The human answered the report's open questions: the game-operating
mirror exists (a controlled re-probe shows Gitea hides repo existence
behind an auth prompt, so the anonymous negative was inconclusive --
withdrawn in F-007); component dormancy is intentional and staged
(F-009 addendum); any F-002/F-003 remediation must ship an old->new
Zuordnung in the proven style of commit-zuordnung-2026-08-07 (F-002).
verify_claims.py gives all 813 claim rows a mechanical disposition;
the 28 flags were adjudicated by hand (REPORT.md appendix). Two survived
as genuine drift (F-017): a closed issue still described as open in
shared/lab-netzwerk.md, and a 'pending' decision block in hosts/cfgmon.md
whose premise the same file records as executed.
Also: narrow the vendored-path filter (it silently dropped 7 tracked
icon files and produced false path-miss flags), record the confirmed
canonical author identity in F-003, verify the Gitea#48->GitLab#46
numbering shift by title in F-005, and add the ADR-0010 draft under
analysis/drafts/ for the human to git-mv into decisions/.
Branch renamed to Neckbeard-v0.1.1-analyse-1 per the human.
The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.
The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.
REPORT.md groups the 16 findings by their four root-cause patterns,
maps each pattern to the neckbeard mechanism that would have caught it,
and lists the seven framework gaps the field test exposed.
HANDOFF.md carries scope, reproduction, this session's decisions and
the seven calls I am least confident about.