quince converts: five entries, and the first conversion that destroys

Under cart/v1 the cart is untracked, so converting deletes the dailies outright
rather than leaving them in history. That makes the write-ahead log the mechanism
rather than a convenience, and it sharpens the conflict already recorded in
cart.usages.md: the annotation protocol here says commit before dissolving because
git is the only archive, and an ignored cart has no archive.

Answers whether the cluster split removes the need for a PAT. For this repository
yes, and in general no: the confidentiality rule sorts the cases, so a public
repository may only adopt public documents and never needs a credential, while a
private one adopting private documents legitimately does. Needing a credential
stopped being a capability and became a signal, which is why add warns rather than
deciding — it sees that the source is private and cannot see who may read the
repository the copy lands in.

Downgrades the git-over-HTTPS assumption from load-bearing to unexercised. The code
did not change and its status did, which is the kind of thing only a log says.

Records that the completeness case has a mechanism after all — the usages facet the
tool points at when it stages a polad — and that it failed the first time because
the facet did not exist rather than because nothing could work.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -714,3 +714,92 @@ own word, discoverable in `--help` rather than found in a hint.*
 
 *The domain word survives regardless: `externals` says adopting is fetching a URL,
 and the tool says `adopted` throughout.*
+
+## 2026-09-07 — the credential is not needed here, and is not gone `quince`
+
+**`jeffry/homelab-cluster` is public and `jeffry/homelab-impl` is private.**
+*Adoption flows public → private, so nothing this repository depends on requires a
+credential, and `loomctl` has been exercised end to end without one.*
+
+**That does not remove the PAT. It moves when you need it.** *`externals` now
+says: **do not adopt from a source less readable than the repository you are
+adopting into.*** *Which sorts the cases:*
+
+- **a public repository adopting** — *may only adopt public documents*, **so it
+  never needs a credential**, *and needing one is the signal that something is
+  wrong.*
+- **a private repository adopting private documents** — *legitimate, and needs
+  one.*
+
+> **So needing a credential stopped being a capability and became a signal.** *The
+> tool cannot tell the two apart — it sees that the source is private and cannot
+> see who may read the repository the copy lands in* — **which is exactly why
+> `add` warns rather than deciding.**
+
+**Belief that could be shown wrong:** *that public-adopting-public covers the
+common case.* **The moment a private repository wants to depend on another private
+one, the credential is required and untested.**
+
+## 2026-09-07 — status change: the git-over-HTTPS assumption is unexercised, not blocking `quince`
+
+**An earlier entry records that nobody has confirmed a read-scoped PAT
+authenticates git over HTTPS, and calls it load-bearing. It is no longer
+blocking.**
+
+*It bears on `external list` against a private repository, which is the
+private-to-private case above and does not occur here.* **The path is unexercised
+rather than untested-and-in-the-way.**
+
+**Recorded because the code did not change and its status did**, *which is the
+kind of thing only a log says.* **It stays the first thing to run against the next
+token.**
+
+## 2026-09-07 — the completeness case has a mechanism: it is the facet `quince`
+
+**The open question was: a `200` tells you a document moved and says nothing about
+whether your casting still covers it.**
+
+**`check` prints the document's `.usages.md` when it stages a polad**, *and for an
+agreement that is the file its roles are cast in* — **so the question is answered
+by reading the facet the tool just pointed at.**
+
+**It failed on the first real change because `externals.md` had no facet at all**,
+*and the tool said `no .usages.md — nothing records what depends on this`:* **a
+correct report and useless as a prompt.**
+
+**So both were written.** *`externals.usages.md` names which Go file implements
+which rule — an unusual usage, because this repository implements the convention
+rather than using it — and `cart.usages.md` gained the `v1` casting it was missing.*
+
+**Belief that could be shown wrong:** *that pointing is enough.* **Nothing checks
+that a facet was updated, or that it was even read.**
+
+## 2026-09-07 — decided: nothing committed announces an open cart `quince`
+
+**A cart is local and untracked, so a clone cannot see that a round is open.**
+*That is the boundary and not a defect:* **`v1` makes the cart local to the
+working tree the two presences share, and somebody who has only cloned is by
+construction not one of them.**
+
+**`.gitignore` records that carts happen here. Nothing records that one is open**,
+*and the asymmetry is deliberate* — **a mechanism for announcing something
+designed to be ephemeral is the first step in it not being ephemeral.**
+
+**Belief that could be shown wrong:** *that the shared working tree is the right
+unit.* **If two presences ever work from different machines, the cart has nowhere
+to live**, *and everything above stops being true at once.*
+
+## 2026-09-07 — conversion now destroys, so the log is the only record `quince`
+
+**Under `cart/v1` the cart is untracked, so converting a round deletes its dailies
+outright.** *Every previous conversion left them in git.*
+
+**So an entry that was not written before the `rm` is gone**, *and the write-ahead
+log is the mechanism* — **stage as you go, because at conversion the cart is the
+only copy and you are about to delete it.**
+
+**And it sharpens a conflict recorded in `cart.usages.md`:** *the annotation
+protocol here says commit before dissolving because git is the only archive.*
+**With an ignored cart there is no archive, so dissolving a notes file destroys
+the annotations outright.** *Both documents are loom's; this is where an adopter
+can see the collision.*