diff --git a/docs/RESEARCH_DOCUMENTATION_PLAN.md b/docs/RESEARCH_DOCUMENTATION_PLAN.md
new file mode 100644
index 00000000..018928fa
--- /dev/null
+++ b/docs/RESEARCH_DOCUMENTATION_PLAN.md
@@ -0,0 +1,417 @@
+# Research Documentation Plan - Tractatus Framework
+
+**Date**: 2025-10-25
+**Status**: Planning Phase
+**Purpose**: Document framework implementation for potential public research publication
+
+---
+
+## 📋 User Request Summary
+
+### Core Objective
+Document the hook architecture, "ffs" framework statistics, and audit analytics implementation for potential publication as research, with appropriate anonymization.
+
+### Publication Targets
+1. **Website**: docs.html left sidebar (cards + PDF download)
+2. **GitHub**: tractatus-framework public repository (anonymized, generic)
+3. **Format**: Professional research documentation (NOT marketing)
+
+### Key Constraint
+**Anonymization Required**: No website-specific code, plans, or internal documentation in public version.
+
+---
+
+## 🎯 Research Themes Identified
+
+### Theme 1: Development-Time Governance
+Framework managing Claude Code's own development work through architectural enforcement.
+
+**Evidence**:
+- Hook-based interception (PreToolUse, UserPromptSubmit, PostToolUse)
+- Session lifecycle integration
+- Enforcement coverage metrics
+
+### Theme 2: Runtime Governance
+Framework managing website functionality and operations.
+
+**Evidence**:
+- Middleware integration (input validation, CSRF, rate limiting)
+- Deployment pre-flight checks
+- Runtime security enforcement
+
+### Question
+Are these separate research topics or one unified contribution?
+
+**Recommendation**: One unified research question with dual validation domains (development + runtime).
+
+---
+
+## 📊 Actual Metrics (Verified Facts Only)
+
+### Enforcement Coverage Evolution
+**Source**: scripts/audit-enforcement.js output
+
+| Wave | Date | Coverage | Change |
+|------|------|----------|--------|
+| Baseline | Pre-Oct 2025 | 11/39 (28%) | - |
+| Wave 1 | Oct 2025 | 11/39 (28%) | Foundation |
+| Wave 2 | Oct 2025 | 18/39 (46%) | +64% |
+| Wave 3 | Oct 2025 | 22/39 (56%) | +22% |
+| Wave 4 | Oct 2025 | 31/39 (79%) | +41% |
+| Wave 5 | Oct 25, 2025 | 39/39 (100%) | +21% |
+
+**What this measures**: Percentage of HIGH-persistence imperative instructions (MUST/NEVER/MANDATORY) that have architectural enforcement mechanisms.
+
+**What this does NOT measure**: Overall AI compliance rates, behavioral outcomes, or validated effectiveness.
+
+### Framework Activity (Current Session)
+**Source**: scripts/framework-stats.js (ffs command)
+
+- **Total audit logs**: 1,007 decisions
+- **Framework services active**: 6/6
+- **CrossReferenceValidator**: 1,765 validations
+- **BashCommandValidator**: 1,235 validations, 157 blocks issued
+- **ContextPressureMonitor**: 494 logs
+- **BoundaryEnforcer**: 493 logs
+
+**Timeline**: Single session data (October 2025)
+
+**Limitation**: Session-scoped metrics, not longitudinal study.
+
+### Real-World Examples (Verified)
+
+**Credential Detection**:
+- Pre-commit hook blocks (scripts/check-credential-exposure.js)
+- Actual blocks: [Need to query git logs for exact count]
+- Documented in: .git/hooks/pre-commit output
+
+**Prohibited Terms Detection**:
+- Scanner active (scripts/check-prohibited-terms.js)
+- Blocks: Documentation and handoff files
+- Example: SESSION_HANDOFF document required citation fixes
+
+**CSP Violations**:
+- Scanner active (scripts/check-csp-violations.js)
+- Detection in HTML/JS files
+- [Need actual violation count from logs]
+
+**Defense-in-Depth**:
+- 5-layer credential protection audit (scripts/audit-defense-in-depth.js)
+- Layer completion status: [Need to run audit for current status]
+
+---
+
+## 🚫 What We CANNOT Claim
+
+### Fabricated/Unsubstantiated
+- ❌ "3 months of deployment" (actual: <1 month)
+- ❌ "100% compliance rates" (we measure enforcement coverage, not compliance)
+- ❌ "Validated effectiveness" (anecdotal only, no systematic study)
+- ❌ "Prevents governance fade" (hypothesis, not proven)
+- ❌ Peer-reviewed findings
+- ❌ Generalizability beyond our context
+
+### Honest Limitations
+- ✅ Anecdotal evidence only
+- ✅ Single deployment context
+- ✅ Short timeline (October 2025)
+- ✅ No control group
+- ✅ No systematic validation
+- ✅ Metrics are architectural (hooks exist) not behavioral (hooks work)
+
+---
+
+## 📝 Proposed Document Structure
+
+### Research Paper Outline
+
+**Title**: [To be determined - avoid overclaiming]
+
+**Abstract** (MUST be factual):
+- Problem statement: AI governance fade in development contexts
+- Approach: Architectural enforcement via hooks + session lifecycle
+- Implementation: October 2025, single project deployment
+- Findings: Achieved 100% enforcement coverage (hooks exist for all mandatory rules)
+- Limitations: Anecdotal, short timeline, no validation of behavioral effectiveness
+- Contribution: Architectural patterns and implementation approach
+
+**Sections**:
+1. **Introduction**
+   - Governance fade problem in AI systems
+   - Voluntary vs architectural enforcement hypothesis
+   - Research contribution: patterns and early implementation
+
+2. **Architecture**
+   - Hook-based interception layer
+   - Persistent rule database (.claude/instruction-history.json)
+   - Multi-service framework (6 components)
+   - Audit and analytics system
+
+3. **Implementation** (Generic patterns only)
+   - PreToolUse / UserPromptSubmit / PostToolUse hooks
+   - Session lifecycle integration
+   - Meta-enforcement (self-auditing)
+   - Enforcement mechanism types (git hooks, scripts, middleware)
+
+4. **Deployment Context A: Development-Time**
+   - Claude Code self-governance
+   - Hook architecture for tool validation
+   - Session state management
+   - Metrics: Enforcement coverage progression
+
+5. **Deployment Context B: Runtime**
+   - Web application governance patterns
+   - Middleware integration (input validation, CSRF, rate limiting)
+   - Deployment pre-flight checks
+   - Security layer enforcement
+
+6. **Early Observations** (NOT "Results")
+   - Enforcement coverage achieved: 39/39 (100%)
+   - Framework activity logged: 1,007 decisions
+   - Real-world blocks: [Credential attempts, prohibited terms, etc.]
+   - Timeline: October 2025 (single month)
+
+7. **Discussion**
+   - Architectural patterns demonstrated
+   - Limitations of current deployment
+   - Anecdotal nature of findings
+   - Need for systematic validation
+   - Questions for future research
+
+8. **Future Work**
+   - Systematic effectiveness validation
+   - AI-driven project management (next research phase)
+   - Cross-domain applications
+   - Behavioral outcome measurement
+
+9. **Conclusion**
+   - Contribution: Architectural patterns for AI governance
+   - Early deployment demonstrates feasibility
+   - Systematic validation needed
+   - Patterns available for replication
+
+**Appendices**:
+- A. Generic code examples (anonymized)
+- B. Audit dashboard screenshots
+- C. Enforcement statistics (factual)
+
+---
+
+## 🔒 Anonymization Requirements
+
+### Safe to Publish (Generic Patterns)
+
+**Hook Pattern Example**:
+```javascript
+// Generic hook validator pattern
+function preToolUseHook(toolName, parameters) {
+  const rules = loadGovernanceRules();
+  const violations = checkRuleViolations(rules, toolName, parameters);
+
+  if (violations.length > 0) {
+    return {
+      blocked: true,
+      reason: violations[0].message,
+      instruction_id: violations[0].id
+    };
+  }
+
+  return { blocked: false };
+}
+```
+
+**Session Lifecycle Pattern**:
+```javascript
+// Session initialization pattern
+function initializeSession() {
+  const sessionId = generateSessionId();
+  resetTokenCheckpoints();
+  loadGovernanceRules();
+  initializeFrameworkComponents();
+  runComplianceChecks();
+}
+```
+
+### NOT Safe to Publish
+
+- ❌ Tractatus-specific database connections
+- ❌ Website routes, endpoints, business logic
+- ❌ Project-specific file paths (/home/theflow/projects/tractatus)
+- ❌ Internal roadmap or plans
+- ❌ Actual website code
+- ❌ sydigital, family-history project references
+- ❌ Client/business-specific information
+
+**Rule of Thumb**: Can someone recreate the **pattern** but not **our website**?
+
+---
+
+## 🎯 Publication Tiers
+
+### Tier 1: Public Research Paper (tractatus-framework GitHub)
+- **Content**: Anonymized patterns, architecture, early observations
+- **Audience**: Researchers, AI safety community, developers
+- **Format**: Academic-style paper (markdown + PDF)
+- **Tone**: Honest about limitations, factual claims only
+
+### Tier 2: Website Research Page (docs.html)
+- **Content**: Same as Tier 1
+- **Plus**: Interactive elements (audit dashboard screenshots)
+- **Cards**: Key findings, architecture diagrams
+- **PDF**: Downloadable version of paper
+- **Links**: To GitHub for code examples
+
+### Tier 3: Internal Documentation (NOT Published)
+- **Location**: Tractatus repo (private sections)
+- **Content**: Website-specific implementation, roadmap, plans
+- **Audience**: Development team only
+
+---
+
+## 📊 Executive Summary Draft (For Leader Section)
+
+**Title**: "Research Update: Architectural AI Governance Framework"
+
+**Content** (FactCheck Required):
+
+> **Development Status**: We have implemented a comprehensive architectural enforcement system for AI governance in development contexts, achieving full enforcement coverage (39/39 mandatory compliance rules now have programmatic enforcement mechanisms, up from 11/39 baseline). Implementation occurred October 2025 over 5 iterative waves.
+
+> **Approach**: The system employs a hook-based architecture that intercepts AI tool use and validates against a persistent governance rule database. Early session metrics show [NEED EXACT COUNT] governance decisions logged, [NEED COUNT] validations performed, and [NEED COUNT] attempted violations automatically blocked.
+
+> **Next Steps**: We are preparing research documentation of our architectural patterns and early observations, with appropriate caveats about the anecdotal nature of single-deployment findings. Future work includes systematic validation and AI-driven project management capabilities leveraging the same enforcement framework.
+
+**Tone**: Professional progress update, measured claims, clear limitations.
+
+---
+
+## 🚨 Critical Errors to Avoid
+
+### What I Did Wrong (Meta-Failure)
+In my previous response, I fabricated:
+1. "3 months of deployment" - FALSE (actual: <1 month, October 2025)
+2. "100% compliance rates" - MISLEADING (enforcement coverage ≠ compliance rates)
+3. Presented metrics out of context as validated findings
+
+**Why this is serious**:
+- Violates inst_016/017 (no unsubstantiated claims)
+- Violates inst_047 (don't dismiss or fabricate)
+- Defeats purpose of prohibited terms enforcement
+- Undermines research credibility
+
+**Correct approach**:
+- State only verified facts
+- Provide source for every metric
+- Acknowledge limitations explicitly
+- Use precise language (coverage ≠ compliance ≠ effectiveness)
+
+### Framework Application to This Document
+
+**Before publishing any version**:
+1. ✅ Run through scripts/check-prohibited-terms.js
+2. ✅ Verify all statistics with source citations
+3. ✅ Apply PluralisticDeliberationOrchestrator if value claims present
+4. ✅ Cross-reference with instruction-history.json
+5. ✅ Peer review by user
+
+---
+
+## 🎓 Humble Communication Strategy
+
+### How to Say "This Is Real" Without Overclaiming
+
+**Good**:
+- ✅ "Production deployment in development context"
+- ✅ "Early observations from October 2025 implementation"
+- ✅ "Architectural patterns demonstrated in single project"
+- ✅ "Anecdotal findings pending systematic validation"
+
+**Bad**:
+- ❌ "Proven effectiveness"
+- ❌ "Solves AI safety problem"
+- ❌ "Revolutionary approach"
+- ❌ Any claim without explicit limitation caveat
+
+**Template**:
+> "We present architectural patterns from a production deployment context. While findings remain anecdotal and limited to a single project over one month, the patterns demonstrate feasibility of programmatic AI governance enforcement. Systematic validation is needed before generalizability can be claimed."
+
+---
+
+## 📅 Next Actions
+
+### Immediate (This Session)
+1. ✅ Create this planning document
+2. ✅ Reference in session closedown handoff
+3. ⏭️ Test session-init.js and session-closedown.js (next session)
+4. ⏭️ Fix any bugs discovered
+
+### After Bug Fixes
+1. **Gather accurate metrics**:
+   - Query git logs for actual block counts
+   - Run defense-in-depth audit for current status
+   - Document CSP violation counts
+   - Verify all statistics with sources
+
+2. **Draft research paper**:
+   - Use structure above
+   - ONLY verified facts
+   - Run through prohibited terms checker
+   - Apply framework validation
+
+3. **Create website documentation**:
+   - Cards for docs.html
+   - PDF generation
+   - Interactive elements (screenshots)
+
+4. **Prepare GitHub tractatus-framework**:
+   - Anonymize code examples
+   - Create README
+   - Structure repository
+   - License verification (Apache 2.0)
+
+5. **Blog post** (optional):
+   - Accessible summary
+   - Links to full research paper
+   - Maintains factual accuracy
+
+### Future Research
+- **AI-Driven Project Manager**: Next major research initiative
+- **Systematic Validation**: Control groups, longitudinal study
+- **Cross-Domain Applications**: Test patterns beyond development context
+
+---
+
+## 🤔 Open Questions for User
+
+1. **Timeline**: Publish now as "working paper" or wait for more data?
+2. **Scope**: Single unified paper or separate dev-time vs runtime?
+3. **Audience**: Academic (AI safety researchers) or practitioner (developers)?
+4. **GitHub visibility**: What level of detail in public tractatus-framework repo?
+5. **Blog**: Separate blog post or just research paper?
+6. **Validation priority**: How important is systematic validation before publication?
+
+---
+
+## ✅ Verification Checklist
+
+Before publishing ANY version:
+
+- [ ] All statistics verified with source citations
+- [ ] No fabricated timelines or metrics
+- [ ] Limitations explicitly stated
+- [ ] Anecdotal nature acknowledged
+- [ ] No overclaiming effectiveness
+- [ ] Anonymization complete (no website specifics)
+- [ ] Prohibited terms check passed
+- [ ] Framework validation applied
+- [ ] User approval obtained
+
+---
+
+**Status**: Planning document created
+**Next Step**: Reference in session closedown handoff
+**Priority**: Bug testing session-init/session-closedown first
+**Research Publication**: After bugs fixed and metrics verified
+
+---
+
+**Apache 2.0 License**: https://github.com/AgenticGovernance/tractatus-framework