sorrel converts: four entries, no shelf

Extracted at conversion rather than staged as it went — there was no wal this
round, and the answers lived in the daily that the rm destroys, which is precisely
the failure v2 added the rule to prevent. Worth noticing that the round which
answered a question about durable records is the one that nearly lost its own.

Records two declines with their reasons: a second orientation file, since the
publishing half varies not at all and is already adopted so it appears in the index
by itself; and .loom/externals/README.md as the path, measured rather than argued,
because check walks that directory and would report a generated file as unlocked in
every repository using the feature, forever.

Records the visibility field with the word it refuses — public or not-public and
never private, because an anonymous request tells those apart and nothing finer,
and private would claim precision the signal does not have.

And records a one-line bug whose trap is permanent: visibility was computed by one
function used both after a successful fetch and as a probe, where "no credential
configured" means opposite things. In the audit it would have silently cleared real
alarms, which is the worst failure available to a check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -1003,3 +1003,92 @@ file that only ever arrives as a conversion-timing failure has its fix upstream*
 
 *One instance is not a sample* — **which is the reason `cart/v2` gave for leaving
 it alone, applied one step further.**
+
+## 2026-09-08 — `orient`, and declined: a second orientation file `sorrel`
+
+**Decided:** *one generated file, `.loom/orientation.md`, for whoever arrives
+next.* **It restates no rule** — *every rule it might repeat is owned by a
+document already in the working tree, and a copy of a rule is a copy that goes
+stale.*
+
+**Declined: splitting it into an externals half and a publishing half.** *The
+splitting rule is **generate what varies, adopt what does not*** — **and the
+publishing half varies not at all and is already adopted**, *so `publication.md`
+appears in the index like any other adopted document, in exactly the repositories
+that adopted it.* **A second command would emit a file whose whole content is a
+pointer to a file already in the tree**, *and would revive the `published` noun
+that went with `published check`.*
+
+**Declined: `.loom/externals/README.md` as the path**, *which was measured rather
+than argued:*
+
+```
+$ loomctl external check
+README.md  unlocked  no origin recorded — ...
+```
+
+**`check` walks that directory for adopted documents, so a generated file there
+reports as unlocked in every repository using the feature, forever.** *And the
+deeper reason is the invariant: everything under `.loom/externals/` is somebody
+else's document, which is what makes "do not edit these" a rule you can state in
+four words.*
+
+**The `.usages.md` is pointed at, not summarised.** *What depends on a document is
+free prose, and anything that extracts a claim from prose will eventually extract
+it wrong.*
+
+**Belief that could be shown wrong:** *that a fixed path is worth more than a
+configured one.* **It only pays if it is the same everywhere**, *which is not ours
+to decide and is with `bedrock`.*
+
+## 2026-09-08 — the lock records visibility, and the word it will not use `sorrel`
+
+**Decided:** *the lock carries what the source could be read as when it was
+fetched, and `check` audits it against this repository's visibility now.*
+
+**Believed to advance:** *access is verified once, at fetch, and the copy is
+durable.* **Whether an adoption is still legitimate rests on the relative
+visibility of two repositories — a fact somebody can change with a checkbox a year
+later, without ever seeing the adoption.** *Recording it turns a silent permanent
+hazard into something that runs.*
+
+**The value is `public` or `not-public`, and never `private`.** *An anonymous
+request tells those two apart and nothing finer* — **so it cannot see two
+repositories private to different people, which is the case where adopting between
+private repositories genuinely widens access.** *The word `private` would claim
+precision the signal does not have.*
+
+**Belief that could be shown wrong:** *that the coarse signal is worth having.*
+**If the cases that matter here are all private-to-private, this alarm will never
+fire and the field is ceremony.**
+
+## 2026-09-08 — a probe is not a fetch, and confusing them clears alarms `sorrel`
+
+**Recorded because the bug was one line and the trap is permanent.**
+
+*Visibility was computed by one function used in two places.* **At `add` time,
+"no credential is configured" means the fetch that just succeeded was anonymous,
+so the source is public** — *sound.* **In the audit, nothing is being fetched:
+"no credential configured" says nothing about whether a stranger could read the
+URL**, *and returning `public` there would have **silently cleared real
+alarms**.*
+
+> **The worst failure available to a check is to report that it found nothing.**
+
+**Probing is now its own function that always asks with no credential at all**,
+*because what matters is what a stranger can read and not what we can.* **Found by
+testing the alarm path rather than after shipping it.**
+
+## 2026-09-08 — `orient`, not `prompt`, and why that was mine to notice `sorrel`
+
+**Renamed before it shipped.** *`prompt` reads as "produce something to feed a
+model", and the file is a table of contents a person can read.*
+
+**The correction was right and the assumption behind it was mine:** *`prompt` was
+not being used in the narrow sense, and I took it at the narrowest reading
+available.* **Second time in two days** — *the first was reading `others` as
+`everyone` in `publication.md`, which cost a command that was built, validated
+three times, and then declined.*
+
+*Recorded as a working note rather than a decision: **when a word could be read
+narrowly or broadly, this repository has evidence that I pick narrow.***