[jm-rivera]

The client contract's file-selector fallback now asks dfo-apis only for the keys its selector reads. A default fetch records without_party_totals: true in its ref, and selector_path put the whole rendering into GET /datasets/{id}/{cv}/file, which dfo-apis refuses with 400 request_invalid (its selector reads format, bundle and layout). So a default-fetched ref whose file had expired or gone unlisted raised instead of rebuilding. The two scenarios for that path are synthetic and faked a 302 for the refused URL.

A new file-selector rule (rules/file-selector.json, query_keys: [format, bundle, layout], four vectors) names the keys once. The validator and the capture tool both build the selector query from it, and the two synthetic scenarios now request file?format=parquet&bundle=false, the URL dev answers with a 302 to the stored digest. The published SDK has the same fault in both languages; its fix follows in DevelopmentFinanceObservatory/sdk once this merges.

Other changes:

• The validator compares values by one rule (same_value): numbers by value, so 1 equals 1.0, booleans apart from numbers, NaN equal to NaN, lists and structs item by item. The reference reading_order in tests/test_rules.py uses the same rule, and the vector integer-and-float-are-one-value pins it.
• A ragged row, a column mixing JSON types, or a list or struct column is reported as a problem rather than a traceback.
• Posted renderings are kept per spec as a list, so a scenario that builds one spec under two renderings checks each ref against the right build.
• The base-URL rule refuses %2e dot segments, backslashes and ports outside 1 to 65535, with ten vectors checked against WHATWG URL. The client-identity rule labels a non-browser runtime such as Cloudflare Workers other.
• A mint step can state party_totals, and mint-async-build states the option it was recorded with.
• The capture tool loads its rules before any live call and starts each long-build year scan after the year its record holds. The rules README says a choice names its option by index when two entity_choice groups offer the same labels (choose-refused-label-in-two-groups).
• CONTRIBUTING.md and tools/README.md name pyarrow, and the spec-kit changelog says the registry records frame_unavailable on presentation.write at 404 only, while dfo-apis also serves it at 503 for an artifact read failure.

Testing: uv run tools/validate_client_contract.py passes; the tools tests (574) and the six package suites pass.