v0.4.2

• Fixed: Amazon SearchBot IP ranges never parsed, so verification stayed inconclusive (#135)

v0.4.1

• Changed: analyze no longer prints "wrote N inspect file(s)" to stderr (#131)

v0.4.0

• Added: an often-forbidden tag for clients the server keeps refusing (403) (#123)
• Added: cache-busting version token on inspect-data URLs (#119)
• Added: detect www-Referer browser spoofing as spoofed_browser (#96) (#101)
• Changed: a browser that never caches at volume is spoofed, not automation (#130)
• Changed: all-cold-at-volume is a spoofed_browser tell (#103) (#129)
• Changed: a sustained 403 rate corroborates vuln_scanner (#128)
• Changed: a probing client is a vuln_scanner, even under a browser costume (#122)
• Changed: measure request cadence over navigations, not asset bursts (#121)
• Changed: asset co-load counts only referer-linked page cascades (#109) (#116)
• Fixed: "polls a few URLs repeatedly" counts targets, not query-stripped paths (#126)
• Fixed: lead the inspect rationale with the chosen classification (#125)
• Fixed: count query-string enumeration in the 404-storm signal (#124)
• Fixed: feed-polling spoofers no longer excused as feed readers; add polls-feeds tag (#120)
• Fixed: inspect trace nests an asset's own sub-resources (multi-level cascades) (#118)
• Fixed: require enough HTML pages before co-load scores a browser (#115)

v0.3.3

• Added: control over settings persistence — --no-persist and a note on what was saved (#113)
• Added: per-site output path (--site remembers -o) and graceful stale-log handling (#112)

v0.3.2

• Added: per-site configuration blocks (--site) and --config override (#107)
• Added: --tag and --brief selectors for the inspect command (#105)

v0.3.1

• Fixed: inspect-trace offsets re-base on any top-level request, not just pages (#102)

v0.3.0

• Added: click a client in the HTML report to open its full inspect trace in-page (#94)

v0.2.0

• Added: copy a grouped row's id for inspect --actor, expanding to every member (#93)
• Added: authenticate Pingdom, UptimeRobot and Site24x7 against their published IPs (#90)
• Added: authenticate self-declaring scanners against their published origins (#86)
• Added: real per-bucket request count/timeframe on sparkline hover (#82)
• Added: agent-census wba-check verb to validate a host's Web Bot Auth directory (#77)
• Added: verify Web Bot Auth signatures (new verification tier) (#37)
• Changed: regroup tag colours into identity, botness, and origin systems (#66)
• Fixed: rotated band labels no longer stretch the cross-tab's first band rows (#92)
• Fixed: don't render a bare "–" caption under a request-pattern sparkline (#91)
• Fixed: stop several sparkline captions from showing boilerplate text (#85)
• Fixed: show the WBA operator on the header line when rDNS can't confirm one (#83)
• Fixed: stop the sparkline caption from repeating a client's identity (#84)
• Fixed: stop observational tags from splitting identical actors in the report (#71)
• Fixed: scroll past summary tables when a URL fragment encodes a query or network filter (#69)

v0.1.4

• Maintenance release (no changelog entries)

v0.1.3

• Changed: summary tables show category traffic share and pin their headers (#63)