marmalade converts: eleven entries, and no shelf

Moves the wal into the log and closes the round. Nothing was unresolved: the one
open item — where the credential lives — is recorded as decided by fallback rather
than shelved, since cart says silence is a usable reply and that a fallback which
quietly becomes the decision is worth being able to find later.

The round decided the shape (loomctl, nouns, no plugin seam until somebody reports
a gap, no audience declaration), declined published check on the registry argument
with both its falsifiers, kept the insight that outlives it, settled list on git
with the three-host measurement behind it, established that nothing needs ssh and
nothing needs write access anywhere, chose Go, and recorded git-on-PATH as the
consequence.

Two entries carry things nobody decided. One is the untested assumption that a
read-scoped PAT authenticates git over HTTPS and not only the API and raw files,
which is the first thing to run against the next token and the only argument that
would bring ssh back. The other is a wrinkle in the isolation role: it assumed work
happens during a round, and both rounds so far have decided work that happens
after, so a branch is named for the round that authorised it and outlives the cart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -322,3 +322,199 @@ never writes, so it never provokes the only response that would tell it anything
 **Belief that could be shown wrong:** *that gitea keeps doing this.* **The scope
 list in an error body is not a documented interface** — *it is a message, and
 messages change.*
+
+## 2026-09-07 — the CLI has nouns, and one of them is not built `marmalade`
+
+**Decided:** *`loomctl`, with subcommands.* **`loomctl external …` now; `loomctl
+beads …` when it exists.**
+
+**Believed to advance:** *`external` is what somebody else published that we depend
+on.* **The verb `check` means the same thing wherever it appears — ask somebody
+else whether what we believe is still true.**
+
+**Declined: a plugin boundary.** *`kubectl` and `gh` grew plugins after somebody
+outside wanted in.* **The seam gets built when it is a reported gap, not a designed
+one** — *which is how loom says that arrives, with a name attached and a workaround
+recorded beside it.*
+
+**Declined: a field where a repository declares who it published for.** *It would
+let a tool compare intent to result, and it asserts a category nobody decided.*
+**The better version needs no declaration: derive it from the other side, by
+reading everybody's `externals/` to see who actually depends on you.** *That is
+`registry`'s shape.*
+
+**Belief that could be shown wrong:** *that one noun justifies the structure.*
+**Until `beads` exists, `loomctl external` is a subcommand with nothing to be
+distinguished from.**
+
+## 2026-09-07 — declined: `published check` `marmalade`
+
+**Considered and rejected.** *The command that would ask whether somebody who is
+not you can fetch what you published.*
+
+**Because it simulates a consumer, and `registry` will have real ones.** *An
+observed fetch beats a synthetic probe — the probe says a stranger **could** have
+fetched it; a registry says somebody **did**.* **Building the probe first builds a
+worse version of the thing that is coming.**
+
+**And it removes the only thing complicating the credential story:** *`--as
+<context>` existed almost entirely to serve this command.*
+
+**Belief that could be shown wrong, two ways:**
+
+- **`registry` never materialises**, *and nothing ever asks the question.*
+- **`registry` records *declared* consumers rather than *observed* fetches.** *"Who
+  says they depend on us" is not "who can actually read us"* — **then this comes
+  back.**
+
+*Cost of deciding: the command found three real problems in one afternoon, one of
+which was a false positive it would have produced forever.* **The workaround is one
+`curl`, and a real need with a cheap workaround is a gap rather than a missing
+feature.**
+
+## 2026-09-07 — kept, though nothing implements it `marmalade`
+
+> **A check performed with your own credential proves nothing.** *It helps you
+> complete alone an act that, by definition, you cannot* — **and then tells you it
+> was fine.**
+
+**Believed to advance:** *whoever builds `registry`'s consumer view needs this
+before they design it*, **because the tempting implementation is for the publisher
+to verify their own publication** — *the same mistake with a database behind it.*
+
+**And it is cheap to detect:** *`/api/v1/user` gives the acting login, the
+repository gives its owner.* **One request**, *and nobody thinks to make it.*
+
+## 2026-09-07 — `external list` talks to git, measured `marmalade`
+
+**Decided:** *`list` enumerates a publisher's `.loom/published/` by shelling out to
+`git`* — **`clone --filter=blob:none --depth=1 --no-checkout`, then `ls-tree`.**
+
+**Believed to advance, and measured across three hosts:**
+
+```
+git archive --remote   gitea ok · github 422 · gitlab 404
+partial clone          gitea ok · github ok · gitlab ok      124–144KB
+REST                   /api/v1/repos/{o}/{r}/contents/{p}
+                       /repos/{o}/{r}/contents/{p}           (api.github.com)
+                       /api/v4/projects/{url-encoded}/repository/tree
+```
+
+**The argument is consistency, not thrift.** *One mechanism against three hosts
+instead of three adapters* — **and REST `404`s on a private repository, which is
+the case that matters.**
+
+**The failure mode to build for:** *`--filter` is a server capability and git's
+fallback is **silent***, warning `filtering not recognized by server` and
+downloading everything. **`--depth=1` bounds it. Detect the warning and say so.**
+
+**Belief that could be shown wrong:** *that shelling out stays simple.* **The first
+time we need output `git` does not print stably, the library trade looks
+different.**
+
+## 2026-09-07 — nothing needs ssh, and nothing needs write access `marmalade`
+
+**Decided:** *every transport is HTTPS on 443, and no token this tool is given
+should carry `write:repository`.*
+
+**Measured:** *partial clone with the blob filter works over gitea's **smart
+HTTP***, so `list` never needed ssh — *it was built that way out of habit.*
+
+**The tool writes only to the working tree** — *a fetched document, a lock, a
+facet* — **and never commits or pushes.** *Committing and pushing are the person's,
+under their own credentials.*
+
+> *Same reason `cart` gives for an agent committing and not pushing:* **the
+> consequences of a push land on people it cannot experience.** *A tool that can
+> push is a tool that can publish, and publishing is an act somebody performs.*
+
+**Implementation:** *never build `https://<token>@host/…`* — **git writes it into
+`.git/config` and it surfaces in `git remote -v` and logs.** *Pass
+`-c http.extraHeader="Authorization: token …"` per invocation instead.*
+
+**Belief that could be shown wrong:** *that every host we meet allows token auth
+over git-HTTPS.* **A host that does not would need ssh for `list` and nothing
+else.**
+
+## 2026-09-07 — untested, and load-bearing `marmalade`
+
+**Nobody has confirmed that a gitea PAT scoped `read:repository` authenticates
+*git over HTTPS*, not only the API and raw files.** *Those are different paths in
+gitea; the token we had was measured only against the second.*
+
+**Measured:** *an unauthenticated HTTPS clone of a private repository returns
+`Failed to authenticate user`* — **so something is required, and which something is
+unknown.**
+
+**Recorded rather than assumed** *because it is the first thing to run against the
+next token*, **and because if a read scope is not enough, that is the only argument
+for keeping ssh.**
+
+## 2026-09-07 — `--help` is the documentation surface `marmalade`
+
+**Decided:** *`--help` is what a person or an agent actually runs when handed an
+unfamiliar CLI, so it is the surface that has to be good* — **say what a command
+does and what it will not do.**
+
+**A `.loom/published/` for `loomctl` is deferred, not declined.** *The distinction
+matters because `init` was declined.* **It earns publication when somebody depends
+on this tool's behaviour rather than reading its help.**
+
+## 2026-09-07 — decided by fallback: where the credential lives `marmalade`
+
+**Nobody chose this; the fallback became the decision and that is recorded so it
+can be found.**
+
+**One file in `~`, kubeconfig-shaped, holding hosts and credentials together.**
+*Never in a repository, and nothing that reads from a repository.*
+
+**Believed to advance:** *the config is no longer only a secret* — **it is how you
+talk to a host at all**, *API shape, ssh port if it ever matters, which transport a
+command uses.* **Some of that is not secret and several people would want the same
+values.**
+
+> **The split is expected and was not done:** *a host list that can be committed,
+> and a credential file that cannot.* **It was named rather than decided.**
+
+**Belief that could be shown wrong:** *that one file is fine until somebody
+shares.* **The first time two people want the same host list, the file has to
+split**, *and doing it later means moving a file people have already written by
+hand.*
+
+## 2026-09-07 — Go, and `git` on `PATH` `marmalade`
+
+**Decided:** *`loomctl` is written in Go.*
+
+**Believed to advance:** *it gets installed on other people's machines — a laptop,
+a cluster node, a CI runner* — **and a single static binary is the difference
+between "download it" and "first install a runtime."** *The work is precise HTTP
+header control, shelling out to `git`, and reading files; the standard library does
+the first and third with no dependencies.*
+
+**Considered: TypeScript on npm.** *A real distribution channel and the familiar
+one.* **Not chosen because it puts a runtime in front of a tool meant to be run
+casually and often** — *including by agents in loops that pay start-up cost every
+time.*
+
+**Consequence: `git` must be on `PATH`.** *`list` shells out rather than using a
+library, because the behaviour measured across three hosts **is** git's behaviour —
+filter support, the silent fallback, the user's existing credential helpers.*
+**`list` is the only command that needs it, which makes `list` the seam if this
+ever bites.**
+
+**Belief that could be shown wrong:** *that distribution is the deciding
+constraint.* **If `loomctl` only ever runs in one or two places, the binary
+advantage is worth little and the choice was made on a cost nobody pays.**
+
+## 2026-09-07 — a wrinkle in the isolation role `marmalade`
+
+**`osprey` cast the isolation role as: the cart on the default branch, the work on
+a branch named for the cart.** *It assumed the work happens **during** the round.*
+
+**Both rounds so far have been design rounds that decide work happening
+**after**.** *So the branch is named for the round that authorised it, and outlives
+the cart that named it.*
+
+**Recorded rather than fixed.** *The role still works; its justification was
+written for a case that has not yet occurred.* **If a round ever does produce code
+while it is open, nothing here changes.**