# Current market-data source integrity review

Use for independent reviews of current-day market-data recovery, one-shot valuation writers, source activation gates, and operator status projections.

## Read-only dry-run truth

- A live SQLite dry-run should use `mode=ro` plus `PRAGMA query_only=ON`.
- Do not default a live database to `immutable=1`: with WAL, SQLite may ignore committed rows still present only in the WAL. Reserve immutable mode for a frozen/checkpointed copy whose immutability is externally guaranteed.
- Deterministic probe: create a WAL database, checkpoint it, commit one later row into WAL, then compare `mode=ro` with `mode=ro&immutable=1`; the dry-run path must see the committed row and write nothing.

## Provider quote identity and units

Treat the dictionary key alone as insufficient provenance. Before valuing or persisting a quote, fail closed unless all dimensions match the request:

- returned provider/instrument ID equals the canonical requested ID;
- returned currency equals the requested/base currency;
- provider identity is allowlisted;
- price is positive and quality is accepted;
- provider timestamp exists, is not materially future-dated, and is within the freshness bound.

Counterprobe: return a quote under the requested dictionary key but with a different internal ID, currency, or provider. Expected result is blocked/partial with zero price and valuation writes.

## Activation gate concurrency

- Put the idempotency lookup inside the same `BEGIN IMMEDIATE`/write lock as audit creation.
- A pre-lock lookup followed by an unconditional insert is racy even if sequential tests pass.
- Probe two independent SQLite connections using the same confirmation ID. Exactly one activation audit may be created; one caller writes and the other returns truthful idempotent success.

## Source-isolation contract

A global scheduler gate is not proof that unrelated source writers remain inactive. Trace the exact worker list and every source-specific gate. If a release authorizes only one source, pre-existing activation records for other sources must not make their writers executable. The operator status projection and the actual worker-selection logic must derive from the same gate truth.

## Status-projection consistency

- Model global scheduler gate, source selection/activation, latest attempt, and latest success as separate axes. A source that is globally enabled, selected, and activated but has no run yet is `active/never_run` with a concrete first-run action—not `paused`. A source intentionally excluded from the dispatcher remains `paused` even when old successful rows exist.
- Add an explicit state-matrix regression for at least: globally disabled, source disabled, enabled+activated+never-run, latest complete, latest partial, and latest failed. Verify the visible label and next action, not only the raw status field.
- Do not combine `valued_assets` from the last successful run with `missing_assets` from the latest failed attempt under one unlabeled total.
- Bind price provenance to the exact run (run-linked rows or an exact capture identity), not merely a broad started/completed timestamp interval that unrelated refreshes can enter.
- Distinguish last-success values from latest-attempt diagnostics explicitly.
- Treat provenance as an all-or-nothing projection. For an expected price count `N`, require `COUNT(*) = COUNT(provider_timestamp) = COUNT(provider) = COUNT(price_currency) = N`, require homogeneous provider/currency (`MIN = MAX`), and require every row to be bound to that exact run. If any dimension is missing, mixed, or incomplete, suppress provider, currency, provider time, price age, and FX provenance together rather than showing plausible partial lineage.
- A direct base-currency batch may truthfully report `direct CHF quote; no FX run` only after that complete homogeneous proof. Do not infer “no FX needed” merely from the valuation currency.

Counterprobes: set one bound row's provider timestamp to `NULL`, mix one provider/currency, and add an unrelated price row inside the wall-clock interval. Each case must hide all provenance while preserving read-only status behavior.

## Canonical writer-to-reader identity

A successful valuation insert is not acceptance evidence until the real downstream readiness/performance reader consumes it. Trace the full identity tuple used by that reader: scope kind, scope/account ID, source, date, quality, version, activation role, and coverage. Then create the canonical activated account, run the current-day writer, and require the actual reader to recognize that day exactly once. A virtual aggregate scope with `account_id=NULL` does not satisfy an account-keyed reader without an explicit, tested bridge.

## Same-day replay and activation ordering

After one complete run, mutate one consumed input at a time—holding quantity, provider mapping, quote timestamp/price, or active asset state—and retry the same date. An early `existing complete for day` return is valid only after proving the stored fingerprint still matches current consumed inputs. Otherwise fail closed or append a corrected version with explicit supersession; do not silently report stale output as idempotent.

A robust no-provider replay proof uses a stable fingerprint over the current inventory plus the exact stored price batch bound to the original run. Under the same write lock, re-read inventory/mappings, reconstruct quote dimensions from those stored rows (canonical ID, currency, provider, provider timestamp, quality, and price), recompute the fingerprint, and compare it with the run's committed fingerprint. This catches local holding/mapping/price-row drift while preserving the requirement that an identical second invocation makes no network call. Exclude wall-clock-derived fields such as current quote age from this stable fingerprint.

For scheduler paths, check source activation before returning an existing manual run. Probe an unactivated source both with no prior run and after a successful manual one-shot. Both scheduled invocations must remain non-writing and truthfully `not_activated`.

## Acceptance-evidence boundary

Separate snapshot-bound code findings from missing runtime evidence: real read-only provider dry-run, aggregate candidate/mapping counts, installed timer `is-active`/`is-enabled` and effective environment, and all-table no-write sentinels. An environment-local dependency failure makes the observed gate non-green, but is not automatically a durable product defect without canonical-toolchain reproduction.

## Severity guidance

Treat stale live-DB reads, unvalidated quote identity/currency, non-idempotent activation audits, canonical writer/reader identity breaks, stale same-day replay, activation bypass through a prior manual run, or unauthorized cross-source execution as P1 release blockers. Treat mixed-run counters and loosely bound status provenance as P2 unless they feed a financial decision or automated writer.