the lock holds visibility, and it says public or not-public

The field shipped in loomctl, so this document was describing a three-column
format that no longer exists.

Access is checked once at fetch and the copy is durable, so an adoption's
legitimacy rested on the relative visibility of two repositories — a fact
recorded nowhere and changeable by a checkbox a year later by somebody who never
saw the adoption.

The design is loom-cli's. Record public or not-public and never private, because
an anonymous request cannot tell two repositories private to different people
apart, and that is exactly the case where private into private widens access.
One request per run rather than per document, since only your own visibility must
be current. Re-check a source only when the alarm would fire, since a stored
visibility decays in both directions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.loom/event-log.md

@@ -134,3 +134,40 @@ sensitive; the pages telling somebody what to decide are not.*
 *Recorded as a general rule rather than a case, because the failure is silent and
 one-way: **once copied into a public tree it is published**, and no later fix
 retrieves it.*
+
+---
+
+## The lock grows a fourth column: visibility
+
+**Decided.** *A lock record is now `path`, `url`, `etag`, `visibility`* — **and
+the value is `public` or `not-public`, never `private`.**
+
+**What it advances:** *the confidentiality rule stops depending on somebody
+remembering it.* **Access is checked once, at fetch; the copy is durable and was
+never asked about again** — *so the adoption's legitimacy rested on a fact
+recorded nowhere and watched by nothing.*
+
+**Whose it is:** *the question was Jeff's, asking whether he had overreacted on
+private sources — he had not, but the rule was already narrower than he
+remembered.* **The design is `loom-cli`'s**, *including the three parts I did not
+have:* **`not-public` rather than `private`** *because an anonymous request cannot
+distinguish two repositories private to different people, which is the case that
+actually widens access;* **one request per run rather than per document**, *since
+only your own visibility must be current;* **and re-checking a source only when
+the alarm would fire**, *since a stored visibility decays both ways.*
+
+**Declined: refusing the adoption.** *`loomctl` warns and proceeds.* **Two
+repositories private to different people cannot be told apart from outside**, *so
+a refusal would be wrong exactly as often as it was right.*
+
+**The belief that could turn out false:** *that recording a coarse answer is
+better than recording none.* **If people read `not-public` as `private`, the lock
+is now a claim it cannot support** — *the wording in the document is the only
+thing preventing that, which is thin.*
+
+## Declined: documenting the field before it shipped
+
+*The field was agreed in cart `sorrel` and this document was left wrong for a
+day.* **Documenting a format that does not exist yet is the same mistake as
+publishing into a repository nobody can read** — *it passes every check available
+to the writer.*

.loom/published/externals.md

@@ -62,6 +62,7 @@ what to decide are not.**
 
 - **where it was fetched from** — *resolved, as above*
 - **the publisher's `ETag`** — *verbatim*
+- **the visibility the source could be read at, when it was fetched**
 
 **It is committed**, because the thing it locks is committed, and *a lock that
 travels separately from what it locks is the drift this is meant to prevent.*
@@ -71,6 +72,26 @@ travels separately from what it locks is the drift this is meant to prevent.*
 > asserts your copy is the one being served, which is the thing you were going to
 > check.
 
+### Why visibility is in the lock and not left to the moment
+
+**Access is checked once and the copy is durable.** *A token gets you the read;
+nothing revisits it afterwards.* **So the adoption's legitimacy rests on the
+relative visibility of two repositories — and that is changeable by a checkbox, a
+year later, by somebody who never saw the adoption.**
+
+> **Record `public` or `not-public`. Never `private`.** *An anonymous request can
+> tell you a repository is not public. It cannot tell two repositories private to
+> **different people** apart* — **which is exactly the case where private into
+> private genuinely widens access.** *Record the word you can verify.*
+
+**Checking it costs one request per run, not one per document**, *because the only
+thing that must be current is **your own** visibility.* **Re-check a source only
+when the alarm would fire** — *you are public, it was recorded not-public* — *and
+if it has since gone public, update the lock and say nothing.*
+
+*A stored visibility decays in both directions, which is why the alarm re-checks
+rather than trusting the record.*
+
 ## Freshness is a conditional request
 
 **Locked on the publisher's `ETag`, verbatim — never a hash you compute.** *A