@@ -443,6 +443,21 @@ jobs:
           node "$KIT/bin/artifact.mjs" validate --file "$ARTIFACT_PATH" --json
           node "$KIT/bin/artifact.mjs" validate --file "$ARTIFACT_PATH" --quiet
 
+      # `retention-days` BOUNDS the exposure. It does not remove it, and the difference is
+      # worth stating because the naming rules above are easy to over-trust.
+      #
+      # On a public repository, ANY signed-in GitHub account can open this run, read these
+      # logs - which echo the dispatched topic in the `env:` group above - and download
+      # this artifact, which is the whole collected corpus. The documentation is explicit:
+      # "You must be logged in to a GitHub account to view workflow run information,
+      # including for public repositories", and viewing, searching and downloading logs and
+      # artifacts each require only "read access to the repository", which on a public
+      # repository is universal. The 401 and 403 an anonymous probe gets are refusals of
+      # ANONYMITY, not of strangers.
+      #
+      # Seven days rather than the 90-day default, because the only dial here is how long
+      # the window stays open. The agent path fetches within minutes, so a short window
+      # costs nothing real. See docs/decisions/2026-09-21-public-run-visibility/.
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4, resolved 2026-09-21
         with:
           name: ${{ env.ARTIFACT_NAME }}
 
@@ -141,9 +141,18 @@ it.
 
 - The next build step is a `workflow_dispatch` collector that uploads a labelled artifact,
   with the five properties above.
-- Two things remain unproven and are recorded as gaps rather than claimed: the runner-side
-  `npm install -g firecrawl@<version>` path, which has never executed, and whether artifact
-  download is ergonomic for the intended operator, which documentation cannot answer.
+- Two things remained unproven when this was written and were recorded as gaps rather than
+  claimed: the runner-side install path, and whether artifact download is ergonomic for the
+  intended operator.
+
+  **The first is closed, later the same day.** The install path has executed on a real
+  runner and succeeded, in runs `35600022797` and `35608301287` — both reporting `install
+  the vendor CLI` and `the CLI is a major this adapter supports` as successful. Getting
+  there took a fix no amount of reading would have found: the npm package is
+  `firecrawl-cli`, and the one called `firecrawl` is the SDK, which ships no binary.
+
+  The second is still open and always will be by this route — it is a usability question,
+  and no vendor page answers it.
 - The preliminary note keeps its text. It was right about the behaviour it observed and
   wrong about the cause, and rewriting it would erase the most useful thing in this
   decision: that reading a page and running the call gave different answers, and only
 
@@ -224,10 +224,16 @@ vulnerability: the substitution happens before the validation can run.
 - `live-collection.yml` loses four shell interpolations and gains four `env:` blocks.
 - The collector runs on `ubuntu-latest` and `windows-latest`, with `shell: bash` pinned so
   one script serves both.
-- **The runner path is still unproven.** `npm install -g firecrawl@<version>` on a runner,
-  and `cliCompatibility()` against the CLI it installs, have never executed. This change
-  makes that the only remaining gap and does not close it — closing it needs the
-  environment, the secret, and one real dispatch, all of which are the owner's.
+- **The runner path was unproven when this was written, and is now closed.** It needed the
+  environment, the secret and one real dispatch, all of which were the owner's to provide —
+  and all of which arrived the same day. Runs `35600022797` and `35608301287` both executed
+  `npm install -g firecrawl-cli@1.23.3` and `cliCompatibility()` against the CLI the runner
+  installed, successfully.
+
+  The first attempt failed, which is the point of having run it at all: both workflows had
+  been installing a package called `firecrawl` since they were written. On npm that is the
+  JavaScript SDK, and it ships no binary. The CLI is `firecrawl-cli`. Nothing offline could
+  have caught it — every test drives a stub.
 
 ## What this ADR does not claim
 
 
@@ -119,6 +119,48 @@ silent spend, and a worse diagnostic than expected. The step's message already n
 right fix for the wrong reason; anybody hitting it on a Free private repository should read
 this paragraph first.
 
+### The unmeasured half, measured — 2026-09-21, later the same day
+
+The section above says what a signed-in user sees "is **unknown**, and 'unknown' is what
+the documentation now says rather than 'safe'". That was the right posture and it did not
+survive contact with the documentation.
+
+Collected through the collector itself, into
+`docs/decisions/2026-09-21-public-run-visibility/`:
+
+- "You must be logged in to a GitHub account to view workflow run information, **including
+  for public repositories**." That is why an anonymous probe saw so little — the web
+  surface *starts* at an account.
+- Viewing logs, searching logs, downloading logs and downloading artifacts each carry the
+  same requirement: "**Read access to the repository is required to perform these steps.**"
+
+**On a public repository, read access is universal.** So any person with a free GitHub
+account can open a collector run, read the logs — which echo the dispatched topic in the
+`env:` group the runner prints — and download the artifact, which is the entire collected
+corpus.
+
+**The `401` and `403` this ADR measured are refusals of ANONYMITY, not of strangers.** The
+measurement was accurate about what it measured; the population it measured is not the
+population that matters.
+
+Three consequences:
+
+1. **The naming rules are demoted, not discarded.** This ADR called them "the primary
+   control". They cover the anonymous surface — listing-scrapers, a glance over a shoulder
+   — and nothing beyond it.
+2. **`retention-days: 7` on the collector now has a recorded reason.** It bounds the
+   window; it removes nothing. The comment in `collect.yml` says so rather than leaving
+   seven days looking like a tidy default.
+3. **Decision 1 stands, with a different caveat.** Staying public was decided on *plan*
+   grounds — a free private repository has its environment secrets and variables ignored,
+   so going private breaks the collector rather than protecting it. That is untouched. What
+   changes is the sentence attached to it: not "the exposure is limited to shape" but "the
+   exposure is total to anyone with an account, and the remedy is a paid plan, not a
+   toggle".
+
+The gap was named in this ADR and closed by the kit this ADR is about, which is the first
+time that loop has run on a question this repository asked of itself.
+
 ## Alternatives considered
 
 **Go private anyway, to be safe.** Breaks the collector on this plan, for an exposure the
 
@@ -99,10 +99,11 @@ Two things remain unproven and are deliberately *not* unknowns in the contract,
 neither blocks this decision - they block the thing it recommends building. They are
 recorded in `research/MAP.md` under "Known gaps":
 
-1. The runner-side `npm install -g firecrawl@<version>` path has never executed, and
-   neither has `cliCompatibility()` against a CLI installed on a runner. The local metered
-   route was verified (`../../live-predicate-verification-2026-09-21.md`); the CI route was
-   not. Closing it needs the `live-collection` environment, its secret, and one dispatch.
+1. ~~The runner-side install path has never executed.~~ **Closed later the same day.**
+   `npm install -g firecrawl-cli@1.23.3` and `cliCompatibility()` both ran and succeeded on
+   a real runner, in runs `35600022797` and `35608301287`. Worth having named rather than
+   assumed: the first real attempt failed, because the workflow installed `firecrawl`,
+   which on npm is the SDK and ships no binary. The CLI is `firecrawl-cli`.
 2. Whether artifact download is ergonomic enough for the intended operator. A usability
    question; documentation cannot answer it.
 
 
@@ -57,12 +57,12 @@ Neither is an unknown in the contract, because neither blocks *this* decision -
 block the thing the decision recommends building, and omitting them would misrepresent
 what has been established.
 
-- **The runner-side install path has still never executed.** `npm install -g firecrawl@<v>`
-  on `ubuntu-latest`, and `cliCompatibility()` against the CLI it installs, are asserted by
-  `.github/workflows/live-collection.yml` and proven nowhere. The local metered route was
-  verified on 2026-09-21 (`../../live-predicate-verification-2026-09-21.md`); the runner
-  route was not. Closing it needs the `live-collection` environment, its secret, and one
-  dispatch - all of which are the repository owner's to create.
+- ~~**The runner-side install path has still never executed.**~~ **Closed 2026-09-21.** It
+  now has, on a real runner, twice - runs `35600022797` and `35608301287` - including
+  `cliCompatibility()` against the CLI the runner installed. The first attempt failed, and
+  that is exactly why the gap deserved naming rather than assuming: the workflow installed
+  `firecrawl`, which on npm is the SDK and ships no binary at all. The CLI is
+  `firecrawl-cli`, and no amount of reading the documentation would have found it.
 - **Whether artifact download is ergonomic for the intended operator.** A usability
   question. No quantity of vendor documentation answers it, and this corpus does not
   pretend to.
 
@@ -0,0 +1,10 @@
+# The corpus's line endings are integrity, not style.
+#
+# A capture's body hash is taken over the LF bytes the collector fetched. git's smudge
+# filter rewrites every text file on a default Windows checkout (core.autocrlf=true), so
+# without this file the whole corpus fails `body-unmodified` on arrival with nothing
+# actually wrong with it. This file outranks a reader's core.autocrlf. See ADR-0020.
+
+research/raw/* text eol=lf
+*.jsonl text eol=lf
+research/*.md text eol=lf
@@ -0,0 +1,27 @@
+node_modules/
+.DS_Store
+
+# Credentials never belong in a research project (AGENTS.md Rule 6). Note that
+# `firecrawl env` writes the key into .env, which is why the rule says never to run it
+# inside a repository.
+.env
+.env.*
+*.pem
+*.key
+
+# The Firecrawl CLI saves scrape output into .firecrawl/ in whatever directory it runs
+# from. That is a vendor cache, not evidence - the kit's own captures live in
+# research/raw/ with a ledger entry behind each one.
+.firecrawl/
+
+# The kit's local review logs are not evidence.
+research/raw/.usage.jsonl
+research/raw/.failures.jsonl
+research/raw/.diagnostics.jsonl
+research/raw/.fetches.lock
+
+# The chain IS evidence and must travel. The explicit negation is here so a broader
+# dotfile rule added later cannot silently exclude it - this repository lost its ledger
+# exactly that way once.
+!research/raw/.fetches.jsonl
+!research/overrides.log
@@ -0,0 +1,131 @@
+# Research-first project bootstrap
+
+Agent instructions for this project. Read this before planning, designing, or building
+anything here.
+
+## How this project works: two phases, two roles
+
+**Phase 1 - research (this kit).** Close every blocking unknown with fetched primary
+sources, then pass the gate. The output is a briefing, not code: `research/DISCOVERY.md`
+(the contract), `research/EVIDENCE.md` (claims with cached pages behind them), and
+`research/BRIEF.md` (the handoff). Phase 1 never writes product code.
+
+**Phase 2 - build (someone else's job).** A builder - another agent, a different model, or
+a human - takes `research/BRIEF.md` plus `research/` and implements. They should not need
+to re-research anything: if they do, phase 1 was incomplete, and the fix is to collect the
+missing fact rather than to let the builder guess it.
+
+The gate is the handoff point. Before it passes, phase 2 does not start.
+
+## Two machines, two roles
+
+The role is machine config - `role: "collector" | "builder"` in
+`~/.agents/research-kit.config.json`, default `collector`; declare it with
+`node ~/.agents/research-kit/bin/install-hooks.mjs --role builder`.
+
+| | **collector** (the operator's PC) | **builder** (a sandbox, a CI box, a laptop) |
+|---|---|---|
+| holds | the Firecrawl key | no key, no Firecrawl egress |
+| runs | `decompose.mjs`, `research.mjs` | `handoff.mjs`, `preflight.mjs`, the build |
+| a missing key is | a **FAIL** | **informational** |
+| must | push `research/raw/` including its dotfiles | **not collect** - the collection CLIs refuse (exit 2) |
+
+**If you are on a builder machine and there is no brief: you do not collect.** A page
+fetched by hand is not evidence in this kit, and a builder that "re-collects" a missing
+page forges a corpus instead of reporting a gap. Name the missing fact instead.
+
+A builder's first command is:
+
+```
+node ~/.agents/research-kit/bin/handoff.mjs
+```
+
+The remedy depends on the cause, and the command says which: something that did not
+travel is the collector's to push (`git add -f research/raw/`, dotfiles included);
+a corpus that travelled whole and was rewritten on checkout here is fixed **here**, with
+`.gitattributes`, and costs no credits.
+
+## Starting in the wrong place: ask which project, do not hunt for it
+
+The project is the **current working directory**. The kit takes no project argument and
+never will. If the cwd is not the project the operator means - the kit's own repo, a
+parent folder, an unrelated checkout - **ask which project**, and wait. Do not search the
+filesystem, do not infer it from a name, do not look it up on a remote. Searching a
+person's disk to guess his intent reads directories nobody authorised, and the question
+it replaces takes one line.
+
+Signals: no `AGENTS.md`, no `research/` directory, or a `research/` corpus plainly about
+something else. An existing corpus about another topic is the signal doing its job.
+
+## Resuming after an interruption: resume, do not restart
+
+The gate is a pure function of repository state, so orient from disk before touching
+anything. `doctor.mjs` and preflight answer *where this project is*; the last commit
+report and `docs/ARCHITECTURE.md` say *what was happening and why*; `git status` answers
+what is unfinished, and its uncommitted changes are the interrupted task - partial and
+unverified, work in progress, never state to trust. The corpus is already collected and
+spent credits are not spent again.
+
+## Rule 1 - research first, then build
+
+The sequence is decompose -> contract -> collect -> gate -> brief.
+
+0. **Decompose** (collector machine): `node ~/.agents/research-kit/bin/decompose.mjs --topic "<topic>"`
+   drafts `research/MAP.md` seeded with the universal checklist. The tool contains no
+   judgment. Mark every row COVERED (citing U-## rows), DISMISSED (reason required), or
+   GAP.
+1. **Write the intent** in `research/DISCOVERY.md` under `## Build intent`, and enumerate
+   the blocking unknowns FROM the map.
+2. **Collect**: `node ~/.agents/research-kit/bin/research.mjs --plan research/plan.json`. Prefer the page
+   that *owns* the fact over any write-up about it.
+3. **Rewrite** each auto-extracted `Finding` cell into a real claim, keeping the `Raw`
+   cell pointing at the cached page.
+4. **Gate**: `node ~/.agents/research-kit/bin/preflight.mjs`. **Do not start building until it prints
+   PASS.** Evidence must be *fetched*, not typed, and by a named transport.
+5. **Hand off**: write `research/BRIEF.md`.
+
+There are exactly three overrides - `git commit --no-verify`, a deliberate
+`research/GATE_OFF`, and a repository-local `core.hooksPath` - and all three are recorded
+in `research/overrides.log`. If you take one, say so in your reply.
+
+## Rule 2 - questions are for intent, never for facts
+
+At most **3** questions, once, up front, and only about things no document can answer. If
+a question's answer is in public documentation, it is a research task. **Never answer
+"insufficient info" and stop.**
+
+## Rule 3 - known unknowns are allowed, silence is not
+
+Mark a genuinely unreachable fact `KNOWN-UNKNOWN` and write the day-one verification step
+in the `Evidence` cell. An unlabeled gap is the failure mode this project exists to
+prevent.
+
+## Rule 4 - source quality
+
+`P` primary/official carries the design. `S` secondary is context. `L` lead-only is a
+hint, never proof. Never invent a citation. Flag contradictions instead of averaging them.
+
+## Rule 5 - cost discipline
+
+Every scrape spends credits. Plan the queries in `research/plan.json` first, reuse the
+cache (`--refresh-days`), and check the budget with `node ~/.agents/research-kit/bin/research.mjs --status`.
+
+## Rule 6 - secrets
+
+The key lives in the CLI config or the environment. Never write it into this repository.
+
+## The standing protocol
+
+Five rules for how work here is committed and recorded. Documentation, not enforcement:
+no check judges prose, because a gate that judges prose is a gate that will be wrong.
+
+1. **Architecture map current in the same commit.** A commit touching a declared code
+   path (`research/kit.json`) stages `docs/ARCHITECTURE.md` with it. Enforced - and a
+   prompt, not a proof: the gate checks the map was *staged*, not that it is *current*.
+2. **Commit report: five named parts** - what changed / why / what it touched / what you
+   verified / what you got wrong and fixed. The got-wrong line is not optional; if
+   nothing was gotten wrong it is written as "nothing to report".
+3. **An ADR for any choice with a rejected alternative**, dated, with the reason a future
+   explorer would need to avoid re-suggesting it.
+4. **One commit per task - the revert test.** `git revert <sha>` undoes it alone.
+5. **A red suite stops work**, reported immediately and alone, **with the cwd recorded**.
@@ -0,0 +1,42 @@
+# Start here
+
+A **decision project** (ADR-0030). Read `research/BRIEF.md`; everything else is what it
+rests on.
+
+**The question:** on a public repository, who can actually read a workflow run - its shape,
+its logs, and the artifact it produced?
+
+## Why it exists
+
+ADR-0035 measured an **anonymous** caller and found only the run's shape exposed. It closed
+with a section headed "What is NOT measured, and is therefore not claimed": what a
+**signed-in** user sees. That gap was load-bearing, because the collector's logs echo the
+dispatched topic and the artifact *is* the corpus.
+
+This closes it, and the answer is the less comfortable one: **any signed-in GitHub account
+can read the logs and download the artifact.** The `401` and `403` ADR-0035 measured are
+refusals of anonymity, not of strangers.
+
+## How it was collected
+
+Dispatched through `bin/collect-remote.mjs` - the agent path, the same one an AI would
+use - as run
+[35620262684](https://github.com/StepenkoAnatoli/Research-Kit/actions/runs/35620262684),
+depth `quick`. Three pages, all `full`, all from `docs.github.com`.
+
+The `corroboration` check reports that as `one-voice` rather than `independent`, and it is
+right to: this is GitHub describing its own permission model. Authoritative, and not a
+second opinion. The warnings are left standing rather than argued away.
+
+## Verifying it
+
+From **this** directory:
+
+```
+cd docs/decisions/2026-09-21-public-run-visibility
+node ..\..\..\research-kit\bin\preflight.mjs
+node ..\..\..\research-kit\bin\handoff.mjs
+```
+
+As of 2026-09-21: `PASS  0 blocking, 4 warning(s), 12 passing` and `handoff OK - 3 ledger
+entries, chain verifies`.