Changes touching this path

• the private tier counts ACTIONS at the one seam every handler enters through, and the account reference it carries is the notice second identifier rather than a footnote loot#1758, the third of loot#1619 three collection points. Every api.private.* request enters through withPrivateSession, so the row is queued there on the way OUT with the status actually sent - one instrumentation point rather than one per route, which means a new endpoint is counted by construction and a test pins that every api.private.* file uses the seam. Deliberately narrow: the beacon owns views, the log owns volume, this owns actions. Counting anywhere wider would either double-count with the beacon or undercount behind the 60-second cache. The path is the ROUTE SHAPE, which on this tier is not a formality: owner, repo and file path all travel in the QUERY STRING, and routeShape drops the query before any rule runs. The pin asserts the repo name is absent from the serialised row, not merely that the path looks right. account_ref is a keyed SHA-256 digest of the Clerk id, 32 hex, stable ON PURPOSE - the opposite choice from the visitor key, because its entire job is to let an erasure request find every row of one account. A read of the metrics database yields nothing a third party issued; an erasure can still compute the value to delete by. A 401 row carries NULL rather than a reference to nobody, so the one-subject-tier CHECK reads it as no subject. The notice moved with it, in nine sentences. The page said in so many words that the records carry NO account reference and that there is ONE identifier; both are now false and both are now pinned in the other direction. What the page does NOT claim is as deliberate: loot#1622 says the reference lives with the account and is deleted on request, and only the second half is built - no account-deletion hook removes these rows - so the page says on request and says the automatic link is not built, and a test refuses the flattering version. Rendering found two more sentences that had become misleading rather than false: Erasure said deleting the account deletes it, which now read as covering the counted rows, and the retention section said keyed rows lose their meaning when the salt dies, which is true of visitor keys and the opposite of true for account codes. Both now say which rows they mean. 547 site tests pass; budget green with 263 B of slack left on /privacy, so the next notice edit will need a recorded raise. 3bb326ce · dbf3dbe6…
• the private repo surface becomes a workbench: /private/<owner>/<repo> is one layout route that mounts a VS Code-like shell once behind one gate (activity bar, side panel, preview and pinned tabs, status bar, Ctrl+P quick open) and keeps it across navigation, each child route naming its document with OpenDocument rather than rendering a page; a view is one module plus its routes, WorkbenchView in components/workbench/view.ts is the contract and VIEWS the one list the shell derives from, and the shell names no view. two views ship, Files (explorer over one new /api/private/manifest read, file editor with gutter, minimap, #L links and per-file decrypt, folder overview) and History (ledger panel, ledger, path and two-sided diff documents moved from the old pages), History built second against the contract and needing no shell edit, which is the test of the operator requirement that new views such as proposals and tickets be easy to add. /api/private/repo answers the header without a tree read, /api/private/tree and the page chrome it fed are deleted, every URL #1043 served still resolves. ADR 0094 and CONTEXT.md record it; 768 site tests pass, each new test red under a named mutation and restored; no migration, no format byte, no forge change, site deploy only (#2327) 7462b904 · dbf3dbe6…diff
• every compiled-in and current-tense loot host moves to loot.build (map #2412, ADR 0099): loot --help names security@loot.build and https://loot.build/trust, ALPHA_PROMISE_URL is https://loot.build/install and the telemetry DEFAULT_ENDPOINT https://loot.build/api/telemetry, so the next release carries them; the site install one-liners, R2_BASE and HOP_BASE (https://dl.loot.build, https://loot.build/dl), the metrics SITE_SCOPE and own-host referrer, the disclosure links on trust, terms, privacy and known-issues, and the install, quickstart and guides pages follow, with the privacy and terms markers moved to 25 September 2026 and re-pinned since readers see the new address; README, CONTEXT.md (the forge door now forge.loot.build), the release checklist, site CI and test fixtures follow, and the two specs carry a note instead of a partial rewrite. the destination census gains build in WEB_TLDS, without which security@loot.build would be invisible to its bare-host clause, and exempts the two shipped lines that tld makes read as hosts (state.build, r.build()) by their exact text; ADR 0074 section 9 says twelve-entry to match. 37 lines still name millerbyte.com outside ADR bodies, evidence, research and scratch, each kept on purpose: dated history, millerbyte.com the site and its @millerbyte/ui tokens, the two noted specs, and relay-era tooling with no successor host, filed as #2438. census red with build dropped from WEB_TLDS, restored; site gate 819 passed and within budget; workspace suite 4559 passed over 142 binaries, 13 ignored (#2418) c5663115 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.