the path does not record the origin — a lock does

loom-cli's builder tried to run check against a real tree and could not. The
stored path does not round-trip to a URL: we hold
git.hypertheory-labs.dev/loom/externals/externals.md and the document is served
from /loom/externals/raw/branch/main/.loom/published/externals.md, measured as a
404.

Two segments are dropped and the second is not routing. The raw route and branch
are recoverable only by knowing the host's URL shape and guessing a branch name.
And .loom/published/ — which publication.md says is the entire contract — means a
consumer's tree did not record whether a copy came from a published surface or a
file its owner may rename at will.

The short form is worse than incomplete: a host may redirect it to whatever the
default branch is at the time you ask, so a lock holding one is locked to a moving
target and a branch rename reports as a change in the document. Locks record the
resolved URL.

This is the ETag mistake one layer down, and the builder named the appetite behind
both: the design is beautiful when nothing is written down, and both times what
made it possible was a property of one host. Second occurrence, so it is recorded
as a pattern to check for.

Also records that gitea's ETag being the blob hash is a migration aid rather than
a mechanism — the builder used it to check eight documents with no locks at all,
which is worth doing once and nothing after. The next person to notice the
coincidence will think they found the good idea again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.loom/published/externals.md

@@ -5,8 +5,20 @@
 ## Pull what you use
 
 **You fetch a copy of somebody's document and keep it** at
-`.loom/externals/<host>/<path>.md`. *The path says where it came from, so nothing
-has to record an origin.*
+`.loom/externals/<host>/<path>.md`.
+
+> ~~*The path says where it came from, so nothing has to record an origin.*~~
+> **This was false and it was load-bearing.** *A stored path is short enough to
+> read and therefore too short to resolve: it drops the host's routing, the
+> branch, and — worst — the `published/` segment, **which is the whole contract.***
+
+**The path is for a person. The origin is recorded in the lock**, resolved: host,
+route, branch, and full path.
+
+*Record the **resolved** URL and not the short form. A host may redirect a short
+form to whatever the default branch is **at the time you ask** — so a lock holding
+one is locked to a moving target, and a rename of the branch reports as a change
+in the document.*
 
 **Pull what you need to understand, not everything it depends on.** *A document
 you fetch may refer to others; follow one when you hit something you do not know.
@@ -22,6 +34,21 @@ you fetch may refer to others; follow one when you hit something you do not know
 > `manifests/ingress.yaml`" is the whole value**, because it answers the only
 > question reconciliation asks.*
 
+## What a lock holds
+
+**One record per adopted document, in `.loom/externals/.locks`:**
+
+- **where it was fetched from** — *resolved, as above*
+- **the publisher's `ETag`** — *verbatim*
+
+**It is committed**, because the thing it locks is committed, and *a lock that
+travels separately from what it locks is the drift this is meant to prevent.*
+
+> **A document with no lock is not broken; it is unlocked.** *Report it and fetch
+> again.* **Do not adopt whatever the remote currently serves as the lock** — that
+> asserts your copy is the one being served, which is the thing you were going to
+> check.
+
 ## Freshness is a conditional request
 
 **Locked on the publisher's `ETag`, verbatim — never a hash you compute.** *A