The upstream cart.md change was planted to test whether the tool would notice, and
the honest sequence is that check did not catch it. Every document was unlocked,
and unlocked means I cannot tell you. add revealed the change by overwriting the
file, and the only reason the diff was visible is that git happened to be watching
the working tree.
So the mechanism is proven and the workflow is not: a document nobody has locked is
a document nobody is checking, silently.
Fixes the defect that exposed. add reported only "adopted" while overwriting local
content that differed from what the publisher serves — and a differing copy is the
only evidence that something moved while the document was unlocked. It now says so.
Recorded with its own limit: add still overwrites rather than stashing, so outside
a git working tree the note says something was lost without letting you see it.
Also records the unowned half. Nothing decides when check runs, and every answer —
a hook, CI, an agent's session start, a schedule — is outside the tool. Filed as a
need with no owner rather than built, because choosing one would put a scheduler
inside a fetcher and a comparator, with the falsifier that if nobody ever runs
check unaided then a tool that reports only when asked reports nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Go, standard library only, with git shelled out for list alone. list enumerates a
publisher's .loom/published by partial clone and ls-tree; add fetches one document,
writes it under .loom/externals and records the resolved origin and the publisher's
ETag in .loom/externals/.locks; check asks conditionally and reports.
The first real run did what the tool exists for. All eight documents adopted by
hand before it existed reported unlocked — the tool refuses to invent a lock by
adopting whatever the remote currently serves, since that would assert the local
copy is the one being served, which is the thing it was about to check. Locking
them fetched two that had moved: bedrock/starting.md, which now says the worked
example is private and will not link to something you cannot fetch, and cart.md,
which went to v1.
cart v1 changes a role we cast: a cart is not committed, because a committed cart
grows a third file by itself — version control does not require anybody to ask, so
the two-file rule is never invoked — and because ignored, gone means gone. Adds
.loom/cart/ to .gitignore and supersedes the isolation entry rather than editing
it. osprey and marmalade are already in history and are left there: rewriting to
honour a rule adopted afterwards costs more than it buys.
Records the conflict this creates rather than settling it: the annotation protocol
here says commit before dissolving because git is the only archive, and an ignored
cart has no archive, so dissolving would destroy the annotations outright.
Credentials are read-only, per host, and passed to git through the environment
rather than argv, because argv is visible to every process on the machine.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
jeffryandClaude Opus 5