@@ -5,6 +5,17 @@ Each release of Research-Kit, newest first. The version is `KIT_VERSION` in
 
 ## Unreleased
 
+- The `browserPath` machine-config key is read. The browser transport's errors and ADR-0088
+  name it, but the config was loaded and saved without it: a fetch through the collector
+  never consulted it, and any save, `install-hooks --role` among them, erased a value set
+  by hand. `scrape` and `status` called without a config now read the machine's.
+
+- `researcher-release validate --genesis` and `--checkpoints` are verified. Both were
+  advertised and parsed, but `validateRelease` had no parameters for them, so they were
+  dropped before the ledger check and an operator who supplied a signed genesis believed it
+  was checked. Each must now exist below the record root, as `--ledger` and `--head` must,
+  and either one without `--ledger` is refused as INCOMPLETE instead of ignored.
+
 - Under an explicit refusal of this machine's network (`allowInternalRedirects: false`,
   or `RESEARCH_KIT_ALLOW_INTERNAL_REDIRECTS=0`) a name asked for is now judged by what it
   resolves to - at the browser guard even when it is the page's own host, and before any
 
@@ -606,6 +606,7 @@ The full table, including the release-evidence validators and the artifact forma
 | `evidencePolicy` | `pluralist`, `strict` | `pluralist` | whether a keyless or partial capture passes the gate with a warning or fails it |
 | `serpapiKey` | a key | none | SerpAPI search; the environment variable `SERPAPI_API_KEY` works too |
 | `searxngUrl` | a URL | none | a SearXNG instance for search |
+| `browserPath` | a path | the usual install paths | the Chromium or Chrome the `browser` transport runs; read before `RESEARCH_KIT_BROWSER` (ADR-0088) |
 | `failOpen` | `true`, `false` | `true` | what the gate does when it cannot run at all |
 | `editGate.mode` | `ask`, `hard-block`, `off` | `ask` | the Claude Code edit-time gate; `install-hooks.mjs --mode` sets it |
 | `editGate.settingsPath` | a path | `~/.claude/settings.json` | where the edit-time gate is registered |
 
@@ -561,7 +561,7 @@ node research-kit/bin/selftest.mjs            # all of it
 node research-kit/bin/selftest.mjs gate hook  # just these files
 ```
 
-1780 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
+1784 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
 the assertions settled (ADR-0021), and each test is raced against a watchdog
 (`RESEARCH_KIT_TEST_TIMEOUT`, default 60s).
 
 
@@ -20,6 +20,7 @@ import { mainContent, htmlToMarkdown, titleOf, gradeCompleteness, isInternal, se
 import httpKeyless from './http-transport.mjs';
 import { REFUSAL_MARKER } from './browser-guard.mjs';
 import { CHILD_OUTPUT_LIMIT, MAX_PAGE_BYTES, outputOverflow } from './runtime.mjs';
+import { loadConfig } from './machine.mjs';
 
 const GUARD_CHILD = fileURLToPath(new URL('./browser-guard.mjs', import.meta.url));
 
@@ -252,10 +253,12 @@ export function command(argv) {
   return ['browser', ...argv.slice(-1)].map((p) => (/\s/.test(p) ? JSON.stringify(p) : p)).join(' ');
 }
 
-export function scrape(url, { render = renderGuarded, browserPath = null, env = process.env, config = {}, exists, timeout = TIMEOUT_MS, uid,
+export function scrape(url, { render = renderGuarded, browserPath = null, env = process.env, config = null, exists, timeout = TIMEOUT_MS, uid,
   allowInternalRedirects } = {}) {
   const target = String(url);
-  const binary = browserPath ?? findBrowser({ config, env, exists });
+  // No config from the caller means the machine's: the collector calls runScrape(url) with no
+  // options, and an empty default here meant browserPath was never consulted (2026-10-11).
+  const binary = browserPath ?? findBrowser({ config: config ?? loadConfig(env), env, exists });
   const cmd = command([target]);
   if (!binary) {
     return { ok: false, url: target, transport: name, cmd,
@@ -402,8 +405,8 @@ export function map(url, opts = {}) {
   return httpKeyless.map(url, opts);
 }
 
-export function status({ config = {}, env = process.env, exists } = {}) {
-  const path = findBrowser({ config, env, exists });
+export function status({ config = null, env = process.env, exists } = {}) {
+  const path = findBrowser({ config: config ?? loadConfig(env), env, exists });
   return { ok: Boolean(path), transport: name, path, error: path ? '' : 'no Chromium or Chrome found' };
 }
 
 
@@ -83,6 +83,7 @@ export const DEFAULTS = Object.freeze({
   skillRoots: Object.freeze([]),
   projectSkillDir: '',
   maxAgeDays: 180,
+  browserPath: '',
 });
 
 export const ROLES = Object.freeze(['collector', 'builder']);
@@ -168,6 +169,10 @@ function shape(raw) {
     skillRoots: Array.isArray(raw.skillRoots) ? raw.skillRoots.filter((root) => typeof root === 'string' && root.trim() !== '') : [],
     projectSkillDir: typeof raw.projectSkillDir === 'string' ? raw.projectSkillDir : '',
     maxAgeDays: Number.isFinite(raw.maxAgeDays) ? raw.maxAgeDays : DEFAULTS.maxAgeDays,
+    // The browser transport's executable (ADR-0088), which its own errors tell the operator
+    // to set. It was missing here until 2026-10-11, so it was never read, and every save -
+    // `install-hooks --role` among them - rewrote the file without it.
+    browserPath: typeof raw.browserPath === 'string' ? raw.browserPath : DEFAULTS.browserPath,
   };
   // A retired key is READ before it is dropped: a rename that silently relaxes a gate is
   // the same defect as a rename that silently stops firing one.
 
@@ -971,7 +971,7 @@ function loadSchema(schemaDir, name) {
   return loaded.error ? { value: null, error: loaded.error } : loaded;
 }
 
-export function validateRelease({ root, package: packageName, registryPath, rolesPath, pointersDir, schemaDir = DEFAULT_SCHEMA_DIR, ledgerPath = null, headPath = null, genesisHash = '0'.repeat(64), publicKeys = {}, now = Date.now(), snapshotMaxAgeMs = SNAPSHOT_MAX_AGE_MS } = {}) {
+export function validateRelease({ root, package: packageName, registryPath, rolesPath, pointersDir, schemaDir = DEFAULT_SCHEMA_DIR, ledgerPath = null, headPath = null, genesisPath = null, checkpointsDir = null, genesisHash = '0'.repeat(64), publicKeys = {}, now = Date.now(), snapshotMaxAgeMs = SNAPSHOT_MAX_AGE_MS } = {}) {
   const errors = [];
   const output = {
     validatorVersion: VALIDATOR_VERSION,
@@ -1012,6 +1012,11 @@ export function validateRelease({ root, package: packageName, registryPath, role
   if (pointersDir && fs.existsSync(pointersDir) && !inside(root, pointersDir)) add(errors, 'PATH-CONTAINMENT', 'pointer directory escapes record root', pointersDir);
   if (ledgerPath && (!fs.existsSync(ledgerPath) || !inside(root, ledgerPath))) add(errors, 'LEDGER-PATH', 'ledger path must exist below record root', ledgerPath, 'INCOMPLETE');
   if (headPath && (!fs.existsSync(headPath) || !inside(root, headPath))) add(errors, 'LEDGER-PATH', 'head path must exist below record root', headPath, 'INCOMPLETE');
+  if (genesisPath && (!fs.existsSync(genesisPath) || !inside(root, genesisPath))) add(errors, 'LEDGER-PATH', 'genesis path must exist below record root', genesisPath, 'INCOMPLETE');
+  if (checkpointsDir && (!fs.existsSync(checkpointsDir) || !inside(root, checkpointsDir))) add(errors, 'LEDGER-PATH', 'checkpoints path must exist below record root', checkpointsDir, 'INCOMPLETE');
+  // Only the ledger branch reads them: given without --ledger they would be dropped in silence,
+  // which is how both flags went unread before 2026-10-11.
+  if ((genesisPath || checkpointsDir) && !ledgerPath) add(errors, 'LEDGER-PATH', 'genesis and checkpoints are verified only with --ledger', genesisPath ?? checkpointsDir, 'INCOMPLETE');
   if (!artifacts.length) add(errors, 'INPUT-ARTIFACTS', `registry has no artifacts for ${packageName}`, '.artifacts', 'INCOMPLETE');
   if (!HASH.test(String(roster.rosterSha256 ?? ''))) add(errors, 'ROLE-ROSTER', 'role roster hash is invalid', '.rosterSha256');
   const records = new Map();
@@ -1070,6 +1075,8 @@ export function validateRelease({ root, package: packageName, registryPath, role
         pointer: pointer.value,
         publicKeys,
         genesisHash,
+        genesisPath,
+        checkpointsDir,
         expectedBenchmarkSpecSha256: registry.benchmarkSpecSha256,
         expectedRoleRosterSha256: registry.roleRosterSha256,
         genesisSchemaPath: path.join(schemaDir, 'qualification-ledger-genesis.schema.json'),
 
@@ -225,6 +225,24 @@ test('the recorded command names the browser, not the keyless transport', () =>
   assert.doesNotMatch(none.cmd, /http-keyless/, 'the refusal carries the same command');
 });
 
+// Found 2026-10-11: the collector calls runScrape(url) with no options, so the adapter looked
+// for the browser with an empty config, and browserPath - the setting its own error message
+// names - was never consulted. A caller that passes no config gets the machine's.
+test('a scrape with no config of its own runs the browserPath the machine config names', () => {
+  const dir = tempDir('rk-browser-config-');
+  const binary = path.join(dir, 'chrome');
+  fs.writeFileSync(binary, '', 'utf8');
+  const configFile = path.join(dir, 'research-kit.config.json');
+  fs.writeFileSync(configFile, JSON.stringify({ browserPath: binary }), 'utf8');
+  const env = { RESEARCH_KIT_CONFIG: configFile };
+  const { render, calls } = renderWith({ stdout: PAGE });
+  const r = browser.runScrape('https://nodejs.org/api/fs.html', { render, env });
+  assert.equal(r.ok, true, r.error);
+  assert.equal(calls[0]?.file, binary, 'the configured browser ran');
+  assert.equal(browser.status({ env }).path, binary, 'status reports the same browser');
+  assert.equal(browser.status({ env, config: {} }).path === binary, false, 'an explicit config still wins');
+});
+
 test('Chromium\'s own error page is a failure that names its code, though it exits 0', () => {
   assert.equal(chromeErrorOf(PRIVACY), 'ERR_CERT_AUTHORITY_INVALID');
   assert.equal(chromeErrorOf(PAGE), '');
 
@@ -147,6 +147,17 @@ test('saveConfig drops the retired key, so the migration happens through normal
   assert.equal(written.role, 'builder');
 });
 
+// Found 2026-10-11: the browser transport and its error messages tell the operator to set
+// browserPath (ADR-0088), but the config was read without it and rewritten without it, so
+// `install-hooks --role builder` erased a browserPath the operator had set by hand.
+test('browserPath is read from the machine config and survives a save', () => {
+  const { env, file } = envWith(JSON.stringify({ browserPath: '/opt/google/chrome/chrome' }));
+  assert.equal(loadConfig(env).browserPath, '/opt/google/chrome/chrome');
+  saveConfig({ role: 'builder' }, env);
+  assert.equal(JSON.parse(readText(file)).browserPath, '/opt/google/chrome/chrome', 'a save kept the key');
+  assert.equal(loadConfig(envWith(JSON.stringify({ browserPath: 42 })).env).browserPath, '', 'a path that is not a string is not one');
+});
+
 test('a retired ENVIRONMENT variable is reported and never honoured', () => {
   const { env } = envWith(null, { extra: { CLAUDE_SETTINGS_PATH: '/somewhere/settings.json' } });
   const notes = retiredEnvNotes(env);
 
@@ -336,6 +336,117 @@ test('nested promotion pointers require a committed promotion and verify pointer
   }
 });
 
+// A one-artifact R28 release with a promotion pointer, so validateRelease reaches its
+// ledger branch. Its own findings (an uncommitted promotion, no snapshot) are not what the
+// tests below look at.
+async function writePointerRelease(root) {
+  const { payloadHash, sha256, canonicalJson, recordHash } = await import('../lib/release-validator.mjs');
+  const target = envelope({ artifactId: 'R28-04', payload: { manifest: true }, ownerRole: 'evidence-custodian' });
+  target.payloadSha256 = payloadHash(target.payload);
+  const pointerMeta = envelope({ artifactId: 'R28-04', payload: undefined, ownerRole: 'evidence-custodian' });
+  delete pointerMeta.payload;
+  const pointer = {
+    envelope: pointerMeta,
+    payload: {
+      pointerVersion: '1.0.0',
+      promotion: {
+        state: 'ready', package: 'R28', generation: 1, targetArtifactId: 'R28-04',
+        targetHash: target.payloadSha256,
+        predecessorClosureHash: sha256(canonicalJson([])), requiredGate: 'Q0',
+        publishedAt: '2026-01-01T00:00:00Z', previousPointerHash: null, revokedDescendantHashes: [],
+      },
+    },
+  };
+  pointer.envelope.payloadSha256 = payloadHash(pointer.payload);
+  pointer.envelope.recordHash = recordHash(pointer);
+  writeJson(path.join(root, 'records', 'R28-04.json'), target);
+  writeJson(path.join(root, 'pointers', 'R28-04.json'), pointer);
+  const registry = registryFor('R28-04');
+  registry.artifacts[0].ownerRoles = ['evidence-custodian'];
+  registry.artifacts[0].pointer = true;
+  const roles = roster();
+  roles.assignments[0].roleId = 'evidence-custodian';
+  writeJson(path.join(root, 'registry.json'), registry);
+  writeJson(path.join(root, 'roles.json'), roles);
+  // A single .qlog FILE, not a ledger directory: a directory would supply its own
+  // genesis.json and checkpoints/, and hide whether the explicit paths were read at all.
+  fs.mkdirSync(path.join(root, 'ledger'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'ledger', 'ledger.qlog'), '', 'utf8');
+  return {
+    root, package: 'R28',
+    registryPath: path.join(root, 'registry.json'),
+    rolesPath: path.join(root, 'roles.json'),
+    pointersDir: path.join(root, 'pointers'),
+    ledgerPath: path.join(root, 'ledger', 'ledger.qlog'),
+  };
+}
+
+// Found 2026-10-11: `researcher-release validate` advertised --genesis and --checkpoints and
+// parsed them, but validateRelease had no such parameters, so both were dropped before the
+// ledger was verified. An operator who supplied a signed genesis believed it was checked.
+test('validate verifies the genesis and checkpoints it is given, from the library and the CLI', async () => {
+  const { validateRelease } = await import('../lib/release-validator.mjs');
+  const root = tempRoot();
+  try {
+    const inputs = await writePointerRelease(root);
+    const genesisPath = path.join(root, 'anchors', 'genesis.json');
+    const checkpointsDir = path.join(root, 'anchors', 'checkpoints');
+    // Unsigned anchors: well-formed JSON, so they are read and then fail verification.
+    writeJson(genesisPath, { ledgerVersion: '1.0.0', releaseId: 'release-1' });
+    writeJson(path.join(checkpointsDir, 'checkpoint-1.json'), { ledgerVersion: '1.0.0', releaseId: 'release-1' });
+    const result = validateRelease({ ...inputs, genesisPath, checkpointsDir });
+    assert(result.errors.some((error) => error.code === 'LEDGER-GENESIS-SIGNATURE'), `the genesis was not verified: ${JSON.stringify(result.errors)}`);
+    assert(result.errors.some((error) => error.code === 'LEDGER-CHECKPOINT-SIGNATURE' && error.path.startsWith('.checkpoints[0]')), `the checkpoint was not verified: ${JSON.stringify(result.errors)}`);
+    assert(result.status !== 'PASS', JSON.stringify(result));
+
+    const run = spawnSync(process.execPath, [
+      'research-kit/bin/researcher-release.mjs', 'validate',
+      '--root', root, '--package', 'R28', '--registry', inputs.registryPath,
+      '--roles', inputs.rolesPath, '--pointers', inputs.pointersDir,
+      '--ledger', inputs.ledgerPath, '--genesis', genesisPath, '--checkpoints', checkpointsDir, '--json',
+    ], { encoding: 'utf8' });
+    assert(run.status !== 0, `an unsigned genesis passed: ${run.stdout}`);
+    const codes = JSON.parse(run.stdout).errors.map((error) => error.code);
+    assert(codes.includes('LEDGER-GENESIS-SIGNATURE'), `the CLI dropped --genesis: ${codes.join(', ')}`);
+    assert(codes.includes('LEDGER-CHECKPOINT-SIGNATURE'), `the CLI dropped --checkpoints: ${codes.join(', ')}`);
+  } finally {
+    cleanup(root);
+  }
+});
+
+test('validate refuses a genesis or checkpoints path it would not read', async () => {
+  const { validateRelease } = await import('../lib/release-validator.mjs');
+  const root = tempRoot();
+  try {
+    const inputs = await writePointerRelease(root);
+    const refusal = (result, word) => result.errors.find((error) => error.code === 'LEDGER-PATH' && error.message.includes(word));
+
+    const missingGenesis = validateRelease({ ...inputs, genesisPath: path.join(root, 'no-such-genesis.json') });
+    assert(refusal(missingGenesis, 'genesis'), `a missing genesis was ignored: ${JSON.stringify(missingGenesis.errors)}`);
+
+    const missingCheckpoints = validateRelease({ ...inputs, checkpointsDir: path.join(root, 'no-such-checkpoints') });
+    assert(refusal(missingCheckpoints, 'checkpoints'), `a missing checkpoints directory was ignored: ${JSON.stringify(missingCheckpoints.errors)}`);
+
+    const outside = tempRoot();
+    try {
+      const outsideGenesis = path.join(outside, 'genesis.json');
+      writeJson(outsideGenesis, { ledgerVersion: '1.0.0' });
+      const escaped = validateRelease({ ...inputs, genesisPath: outsideGenesis });
+      assert(refusal(escaped, 'genesis'), `a genesis outside the record root was accepted: ${JSON.stringify(escaped.errors)}`);
+    } finally {
+      cleanup(outside);
+    }
+
+    // Without --ledger nothing verifies a ledger, so a genesis given anyway would be dropped.
+    writeJson(path.join(root, 'anchors', 'genesis.json'), { ledgerVersion: '1.0.0' });
+    const noLedger = validateRelease({ ...inputs, ledgerPath: null, genesisPath: path.join(root, 'anchors', 'genesis.json') });
+    assert(refusal(noLedger, '--ledger'), `a genesis without a ledger was ignored: ${JSON.stringify(noLedger.errors)}`);
+    assert(noLedger.status !== 'PASS', JSON.stringify(noLedger));
+  } finally {
+    cleanup(root);
+  }
+});
+
 test('descendant invalidation attributes multiple roots to each affected pointer', async () => {
   const { computeDescendantInvalidation } = await import('../lib/release-validator.mjs');
   const rootA = 'a'.repeat(64);