Changes touching this path

• a land builds the site and weighs the eager bytes of every published surface, so a redesign cannot spend the byte lead in silence, and the four places that called site/ ungated now say what is true (#1241) 674361ad · dbf3dbe6…
• the site stops shipping 298 grammars to highlight two languages, and a three-line meta helper stops dragging fifteen more into the entry chunk of every page including the ones with no code at all (#1244) b06ca1b5 · dbf3dbe6…diff
• a wrong webfont subset stops reading as an improvement: the shipped faces carry a hash-bound coverage manifest, and a test walks every published surface including the SSR-only landing page to refuse any character the site renders and the font cannot draw 1ec496c7 · dbf3dbe6…diff
• a re-record that lowers a ceiling keeps the reason and appends the move instead of deleting the only record of why that surface costs what it does, the bookkeeping becomes a pure function, and twelve tests hold the branch that had none efbf9eb5 · dbf3dbe6…diff
• a raise appends its reason to the accumulated history instead of replacing it, which is the arm both ceiling raises actually took, and throwing the old rationale away becomes a deliberate --replace-reason rather than the default 2d293f04 · dbf3dbe6…diff
• the docs become fifty-six routed entries derived from one registry that the nav, the reading order, the search and the prerenderer all read, so those four can no longer drift apart the way ten hand-listed surfaces already had to be watched; the thirty-eight pages nobody has written yet are real bookmarkable URLs that say what they will cover and carry noindex until they earn a place in an index, rather than dead rows in a sidebar; and the byte gate learns to walk nested surfaces, which is the only reason the fifty-two new pages weigh anything at all instead of shipping past a gate that read one directory level (#1378) 424be083 · dbf3dbe6…diff
• the foreign grant stops applying itself, and that was a LIVE defect rather than a guard this ticket adds: pullMailbox indexed every verified blob alike and discarded the grantor pubkey, so a grant somebody else deposited in the mailbox was applied SILENTLY the first time any file at its address was opened - the exact opposite of #488's decision that nothing auto-applies. The mailbox is sorted BY GRANTOR now: a self-grant under ADR 0057 still goes straight into the key index, while anything signed by another key becomes an offer in a second map the decrypt path cannot reach, so the property is structural rather than a check somebody has to remember. Restoring the old line turns nine of sixteen cases red, headed by a stranger's key entering the key index, and the positive controls are what make locked a decision rather than a broken fixture: an accepted grant reads open with bytes equal to the content key, and a self-grant in the SAME pull still opens itself. The copy is asserted as RENDERED rather than as source, and the decline half is honest for a reason it states out loud - the only wire act that could take a grant out of your mailbox is an ack, and an ack would delete the blob for every other device you own, so this page does not have one - which is why declining revokes nothing and says so, against an absent-phrase list that refuses has been revoked and no longer has access. Expiry's first line is WELDED to the refusal constant rather than restating it, an expired offer stays visible after a refused accept, and a control files the same grant one second before it expires. The unprovisioned member tier is ASKED rather than remembered: the me route answers whether the read class is live and the browser tests that for exactly true, so a missing field lands on the arm that promises nothing, and the dark arm - the live one today - says the repo answers not yours as a 404 whether or not you have been added. Three things were found on the way and each is measured rather than argued. Importing the fingerprint helper dragged a curve library into the shared entry at eight kilobytes on every PUBLIC route, fixed by moving the function to the dependency-free module beside it. A lazy route was measured and REJECTED at 581 bytes against 270 eager, because the split chunk's manifest outweighs the code it saves, and that is recorded in the route so nobody fixes it back. And the byte record had to be raised, so the raise is SPLIT rather than apportioned: the same tree with this ticket removed already reads a thousand and thirty bytes over the recorded numbers on every surface, which is pre-existing shared-entry drift, where this page itself costs 270. The budget tool had a real bug that recording surfaced - its lowering note is anchored to the end of the line so a later lowering can replace its predecessor, but a raise appended after it buried the note out of that anchor's reach and the next lowering stamped a second one - fixed with a fixture that is red without it (#1640) 152d0635 · dbf3dbe6…diff
• a docs page fetches its own prose and no other page prose, where content/docs/index.tsx imported every content module statically and the one splat route chunk carried all of it: 9,211 B gzip preloaded on every published docs surface, planned pages included, and a paragraph added to one page moved all of them, so the byte budget reported about fifty regressions for a one-page edit and taught its reader to record the raise rather than investigate it. each module now sits behind its own dynamic import that import.meta.glob finds by directory, keyed by the slug first segment, and each exports CONTENT so the index derives the set instead of listing it. measured on one tree before and after: the route shell falls from 9,211 B to 1,244 B gzip, docs/concepts/cas from 210,980 B to 202,288 B and docs/cli from 214,827 B to 206,137 B, the code-block chunk leaving the eager set with the prose; 52 ceilings are re-recorded down, and the whole-file rewrite carries four raises that measured over before this change as well as after, each with its reason. the prerendered document is unchanged, so what defers is the module hydration wants: headless chrome against the built server renders a written and a planned page whole, and every code fence on the quickstart page reaches its client-only highlighted form, which needs the deferred chunk and a real hydration. site/test/docs-content.test.ts holds the property against the built bytes, refusing a page with no prose to look for and prose no search of the assets can find, and budget.mjs names the shape of a wide refusal under the rows. red under mutation: one content module re-coupled statically (1 failed, 4 passed), a module export renamed (2 failed, 3 passed), a body filed under a slug the registry does not call written (2 failed, 3 passed), entity decoding dropped from the marker extractor so the vacuity guard fires (1 failed, 4 passed), the same-growth check dropped from the hint (1 failed, 22 passed), its unrecorded-row guard dropped (1 failed, 22 passed), and the count dropped from its text (1 failed, 22 passed). no migration, no wire or format byte moves and no forge or relay byte moves; the built site changes, so this owes a site deploy. the site gate is green end to end (659 passed over 53 files, 62 surfaces all under ceiling with nothing recorded) and the workspace suite is green (3952 passed over 122 binaries, 7 ignored) (#1878) 678876e6 · dbf3dbe6…diff
• the docs byte test refuses an empty set before it concludes anything from one, and the sentences #1877 and #1878 left behind stop counting what code can add to: with eagerHrefs matching nothing the eager-asset half of site/test/docs-content.test.ts was true of nothing and green, measured at 5 passed and 0 failed with that mutation in place against 1 failed and 4 passed once the refusal was written, and the same hole over the pages the registry calls written and over the bodies the modules publish is refused too, each proved by running its mutation without the guard (1 passed) and with it (1 failed). sharedChunkHint stops listing its silences, which were more than the list said, and states the property its guards define, with the row floor named SHAPE_ROWS so the doc cites code rather than a digit, and the CONTEXT.md line loses its whenever. tsconfig.test.json and ADR 0071 stop naming the tests that import tools/budget.mjs, a list #1877 wrote and #1878 falsified in the same session, and the ADR carries both survey numbers, 17 raw of which nine were the first draft of that config own fault and eight genuine over five files. the docs splat route stops describing a fallback it did not have: writtenDoc takes the node a missing body renders, so a written page whose module holds nothing under its slug shows the honest planned template rather than a bare title, verified by renaming one body key and reading the prerendered page, which carried the template on the same tree the gate refused (3 failed, 2 passed). the four content modules point at DocContentModule instead of pasting the rule it defines, the byte test failure message stops saying every docs surface where the set is a union over written pages, and the four raises in budget.json carry their own measurement, +239 B on /docs, +613 B on /install, +681 B on /known-issues and +1,444 B on /privacy, each against the figure its previous ceiling was derived from. the second reason claimed for including src is declined at the code with what refutes it: with src out of the include tsc -b reports exactly one error and it is the routeTree augmentation, import.meta.glob being typed by a type library reference that travels with a dependency rather than with an include. no migration, no wire or format byte moves and no forge or relay byte moves; the built site moves a few bytes per docs surface, all under ceiling with nothing recorded, and no page a reader sees changes. the site gate is green end to end (659 passed and 61 skipped over 60 files, 62 surfaces) and the workspace suite is green (3970 passed over 122 binaries, 7 ignored) (#2088) 45b6f3ec · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.