Researcher-blind privacy measurement

The argument

Publicly accessible is not the same as ethically frictionless to observe, aggregate, retain and republish. A researcher who reads leaked paths and identities to prove that they leak becomes a second observer and a new point of aggregation — exactly the failure under study.

The answer is architectural rather than a promise not to look. A sealed machine zone performs the first observation, suppresses sensitive values and emits anonymous feature objects. The researcher and any downstream analysis model receive disclosure classes, presence or absence, template likelihood, confidence, detector disagreement, owner class, a time bucket and UNKNOWN — never repository or account identity, raw paths, private addresses, credential-like values or quotable source text.

It is a minimization strategy, not a guarantee of anonymity or of zero re-identification risk. A plain repository hash is not anonymous; linkage tables are optional and dangerous; and the question worth studying is the mechanism, class, frequency and structure of failure — not who exactly leaked what.