Say exports are readable data, link what the host can see, require Node 24

app/components/console/results-panel.tsx

@@ -78,7 +78,9 @@ export default function ResultsPanel({
             ))}
           </div>
           <p className="secondary-text">
-            Drafts appear only in the not-submitted file and the archive, never in the submitted sorts or the analysis.
+            These files are readable, not sealed: they hold every response with its participant code. Store them where
+            your study keeps participant data, as carefully as the key file. Drafts appear only in the not-submitted file
+            and the archive, never in the submitted sorts or the analysis.
             {generationOf(collection.definition) &&
               " Cards participants added are in the sorts files, marked “participant” under card_origin; the analysis compares your cards only."}
           </p>

app/package.json

@@ -4,7 +4,7 @@
   "license": "Apache-2.0",
   "private": true,
   "engines": {
-    "node": ">=22.18.0"
+    "node": ">=24 <25"
   },
   "scripts": {
     "dev": "node scripts/run-framework.mjs dev",

docs/FACILITATOR_GUIDE.md

@@ -66,6 +66,8 @@ Choose **Collect responses**. The console opens the sealed responses on your com
 - **Not submitted: drafts (CSV):** the same layout, for drafts only. Drafts never appear in the submitted file or the analysis.
 - **Archive (JSON):** the activity and everything collected, with codes, kinds and times. It keeps the original text exactly.
 
+**The exports are not sealed.** Each one holds readable responses with participant codes. Store them only where your study has approved keeping participant data, with the same care as the key file, and don't email them or paste them into a chat or AI tool.
+
 If participants could add their own cards, those cards are in the two sorts files, with `participant` in the `card_origin` column (your cards say `shared`). Pairwise similarity and the analysis views compare your cards only.
 
 The CSV files open in spreadsheets, with accents and emoji intact. Cells that start like a formula are escaped. The console also shows the co-sorting matrix, connection map and clustering for the submitted sorts. See [Methods](METHODS.md).
@@ -76,7 +78,7 @@ The CSV files open in spreadsheets, with accents and emoji intact. Cells that st
 2. **Collect again** and save the four exports, so you have the final versions.
 3. **Delete from the relay.** The console asks you to confirm that the exports are saved. Every link stops working and the sealed responses are deleted. Tell your study team plainly: the session is **deleted from the live database when you delete the session; Cloudflare's recovery history keeps the sealed copy for up to 7 more days**. That copy stays sealed; only the key file can open it.
 
-Your key file and exports stay on your computer. The key file still opens in the console afterwards, which then says the session is no longer on the relay. If you never delete the session, it deletes itself at its expiry date.
+Your key file and exports stay on your computer. If you ever can't use this console while the session is still on the relay, the key file and Node 24 are enough to collect the responses as JSON: see [reading data without the app](https://github.com/MalverdeSoftware/malverdesoftware/blob/main/docs/DATA-VISIBILITY.md#reading-data-without-the-app). The key file still opens in the console afterwards, which then says the session is no longer on the relay. If you never delete the session, it deletes itself at its expiry date.
 
 ## Before the first real session
 

docs/SELF_HOSTING.md

@@ -77,6 +77,7 @@ Pull reviewed changes, run `npm ci` and `npm run verify`, then deploy again with
   - Since September 1, 2026, D1 queries on the free plan fail once a daily limit is exceeded, until it resets at 00:00 UTC.
   - A 20-person sort uses a few thousand writes in total. If saves do fail, participants' work stays on their device and syncs after the reset.
 - **Logs.** The app turns off Workers observability and adds no logging. Cloudflare may keep its own operational logs under its policy.
+- **What the host can see.** Cloudflare receives each request's IP address, user agent, time, size and path (which includes the random session and slot IDs). The relay stores none of these, but it does store when each slot saved and submitted. So the host can tell that a device opened a session at a given time, but not who the participant is in the study or what they answered. The full list is in [what the relay can see](https://github.com/MalverdeSoftware/malverdesoftware/blob/main/docs/DATA-VISIBILITY.md). Include it when you review hosting with communities and partners.
 - **Security headers.** Every page has a content security policy that lets it load and connect only to its own site, plus `Referrer-Policy: no-referrer` and `X-Frame-Options: DENY`.
 - **Not included.** Accounts, CAPTCHA, and verified one-person-one-response. Each link and passcode is personal; whoever has both can open that participant's sort.
 - **Your obligations.** Communities and their university partners govern the data and decide how the app is operated and who receives links. Review hosting with them before collecting real responses.