Run the canary weekly on Mondays instead of daily

.github/workflows/canary.yml

@@ -16,7 +16,7 @@
 # `python-requests` and to `wget`. Sixteen candidate bot-challenge markers
 # counted at zero across seven captures.
 #
-# So these jobs run a real scrape every morning from a runner with no
+# So these jobs run a real scrape every Monday from a runner with no
 # secrets, and they are expected to be GREEN. That is not a convenience — it
 # is what keeps the central claim of this repo's README honest. If
 # justjoin.it ever puts these routes behind a challenge, a key or a rate
@@ -32,7 +32,7 @@ on:
   schedule:
     # 05:40 UTC. Not on the hour: every scheduled workflow on GitHub fires
     # at :00 and the queue there is long.
-    - cron: "40 5 * * *"
+    - cron: "40 5 * * 1"
   workflow_dispatch:
 
 permissions:

CHANGELOG.md

@@ -11,6 +11,10 @@ burying it.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary now runs weekly (Mondays 05:40 UTC) instead of daily, and on a manual dispatch.
+
 ## [0.1.4] — 2026-10-15
 
 > **Behaviour changes for existing users.** `--route ssr` now refuses, with

CONTRIBUTING.md

@@ -84,10 +84,10 @@ Then the rest of the presentation, in the order that matters:
 1. `python3 smoke_test.py` green, and the canary dispatched at least once.
    Unlike most siblings in this family the canary here is **not** gated on a
    secret: every route this scraper reads is served to a bare GitHub runner,
-   so it runs a real 3-page scrape daily and is expected to be GREEN. That
+   so it runs a real 3-page scrape weekly (Mondays) and is expected to be GREEN. That
    is not a convenience — it is what keeps the README's central claim
    honest. If justjoin.it ever puts these routes behind a challenge or a key, the
-   badge goes red the next morning and the claim is retested without anyone
+   badge goes red on the next weekly run and the claim is retested without anyone
    having to remember to.
 2. The repo description, homepage and topics set (see the family notes on
    what those should say).

README.md

@@ -515,7 +515,7 @@ absent" reads identically to a real import error.
 Fixtures are cut from real captures and verified to parse identically to
 their untrimmed originals.
 
-The daily [canary](.github/workflows/canary.yml) runs a real 3-page scrape
+The weekly (Monday) [canary](.github/workflows/canary.yml) runs a real 3-page scrape
 from a bare GitHub runner and is **expected to be green**: the listing path
 needs no credentials, so gating it on a secret would hide the day that
 stops being true.