diff --git a/analysis/SCOPE.md b/analysis/SCOPE.md
new file mode 100644
index 0000000..796bf67
--- /dev/null
+++ b/analysis/SCOPE.md
@@ -0,0 +1,130 @@
+# SCOPE.md — Field test scope freeze (Session 1, analysis only)
+
+Status: **proposed — awaiting human confirmation (Phase 0 STOP)**
+
+Every line is marked `[observed]` (verified by command output in this
+session) or `[inferred]` (derived, not verified).
+
+## 1. Reference state
+
+| Item | Value | Source |
+|---|---|---|
+| Neckbeard reference | `v0.1.1` @ `823a08cac6b03a47d7e2f661200a49ac6e09d38d` | `git describe --tags --always`, `git log -1` `[observed]` |
+| Neckbeard branch / cleanliness | `main`, clean worktree | `git status --porcelain` empty `[observed]` |
+| Neckbeard origin | `https://git.lab/oss-projekte/ai/neckbeard.git` | `git remote -v` `[observed]` |
+| Management HEAD | `2f012a6cd2964fbc114bf7da6942ddd30f3dee70` (2026-08-09, `docs: AAR for 2026-08-09 …`) | `git log -1` `[observed]` |
+| Management branch / cleanliness | `main`, clean worktree | `git status --porcelain` empty `[observed]` |
+| Management origin | `https://git.lab/axion1337.chat/management.git` — **canonical git.lab, not the Gitea mirror** | `git remote -v` `[observed]` |
+| Management commits / span | 86 commits, 2026-07-30 … 2026-08-09 | `git rev-list --count`, `git log --date=short` `[observed]` |
+| Analysis branch | `analysis/neckbeard-fieldtest`, branched from `main` | `git checkout -b` `[observed]` |
+
+The reference standard for every "neckbeard mechanism" field in Phase 2
+findings is neckbeard `v0.1.1` as pinned above (per ADR-0006).
+
+### Working-copy safety
+
+Both repos are **fresh clones** made by this session into
+`/Users/thore/Documents/neckbeard-test-1/`; no pre-existing working copy
+of the human's was touched. As an additional guard, the push URL of both
+clones was set to the invalid value `DISABLED-no-push`, so nothing from
+this session can reach git.lab. `[observed]`
+
+Consequence for the Phase-0 mandate "verify that the working copy's
+remote points at the canonical git.lab origin": verified **for this
+session's clone** (it is canonical by construction). Whether the human's
+own working copy points at git.lab or at the Gitea mirror is **not
+observable from here** — carried into Phase 3 as an open question.
+
+## 2. Gate-0 suspension (explicit, per session mandate)
+
+`PROJECT.md` is absent from the management repo `[observed]`. Per the
+override in the session mandate, AGENTS.md §2 does **not** fire here:
+its absence is an observation for the report, not a task. Gate 0 for the
+management repo belongs to Session 2.
+
+## 3. Components in scope
+
+The five ThreadNet repos of the GitLab group `axion1337.chat`. Display
+names come from the mandate; slugs were **not** guessable from the
+display names and were resolved against repo documents and then verified
+against git.lab with `git ls-remote` (read-only, no clone).
+
+| # | Display name | Repo slug | Slug evidence | `ls-remote` | Availability |
+|---|---|---|---|---|---|
+| 1 | ThreadNet Call | `threadnet-call` | `vision/threadnet.md:10`, `hosts/overmind.md:29` | OK (2 heads) `[observed]` | **clone required** from `https://git.lab/axion1337.chat/threadnet-call.git` |
+| 2 | ThreadNet Git | `thread-net-git` | `vision/threadnet.md:10`, `hosts/overmind.md:29` | OK (2 heads) `[observed]` | **clone required** from `https://git.lab/axion1337.chat/thread-net-git.git` |
+| 3 | ThreadNet Operating | `threadnet-operating` | `README.md:78`, `CLAUDE.md:4`, `hosts/overmind.md:29` | OK (2 heads) `[observed]` | **clone required** from `https://git.lab/axion1337.chat/threadnet-operating.git` |
+| 4 | ThreadNet Server Suite | `axion1337.chat-gitops` | `CLAUDE.md:6` states the equation verbatim: „ESS-/Flux-Details in ‚ThreadNet Server Suite' = `axion1337.chat-gitops`" | OK (3 heads) `[observed]` | **clone required** from `https://git.lab/axion1337.chat/axion1337.chat-gitops.git` |
+| 5 | ThreadNet Web | `ThreadNet-Web` | `roadmap.md:53`, `hosts/overmind.md:28`, `hosts/matrix.md:20` | OK (3 heads) `[observed]` | **clone required** from `https://git.lab/axion1337.chat/ThreadNet-Web.git` |
+
+No local checkout of any component existed before this session; the
+working directory was empty. `[observed]` No `.gitmodules` exists in the
+management repo, so submodule discovery yields nothing. `[observed]`
+
+### Slug irregularities already visible (carried into Phase 2, not fixed)
+
+- **`thread-net-git`** breaks the `threadnet-*` pattern of its four
+  siblings. `https://git.lab/axion1337.chat/threadnet-git.git` returns
+  "project could not be found". `[observed]`
+- **`ThreadNet-Web`** is the only CamelCase slug. `ThreadNet-Web` and
+  `threadnet-web` resolve to byte-identical ref lists, i.e. the same
+  project reached through GitLab's case-insensitive path handling
+  `[observed]`; docs and CI use both spellings plus a lowercase registry
+  path `registry.git.lab/axion1337.chat/threadnet-web/desktop-build`
+  (`hosts/overmind.md:54`).
+- **`axion1337.chat-gitops`** carries no ThreadNet name at all; the
+  display name "ThreadNet Server Suite" exists only inside prose.
+
+These are recorded as scope facts here and will be turned into findings
+in Phase 2, not corrected.
+
+## 4. Out of scope (fixed by the human, not re-derived)
+
+Not analysis targets: `game-operating`, `gameserver`, the `vendor`
+subgroup, the `Archiv` subgroup. Cross-references from the management
+repo into them are still recorded in `links.tsv` / `claims.tsv` as
+`points-outside-scope` — they are evidence about the management repo.
+
+Already sighted in the management repo and to be recorded that way:
+`hosts/overmind.md:29` (`game-operating`), `hosts/overmind.md:33`
+(`gameserver`), `hosts/overmind.md:23` (`vendor/windows`). `[observed]`
+
+Also referenced but outside the five components: the `homelab` group
+(`docs`, `wiki`, `wiki-bookstack`) and the Gitea host
+`rohana.axion1337.de`. Treated as `points-outside-scope`, not analysed.
+
+## 5. GitLab API access — decision required
+
+`GITLAB_ACCESS` was left blank in the mandate. Findings:
+
+- `glab` is **not installed** `[observed]`; no `~/.config/glab-cli/`.
+- No GitLab token in any environment variable `[observed]`.
+- A token file **exists** at `~/.config/gitlab-lab/token` — exactly the
+  path the management repo's `CLAUDE.md:112` names as the sanctioned way
+  to reference lab credentials. `[observed]` Its value has not been
+  read, printed or logged, per `CLAUDE.md:109`.
+- Anonymous API: `GET /api/v4/groups/axion1337.chat` → HTTP 200;
+  `GET /api/v4/projects/axion1337.chat%2Fmanagement/issues` → `404
+  Project Not Found`, i.e. issues are not readable anonymously.
+  `[observed]`
+
+So the ticket dimension of Phase 1/2 (`gitlab_issues.json`, the backlog
+duality check) is reachable **only** if the human authorises use of that
+token file. Without it, backlog duality is analysed from in-repo
+evidence only and the gap is recorded as an explicit non-goal in
+REPORT.md. Web-UI scraping is excluded by the mandate and will not be
+attempted.
+
+## 6. Open questions for the Phase-0 STOP
+
+1. **Clone the five component repos?** All five need cloning; approval
+   is required before any clone happens.
+2. **May this session read the git.lab API using
+   `~/.config/gitlab-lab/token`** (read-only: group and project issues,
+   metadata only, no descriptions)? Or is the ticket dimension a
+   non-goal for this session?
+3. **Is `axion1337.chat-gitops` = "ThreadNet Server Suite" correct?**
+   The equation rests on a single sentence in `CLAUDE.md:6`. It is a
+   large, infrastructure-heavy repo; confirming it fixes the scope.
+4. **Does the human's own management working copy point at git.lab or at
+   the Gitea mirror?** Not observable from this session.