Changes touching this path

• the metrics dashboard loads again: the installs-seen-again subquery was aliased returning, a reserved word in Postgres, so the statement never parsed, and because dashboard runs its queries under one Promise.all that one refusal took the whole page down for the operator with every gate green since 1940. the alias is seen_again. what let it through is that metrics-read.test.ts reads the SQL as text and nothing parsed it, so a new metrics-read.pg.test.ts, on the suites existing skip-unless-configured pg convention, runs the real reader as the real metrics_read role over site/migrations on a throwaway cluster: it went red with the production error word for word before the fix and is green after, along with both drill-down kinds and a seeded case that measures what the text pins could only describe, namely that an internal-class report is neither an install nor a return, that only docs sections reach the docs panel, that the rule versions are the union of the raw window and the rollup, and that the read role holds SELECT on every table the page reads. the text tests header now says what it cannot see and to run the pg test before landing SQL. tsc and the full site suite are green (#2010) 60af97d8 · dbf3dbe6…
• the metrics dashboard reader test runs in CI instead of passing by running nothing: test-main.yml already ran every site pg test under LOOT_FORGE_TEST_REQUIRE_DATABASE, and metrics-read.pg.test.ts skipped there with a bare console.warn, so the guard 2010 added fired only by hand. the file now calls skippingLive like its siblings, and it went from exit 0 with all tests skipped to a failure under the flag with no keys. the workflow provisions loot_metrics the way the scripts repos metrics-db.js does, bare LOGIN roles, the database and CONNECT only, so every table, sequence and function grant comes from the migrations as in production; it then applies site/migrations in C-locale order from this commit, and sets the two metrics keys. the step was pulled out of the parsed YAML and run verbatim against a throwaway password-auth PostgreSQL 17, twice to show it is idempotent, and the test then passed 3 of 3 with the exact CI URLs under the flag and failed on syntax error at or near returning when that alias was put back. no CI run proves it yet: GitHub refused to start any Actions job over account billing. the text tests header says the land gate runs it only when the landers environment carries the keys (#2041) 7b84226b · dbf3dbe6…diff
• a count of people is rounded before the dashboard draws it, because the exemption that keeps this site banner-free has an output condition nothing implemented: 1617s research recorded that the reports an operator reads must hold anonymous statistics only, holding under whatever combination of filters the operator selects, with present to the nearest ten as the recommended measure. that only began to bite when 1940 put people on the page, since before it every panel counted requests. presentPeople is the one place it is applied: a true zero stays zero, 1 to 9 carries no number at all and the page draws under ten rather than a zero over real activity, and anything larger goes to the nearest ten. it is a union rather than a number beside a flag, so an under-ten count has no n to read and a caller that wants a bar height has to ask for a magnitude and cannot print a floor as if it were a measurement; the boundary test proves 1 and 9 are indistinguishable and that no 4 survives into the value, and a floor that carried its count reddens exactly that pin. window totals are summed exactly and rounded once, which a mutation summing the rounded days reddens. what rounds is decided by the unit rather than by a list of panels: a field typed People rounds and a plain number does not, so a panel added later inherits the rule from its type. the rule lives in lib/metrics-drill.ts, not in read.ts, because a value import from the reader puts pg into every client bundle, which is 1804s defect and I had just written it. ADR 0087 records the decision, that under ten deviates from the recommended measure by disclosing that somebody was there, and why that beat a false zero on the operators own page (#1951) 71be502c · dbf3dbe6…diff
• the private repo surface becomes a workbench: /private/<owner>/<repo> is one layout route that mounts a VS Code-like shell once behind one gate (activity bar, side panel, preview and pinned tabs, status bar, Ctrl+P quick open) and keeps it across navigation, each child route naming its document with OpenDocument rather than rendering a page; a view is one module plus its routes, WorkbenchView in components/workbench/view.ts is the contract and VIEWS the one list the shell derives from, and the shell names no view. two views ship, Files (explorer over one new /api/private/manifest read, file editor with gutter, minimap, #L links and per-file decrypt, folder overview) and History (ledger panel, ledger, path and two-sided diff documents moved from the old pages), History built second against the contract and needing no shell edit, which is the test of the operator requirement that new views such as proposals and tickets be easy to add. /api/private/repo answers the header without a tree read, /api/private/tree and the page chrome it fed are deleted, every URL #1043 served still resolves. ADR 0094 and CONTEXT.md record it; 768 site tests pass, each new test red under a named mutation and restored; no migration, no format byte, no forge change, site deploy only (#2327) 7462b904 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.