[jehrr]

Fixes from the 2026-10-14 audit (base main = 6524017, same SHA as the one audited). The live site breakage (F1) is in a separate PR, #8.

Changes

Finding	What changed	Evidence
F2 exit codes	finish_run: a zero-row run returns 4 only when its stop reason shows the listing is empty (no_results, listing_exhausted, no_new_listings, completed). Every other reason returns 5, including reasons added later, because the list names what proves emptiness rather than the failures. EXIT_API_ERROR moves into output_writer.	Called for each reason in a new check. Before: all returned 4. After: timeouts, content_unparsed, page_never_painted, worker_lost_page, api_error and an unknown reason return 5. Rows followed by a failure still return 6.
F3 modes	_atomic_write chmods the temp file before os.replace: a new file gets 0o666 & ~umask, an existing file keeps its mode.	Check under umask 022/002/077, plus a 0664 file kept as 0664, plus the sidecar mode.
F4 CSV	LF added to the formula leads. write_csv returns its escape count, and csv_cells_escaped goes into the sidecar under the run's own keys.	Check
F5 solve budget	page_flow.SolveBudget (SOLVES_PER_PAGE = 1) is created once per page outside the retry/rotation loop and claimed before solve() in all three engines.	A stubbed-solver drive of Playwright _fetch_one_page with a 3-exit pool and an always-challenged page: 3 solves on main, 1 here. An AST check (read off disk, so it runs without the drivers) covers all three engines.
F6 status	Playwright and pyppeteer pass goto()'s status into classify. A captcha reload clears it. Selenium passes status_code=None explicitly. The Scraper API reads http_code.	The same drive now classifies the page as "blocked (HTTP 403)". An AST check covers every classify call.
F7 / F8 Scraper API	waitFor is now an object; state is validated; x-debug goes through redact_secret_patterns. The docstring is corrected.	A mocked requests.post check. No paid calls made.
F9 citations	Removed from code, .gitignore, tests.yml, CHANGELOG (released 0.2.1 section: citations only) and the v0.2.1 release notes (two citations removed, otherwise byte-identical). New check no shipped file cites a private instruction file, built from assembled tokens.	Check
F10 scan	Skipped directories are matched on path.relative_to(REPO).parts. 0 files scanned is now a failure.	Check: a clone under …/legacy/clone with a planted key is caught; an empty tree fails.
F13	--fingerprint is refused with exit 2 in pyppeteer and Selenium, and in Playwright together with --cdp-endpoint.	Run in each engine's venv.
F15	The fingerprint-refusal check skips when Playwright has no Chromium. It runs with a private HOME. The local failure turned out to be a fingerprint cached in ~/.cache answering instead of the dead proxy, not only the missing binary.	Playwright venv: 471 passed, 0 failed.
Canary (instructions §12)	Exit 3 is now always an error, because the site serves this URL to GitHub runners (all 16 red runs from 2026-09-29 to 2026-10-14 reached the page and parsed it). Exit 5 is now an explicit error. The HAS_PROXY notice path is gone. No secret is required; FLIPPA_PROXY stays optional.	Canary dispatch on this branch: see below
Metadata	Description now says "2Captcha Scraping Browser API" and drops the "embedded-JSON parsing" and "Turnstile solving" claims.	gh repo edit

Controls (fault planted in a copy, suite run, named check required red)

All 13 went red on the expected check:

• exit mapping
• chmod removed
• LF lead removed
• sidecar count removed
• Selenium budget guard neutralised (the first version of that check stayed green against this; the check was rewritten to require an if not budget.spend(): return ahead of solve())
• budget moved inside the loop
• pyppeteer classify without status
• http_code back to status
• waitFor back to a string
• x-debug unredacted
• absolute-path scan
• zero-file guard removed
• a citation re-added

The harness ran with PYTHONDONTWRITEBYTECODE=1, on copies with no __pycache__.

Suites

venv	passed	failed	skipped
Core only	437	0	9 (engine-absent)
Playwright	471	0	1 (local capture)
pyppeteer	441	0	8
Selenium	441	0	8

Not changed

• F1 site breakage: PR Read Flippa's rebuilt search page (0 rows since 2026-09-29) #8. Until it lands, a canary run on this branch is expected to fail with exit 4.
• F11 README status paragraph: rewritten in Read Flippa's rebuilt search page (0 rows since 2026-09-29) #8, which re-measured it.
• F12 urllib3 advisories through pyppeteer: owner decision (ignore with a reason, or drop pyppeteer).
• F14 Scraper API --retries semantics: owner decision.
• F16 donor names in provenance comments: low and not functional. Left to avoid conflicts with Read Flippa's rebuilt search page (0 rows since 2026-09-29) #8, which edits the same modules.
• F17 --locale / --mode: owner decision.
• Not in this PR at all: version bump, tag, release, shared-loop refactor, schema/sinks.
• The open Dependabot PR Bump actions/upload-artifact from 7.0.1 to 7.0.2 in the actions group across 1 directory #7 is not touched.

Conflicts

CHANGELOG.md (both PRs add [Unreleased]), and possibly smoke_test.py and canary.yml. Whichever PR lands second needs a rebase.

🤖 Generated with Claude Code