The Gitea mirror is private to the owner. An earlier draft inferred
'public' from an anonymous git ls-remote succeeding on the owner's
machine, which does not follow -- corrected in F-002, F-003, F-006,
REPORT.md and HANDOFF.md.
The exposure is prospective and sits on the git.lab side: content there
may later be pushed to GitHub. No such path is configured today (no
remote besides origin, no github.com reference in any of the six CI
configs). The severity ranking is unchanged and its reasoning is now
stated: a protection believed present but absent is what would make a
later outward push unsafe.
REPORT.md groups the 16 findings by their four root-cause patterns,
maps each pattern to the neckbeard mechanism that would have caught it,
and lists the seven framework gaps the field test exposed.
HANDOFF.md carries scope, reproduction, this session's decisions and
the seven calls I am least confident about.
Thore Cimbal