diff --git a/STATE.md b/STATE.md
index d3d2ca8..ccc7d79 100644
--- a/STATE.md
+++ b/STATE.md
@@ -7,9 +7,15 @@ relevant table/section. Don't rewrite history.
## Forge
-**Primary git host: (Forgejo).** GitHub is a
-push-mirror only since 2026-05-05. When the operator says "my git",
-they mean Forgejo.
+**Primary git host: (Forgejo).** Forgejo is the
+ONLY source of truth. When the operator says "my git", they mean
+Forgejo.
+
+**Push-mirror to GitHub is OFF by default** (changed 2026-05-06).
+Operator works privately on Forgejo. Push to GitHub happens only when
+explicitly requested for a specific repo. GitHub copies that exist
+right now are point-in-time snapshots from before the mirror was
+disabled — they will go stale.
- Forgejo: (LE cert, `no-guest@file` ACL)
- Forgejo SSH: `ssh://git@192.168.0.100:222//.git`
@@ -39,14 +45,15 @@ Mesh:
| Repo | Owner | Forgejo | GH mirror | Notes |
|---|---|---|---|---|
-| veilor-os | veilor-org | ✅ primary | ✅ | hardened Fedora KDE remix |
-| veilor-server | veilor-org | ✅ primary | ✅ NEW | Debian preseed bootstrap |
-| infra | veilor-org | ✅ primary | ✅ NEW | this repo |
-| x | s8n-ru | ✅ primary | ✅ | private Misskey fork |
-| minecraft-launcher | s8n-ru | ✅ primary | ✅ | racked.ru launcher |
-| minecraft-server | s8n-ru | ✅ primary | ✅ | racked.ru MC server |
-| minecraft-client | s8n-ru | ✅ primary | ✅ | racked.ru MC client config |
-| auth-limbo | s8n-ru | ✅ primary | ✅ | Paper plugin (AuthMe fix) |
+| veilor-os | veilor-org | ✅ primary | snapshot 2026-05-06 (stale from now) | hardened Fedora KDE remix |
+| veilor-server | veilor-org | ✅ primary | snapshot 2026-05-06 (stale) | Debian preseed bootstrap |
+| infra | veilor-org | ✅ primary | snapshot 2026-05-06 (stale) | this repo |
+| x | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | private Misskey fork |
+| minecraft-launcher | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | racked.ru launcher |
+| minecraft-server | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | racked.ru MC server |
+| minecraft-client | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | racked.ru MC client config |
+| auth-limbo | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | Paper plugin (AuthMe fix) |
+| 8bit-icons | s8n-ru | ✅ primary | snapshot 2026-05-06 (stale) | AGPLv3 AMOLED 24×24 pixel-art Android pack |
**No repos on GH that aren't mirrored from Forgejo.**
@@ -124,7 +131,11 @@ ubuntu-24.04` since runner has that label.
## Changelog
### 2026-05-06
-- Created `veilor-org/infra` Forgejo repo + GH push-mirror
+- **Disabled all Forgejo→GH push-mirrors** (8 repos). Forge is now
+ the only auto-pushed-to host. Operator works privately. Push to GH
+ is a manual operator step for specific repos when wanted.
+- Created `veilor-org/infra` Forgejo repo (mirror initially set, then
+ removed same day per the policy change above)
- Stopped RocketChat (`docker compose stop`); volumes preserved
- 5-agent stack audit shipped (`AUDIT-2026-05-05.md`)
- Cobblestone deployed (fresh Debian + DE) — awaiting access details