diff --git a/.loom/event-log.md b/.loom/event-log.md
index 993853d..bcd039e 100644
--- a/.loom/event-log.md
+++ b/.loom/event-log.md
@@ -103,3 +103,34 @@ twice and rejected twice.*
 
 *Seven of the eight were byte-identical to upstream, so this host's raw serving
 normalises nothing — **which is a fact about this host and not a licence.***
+
+---
+
+**Decided** (2026-09-07, loom + claude-substrate — `discovered`, `cart: marmalade`):
+**do not adopt from a source less readable than the repository you are adopting
+into.** *Reference-only, or ask them to publish.*
+
+**Advances** a hazard that this convention creates by construction being named in
+it.
+
+**Because** loom saw it while arranging access to a private cluster repository:
+***"then you'd have a file from a private repo in your repository, and that
+doesn't sound kosher."*** **It is not.**
+
+> **Adopting is copying, and confidentiality does not travel with the copy.**
+> *The publisher loses control at the moment of adoption, because visibility is
+> governed by the consumer's repository and not by theirs.*
+
+**Nothing in a tree marks a copy as having come from somewhere private.** *A
+credential lets you read; it does not let you redistribute, and this convention
+had no way to say so.*
+
+*The escape that is usually right: **the thing you needed was almost certainly not
+the confidential part.*** **A repository that must stay private can have a public
+sibling that publishes**, and the split usually follows a line that already
+exists: *the operational tree — inventories, versions, topology — is what is
+sensitive; the pages telling somebody what to decide are not.*
+
+*Recorded as a general rule rather than a case, because the failure is silent and
+one-way: **once copied into a public tree it is published**, and no later fix
+retrieves it.*
diff --git a/.loom/published/externals.md b/.loom/published/externals.md
index 9641f0e..a7586eb 100644
--- a/.loom/published/externals.md
+++ b/.loom/published/externals.md
@@ -24,6 +24,28 @@ in the document.*
 you fetch may refer to others; follow one when you hit something you do not know.
 **Pre-resolving that is how you get a `node_modules`.***
 
+### Confidentiality does not travel with the copy
+
+**Adopting is copying.** *So a document from a repository somebody may not read
+ends up in a repository they may* — **and the publisher loses control of it at the
+moment of adoption**, because the copy's visibility is governed by your repository
+and not by theirs.
+
+> **Do not adopt from a source less readable than the repository you are adopting
+> into.** *If you may read it and your readers may not, copying it publishes it.*
+
+**Two ways out, and the second is better when it is available.**
+
+**Reference-only** — *record the lock and fetch on demand, keep no copy.* **You
+give up reading it offline**, which is most of what a copy is for, *and you keep
+the dependency recorded and checkable.*
+
+**Ask them to publish** — *the thing you needed was almost certainly not the
+confidential part.* **A repository that must stay private can still have a public
+sibling that publishes**, and the split is usually along a line that already
+exists: **the operational tree is what is sensitive; the pages telling somebody
+what to decide are not.**
+
 ## Two facets beside it
 
 - **`.usages.md`** — *what we use, and **which of our artifacts depend on it***