/docs/index.tsx imported every content module statically and the one splat route chunk carried all of it: 9,211 B gzip preloaded on every published docs surface, planned pages included, and a paragraph added to one page moved all of them, so the byte budget reported about fifty regressions for a one-page edit and taught its reader to record the raise rather than investigate it. each module now sits behind its own dynamic import that import.meta.glob finds by directory, keyed by the slug first segment, and each exports CONTENT so the index derives the set instead of listing it. measured on one tree before and after: the route shell falls from 9,211 B to 1,244 B gzip, docs/concepts/cas from 210,980 B to 202,288 B and docs/cli from 214,827 B to 206,137 B, the code-block chunk leaving the eager set with the prose; 52 ceilings are re-recorded down, and the whole-file rewrite carries four raises that measured over before this change as well as after, each with its reason. the prerendered document is unchanged, so what defers is the module hydration wants: headless chrome against the built server renders a written and a planned page whole, and every code fence on the quickstart page reaches its client-only highlighted form, which needs the deferred chunk and a real hydration. site/test/docs-content.test.ts holds the property against the built bytes, refusing a page with no prose to look for and prose no search of the assets can find, and budget.mjs names the shape of a wide refusal under the rows. red under mutation: one content module re-coupled statically (1 failed, 4 passed), a module export renamed (2 failed, 3 passed), a body filed under a slug the registry does not call written (2 failed, 3 passed), entity decoding dropped from the marker extractor so the vacuity guard fires (1 failed, 4 passed), the same-growth check dropped from the hint (1 failed, 22 passed), its unrecorded-row guard dropped (1 failed, 22 passed), and the count dropped from its text (1 failed, 22 passed). no migration, no wire or format byte moves and no forge or relay byte moves; the built site changes, so this owes a site deploy. the site gate is green end to end (659 passed over 53 files, 62 surfaces all under ceiling with nothing recorded) and the workspace suite is green (3952 passed over 122 binaries, 7 ignored) (#1878) 678876e6 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.