sneak
978fef8b2c
check / check (pull_request) Failing after 1s
The remote layout and threat model in three documents described plaintext snapshot IDs as directory names and misattributed the observable backup time to those IDs. In fact `RemoteSnapshotKey` names each metadata directory (and the manifest `snapshot_id`) with a one-way double SHA-256 hash of the human ID, so hostname and snapshot name are not observable; the backup time is, via the plaintext manifest timestamp, an accepted design property (issue 81). Document the derivation once in `docs/REPOSTRUCTURE.md` with a worked example; README, ARCHITECTURE and DATAMODEL now show the hashed layout and link to it. Rewrite the privacy section to state what the unencrypted manifest really exposes. Fix two code comments that claimed the public bytes hide the timestamp. Docs and comments only; no behaviour change. Model: opus-4-8