v0.11.0

Added

• Customer Journey Analytics — 10 read-only tools. CJA is a sibling service
  to AEP, not another AEP endpoint: its own host, its own paths, and no
  sandbox. It shares only the OAuth credential, so adding the CJA API to the
  existing Developer Console project is all that is required. Every path was
  established by live probe — CJA's are not uniform, and /data/segments,
  /data/calculatedmetrics and /data/reports are all HTML 404s.

  Company discovery is unavailable on a CJA-only credential: Adobe serves it
  from analytics.adobe.io, which belongs to Adobe Analytics, a different
  product. CJA answers everything with x-gw-ims-org-id alone, so the company
  id is optional via CJA_GLOBAL_COMPANY_ID. There is no auto-discovery
  fallback and no auto-selection — if discovery ever returns several companies,
  the tool refuses to pick rather than silently pointing reports at the wrong one.

• A machine-recorded evidence ledger (docs/validation-evidence.json) and a
  test that fails the build if the validation matrix marks a tool live without a
  recorded pass.

  The matrix was hand-maintained: a ✅ meant someone ran something once and typed
  a tick. That gap was not theoretical. CJA was reported as live-validated on the
  strength of a throwaway script in /tmp, and the read-only sweep had never
  constructed a CJA client, so it had never tested a single CJA tool.

• npm run validate:writes — replays the whole write path and removes what
  it made: schema → dataset → batch → abort, a second batch through
  complete → revert, expiration create/read/update/cancel, then
  GET-verified dataset deletion. aep_complete_batch and aep_revert_batch
  were previously provable only by an August phase run that nothing replayed —
  the most destructive tools in the server holding the weakest evidence.

Fixed

• The read-only sweep never built a CJA client, so all ten CJA tools returned
  CJA_NOT_CONFIGURED — five reported as failures that were defects in the
  harness, not the product.
• CjaClient sent a whitespace-only x-proxy-global-company-id when the
  override was blank; the env path trimmed, the constructor path did not.
• An HTML 404 from CJA surfaced as "AEP API returned 404" rather than saying the
  route does not exist.

Added

• npm run check:counts — asserts the tool count agrees across all six
  places it appears: package.json, server.json, the README, the validation
  matrix, and the GitHub repository description. Wired into the release gate.

  It has now drifted twice. 0.8.0 shipped with every surface saying 46 while the
  registry held 53. 0.10.0 left the GitHub About saying 53 while the registry
  held 51 — the About is not in the repo, so it is the one that gets forgotten,
  and both times it was caught by a person happening to read a page. That is not
  a control.

  A test already keeps the README's tool names honest against the registry;
  this covers the counts. The registry is the only source of truth.

  Its own first run reported a failure that was not one — the README carries
  legitimate per-category counts ("7 tools", "9 tools") in the comparison table,
  which a bare /(\d+) tools/ matches too. It now matches only total-claim
  phrasings, and that reasoning is a comment in the file.

Fixed

• The GitHub repository description said 53 tools; the registry holds 51.
  Corrected, and now guarded.