docs: publishing is a push now, not a commit

WORKSPACE.md still described the pre-bare-layer setup: fetch-only
origin = https://git.lucas.co/<crate>.git, and "committing locally IS
publishing". Both stopped being true when ~/.local/bin/git-bare-sync.sh
introduced ~/git/<crate>.git as a pushable origin — the static mirror is
demoted to the `published` remote, repos.conf lists the BARE repos, and
gitsite.timer watches those HEADs. The chain is commit → push → timer → site.

The consequence is not theoretical: as of 2026-09-18, 21 crates hold commits
that were never pushed (cce-designer 25, cce-compositor 19, cce-ui 12), because
the doc said a commit was enough. git-bare-sync.sh, which would push them all,
reads repos.conf field 2 as a work tree while that field now holds the bare
path — so it skips every listed repo as "not a git work tree" and pushes
nothing. Noted here with the manual workaround until the script is fixed.

Docs only; no code touched.

Co-Authored-By: Claude Opus 5 <[email protected]>

 WORKSPACE.md | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/WORKSPACE.md b/WORKSPACE.md
index 32209a7..7221498 100644
--- a/WORKSPACE.md
+++ b/WORKSPACE.md
@@ -45,14 +45,25 @@ independent git repository** with its own committed `Cargo.lock`. The crates sit
 side-by-side under this directory to form the build workspace, but are versioned and
 published separately.
 
-**The local repos are the source of truth — there are no push remotes.** Publishing
-goes through **gitsite** (`~/Dropbox/src/gitsite`): repos listed in its `repos.conf`
-are mirrored, rendered, and deployed as a static read-only site at
-**https://git.lucas.co** (browsable, and clonable over dumb HTTP for `clone`-mode
-entries). A systemd user timer (`gitsite.timer`) republishes automatically when any
-listed repo's HEAD changes, so committing locally IS publishing. Crate repos carry a
-fetch-only `origin = https://git.lucas.co/<crate>.git` — `git push` does not work
-against it by design (static host; no receive-pack, no SSH). New crates get a line in
+**Committing is not publishing — pushing is.** Each crate's `origin` is a local
+**bare repo** under `~/git/<crate>.git`: a real, pushable remote, and a second copy on
+disk independent of the work tree. Publishing then goes through **gitsite**
+(`~/Dropbox/src/gitsite`): its `repos.conf` lists those bare repos, which are mirrored,
+rendered, and deployed as a static read-only site at **https://git.lucas.co**
+(browsable, and clonable over dumb HTTP for `clone`-mode entries). A systemd user timer
+(`gitsite.timer`) republishes when a listed **bare** repo's HEAD changes. So the chain
+is `git commit` → `git push origin <branch>` → `gitsite.timer` → the site, and a commit
+that was never pushed is not on it.
+
+The old fetch-only `origin = https://git.lucas.co/<crate>.git` survives as the
+`published` remote in crates that had it. It never accepted a push by design (static
+host; no receive-pack, no SSH) — which is the whole reason for the bare layer, since
+"published" used to mean "a timer happened to run", with no signal either way. See
+`~/.local/bin/git-bare-sync.sh`, which creates the bare repos and pushes every listed
+repo into them in bulk. **It currently pushes nothing:** it reads `repos.conf` field 2
+expecting a work tree, and that field now holds the bare path, so every listed repo is
+skipped as "not a git work tree" — leaving 21 crates with unpushed commits as of
+2026-09-18. Until that is fixed, push per crate by hand. New crates get a line in
 `repos.conf`. (The pre-2026-08-11 per-crate codeberg.org remotes are retired; those
 repos still exist server-side for old history.)