diff --git a/docs/GIT-PUSH-DIAGNOSIS.md b/docs/GIT-PUSH-DIAGNOSIS.md
new file mode 100644
index 0000000..720b28b
--- /dev/null
+++ b/docs/GIT-PUSH-DIAGNOSIS.md
@@ -0,0 +1,64 @@
+# git push in this environment — it was never the firewall, and never missing credentials
+
+## What actually happened
+
+Every push attempt this session used `git push origin main` and failed with:
+
+```
+fatal: could not read Username for 'https://github.com'
+```
+
+That error names the cause exactly, and it was misread all session as "no git
+credentials on this machine." Two things were true instead:
+
+1. **`origin` is GitHub** (`github.com/kev3109/betonblk.git`) and has **no stored
+   credential.**
+2. **`gitea` is the working remote** (`git.builtbykev.com/builtbykev/vyndr.git`)
+   and **a valid credential for it was on the machine the entire time.**
+
+The habit of typing `origin` is what kept twenty commits local. Nothing was
+blocked.
+
+## The GATE-0 firewall theory — tested and REJECTED for VYNDR
+
+The theory was that GATE-0 (Hetzner `mastermind-core-fw`, inbound deny-by-default
+except 80/443, SSH/22 restricted to Tailscale + Kev's IP) was blocking an
+SSH-based push, as it did for COLYRA.
+
+**It does not apply here. Measured:**
+
+| check | result |
+|---|---|
+| `git remote -v` | **both remotes are already HTTPS** — no `git@…:…` URL anywhere |
+| `curl -I https://git.builtbykev.com` | **HTTP 200** in 0.64s |
+| `curl -I https://github.com` | **HTTP 200** in 0.17s |
+| Gitea git endpoint over 443 | **HTTP 200** |
+| GitHub git endpoint over 443 | HTTP 401 (auth required, reachable) |
+
+There was no SSH remote to be blocked and no connectivity failure of any kind.
+COLYRA's HTTPS-remote fix was the right fix for COLYRA's problem; **VYNDR was
+already in the state that fix produces.**
+
+Applying it here would have meant creating a new Gitea token to solve a problem
+that did not exist — and the pre-existing credential would have made the new
+token look like the cure.
+
+## The fix
+
+```
+git push gitea main       # not origin
+```
+
+Result: `6452926..ecf78b9`, 21 commits, verified by `git ls-remote` matching
+local `HEAD`.
+
+## Standing note
+
+- **`gitea` is VYNDR's push remote.** `origin` (GitHub) is unauthenticated on this
+  machine and will always fail.
+- Read the error text before reaching for an infrastructure theory. `could not
+  read Username for 'https://github.com'` is a *credential* message naming a
+  *specific host* — it is not a connectivity message, and it named the wrong
+  remote, not a wrong protocol.
+- The `~/vyndr-full-history-2026-08-07.bundle` and patch series stay as
+  belt-and-braces. They are no longer the only copy.