Cut the README to what you need to run this

It had grown into a changelog: how each fact was discovered, which earlier
claim it overturned, what the sample size was at the time. Useful while
learning the system, noise once you just want to record a match. Rewritten as
a reference, 295 lines to ~195, losing the archaeology and keeping the facts.

Conclusions that were buried in narrative are now rules. Sample-size markers
survive only where they change whether a claim can be leaned on.

Documents --feed, including that it is the setting that matters and that
getting it wrong fails silently.

Two corrections while here. Of five observed endings, three self-terminated
and two ran forever, across both feed types with nothing predicting which --
so the cap stays, but "the stream never ends" was too strong. And preflight
no longer claims to mint a JWT: /oauth/browser-token hands back the session's
existing token, so the expiry it prints is not a freshness signal. The check
is unaffected, since it rests on the 403 a dead session returns.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fr1fLMnVGNAKH5L2BmhMxn

preflight.py

@@ -9,8 +9,9 @@ automate login").
     python preflight.py                     # session + host checks
     python preflight.py --entry 0_z236v0e7  # also exercise the entry API
 
-Exit code is 0 only if the session minted a JWT. Anything else means tonight's
-scheduled run would fail, and it would fail at kickoff with nobody watching.
+Exit code is 0 only if the server returned a JWT for this session. Anything
+else means tonight's scheduled run would fail, and it would fail at kickoff
+with nobody watching.
 
 Prints no secrets. Cookie values and tokens are reported by length only.
 """
@@ -103,7 +104,13 @@ def check_cookies(jar):
 
 
 def check_session(brfc):
-    """The real login test: does the site still mint a JWT off this cookie?"""
+    """The real login test: will the server hand back a JWT for this cookie?
+
+    It returns the session's existing token rather than minting a fresh one per
+    call, so the expiry printed below is the token's remaining life and not a
+    freshness signal. That does not weaken the check: a dead session answers
+    403, which is the thing we are looking for.
+    """
     cj = http.cookiejar.CookieJar()
     for c in brfc:
         cj.set_cookie(c)
@@ -135,7 +142,7 @@ def check_session(brfc):
     exp = claims.get("exp")
     when = (f", expires {datetime.fromtimestamp(exp, timezone.utc):%H:%M:%S}Z "
             f"({(exp - time.time()) / 60:+.0f} min)" if exp else "")
-    say(OK, f"session mints a JWT ({len(jwt)} chars{when})")
+    say(OK, f"session is live, server returned a JWT ({len(jwt)} chars{when})")
     return jwt