[jehrr]

Follow-ups from a third-party audit of v0.1.1 (2026-10-05). Each audit claim was checked against this commit first; most were already addressed, so this PR is deliberately small.

Changed

• README engines badge: no longer lists three engines as equals (pyppeteer measured over CDP, Selenium local only), matching the engine table.
• README: dates the last live checks beside the measurements table, including a hand re-check on 2026-10-05 that a datacentre run is reported as the Akamai refusal (exit 3, nothing written).
• .github/env_report.py, called by both canary jobs: prints Python, TLS library, driver, Chromium versions and the endpoint KIND, never the endpoint. A red canary then says from its own log whether the site or the runner moved.

Checked

• smoke_test.py: 360 passed, 0 failed (engine groups skipped: no driver installed locally).
• ci_checks.py --secret-check: 45 files, nothing credential-shaped.
• env_report.py runs with the driver absent.
• NOT checked: the workflow YAML on a runner (a PR that changes a workflow cannot test it, section 11); the --chromium path.

Not changed, and why

• Resume from a cursor: the cursor is last_hotel_id + window + shown, tied to the session. Whether it replays in a new session is unmeasured and needs a live Scraping Browser; until then a resume could splice two orderings silently. Needs the experiment first.
• Canary on data quality: canary_assert.py already checks rows, uniqueness, price share, currency, original_price and zero ratings; the datacentre job already runs daily.
• Scheduling the Scraping Browser job: profile credentials last about a day, so it would be red for the secret, not the site.
• Dropping Selenium/pyppeteer: family parity; status is already stated.
• Python 3.9 / LibreSSL warning: the auditor's system Python, not a repo setting.
• Versioned JSON Schema and sinks: family-wide product decision.

🤖 Generated with Claude Code