C0 characterized Patreon's `/api/members` from a live capture of the
operator's own session. That capture is worth keeping — re-capturing means
re-authenticating by hand, and it is the ground truth the characterization
(Scribe note #3886) gets re-checked against when a platform's shape is
suspected to have drifted.
It cannot be committed. It carries the operator's creator list, pledge
amounts, and — inside the `card` resources the web app's include set pulls —
the account's own email address. So: a directory that is ignored wholesale
rather than by filename, so the next capture is covered by this rule instead
of needing a line somebody has to remember to add.
Two details that are the point rather than incidental:
* The ignore is written as `captures/*` plus a negation for README.md, NOT as
`captures/`. Git does not descend into an excluded DIRECTORY, so a negation
for a file inside one never takes effect — the README would have been
silently ignored along with everything else, and the convention would not
have survived a fresh clone.
* The README states plainly that SANITIZED fixtures belong in git, elsewhere
under tests/fixtures/. The raw capture exists to derive those from and to
re-check against; it is not the thing tests should load.
The ignore rule landed before the capture file did, deliberately: a payload
with an email address in it should never be sitting in the working tree
un-ignored, however briefly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNXXULQDjVZmbuNa2G9mD9
