diff --git a/AGENTS.md b/AGENTS.md
index 8a7cb82..5eff7a6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4705,6 +4705,46 @@ which needs the HTTPS host below.
 
 ---
 
+## AJ. The repository is public, and the license rule says it must not be (found 2026-08-29)
+
+Found while answering "could Gitea host the over-the-air install?". It could — and the reason it
+could is the problem. Measured, not inferred:
+
+- `GET https://gitea.nothaft.cloud/api/v1/repos/paul/audi-app` → **`"private": false`**
+- `GET .../raw/branch/main/companion-app/auslieferung/App.ipa` → **HTTP 200**, 2,437,551 bytes,
+  `application/octet-stream`, **no authentication**
+- `GET .../raw/branch/main/companion-app/src/assets/audi/schriften/audi-type-400.woff2` → **HTTP 200**,
+  a real 22,868-byte WOFF2
+
+So Audi Type, the four rings, the model badges and the signed `.ipa` that bundles all of them are
+downloadable by anyone right now. That contradicts this file's own **hard license rule** (top of
+document: cleared "only for this one private, unpublished installation") and
+`companion-app/README.md`'s "dieses Repository bleibt privat". The exposure of the brand assets long
+predates the `.ipa`; committing the `.ipa` on 2026-08-29 was done on the documented assumption that
+the repo was private, which turned out to be false.
+
+**Making it private does not break anything.** The obvious worry is the integration's self-update,
+but `custom_components/audi_dashboard/aktualisierung.py` authenticates
+(`_header()` → `Authorization: token …`) and returns early when no token is configured — it never
+relied on anonymous access.
+
+**It does break the "host the OTA install from git" idea**, which is why the two are recorded
+together. The over-the-air download is performed by an iOS **system daemon**, not by Safari, so it
+carries no cookies or login session; a private repo would hand it an HTML login page instead of the
+`.ipa`. Gitea 1.26 no longer accepts API tokens as a URL query parameter, and embedding one in a
+`manifest.plist` would mean writing a credential into a served file anyway. `tailscale serve` stays
+the right host for that job (section AI).
+
+Checked at the same time and clean: no tokens or credentials in tracked files (`.env.local` is
+gitignored; the long hex strings in this file are bundle SHA-256s). Note that flipping visibility now
+does not un-publish what was already reachable — the instance sits behind Cloudflare and may have
+been cached or crawled.
+
+**Decision pending with the owner.** Nothing was changed: repository visibility is an outward-facing
+setting on their server, not something to flip from a session.
+
+---
+
 ## Working conventions (observed — keep them)
 
 - German is the project language: identifiers, comments, commits, UI texts. Exceptions: