[StepenkoAnatoli]

Two unknowns were written down in collect.yml as unknown. Both are now closed — neither by the corpus.

1. Per-input length: nothing truncates

The kit's own collection could not answer this. The one on-topic capture of seven was a 2024 community question asserting "its length is limited to 1024 characters" — whose only reply is a dormancy bot. Nobody ever confirmed it. The other six were Gallup StrengthsFinder, Merriam-Webster, the MDN <input> element and a TV input page, because "input" is a common word and the search matched the word rather than the subject. Same failure as the Tavily topic, now twice.

So I measured it — payloads of known length with a marker at the very end:

sent	run	arrived
1,200 chars	35762363585	1,200, PROBE-END intact
8,000 chars	35762574315	8,000, PROBE-END intact

1024 is not what this repository observes, and the dangerous case does not occur: no silent truncation, so a registered prior cannot be quietly corrupted while still looking whole.

Still unknown, and recorded as unknown: where the ceiling actually is. Above 8,000; bisecting costs one dispatch per probe, so it was not bisected. A realistic prior is a few hundred characters.

2. The signed-in surface — and this one is a correction

ADR-0035 left a hole and named it: "what a signed-in user with read access sees in the web UI… Treat that as unknown rather than safe."

It is not safe.

surface	result
anonymous, run page	input values appear nowhere in 236 KB of HTML, not even collapsed
anonymous, job log	"Sign in to view logs" — refused, agreeing with REST 403
signed in, job log	every input passed through env: is echoed verbatim

Actions prints a step's env: block, so the log carries:

TOPIC: probe
PRIOR: PROBE-START length=1200 xxxxxxxx...

On a public repository that makes the topic readable by anyone with a GitHub account. The 403 is real, but it is an authentication wall, not a need-to-know one.

Not worked around, deliberately

Passing an input through env: is the same rule that keeps it out of a shell (ADR-0020). Routing around the log would mean routing around that protection — trading a disclosure to signed-in readers for a code-execution surface is a bad trade.

bin/disclosure.mjs is unchanged and should be: it probes unauthenticated on purpose, because a probe that quietly authenticated would answer a different question while looking like this one.

What actually changes

The anonymous table stands, every row. It was honestly obtained and it is still true. The error was in the step from what was measured to what it means — a list of refusals reads as "the subject is private", and it is not.

Both halves are kept, not swapped: a correction that erases what it corrected teaches nobody. The new guard pins that the refusal table never appears without the signed-in caveat and the mechanism that causes it, in either file that prints it. Confirmed red by deleting the caveat.

The practical consequence is now stated where someone will read it: to research something you would not publish, use a private repository or collect locally.

Verification

• 889 passed, 0 failed (offline suite)
• Every number above comes from a run id in the table, read back from the artifact or the log — not from the corpus, which got this one wrong

🤖 Generated with Claude Code