Record the bug the extraction found, and why nobody had caught it

Three copies, one bug, and the correct reasoning already written down in
a comment three functions above the code that needed it. That is an
argument about review rather than about duplication, and it is more
persuasive than any of the similarity percentages above it.

README.md

@@ -62,6 +62,36 @@ Every one of those is a fix somebody made once, in one repo, that the other
 will either never get or get by being written a third time. That is the
 cost this repo removes, and it is already being paid.
 
+## It found a bug in all three before shipping a line
+
+`private` was lifted from ai-app because that copy was the better one. Two
+sessions then read it as a module rather than as scattered helpers, and
+found that `OpenOptions::mode` applies **only when a file is created** — so
+opening one that already exists keeps whatever mode it had.
+
+Both projects rewrite existing files holding private material. `certs.rs`
+reissues the TLS leaf on every start, so a `leaf-key.pem` that had ever
+existed world-readable would have stayed that way for the rest of its life,
+with every start looking like it was setting the mode. The config's temp
+file is the other: normally fresh, but one left by a crashed save is
+reopened with its old mode and then renamed over the file holding the
+enrolled token hashes.
+
+It was latent in both — the modes on both machines were checked, and were
+correct — but it was present three times: dev-updater, ai-app, and this
+crate's first commit.
+
+The reason nobody caught it is the argument for this repo, and it is not
+about duplication. The correct reasoning was already written down, in a
+comment, three functions above the code that needed it: `create_dir` sets
+the mode a second time and explains exactly why. It stayed invisible for as
+long as nobody had cause to read those functions as a set. Two readers
+looking at one module found it in under an hour.
+
+Fixed here (`67ac924`), in ai-app (`d0b6b66`), and in dev-updater
+(`bdaade4`), which also adopted the `private` module wholesale — the first
+time the sharing paid rather than merely being argued for.
+
 ## What is here
 
 `server/` — the `wg-link` crate. Three modules, each extracted only after