[jehrr]

Two findings from the 2026-10-05 audit, after checking each against current main (the audit was cut from 12bd047, eight commits back).

Changed

1. CDP connect errors say why. Every failure was followed by the profile_locked paragraph, so a 401 (deny_no_user, expired login) was explained as a held pid. page_flow.cdp_connect_advice now picks the text from the failure itself: expired credentials, held profile, unreachable host, or for a bare timeout an honest "no status, try fresh credentials first". pyppeteer never surfaces the status of a rejected upgrade, so it gets the ambiguous text. pyppeteer also died with a traceback and exit 1 on this failure; it now exits 5 like Playwright, password masked.

2. Tag canary judges claps per source. The old check was "at least one row has claps". Measured 2026-10-05, four live runs of /tag/python: Apollo rows 34-35 per run with claps and responses on 100% in three runs and 30 of 35 in the fourth; the 20 JSON-LD rows carry neither in any run. The canary now requires at least 15 Apollo rows, claps and responses on at least 80% of them (admits the 30 of 35 day), and fails if a JSON-LD row ever carries either.

Verification

• Suite green with no engine, with Playwright only, and with pyppeteer only (each in its own venv). Skips are only the engines absent by design.
• Four planted faults, each red on the named check: 401 regex, Playwright going back to the fixed text, pyppeteer's exit handler, pyppeteer's masking. Two controls were green on the first attempt (a second signal hid the first; the fake error held no password), so the tests were strengthened and the controls rerun.
• The canary step was cut out of the workflow and run against the three real captures (green), the audit-day shape (green), and four broken variants (red).

Not changed

• Python 3.9 stays in the matrix and requires-python (decided separately, family-wide).
• The audit's "coverage is only presence of rows" claim: the archive canary already asserts per-field floors.
• Selenium: it cannot use an authenticated CDP endpoint, so there is no connect path to change.

🤖 Generated with Claude Code