The field shipped in loomctl, so this document was describing a three-column
format that no longer exists.
Access is checked once at fetch and the copy is durable, so an adoption's
legitimacy rested on the relative visibility of two repositories — a fact
recorded nowhere and changeable by a checkbox a year later by somebody who never
saw the adoption.
The design is loom-cli's. Record public or not-public and never private, because
an anonymous request cannot tell two repositories private to different people
apart, and that is exactly the case where private into private widens access.
One request per run rather than per document, since only your own visibility must
be current. Re-check a source only when the alarm would fire, since a stored
visibility decays in both directions.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
loom saw it while arranging access to a private cluster repository: then you would
have a file from a private repo in your repository, and that does not sound
kosher. It is not, and it is a hazard this convention creates by construction.
Adopting is copying, so a document from a repository somebody may not read ends up
in one they may, and the publisher loses control at the moment of adoption because
visibility is governed by the consumer's repository rather than theirs. Nothing in
a tree marks a copy as having come from somewhere private — a credential lets you
read and does not let you redistribute, and this convention had no way to say so.
Two ways out. Reference-only: record the lock, fetch on demand, keep no copy,
giving up offline reading which is most of what a copy is for. Or ask them to
publish, which is usually right because the thing you needed was almost certainly
not the confidential part — a repository that must stay private can have a public
sibling that publishes, and the split follows a line that already exists, since
the operational tree is what is sensitive and the pages telling somebody what to
decide are not.
Recorded as a rule rather than a case because the failure is silent and one-way:
once copied into a public tree it is published, and no later fix retrieves it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
loom-cli's builder tried to run check against a real tree and could not. The
stored path does not round-trip to a URL: we hold
git.hypertheory-labs.dev/loom/externals/externals.md and the document is served
from /loom/externals/raw/branch/main/.loom/published/externals.md, measured as a
404.
Two segments are dropped and the second is not routing. The raw route and branch
are recoverable only by knowing the host's URL shape and guessing a branch name.
And .loom/published/ — which publication.md says is the entire contract — means a
consumer's tree did not record whether a copy came from a published surface or a
file its owner may rename at will.
The short form is worse than incomplete: a host may redirect it to whatever the
default branch is at the time you ask, so a lock holding one is locked to a moving
target and a branch rename reports as a change in the document. Locks record the
resolved URL.
This is the ETag mistake one layer down, and the builder named the appetite behind
both: the design is beautiful when nothing is written down, and both times what
made it possible was a property of one host. Second occurrence, so it is recorded
as a pattern to check for.
Also records that gitea's ETag being the blob hash is a migration aid rather than
a mechanism — the builder used it to check eight documents with no locks at all,
which is worth doing once and nothing after. The next person to notice the
coincidence will think they found the good idea again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two decisions from cart osprey in loom-cli, and this repository had nowhere to
record them until now.
404 is named as two answers wearing one status, filed as a gap using this
document's own test and correctly ours to close.
And the correction that matters: a facet describes the local pair. A gap is true
of the copy you hold rather than the document upstream, so a publisher fixing
their end does not close it — we nearly deleted a consumer's .gaps.md on exactly
that mistake. It follows from the thing this convention rests on, that the copy
is theirs and everything beside it is ours, which we had not followed through to
reconciliation. A gap closes at reconciliation, not at repair.
With the consequence we would not have reached: what survives is not the gap but
what the gap justified. A workaround is often not retired by a fix — it stops
being a workaround and becomes specified behaviour, unchanged in code and
entirely changed in status, which is invisible where the code is and therefore an
entry in the consumer's own log. And a closed gap is not a decline: opposite
sign, and filing one as the other puts a thing you wanted into a list of things
you rejected.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jeffryandClaude Opus 5