marmalade: publication is not publicness, and a token tells you by refusing

Jeff's correction breaks published check rather than denting it. homelab-cluster
publishes six documents and is private deliberately; publication.md says others,
not everyone, and I read one word as the other. The tool as logged would have
reported a correct repository as broken, so a superseding entry is added rather
than revising the osprey entry. What survives is that bedrock's public page
promising a private repository as the better answer was a real defect, and it was
never about homelab-cluster.

So published check must not report a verdict. It reports the identity it used, and
warns when that identity is the repository's own owner — publishing is not an act
you can complete alone, and a tool that verifies with your own credential has
helped you complete it alone and told you it was fine.

Also corrects me: I confirmed the specimen's token claim enthusiastically without
testing the case that would show it wrong. A refused write names the token's
scopes in the error body, so a token cannot be asked what it may do but can be
told by being refused. Verified that no other channel exists — the tokens endpoint
rejects token auth, and no scope header comes back on success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -263,3 +263,62 @@ have had to already depend on that document to have pulled it** — *and the thi
 needed was the one I did not know I was missing.* **A fetcher does not solve
 discovery, and this story is partly a discovery problem wearing a freshness
 problem's clothes.**
+
+## 2026-09-07 — supersedes the `reachable` entry: publication is not publicness `marmalade`
+
+**The entry above records three publication failures found by `reachable` and says
+all three are fixed. One of them was not a failure.**
+
+**`jeffry/homelab-cluster` is private on purpose** — *it describes a running
+cluster, and its owner does not want outsiders reading what is on it.* **It
+publishes six documents to an audience that is not the public**, *which
+`publication.md` permits in the word we misread:*
+
+> **What a repository has handed over for **others** to depend on.**
+
+***Others*, not *everyone*.**
+
+**So the tool as logged would have reported a correct repository as broken.** *An
+anonymous fetch returning `404` is the intended outcome there*, **and a check that
+treats anonymous reachability as success produces a false positive on every
+deliberately-private publisher.**
+
+**What survives:** *the defect that round found in `bedrock/starting.md` was real,
+and it was never about `homelab-cluster`.* **A public document promised that a
+private repository was the better answer**, *and the promise was the defect.*
+**The link was removed; naming it as private, the way `.loom` names `settled`,
+would also have answered it and would have kept the better document findable.**
+*That call is loom's and it is already made.*
+
+**Believed to advance:** *a check that cannot fail teaches nothing, and one that
+fails on correct repositories is worse* — **it trains people to ignore it.**
+
+**Belief that could be shown wrong:** *that anonymous is still the right default.*
+**If most publication here is to private audiences, the default is wrong** and the
+command should refuse to run without being told who to ask as.
+
+## 2026-09-07 — measured: a read token, and what a host will tell you `marmalade`
+
+**A gitea read token was issued for one session and destroyed after.** *Recorded
+because these are facts about the host that nothing else here writes down.*
+
+**A read token authenticates raw HTTP on a private repository.** *`404`
+anonymously, `200` with `Authorization: token` or `Bearer`, and `If-None-Match`
+returns `304` authenticated.* **So `add` and `check` work against private
+repositories** — *the assumption the specimen made and nobody had run.*
+
+**`/api/v1/repos/{o}/{r}` reports `admin, push, pull: true` for a token that
+cannot write.** *Those are the account's rights.*
+
+**But a refused write names the token's scopes in the error body.** *So:*
+
+> **A token cannot be asked what it may do. It can only be told, by being
+> refused.**
+
+*Supersedes the specimen's "the name is the only record", which was too strong.*
+**For this tool the rule is unchanged and the reason is different:** *`loomctl`
+never writes, so it never provokes the only response that would tell it anything.*
+
+**Belief that could be shown wrong:** *that gitea keeps doing this.* **The scope
+list in an error body is not a documented interface** — *it is a message, and
+messages change.*