diff --git a/.loom/event-log.md b/.loom/event-log.md
index bcd039e..fd1e445 100644
--- a/.loom/event-log.md
+++ b/.loom/event-log.md
@@ -134,3 +134,40 @@ sensitive; the pages telling somebody what to decide are not.*
 *Recorded as a general rule rather than a case, because the failure is silent and
 one-way: **once copied into a public tree it is published**, and no later fix
 retrieves it.*
+
+---
+
+## The lock grows a fourth column: visibility
+
+**Decided.** *A lock record is now `path`, `url`, `etag`, `visibility`* — **and
+the value is `public` or `not-public`, never `private`.**
+
+**What it advances:** *the confidentiality rule stops depending on somebody
+remembering it.* **Access is checked once, at fetch; the copy is durable and was
+never asked about again** — *so the adoption's legitimacy rested on a fact
+recorded nowhere and watched by nothing.*
+
+**Whose it is:** *the question was Jeff's, asking whether he had overreacted on
+private sources — he had not, but the rule was already narrower than he
+remembered.* **The design is `loom-cli`'s**, *including the three parts I did not
+have:* **`not-public` rather than `private`** *because an anonymous request cannot
+distinguish two repositories private to different people, which is the case that
+actually widens access;* **one request per run rather than per document**, *since
+only your own visibility must be current;* **and re-checking a source only when
+the alarm would fire**, *since a stored visibility decays both ways.*
+
+**Declined: refusing the adoption.** *`loomctl` warns and proceeds.* **Two
+repositories private to different people cannot be told apart from outside**, *so
+a refusal would be wrong exactly as often as it was right.*
+
+**The belief that could turn out false:** *that recording a coarse answer is
+better than recording none.* **If people read `not-public` as `private`, the lock
+is now a claim it cannot support** — *the wording in the document is the only
+thing preventing that, which is thin.*
+
+## Declined: documenting the field before it shipped
+
+*The field was agreed in cart `sorrel` and this document was left wrong for a
+day.* **Documenting a format that does not exist yet is the same mistake as
+publishing into a repository nobody can read** — *it passes every check available
+to the writer.*
diff --git a/.loom/published/externals.md b/.loom/published/externals.md
index a7586eb..50673cc 100644
--- a/.loom/published/externals.md
+++ b/.loom/published/externals.md
@@ -62,6 +62,7 @@ what to decide are not.**
 
 - **where it was fetched from** — *resolved, as above*
 - **the publisher's `ETag`** — *verbatim*
+- **the visibility the source could be read at, when it was fetched**
 
 **It is committed**, because the thing it locks is committed, and *a lock that
 travels separately from what it locks is the drift this is meant to prevent.*
@@ -71,6 +72,26 @@ travels separately from what it locks is the drift this is meant to prevent.*
 > asserts your copy is the one being served, which is the thing you were going to
 > check.
 
+### Why visibility is in the lock and not left to the moment
+
+**Access is checked once and the copy is durable.** *A token gets you the read;
+nothing revisits it afterwards.* **So the adoption's legitimacy rests on the
+relative visibility of two repositories — and that is changeable by a checkbox, a
+year later, by somebody who never saw the adoption.**
+
+> **Record `public` or `not-public`. Never `private`.** *An anonymous request can
+> tell you a repository is not public. It cannot tell two repositories private to
+> **different people** apart* — **which is exactly the case where private into
+> private genuinely widens access.** *Record the word you can verify.*
+
+**Checking it costs one request per run, not one per document**, *because the only
+thing that must be current is **your own** visibility.* **Re-check a source only
+when the alarm would fire** — *you are public, it was recorded not-public* — *and
+if it has since gone public, update the lock and say nothing.*
+
+*A stored visibility decays in both directions, which is why the alarm re-checks
+rather than trusting the record.*
+
 ## Freshness is a conditional request
 
 **Locked on the publisher's `ETag`, verbatim — never a hash you compute.** *A