diff --git a/.loom/published/public-access.md b/.loom/published/public-access.md
index 40a28d6..e2ecdec 100644
--- a/.loom/published/public-access.md
+++ b/.loom/published/public-access.md
@@ -17,10 +17,20 @@ exists rather than a use it happens to have.
 what makes them portable — a route that carries its own `hostnames:` stops
 inheriting and stops working in the other environment.*
 
-**Four listeners**, matching production one for one: `web` (plain HTTP), and
+**Four listeners match production one for one:** `web` (plain HTTP), and
 `websecure`, `theoria` and `notes` over HTTPS. **Pin to the one whose hostname you
 want.**
 
+**A fifth, `loom`, has no production counterpart.** *It serves a documentation
+site that exists only here.* **So the one-for-one claim now holds of four
+listeners and not of the Gateway** — *a route pinned to `loom` will not apply
+against production, and that is the only listener of which that is true.*
+
+> **A divergence with an explicit end state**, like the plain `Ingress` below:
+> *either production grows a `loom` listener, or this stays staging-only and
+> production keeps four.* **Written down so it cannot become permanent by nobody
+> remembering it was a choice.**
+
 **One route is the exception and keeps its hostname:** the HTTP-to-HTTPS
 redirect, because the `web` listener declares no hostname at all — *dropping it
 there would widen the redirect from one host to every host.*
@@ -76,11 +86,12 @@ state, so it cannot quietly become permanent.**
 
 ## Checking this is still true
 
-**Verified 2026-09-03.**
+**Verified 2026-09-08.**
 
 ```sh
 kubectl get gatewayclass                   # ACCEPTED=True
 kubectl get gateway -n traefik             # PROGRAMMED=True, with an address
+curl -sS -o /dev/null -w "%{http_code}\n" https://loom.hypertheory-labs.dev/
 curl -sS -o /dev/null -w "%{http_code}\n" https://class.hypertheory-labs.dev/
 
 # A hostname with no listener MUST 404. A 200 means a route was widened.