analysis: correct the reach of the timestamp exposure

The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.

The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.

analysis/HANDOFF.md

@@ -111,10 +111,13 @@ In descending order of how much they could mislead Session 2.
    work mass" assumes dormancy is unintended, and a "Stand" label may legitimately mean
    "system state as last verified" rather than "state of this text". Both could be
    dismissed by an answer I do not have.
-4. **The severity I assigned to F-002/F-003.** I treated 237 commits with real clock times
-   on a public mirror as the report's most consequential finding. That weighting is mine.
-   If the exposure is acceptable to you, the finding shrinks to a documentation defect and
-   the executive summary over-weights it.
+4. **The severity I assigned to F-002/F-003.** I first called the Gitea mirror public,
+   inferring it from an anonymous `git ls-remote` succeeding on the owner's machine. The
+   human corrected this: the host is private to them. The findings were rewritten; the
+   exposure is prospective (a future push from git.lab to GitHub) rather than realised.
+   The severity ranking still puts F-002 first, on the argument that a protection believed
+   present but absent is what makes a later outward push unsafe. That weighting is mine
+   and is contestable.
 5. **F-011's confidence is `medium` because the sentence is ambiguous.** "Projekt-Repos
    haben eigene CLAUDE.mds" may be descriptive rather than a claim about all five. I read
    it as a claim because the sentence goes on to define conflict resolution against it.

analysis/REPORT.md

@@ -22,11 +22,13 @@ The most consequential finding is not documentation drift. The 2026-08-07 histor
 set 251 commits to 12:00 UTC so that personal working hours could not be read out of the
 history. That goal is met in **one of six repos**. 237 commits by the project's own
 identities still carry real clock times, including 41 on an abandoned branch in
-`axion1337.chat-gitops` clustered at 21:00–01:00 — publicly readable on the Gitea mirror,
-which this session verified is in sync. Two component repos were never rewritten at all.
-The rule's own caveat in `CLAUDE.md:143` lists push times, issue timestamps and pipelines as
-residual exposure, but not the git history itself, so a reader concludes the opposite of
-what is true. See [F-002](findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md),
+`axion1337.chat-gitops` clustered at 21:00–01:00. Two component repos were never rewritten
+at all. Both hosts are private today, so nothing has leaked; the cost is that the
+protection is believed to be in place and is not, so any future decision to push outward —
+to GitHub, or by opening a project — would be taken on a false premise, and history once
+pushed cannot be recalled. The rule's own caveat in `CLAUDE.md:143` lists push times, issue
+timestamps and pipelines as residual exposure, but not the git history itself, so a reader
+concludes the opposite of what is true. See [F-002](findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md),
 [F-003](findings/F-003-author-identity-unification-incomplete.md),
 [F-006](findings/F-006-stale-branches-publish-pre-rewrite-history.md).
 
@@ -62,8 +64,8 @@ The declaration and the application live in different places, and nothing compar
 
 | Finding | | Impact |
 |---|---|---|
-| [F-002](findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md) | Anonymisation reaches 1 of 6 repos; 237 commits expose real hours | Stated privacy goal unmet, publicly; expensive operation largely undone |
-| [F-003](findings/F-003-author-identity-unification-incomplete.md) | 5 author identities of one person survive, one malformed | Same exposure; one person shows as 4–5 contributors publicly |
+| [F-002](findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md) | Anonymisation reaches 1 of 6 repos; 237 commits carry real hours | Stated privacy goal unmet while believed met; blocks any safe future push outward |
+| [F-003](findings/F-003-author-identity-unification-incomplete.md) | 5 author identities of one person survive, one malformed | Same exposure class; one person renders as 4–5 contributors |
 | [F-011](findings/F-011-component-claude-md-claim-unmet.md) | 4 of 5 components have no `CLAUDE.md` | The distribution channel for the rules is itself only partly applied — a plausible cause of F-002/F-003 |
 | [F-008](findings/F-008-component-slugs-inconsistent.md) | Five components, four naming schemes | No deterministic path from display name to repo; this session had to ask |
 
@@ -87,7 +89,7 @@ The declaration and the application live in different places, and nothing compar
 
 | Finding | | Impact |
 |---|---|---|
-| [F-006](findings/F-006-stale-branches-publish-pre-rewrite-history.md) | 3 abandoned branches, one public with 41 pre-rewrite commits; `wiki` branch is a 3-month-old parallel truth | Undoes the rewrite for 42 commits; two truths about the same docs |
+| [F-006](findings/F-006-stale-branches-publish-pre-rewrite-history.md) | 3 abandoned branches, one carrying 41 pre-rewrite commits; `wiki` branch is a 3-month-old parallel truth | Undoes the rewrite for 42 commits; two truths about the same docs |
 | [F-012](findings/F-012-orphaned-sha-references.md) | 6 unresolvable SHA citations, all benign — but nothing could check them | Evidence-by-citation depends entirely on human diligence at rewrite time |
 
 ### What works and must be preserved

analysis/findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md

@@ -1,4 +1,4 @@
-# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still publish real working hours
+# F-002: The timestamp anonymisation rule reaches one of six repos; 237 commits still carry real working hours
 
 category: claim-vs-reality
 confidence: high
@@ -28,8 +28,18 @@ evidence:
 - The exposed times are exactly the ones the rule exists to hide. On
   `axion1337.chat-gitops`'s `turn-secret-rotation-20260728-192656` branch alone, the
   hour-of-day distribution of the 41 commits is 00h ×1, 01h ×6, 21h ×8, 22h ×1, 23h ×6.
-- All of this is publicly readable: every one of the six repos mirrors to
-  `rohana.axion1337.de`, verified in sync by `git ls-remote` (see F-013).
+- Reach of the exposure, stated precisely. Observed: all six repos mirror to
+  `rohana.axion1337.de` and `git ls-remote` succeeded there without credentials from the
+  owner's machine (see F-013). **Not** observed: that this host is reachable by anyone
+  else. The human states the Gitea host is private to them, and an earlier draft of this
+  finding wrongly inferred "public" from "readable from here" — corrected.
+  The exposure that matters is therefore **prospective and on the git.lab side**: content
+  from git.lab may be pushed to GitHub, which is public. No such push path is configured
+  today — no repo has a remote other than `origin`, and no `.gitlab-ci.yml` in the six
+  repos references `github.com` (the `.github/workflows/` mentions in `hosts/cfgmon.md:60,105`
+  are inherited Element files that were removed). The rule exists for the day that changes,
+  and on that day 237 commits would go out with real clock times unless the gap is closed
+  first.
 - `CLAUDE.md:143-147` does carry a caveat, but it names push times, issue and comment
   timestamps, pipeline runs and package publications — **not** the git history itself.
   `shared/commit-zuordnung-2026-08-07.md:41-44` discloses the untouched pre-boundary
@@ -41,6 +51,11 @@ and its caveat read as though the remaining exposure were limited to non-git sur
 Anyone reading `CLAUDE.md` would reasonably conclude the git history is clean. Effort was
 spent (a 251-commit rewrite, three restarted release pipelines, a mapping document) for a
 result that a `git log` on any side branch undoes.
+The cost is not damage already done — both hosts are private today. It is that the
+protection is believed to be in place and is not, so the decision to open any repo
+outward (a GitHub push, an added collaborator, a public project toggle) would be taken on
+a false premise. That is the moment the gap becomes irreversible: history, once pushed,
+cannot be recalled.
 
 root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
 the two is documented in a third place, in different terms.**

analysis/findings/F-003-author-identity-unification-incomplete.md

@@ -19,10 +19,11 @@ evidence:
   identity, while `axion1337.chat-gitops` main still carries 135 commits as
   `Scrublord MacBad <Scrublord@Mac.Bad>` and 10 as `ScrublordMcBad`.
 
-impact: Same exposure class as F-002 and the same false sense of completion. In addition,
-the malformed address makes those two commits unattributable by tooling that matches on
-e-mail, and `Scrublord@Mac.Bad` leaks a machine name. Contributor statistics on the public
-Gitea mirror show one person as four or five contributors.
+impact: Same exposure class as F-002 -- prospective, not realised, since both hosts are
+private today (see the reach note in F-002) -- and the same false sense of completion. In
+addition, the malformed address makes those two commits unattributable by tooling that
+matches on e-mail, and `Scrublord@Mac.Bad` leaks a machine name. Any forge rendering these
+repos shows one person as four or five contributors.
 
 root-cause pattern: **Rule declared repo-wide, applied to a subset** — the same pattern as
 F-002, in the same operation. Both were verified for the property that was easy to check

analysis/findings/F-006-stale-branches-publish-pre-rewrite-history.md

@@ -1,4 +1,4 @@
-# F-006: Three abandoned branches keep publishing exactly what the rewrite removed from main
+# F-006: Three abandoned branches still carry exactly what the rewrite removed from main
 
 category: dead-artifact
 confidence: high
@@ -9,12 +9,12 @@ evidence:
   no). All 41 carry real clock times (00h–01h and 21h–23h heavy). They are the *pre-rewrite*
   versions of commits the mapping table lists as replaced — 42 mapping rows resolve as
   `ok-both-present` in `analysis/data/sha_refs.tsv`, meaning the old SHA is still reachable.
-- The same branch exists on the public mirror:
+- The same branch exists on the Gitea mirror (private to the owner, see F-002):
   `git ls-remote https://rohana.axion1337.de/sorb/axion1337.chat-gitops.git` ->
   `f30d2f582ba14d85a7dec97c4db9bb2677ca824d refs/heads/turn-secret-rotation-20260728-192656`,
   identical to git.lab.
 - `threadnet-call` `origin/livekit`: 14 own commits with real clock times, head `c12a4116`
-  (2026-07-31 22:22), mirrored publicly with the same head.
+  (2026-07-31 22:22), mirrored with the same head.
 - `axion1337.chat-gitops` `origin/wiki`: head `0ff598e`, 2026-05-14. `CLAUDE.md:63` already
   describes it as "ein überholter Mai-Abzug von `docs/`", and management#19 ("DOC-02:
   Veralteten `wiki`-Branch im gitops-Repo entfernen?") tracks it — open, `priority:low`,
@@ -25,7 +25,8 @@ evidence:
 
 impact: The single most expensive operation in this repo's history — a 251-commit rewrite
 that restarted three release pipelines and needed its own mapping document — is undone for
-42 of those commits by a branch nobody looks at, on a host that is public. The `wiki` branch
+42 of those commits by a branch nobody looks at, and the branch travels with every mirror
+and every future clone or push of that repo. The `wiki` branch
 additionally offers a three-month-old copy of the documentation next to the current one,
 which is the "zwei Wahrheiten über dieselbe Sache" failure `CLAUDE.md:94-97` names as worse
 than an incomplete one.