Changes touching this path

• the two installers come off the prerender list, because a server handler needs no entry there and listing one made the BUILD execute it: /install.sh and /install.ps1 are proxyInstaller handlers rather than pages, so the prerender ran the handler and wrote .output/public/install.sh with the R2 rewrite baked in at build time. production has been serving the LIVE handler all along and the static copy was inert only by nitro route-versus-asset precedence - an accident, and three things were resting on it. ADR 0067 published half is rolled back by re-pointing R2 installers/ prefix, and against a copy frozen at deploy time that recourse changes NOTHING. the prerender also put a network fetch inside every land site gate, since it fetches dl.millerbyte.com and rewriteInstaller throws when dist anchor has drifted, so a land could fail on somebody else uptime. and once 1627 hop lands a frozen copy freezes the hop TAG too, which would 404 through our own hostname while the download count silently flatlined. verified the way the ticket asks rather than by reading config: after the change the build emits neither .output/public/install.sh nor install.ps1, and that absence IS the proof the handler was not executed at build time, since the file only exists if it ran. the shipper bundle is unaffected and the byte budget is untouched, which it would be - the list holds /install, the HTML page, and never held /install.sh. the guard added is not the pair of names it looks like it should be. it derives every route file defining a server handler, derives the prerender list, and asserts the INTERSECTION is exactly robots.txt - set equality rather than a subset, because a none-of-these-two assertion looks identical to a real guard and would let a THIRD handler route be prerendered silently. it carries its own control asserting the two derivations found anything at all, since an empty list intersects an empty list and reads green forever. ⚠ the ticket own text is wrong about the exception and the test says so rather than inheriting it: it says leave robots.txt alone because that one really is a static file with no handler. robots[.]txt.ts IS a handler. it is exempt for a better reason - it returns a compile-time constant string, so prerendering it fetches nothing and freezes nothing, and that is the real rule the installers break. not is a handler, but is a handler whose response depends on the outside world at build time (#1645) 4aea0e29 · dbf3dbe6…
• the metrics dashboard ships as SIX STATIC PANELS behind an operator allowlist, and the two reviews moved it from a client-fetched page with a 401 to a server-rendered one that cannot be probed: 1623 settled Variant A, the Briefing - one column, one section per question, each caveat as PROSE beside the number it qualifies, which is the structural reason it won, since a caveat there cannot be skipped without skipping its number. the access decision is that being signed in is not the same as being the operator. anyone can sign up to this host and the data is site-WIDE - every visitor path, referrer host and install-funnel count - so the door is a custody list in the 1045 shape: a Clerk id is on it or it is not. it fails CLOSED in every branch, and the proof is that the fail-OPEN spelling was written and run: allowed.length greater than zero AND not includes, then return true, reads as careful and admits the entire internet the moment the list is empty, which is the state a box is in before its first deploy writes one. exactly two tests went red on it. the security review then found the route around that allowlist was the wrong shape twice over. the check sat INSIDE withPrivateSession, which maps an unauthenticated caller to 401 - so a stranger probing the endpoint got a 401 where an unserved path gets 404, and the refusal meant to hide the route confirmed it, while a load-bearing comment three lines up asserted the opposite. and the page itself answered 200 to anyone, rendering a document and only saying not found after a client fetch failed. both collapse into one server function returning null for BOTH refusals, which the loader turns into a real notFound: signed-out, signed-in-not-an-operator and a path we do not serve are now one answer. that rework is also what the ticket asked for and I had not done - the panels render into the HTML from a route loader rather than from a browser round trip, so the acceptance criterion about server-side rendering stops being approximated. the second finding is sharper than it looks: the route declared no headers, and every private route sets private no-store BECAUSE an nginx proxy_cache sits in front. an operator document without it is cacheable at the edge, which is the edge handing one caller a page meant for another. it now carries PRIVATE_HEADERS, and that constant own comment is widened to say it covers two tiers rather than left reading as private-only. one real data bug came out of the same review and no test I had written could see it: ordering a to_char MM-DD label sorts the series as TEXT, so any window crossing new year draws january before december - the sparkline scrambled about thirty days a year on the one chart whose job is a shape over time. grouped and ordered on the timestamp now, formatted on the way out, and pinned by asserting the grouped expression is not a to_char, verified by restoring the bug and watching it go red. built against the PRODUCERS rather than the schema, which is what the prototype was really for: visitor_key is null on every log-sourced row and permanently will be since 1632 took the address out of the log, so there are no uniques and no sessions here at all, and device, browser, os and country have no producer either. the panels that wait on one are rendered, named and marked rather than omitted - uniques on 1757, forge usage on 1758, downloads on 1647 and telemetry on 1658 - because a dashboard that silently drops what it cannot see is how you talk yourself into a wrong conclusion. not prerendered, and that is a security property rather than a build detail: a prerendered page is served as a static FILE with the static route headers, so an operator surface would exist as bytes anyone can fetch with the door never consulted - the same reason private joined that filter in 1043. asserted, and the mutation confirms the assertion bites. it is correspondingly absent from the byte budget, which discovers prerendered surfaces, and its styles stay in the route rather than styles.css because that sheet is eager on all sixty budgeted surfaces and an operator page has no business charging them (#1794) 2c969a0e · dbf3dbe6…diff
• the line-ending land refusal now walks site/ and covers ts, tsx, mjs, css, html and py, the site extensions it did not cover, while skipping the site build output that site/.gitignore ignores (dist, .output, .tanstack, .nitro and site/src/wasm), so a flipped site source file no longer lands unrefused. js stays out because the site tracks none, txt stays out because the tracked run transcripts in docs/evidence/runs hold CRLF, and ps1 stays exempt. a planted CRLF file for each new extension under site/ went red on the old walk (10 passed, 3 failed), and dropping site from the roots or tsx from the extensions went red again (10 passed, 3 failed each). unskipping .output or site/src/wasm, or covering ps1, went red on the build-output and powershell pin (9 passed, 4 failed each), and covering txt turned the real-tree test red (1 passed, 1 failed). on this repo the walk now reads 1228 files where it read 1007, median 46 ms against 38 ms, and a built site passes it. AGENTS.md and the hygiene.rs module doc now say which files the refusal reads by pointing at the constants, AGENTS.md names the transcripts as an exception, and the NUL sentinel in site/test/prerender-list.test.ts is written as an escape so git reads the file as text. the site gate and the workspace suite are green (#1792) ab6c3116 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.