404 is two answers wearing one status

Filed as a gap against this document by loom-cli's builder, and correctly: the
table listed 304, 200 and 410 and not 404, while gitea returns 404 for both "the
document was withdrawn" and "you no longer have access".

They are indistinguishable over HTTP by design — a host that distinguished them
would leak the existence of things you may not see — so the convention says
report both readings rather than pick one. They want different actions, re-pull
elsewhere versus ask for access, and a tool that guesses will be wrong half the
time silently.

Notes that ssh does distinguish them, permission denied against repository not
found, so a client with both transports should say which it used.

The claim was filed using this document's own test — could you say whose job it
is — which is the first time the convention has been used against the document
that defines it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.loom/published/externals.md

@@ -33,6 +33,19 @@ did not happen.*
 | **`304`** | nothing changed |
 | **`200`** | changed — the new copy is a candidate, not a replacement |
 | **`410`** | gone — follow whatever the response points at |
+| **`404`** | **unresolved.** *Report both readings; do not pick one* |
+
+**`404` is two different answers wearing one status.** *The document was
+withdrawn, or you no longer have access — **and over HTTP they are
+indistinguishable**, because a host that distinguished them would leak the
+existence of things you may not see.*
+
+> **Say both. Do not guess.** *They want different actions — re-pull elsewhere,
+> versus ask somebody for access — and a tool that picks one will be wrong half
+> the time silently.*
+
+*Over ssh they **are** distinguishable — permission denied against repository not
+found — so a client that has both transports should say which it used.*
 
 ## Reconciliation runs the other way