the lock records what the source could be read as, and check audits it

Access is verified once, at fetch, and the copy is durable — so whether an
adoption is still legitimate rests on the relative visibility of two
repositories, which somebody can change with a checkbox a year later without ever
seeing the adoption. The lock gains an optional fourth field and check turns that
from a silent permanent hazard into something that runs.

It costs nothing at add time, because the anonymous request already happened to
decide whether to warn and the answer was being thrown away, and one request per
run at check time rather than one per document, because only our own visibility
has to be current. The stored value decays in both directions, so a source
recorded not-public is re-probed only when the alarm would fire, and a source that
has since gone public updates the lock and says nothing.

Fixes a bug found while testing the alarm rather than after shipping it.
sourceVisibility returned public whenever no credential was configured, which is
sound at add time — the fetch had just succeeded anonymously — and wrong in the
audit, where it is a probe and not a fetch: it would have silently cleared real
alarms. Probing is now its own function that always asks with no credential,
because what matters is what a stranger can read and not what we can.

The value is recorded as public or not-public and never private: an anonymous
request tells those apart and nothing finer, so it cannot see two repositories
private to different people, which is the case that genuinely widens access.

Three-field locks still load, and unknown visibility round-trips as absent rather
than as a value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

internal/lock/lock_test.go

@@ -0,0 +1,57 @@
+package lock
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Locks written before visibility was recorded have three fields, and must keep
+// loading: a repository does not get to stop working because the tool learned
+// something new.
+func TestLoadsThreeAndFourFieldRecords(t *testing.T) {
+	root := t.TempDir()
+	p := Path(root)
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	body := "# comment\n\nh/o/r/old.md\thttps://h/old\t\"1\"\n" +
+		"h/o/r/new.md\thttps://h/new\t\"2\"\tnot-public\n"
+	if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	s, err := Load(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	old, _ := s.Get("h/o/r/old.md")
+	if old.Visibility != "" {
+		t.Errorf("a three-field record should have unknown visibility, got %q", old.Visibility)
+	}
+	nw, _ := s.Get("h/o/r/new.md")
+	if nw.Visibility != NotPublic {
+		t.Errorf("visibility = %q, want %q", nw.Visibility, NotPublic)
+	}
+
+	// And unknown must survive a round trip rather than being written as a value.
+	if err := s.Save(); err != nil {
+		t.Fatal(err)
+	}
+	out, _ := os.ReadFile(p)
+	for _, line := range strings.Split(string(out), "\n") {
+		if strings.HasPrefix(line, "h/o/r/old.md") && strings.Count(line, "\t") != 2 {
+			t.Errorf("unknown visibility was written as a field: %q", line)
+		}
+	}
+}
+
+func TestRejectsAMalformedRecord(t *testing.T) {
+	root := t.TempDir()
+	p := Path(root)
+	os.MkdirAll(filepath.Dir(p), 0o755)
+	os.WriteFile(p, []byte("h/o/r/x.md\thttps://h/x\n"), 0o644)
+	if _, err := Load(root); err == nil {
+		t.Error("a two-field record should be an error, not a silently empty ETag")
+	}
+}