Run the canary's paid job weekly; free jobs stay daily

.github/workflows/canary.yml

@@ -12,7 +12,8 @@
 # exactly the case this proves.
 #
 # The PROFILE path is different — it fetches a Cloudflare-gated page — so that
-# half needs a Scraping Browser endpoint. Without the secret it FAILS with an
+# half needs a Scraping Browser endpoint, and runs only on the weekly (Monday)
+# schedule and on a manual dispatch, since each run bills. Without the secret it FAILS with an
 # ::error:: naming the secret rather than going green: a skipped job did not
 # test the site, and a green badge over an untested path is a claim nobody
 # measured. Exit 3 (blocked), exit 5 (never reached the page) and zero rows
@@ -30,6 +31,9 @@ on:
     # 05:40 UTC. Not on the hour: every scheduled workflow on GitHub fires at
     # :00 and the queue there is long.
     - cron: "40 5 * * *"
+    # Mondays only: the paid job (profile) runs on this
+    # schedule (each run bills); the free jobs keep the daily one above.
+    - cron: "40 5 * * 1"
   workflow_dispatch:
 
 permissions:
@@ -169,6 +173,8 @@ jobs:
 
   profile:
     name: profile (needs a Scraping Browser secret)
+    # Paid path: weekly schedule or a manual dispatch only.
+    if: github.event_name != 'schedule' || github.event.schedule == '40 5 * * 1'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     env:

CHANGELOG.md

@@ -10,6 +10,11 @@ When it does, the release notes lead with it.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary's paid `profile` job now runs weekly (Mondays 05:40 UTC)
+  and on a manual dispatch; the free `listing` job still runs daily.
+
 ## [1.1.0] — 2026-10-15
 
 > **Behaviour change:** `--retries 0` is now a usage error (exit 2). It used

README.md

@@ -274,7 +274,8 @@ import error.
 
 The [canary](.github/workflows/canary.yml) runs a real 3-page listing daily —
 **with no secrets**, because the listing path needs none, which is also what
-keeps that claim honest. The profile half skips with a notice when no
+keeps that claim honest. The profile half bills a Scraping Browser session, so it runs weekly
+(Mondays) and on a manual dispatch, and fails, naming the secret, when no
 `BBB_CDP_ENDPOINT` secret is set.
 
 ---