the lock holds visibility, and it says public or not-public

The field shipped in loomctl, so this document was describing a three-column
format that no longer exists.

Access is checked once at fetch and the copy is durable, so an adoption's
legitimacy rested on the relative visibility of two repositories — a fact
recorded nowhere and changeable by a checkbox a year later by somebody who never
saw the adoption.

The design is loom-cli's. Record public or not-public and never private, because
an anonymous request cannot tell two repositories private to different people
apart, and that is exactly the case where private into private widens access.
One request per run rather than per document, since only your own visibility must
be current. Re-check a source only when the alarm would fire, since a stored
visibility decays in both directions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.loom/event-log.md

@@ -134,3 +134,40 @@ sensitive; the pages telling somebody what to decide are not.*
 *Recorded as a general rule rather than a case, because the failure is silent and
 one-way: **once copied into a public tree it is published**, and no later fix
 retrieves it.*
+
+---
+
+## The lock grows a fourth column: visibility
+
+**Decided.** *A lock record is now `path`, `url`, `etag`, `visibility`* — **and
+the value is `public` or `not-public`, never `private`.**
+
+**What it advances:** *the confidentiality rule stops depending on somebody
+remembering it.* **Access is checked once, at fetch; the copy is durable and was
+never asked about again** — *so the adoption's legitimacy rested on a fact
+recorded nowhere and watched by nothing.*
+
+**Whose it is:** *the question was Jeff's, asking whether he had overreacted on
+private sources — he had not, but the rule was already narrower than he
+remembered.* **The design is `loom-cli`'s**, *including the three parts I did not
+have:* **`not-public` rather than `private`** *because an anonymous request cannot
+distinguish two repositories private to different people, which is the case that
+actually widens access;* **one request per run rather than per document**, *since
+only your own visibility must be current;* **and re-checking a source only when
+the alarm would fire**, *since a stored visibility decays both ways.*
+
+**Declined: refusing the adoption.** *`loomctl` warns and proceeds.* **Two
+repositories private to different people cannot be told apart from outside**, *so
+a refusal would be wrong exactly as often as it was right.*
+
+**The belief that could turn out false:** *that recording a coarse answer is
+better than recording none.* **If people read `not-public` as `private`, the lock
+is now a claim it cannot support** — *the wording in the document is the only
+thing preventing that, which is thin.*
+
+## Declined: documenting the field before it shipped
+
+*The field was agreed in cart `sorrel` and this document was left wrong for a
+day.* **Documenting a format that does not exist yet is the same mistake as
+publishing into a repository nobody can read** — *it passes every check available
+to the writer.*