marmalade: git wins list, measured — and I overclaimed the auth saving

git archive --remote is out: gitea allows it, github 422s, gitlab 404s. Partial
clone with --filter=blob:none --depth=1 --no-checkout is uniform across gitea,
github and gitlab, and lists homelab-cluster's six published documents over ssh in
under a second — the list I could not get this morning. REST would be three URL
shapes, three JSON shapes and three auth schemes, and it 404s on the private repo,
which is the case that matters.

Corrects my claim that git collapses the auth section. It does not: list goes over
git, but add and check still want HTTP, because a 304 is a few hundred bytes and a
partial clone is 124KB, so checking eight externals over git costs a megabyte to
learn nothing. Private raw HTTP needs a token. Two credentials per host, not one.
The argument for git is consistency, not thrift, and that argument stands alone.

Records the failure mode: --filter is a server capability and git's fallback is
silent, so detect the warning rather than letting list become a full clone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/cart/current/claude-marmalade.md

@@ -154,3 +154,89 @@ would have caught this.*
 **Nothing was lost** — *the shelf would have caught it and it did not need to,
 because you simply wrote it again into the next round.* **Which is the mechanism
 working.**
+
+---
+
+# Measured: git, and your instinct was right
+
+**Taken: `published check`.** *`reachable` is gone as a word.*
+
+## `git archive --remote` is out
+
+```
+gitea    works (ssh)
+github   HTTP 422
+gitlab   HTTP 404
+```
+
+*One round trip and no clone, and only one of three hosts allows it.*
+
+## Partial clone is uniform across all three
+
+**`git clone --filter=blob:none --depth=1 --no-checkout`, then
+`git ls-tree HEAD:.loom/published`:**
+
+```
+gitea     filter ok   .git=124KB
+github    filter ok   .git=124KB
+gitlab    filter ok   .git=144KB
+```
+
+**Same flags, same command, same output shape.** *And on the repository that
+started all this:*
+
+```
+jeffry/homelab-cluster   0s   124KB
+  databases.md  gitea.md  private-access.md
+  public-access.md  recovering-data.md  storage.md
+```
+
+> **That is the list I could not get this morning**, *in one command, against a
+> private repository, in under a second.*
+
+## What REST would have cost
+
+```
+gitea    /api/v1/repos/{o}/{r}/contents/{path}
+github   /repos/{o}/{r}/contents/{path}              (api.github.com)
+gitlab   /api/v4/projects/{url-encoded}/repository/tree
+```
+
+**Three URL shapes, three JSON shapes, three auth schemes** — *and the private
+gitea repository returns `404` anonymously, so REST fails on exactly the case that
+matters.* **Your sense was right and it is now measured rather than felt.**
+
+## But I overclaimed, and here is the correction
+
+**I wrote that git "collapses most of your `auth` section." It does not.**
+
+*`list` discovers names over git. **`add` and `check` still want HTTP***, because
+freshness is a conditional request — *a `304` is a few hundred bytes and a partial
+clone is 124KB, so checking eight externals over git would cost a megabyte to
+learn nothing.*
+
+**And raw HTTP against a private repository is `404` without a token.** *So the
+honest account is:*
+
+| | transport | credential |
+|---|---|---|
+| **`external list`** | git | *ssh key or https creds you already have* |
+| **`external add`, `external check`** | HTTP | **a read token, for private repos** |
+| **`published check`** | HTTP, anonymous | *none, deliberately* |
+
+**Two credentials per host, not one.** *The argument for git is **consistency**,
+not thrift* — **one mechanism against three hosts instead of three adapters** —
+*and that argument stands on its own.* **The auth saving was me liking my answer.**
+
+*Untested: whether a gitea read token actually works against raw HTTP on a private
+repository.* **It is the specimen's assumption and nobody has run it.**
+
+## The failure mode to build for
+
+**`--filter` is a server capability.** *All three hosts here allow it; an older
+self-hosted gitea or gitlab may not, and **git's fallback is silent** — it warns
+`filtering not recognized by server` and downloads everything.*
+
+**`--depth=1` bounds the damage to one commit**, *which is why both flags are
+there and not just the filter.* **Detect the warning and say so**, rather than
+letting `list` quietly become a full clone of somebody's monorepo.