Changes touching this path

• the site dated markers are pinned to the text they date: site/test/last-updated.test.ts scans every file under site/src, and every file a module there imports as ?raw, for a Last updated marker, and holds each to a sha256 of its page taken with the date slotted out, comments stripped by the TypeScript printer and whitespace collapsed, so a page whose text changes without its marker and pin moving is red at the gate while a comment or a reflow is not, a marker in a format the scan cannot read is refused rather than skipped, and the failure prints the entry to write with the local date of the day it runs. a pinned table was chosen over reading git at build time because a land builds the site in a lane, which is not a git checkout. both markers the scan finds were already true and are unchanged: terms.tsx last changed on 13 September local time (ad38475), so the premise that it was stale is corrected, and privacy.tsx on 20 September (928f213). that a deploy is not an edit is written in the test header and in a comment beside each marker; no notice text moved. red under mutation, counts read each time: a word of the terms text changed (1 failed and 7 passed), the privacy date moved without its pin (1 and 7), a marker written as 2026-09-13 (2 and 5), an unpinned marker on /trust (2 and 7), an unpinned marker in a ?raw evidence file (2 and 7), comment stripping dropped (3 and 5), the date slot dropped (3 and 5), the ?raw reach dropped (1 and 8), each restored to green. no published wording moved, so this owes no deploy. the site gate is green (678 passed and 62 skipped over 62 files, 62 surfaces) with no ceiling moved, and the workspace suite is green (4323 passed over 137 binaries, 12 ignored) (#2096) 94da98ff · dbf3dbe6…
• the review-sweep fix-up over #2295, #2096 and #2137. the discovering layout door takes its caller body need: workspace::ambient_store_dot, which fixed BodyNeed::Unread and so would have admitted a body-reading verb that found its store through it to a body-deferred store, is now discovered_store_dot(start, bodies), passing the need through to resolve_store_dot, and loot doctor declares Unread at its call. ambient_local_config keeps a fixed Unread, since it hands back the config path and lane id rather than the store, and its doc says so. pinned in workspace.rs: a Held caller is refused naming the state from the root and from a subdirectory, an Unread caller still finds the store, and the same repo before the record is the control; red first with the need ignored (0 passed and 1 failed), red under mutation with the door fixed at Held (0 and 1), restored to green. the refusal text, the doctor bodies line and the ADR 0093 section 3 heading now say a verb that declares neither that it fetches first nor that it reads none is refused, since Unread passes. set sentences replaced by the property in workspace.rs, CONTEXT.md and ADR 0093: a door that finds a store without reaching BodyNeed::admit is unguarded and whether that is safe is a question for that door, is_relay is recorded as why a relay store needs no guard, and a verb behind an admit door meets the refusal unless a need other than Held is named there. the site marker pin: the hash now covers every module the page reaches by a relative import, so RETENTION_DAYS on /privacy moves it, and the privacy pin is re-pinned with its date unchanged; the scan reads markers with comments stripped, so a comment saying last updated no longer makes a file unreadable; the header defines a dated marker as the words last updated and says why the known-issues Last reviewed date is left to its own pins. red first against the old test, counts read: RETENTION_DAYS moved to 31 stayed green (9 passed), a terms comment saying last updated went red (2 failed and 6 passed); with the change the first is red (1 failed and 10 passed) and the second green (11 passed). red under mutation: the import reach dropped from the pin (1 failed and 10 passed), comment stripping dropped from the marker read (1 and 10), the import walk reading nothing (2 and 9), each restored to green. stale sentences fixed: HUNT-PERF names every other read the open makes rather than the reads in the body of assemble, the in_progress verb is the verb that wrote the record rather than a STOPPING member, the SDK read test no longer calls its shape the one where the head derivation is load-bearing, and repo.ts and the ChangeView doc name the superseded-head half of within_depth_of_heads and say its working-change branch is not mirrored. no migration, no format byte and no published wording moves, so this owes no deploy. the site gate is green (680 passed and 62 skipped over 62 files, 62 surfaces) with no ceiling moved, the sdk build:wasm and type-check are green, and the workspace suite is green (4324 passed over 137 binaries, 12 ignored) (#2299) d7d5ef94 · dbf3dbe6…diff
• the review-sweep fix-up over #2299, #2142 and #2154. a seek cache round now claims the busy marker before it decides anything: LootCache::claim_and_make creates loot-seek-refreshing with create_new before it asks whether the position stands or makes one, so a position another invocation is making carries a marker from before its store exists, and a round that finds a live one neither makes the position over it (refused, naming the state, when no store stands yet) nor removes it when its own refresh fails; a marker past the hour is taken over. before, the marker was written after the make, and a second round inside that window read the half-made store as a leftover and removed it. a first refresh now means no record file at all (Refresh::absent): the record is written through atomic_write rather than truncated in place and read through read_replaced, so an empty or unreadable record is a refresh that finished and a failed refresh leaves that position standing. pinned in seek.rs by a_make_in_progress_is_not_removed_by_another_invocation, which drives a make through claim_and_make and fails a second round inside it, and by a_record_that_does_not_read_is_not_a_first_refresh; red first against the unchanged rule (1 passed and 2 failed, the make extracted into claim_and_make with the marker still after it). red under mutation, counts read each time: the claim moved after the make (1 passed and 3 failed), begin in place of claim (1 and 3), a round that finds a live marker deciding first on the record (2 and 2), absent read as unreadable (3 and 1), the record written with fs::write (3 and 1), no refusal over a claimed unmade position (3 and 1), a stale marker read as live (3 and 1), each restored to green. the seek unit tests now default to a cache home under the temp directory, pinned by the_unit_tests_cache_home_is_never_the_runners (red with the default dropped, 4 passed and 1 failed). stale sentences fixed: the ADR 0090 #2142 amendment is corrected, the CONTEXT.md seek entry names the marker exception and the gc exit, ADR 0023 scopes the refusal-only exit to a question, root_notice and discovered_store_dot say why the function is free rather than counting callers, the in_progress verb is the verb whose stop created the record and another verb is refused, the last-updated header states its import reach by reachedModules, the seek module doc states the exit property, and a CONTEXT.md rewrap leftover is rewrapped. through the lane binary under a scratch LOOT_SEEK_CACHE, a position with an empty record stands after a failed refresh and a marker-only position is refused with its marker left. no migration, no format byte and no published wording moves, so this owes no deploy. the site gate is green (680 passed and 62 skipped over 62 files, 62 surfaces) and the workspace suite is green (4328 passed over 137 binaries, 12 ignored) (#2303) 4c489c97 · dbf3dbe6…diff
• every compiled-in and current-tense loot host moves to loot.build (map #2412, ADR 0099): loot --help names security@loot.build and https://loot.build/trust, ALPHA_PROMISE_URL is https://loot.build/install and the telemetry DEFAULT_ENDPOINT https://loot.build/api/telemetry, so the next release carries them; the site install one-liners, R2_BASE and HOP_BASE (https://dl.loot.build, https://loot.build/dl), the metrics SITE_SCOPE and own-host referrer, the disclosure links on trust, terms, privacy and known-issues, and the install, quickstart and guides pages follow, with the privacy and terms markers moved to 25 September 2026 and re-pinned since readers see the new address; README, CONTEXT.md (the forge door now forge.loot.build), the release checklist, site CI and test fixtures follow, and the two specs carry a note instead of a partial rewrite. the destination census gains build in WEB_TLDS, without which security@loot.build would be invisible to its bare-host clause, and exempts the two shipped lines that tld makes read as hosts (state.build, r.build()) by their exact text; ADR 0074 section 9 says twelve-entry to match. 37 lines still name millerbyte.com outside ADR bodies, evidence, research and scratch, each kept on purpose: dated history, millerbyte.com the site and its @millerbyte/ui tokens, the two noted specs, and relay-era tooling with no successor host, filed as #2438. census red with build dropped from WEB_TLDS, restored; site gate 819 passed and within budget; workspace suite 4559 passed over 142 binaries, 13 ignored (#2418) c5663115 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.