v0.1.1 — the checklist audit

Correction to v0.1.0's notes. That section was edited after the tag was cut, adding a paragraph about the credential-gated paths. A released section is history — git show v0.1.0:CHANGELOG.md is what a reader can check it against — so it has been restored verbatim and the paragraph moved into this release, where it belongs.

An audit of v0.1.0 against this family's own checklist, done by mutation — breaking one thing at a time and watching whether the offline suite noticed — rather than by re-reading the code. Eight defects this family has shipped before were injected. Six were caught immediately; two were not, and both turned out to be real.

Fixed

• diff_runs.py compared columns that do not exist here. It arrived from a sibling tracking seven fields — none of them a column in this repo's schema — so two runs diffed against each other would have reported "no changes" for ever, on any input, while exiting 0. TRACKED_FIELDS now names what a change is on a prediction market: the price, the order book around it, the volume windows, the state transitions that end a market's life, and the question being re-worded. The suite asserts every name in it is a real column.
• A markets run diffed against an events run reported a collapse that never happened. volume_scope moves between the two while data_source stays flight on both, so volume went from the event's 199,000,000 to the market's 19,000,000 and read as a change. volume_scope now decides "which view" alongside data_source.
• A test that could not fail. Deleting the event-scoping rule outright left the suite green — the fixture generator had trimmed away the very rails the rule exists to scope out. It now keeps two of them on purpose, and the same mutation is caught by ten checks.
• scraper_api_client.py logged "Parsed 70 stor(ies)" through a full live run: a sibling's vocabulary surviving in a shipped file.

Added

• A vocabulary guard — the file-describes-another-site check now also bans the words a copied paragraph keeps after the site's name has been swapped out. Each was counted across the repo before being banned, so words that occur legitimately here are not in the list.
• A check that every field diff_runs.py tracks is a real column, which is what would have caught the first defect above.

Measured

Every credential-gated path was run end to end against this site, because those are the paths nobody runs. All four return the same 70 markets a local browser does:

path	result
Scraper API	$0.0005, 766,857 bytes, 70 markets, 11s
Scraping Browser over CDP	70 markets, identical
Fingerprint API	fetched and applied — user agent, locale en-US, timezone America/New_York
solver	balance call OK; no challenge existed to solve

The Fingerprint API's documented multi-tag example still answers HTTP 400, and this repo's default is the single tag that works.