Changes touching this path

• the edge log gets a parser, and the field that separates a trustworthy line from a dangerous one turns out to be structural rather than a flag: our format writes two request tokens where combined writes three, so a three-token request IS the pre-1632 signature and the parser REFUSES it rather than trusting the file it came from. that matters because 1630 stripped the address from historical logs in place and deliberately left their paths alone to keep backfill open, so those files still name private repos and sealed file paths - a backfill that read them would ingest exactly what 1621 removed from the live format, and no amount of care at the call site would catch it because the line looks fine. a refusal is a RESULT and never a throw or a silent skip, because a shipper that swallowed bad lines would report a clean run over a log it half read and the count of refusals is the only thing that could say otherwise. two privacy reductions belong to the parser rather than to a caller who might forget: the referrer collapses to its HOST, since the full value is another site url carrying its own path and query - somebody elses search terms arriving here because they clicked a link - and the raw user agent, which the log keeps deliberately for bot filtering as a departure 1630 recorded, has no column in the row and must never acquire one. a schema cannot express an absence so the pin is the nearest thing, asserting no value of the row equals or contains the raw string, and the mutation that proves it is the realistic mistake rather than a contrived one: putting the user agent in the agent field, which is exactly what that field looks like it wants. the classifier is INJECTED and not imported, so 1625s shared module stays the only one whenever it lands rather than a second door grown here; the default is unknown and never human, because a positive-match rule never matches a person and the absence of a verdict means we found no reason to exclude this. our own traffic wins over any classifier verdict, since the edge marked it using the address without logging it, which is a fact the line carries where the user agent is a string the caller controls. and the timestamp is read at the offset the line itself declares rather than at the timezone the box happens to run, because reading the second where the first is available is how a backfill of older files silently shifts by hours (#1756) 5e1dd377 · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.