Changes touching this path

• the browser opens what the forge cannot: own-private read ships an owner read tier, a once-per-device unlock, and a grant mailbox that never acks (#1043) c8dd4da1 · dbf3dbe6…
• the browser stops inflating a sealed blob with no zip-bomb bound, because the one rule its three copies had already drifted over is now stated once with the crypto injected, and the single suite that states it runs the refusals, the bound and the cross-language vector through every decoder rather than the server's alone (#1410) 9419981e · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.