analysis: record session-close answers; withdraw the game-operating negative

The human answered the report's open questions: the game-operating
mirror exists (a controlled re-probe shows Gitea hides repo existence
behind an auth prompt, so the anonymous negative was inconclusive --
withdrawn in F-007); component dormancy is intentional and staged
(F-009 addendum); any F-002/F-003 remediation must ship an old->new
Zuordnung in the proven style of commit-zuordnung-2026-08-07 (F-002).

analysis/HANDOFF.md

@@ -88,6 +88,11 @@ The human confirmed their own working copy points at canonical git.lab, not the
     files outside `analysis/`; placing it is one `git mv` by the human. Deliberately in
     German, matching the old scheme it belongs to (a stated deviation from this
     session's English-artifacts rule).
+11a. **Session-close answers by the human (2026-08-10)**: F-002/F-003 remediation must
+    produce a Zuordnung (old→new mapping, style of `shared/commit-zuordnung-2026-08-07.md`);
+    `game-operating` mirror exists (private — the analysis negative was withdrawn);
+    `thread-net-git`/`threadnet-operating` dormancy is intentional and staged (base
+    features → monitoring → security; no polish detours) — see F-002/F-007/F-009 addenda.
 11. **Session-close corrections by the human**, both binding for Session 2: the Gitea
     mirror is **private to the owner**, not public (reach of F-002/F-003 rewritten —
     the exposure is prospective, via a possible future git.lab→GitHub push); canonical
@@ -126,10 +131,11 @@ In descending order of how much they could mislead Session 2.
    history that only a human or a live system can judge. And extraction itself is still
    trigger-based: a false sentence containing no path, issue, ID, date, count or
    status word was never in `claims.tsv` to begin with.
-2. **`git ls-remote` against `rohana.axion1337.de/sorb/<name>` is how I concluded
-   `game-operating` has no mirror** (F-007). That rests on the naming convention holding,
-   which I verified for six repos but cannot prove for the seventh. The contradiction
-   between `CLAUDE.md:36` and `hosts/overmind.md:28` is solid; the cause is not.
+2. **The `game-operating` no-mirror conclusion did not survive** (F-007 addendum): Gitea
+   hides repo existence behind an auth prompt, my first probe discarded stderr, and the
+   human confirmed the mirror exists (private visibility). Twice in one session an
+   anonymous-`ls-remote` inference broke — treat such negatives as inconclusive by
+   default. The `CLAUDE.md:36` vs `hosts/overmind.md:28` contradiction stands.
 3. **F-009 and F-010 are judgement calls, marked `medium`.** "Doc attention should follow
    work mass" assumes dormancy is unintended, and a "Stand" label may legitimately mean
    "system state as last verified" rather than "state of this text". Both could be

analysis/REPORT.md

@@ -74,7 +74,7 @@ The declaration and the application live in different places, and nothing compar
 | Finding | | Impact |
 |---|---|---|
 | [F-001](findings/F-001-milestone-m5-decided-but-absent-from-steering-docs.md) | M5 decided and populated; docs still call it open | Every new session is mis-primed by the canonical file |
-| [F-007](findings/F-007-mirror-scope-claims-contradict-each-other.md) | Mirror count stated as five and six on the same day; `game-operating` claimed mirrored, is not | Gap in the availability guarantee the two-host topology exists for |
+| [F-007](findings/F-007-mirror-scope-claims-contradict-each-other.md) | Mirror count stated as five and six on the same day (the `game-operating` negative was withdrawn post-analysis — mirror exists, not anonymously readable) | Two canonical documents assert different repo counts simultaneously |
 | [F-005](findings/F-005-dead-gitea-tracker-still-referenced.md) | Live doc routes to the tracker three docs declare dead, under an ambiguous number | A high-priority open decision is reachable only through a retired system |
 | [F-010](findings/F-010-stand-labels-lag-their-own-commits.md) | Hand-written "Stand" labels older than their own file's last commit | Trains readers to distrust current content; gives no signal when content really is stale |
 | [F-017](findings/F-017-prose-asserts-states-already-resolved.md) | Prose asserts states the tracker already resolved: a closed issue called open, a "pending" decision whose premise was executed 60 lines earlier | Sentences a reader would act on; found only by the systematic claim sweep |
@@ -184,6 +184,23 @@ GitLab-numbered, strengthening F-014.
 
 ---
 
+### Answers received at session close (2026-08-10)
+
+1. *(Issue location)* — deferred to Session 2, as proposed.
+2. *(F-002/F-003 remediation)* — binding constraint recorded: any history rewrite must
+   ship an old→new **Zuordnung** in the style of `shared/commit-zuordnung-2026-08-07.md`
+   (the pattern F-015 verified). Timing remains with the human / Session 2.
+3. *(game-operating mirror)* — **exists**, per the human; the anonymous negative was
+   withdrawn as inconclusive (Gitea hides existence behind an auth prompt — see F-007
+   addendum). Not ThreadNet-related beyond planned monitoring inclusion.
+4. *(Dormant components)* — **intentional and staged**: base feature set first, then
+   monitoring and security build-out; deliberately not getting lost in polish. Recorded
+   in the F-009 addendum; no repo document states it yet.
+5. *(M5 ADR)* — drafted as `analysis/drafts/0010-haertung-eigener-meilenstein.md`;
+   placed on local `main` as `decisions/0010-haertung-eigener-meilenstein.md` (banner
+   stripped) at session close. Push of `main` pending; the draft stays in the analysis
+   record as the field-test paper trail.
+
 ## Non-goals — what this analysis deliberately did not examine
 
 - **No design doc in the target repo.** Deliberate deviation from `WORKFLOW.md` size-L

analysis/findings/F-002-timestamp-anonymisation-covers-one-of-six-repos.md

@@ -60,6 +60,12 @@ cannot be recalled.
 root-cause pattern: **Rule declared repo-wide, applied to a subset — and the gap between
 the two is documented in a third place, in different terms.**
 
+remediation constraint (human, 2026-08-10): any rewrite of these 237 commits **must ship
+a Zuordnung** — an old→new SHA mapping in the style of
+`shared/commit-zuordnung-2026-08-07.md`, which F-015 verified works (251/251 rows). A
+rewrite without its mapping would break the evidence-by-citation style the repo depends
+on (F-012).
+
 neckbeard mechanism: **Gap in neckbeard.** Nothing in `AGENTS.md`, `WORKFLOW.md`,
 `schema.yaml` or `scripts/validate.py` concerns commit hygiene, author identity or history
 rewriting; `docs/aar/2026-08-09-neckbeard-v1-creation.md` ("Git is the changelog") treats

analysis/findings/F-007-mirror-scope-claims-contradict-each-other.md

@@ -23,6 +23,17 @@ evidence:
   six verified repos; a `game-operating` mirror under a different name would not have
   been found. Confidence high on the contradiction, medium on the specific cause.
 
+post-analysis addendum (2026-08-10, session close): **the "is not mirrored" conclusion is
+withdrawn.** A controlled re-probe showed Gitea answers identically for a definitely
+nonexistent repo and for `sorb/game-operating` (auth prompt — existence is hidden), while
+`sorb/gameserver` and `sorb/management` answer anonymously. The original measurement
+discarded stderr and misread an auth prompt as absence. The human states the mirror
+exists; the observable difference is therefore **visibility** (not anonymously readable,
+unlike the six ThreadNet mirrors), not absence. The five-vs-six document contradiction
+between `CLAUDE.md:36` and `hosts/overmind.md:28` stands unchanged. The human also
+clarified scope: `game-operating` has nothing to do with ThreadNet beyond its planned
+inclusion in monitoring.
+
 impact: The mirror set is the answer to "what can the Hetzner cluster still reach when the
 lab is down" — the reason the two-host topology exists at all (`CLAUDE.md:26-33`). A repo
 believed mirrored but not mirrored is a gap in exactly that guarantee, and the belief is

analysis/findings/F-009-doc-attention-does-not-follow-work-mass.md

@@ -45,3 +45,13 @@ has no cross-repo status concept — the same missing "components" artifact as i
 confidence note: medium rather than high — the underlying counts are exact, but "attention
 should follow work mass" is a judgement about intent, and dormant-by-design is a legitimate
 answer the documents simply do not give.
+
+post-analysis addendum (2026-08-10, session close): the human confirmed the dormancy is
+**intentional and staged**: a base feature set first, then build out monitoring and
+security — explicitly avoiding getting lost in polish ("sich nicht in Chromleisten
+verrennen"). `threadnet-operating` rests deliberately. This resolves the intent question
+and sharpens the finding rather than dissolving it: the strategy exists, but it lives in
+the owner's head and now in this file — no repo document records it. Implication for
+Session 2's components artifact (neckbeard gap 2): it needs a lifecycle field
+(active / dormant, with the staging rationale) so that intent like this is recorded where
+sessions read it.