The human answered the report's open questions: the game-operating
mirror exists (a controlled re-probe shows Gitea hides repo existence
behind an auth prompt, so the anonymous negative was inconclusive --
withdrawn in F-007); component dormancy is intentional and staged
(F-009 addendum); any F-002/F-003 remediation must ship an old->new
Zuordnung in the proven style of commit-zuordnung-2026-08-07 (F-002).
The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.
The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.
Twelve drift findings and four works-well findings, each citing file
paths, line numbers, commit hashes or rows in analysis/data/. Every
'neckbeard mechanism' field names a concrete rule in neckbeard v0.1.1 or
states explicitly that none exists.
Thore Cimbal