# Shared financial read-model adversarial probes

Use this read-only verification recipe when two or more backend surfaces must derive the same cash value from an anchor plus imported and manual movements.

## Projection/deduplication counterexample

Build one isolated synthetic database containing:

- a confirmed CHF 100 cash anchor;
- an active linked budget account with one confirmed CHF 10 imported movement;
- the same imported movement represented in the canonical transaction ledger as CHF 10 with an import/CSV source;
- a distinct confirmed CHF 7 canonical manual adjustment.

Assert the exact value is **CHF 117**, not merely that two surfaces agree. Check every public/shared consumer independently:

1. effective cash evidence/read model;
2. modelled wealth bank component;
3. cash-position output.

The forbidden outcomes identify different bugs:

- CHF 110: the manual adjustment was suppressed with projected imports;
- CHF 120: the imported movement was double counted and the manual adjustment omitted;
- CHF 127: both the budget import and duplicate canonical import were counted.

The intended contract is: linked budget rows are authoritative for projected imported activity, while confirmed non-import canonical adjustments remain additive. Prefer one shared movement selector used by all surfaces over parallel source-filter implementations.

## Fail-closed date and provenance probes

Also insert and verify:

- malformed official and model observation dates with an `all` period: ignore invalid rows without crashing, while preserving valid evidence;
- a similarly named but unrelated provider source: reject it through an exact allowlist or narrowly versioned prefix, not a broad brand-name prefix;
- multiple bank accounts with different evidence ages: the aggregate source date must be the **oldest** contributing source date, because freshness is bounded by the stalest included component.

## Verification discipline

- Run these as an independent runtime probe in addition to regression tests; do not only inspect test names.
- Assert concrete values, dates, and source behavior.
- Then run the focused backend suite and retain its terminal `N passed` summary.
- Run lint with the repository-pinned version from its lock/requirements file. A newer ad-hoc linter may enable rules outside the release contract; version mismatch is not candidate evidence.
- Finish with compile/syntax checks, `git diff --check`, and a final status reread proving the read-only review did not alter the candidate.