[timeleft--]

Change

GitHub's short traffic window currently has no scheduled archive in this repository. Add one daily/manual collector using the exact pinned actions already running in FAVA Trails, retaining daily views/clones by timestamp and dated referrer/path observations on the separate traffic branch. Same-day retries replace the observation; failed collection never publishes a zero sample. Document metric limits, credential scope, archive ownership and recovery. This public workflow collects only its own repository.

Validation

• actionlint 1.7.12 passes for the new workflow; Git diff whitespace and tracked LFS pointers pass.
• Required npm run check passes: types, 45 game tests, 16 Workers tests, 13 browser tests and dry-run Worker build (Node 26.12.1).
• Inspected the pinned collector's timestamp replacement and referrer behavior; its current FAVA workflow run 41074158942 succeeds.
• Live Captain API reads establish traffic access, but scheduled credential availability is unverified: no repository Actions secret is listed, and organization-secret enumeration is unavailable. After merge, manually dispatch and inspect the retained receipt; this PR does not claim operational collection. Missing TRAFFIC_TOKEN fails explicitly. No credential creation, permission expansion, SDK publication or service deployment.

The delivery coordinator will verify the landed revision and actual collection separately.

[yia-mw-agent]

Reviewed the full merge-base (6431e6a) to head diff against main: .github/workflows/traffic.yml and docs/repository-traffic.md, at c424548. No material defects.

Checked:

• Action pins match FAVA Trails' traffic workflow (checkout, traffic-to-badge v1.4.0, actions-gh-pages v4.0.0). I read the pinned collector's source. It clones the existing traffic branch into .traffic, replaces views/clones by timestamp, drops the current and oldest boundary days, and writes traffic_{views,clones,paths,referrers}.json under traffic-<repo>/. It fails on any API error, so the file names the retention step copies exist and a failed run publishes nothing. This matches the documented behavior.
• The credential guard fails explicitly when TRAFFIC_TOKEN is empty. The publish step uses only GITHUB_TOKEN, and the contents: write scope is limited to the job. The concurrency group serializes the writer.
• I ran the retention step against stub data, twice. The copy and same-date overwrite behave as documented. I could not run the jq receipt locally because jq is not installed here. The expression is simple and ubuntu-latest provides jq.
• Whitespace check is clean and the existing CI check passes. The change touches no application code, so I did not rerun the app suite. actionlint is not installed here; the author reports it passes.
• The docs match the code and are accurate about the limits. They state that referrers and paths are not additive and that uniques do not sum across days. They do not claim operational collection, which the PR says must be verified after merge.

Non-blocking:

• observed_at is read after collection, so a run crossing 00:00 UTC could file a receipt under the next date. The window is seconds and a missing or odd date is documented as missing evidence.
• No TRAFFIC_TOKEN secret is visible to me at the repository level (the org-level list is not enumerable). The first manual dispatch after merge decides whether collection works, as the PR already states.

Helmet-Review-Request: #6 (comment)