One unverifiable signature makes a whole hosted repository undisplayable

`Store::replay(Verify::Signatures)` is all-or-nothing. Its own documentation states the rule: under `Verify::Signatures` every sealed entry is put to `keys::check`, and "One whose signature does not verify is refused by name: the log is not loaded and the message says which operation and which file." (`~/usr/code/rust/ore/store/src/store.rs`, the `replay` doc comment, and the `Verify` enum at `store.rs:204-213`.) The forge replays that way on every request -- `~/usr/code/web/apps/oxedyne/oregami/src/forge.rs:130` -- so a single bad signature anywhere in a hosted history takes every view of that repository with it. Files, log, marks, flags, who, notes: all of them are the same replay, so all of them go at once. A repository the forge cannot replay does still get a line naming the fault (`forge.rs:221-224`), which is the right posture, but there is no render-up-to-the-bad-operation. The rule is deliberate and the reasoning behind it is sound where it applies: an operation missing from a history is a different history, so it is never quietly dropped; and the signature is what it is for, so it is never quietly accepted. That argument is about a working replica deciding what to trust. The forge is not a working replica. It is a reader whose whole job is to show what a repository holds, and it is precisely the place where a relay-held repository may contain something a client would have refused, because the relay verifies nothing on arrival by design (`relay_transport.md`, as-built: "The relay verifies nothing on arrival"). So the two decisions interlock. Choosing that the relay stores what it is given, and choosing that any bad signature refuses the whole replay, together mean that anyone who can push to a repository can make its forge pages disappear. That is recorded as gap 7 of the nine, and the shape of the fix named there is a third `Verify` posture -- render what verifies, name what does not, and mark the boundary. Deciding it takes a judgement about which failure is worse for a reader: a page that is not there, or a page that shows the history up to the point where it stopped being verifiable, with the operation named. Transcribed from the project record on 2026-08-14. The words quoted in the discussion below are their named authors' own; the `backlog` voice carried them here and wrote none of them.