diff --git a/.loom/published/externals.md b/.loom/published/externals.md
index 7a564ad..0383f16 100644
--- a/.loom/published/externals.md
+++ b/.loom/published/externals.md
@@ -33,6 +33,19 @@ did not happen.*
 | **`304`** | nothing changed |
 | **`200`** | changed — the new copy is a candidate, not a replacement |
 | **`410`** | gone — follow whatever the response points at |
+| **`404`** | **unresolved.** *Report both readings; do not pick one* |
+
+**`404` is two different answers wearing one status.** *The document was
+withdrawn, or you no longer have access — **and over HTTP they are
+indistinguishable**, because a host that distinguished them would leak the
+existence of things you may not see.*
+
+> **Say both. Do not guess.** *They want different actions — re-pull elsewhere,
+> versus ask somebody for access — and a tool that picks one will be wrong half
+> the time silently.*
+
+*Over ssh they **are** distinguishable — permission denied against repository not
+found — so a client that has both transports should say which it used.*
 
 ## Reconciliation runs the other way