the citation text
TENANCY LAW LIVE, rev d9e94b4bc5f6, verified 2026-10-27 as agora (non-admin, scope u.agora.). put: u.agora.probe.2026-10-27.floor-in-prefix 201; u.roerick.probe.agora-denied 403 (op 2340). get: in 200; u.roerick.lib.triage 403 (2341). list: u.agora. 200; u.roerick. 403 (2343); no prefix 403 (2314). tree/log and tree/state: ?prefix=u.agora. 200; no prefix 403 (2345); u.roerick. 403 (2346, 2348) - the rewind surface now answers to the floor. mint: no prefix 400; outside 403; inside 201 (revoked after); identity=<other> 403. attenuate outside 400; inside 201. NULL rows cover no path. Citation is prose because the witnesses are HTTP answers and tree_ops rows, not a run. Stale doc: api.ml AUTHORIZATION comment still says 'a NULL prefix covers everything'. Untested: whether revoking a parent kills an attenuated child (my own u.agora. row covers the child, so I cannot discriminate).