feat: advance data provider and accounting completion

docs/product/data-provider-accounting-brainstorm-2026-07.md

@@ -20,24 +20,27 @@
 
 ---
 
-## Status Update (2026-07-13)
+## Status Update (2026-07-15)
 
-The `codex/data-provider-accounting-completion` branch completed ideas #1–#5 during the 2026-07-13
-implementation pass. The narratives below are preserved as the point-in-time analysis of
-2026-07-05, with dated update notes where the premise has changed. Current branch status:
+The `codex/data-provider-accounting-completion` branch completed the first implementation pass for
+ideas #1–#6 and #8–#10 by 2026-07-15. The narratives below are preserved as the point-in-time
+analysis of 2026-07-05, with dated update notes where the premise has changed. Independent
+correctness, durability, and tenant-isolation audits then tightened the completion criteria. The
+status table distinguishes source-complete work from final focused and aggregate validation; idea
+#7 remains open after its audit found additional server-owned evidence and scope work.
 
 | # | Idea | Status | What remains |
 |---|------|--------|--------------|
-| 1 | Streaming unification + honest status | Done (2026-07-13) | A shared `ProviderConnectionSupervisor` now owns complete connection transactions for WebSocket and polling lanes; NYSE/IB subscription replay and polling recovery are implemented, and runtime health routes return `unknown`/`unavailable` when diagnostics do not exist. Focused proof: the supervisor harness passed 5/5, and both the default and IBAPI smoke-stub Infrastructure builds passed. Added NYSE/IB replay/rate and endpoint-honesty tests await execution after shared contention; aggregate CI has not run. |
-| 2 | Canonical symbol spine | Done (2026-07-13) | Registry identity is `SecurityId`-aware with provider-scoped aliases; `Legacy`/`Compare`/`Canonical` modes, idempotent migration receipts, mismatch diagnostics, and the browser registry surface are implemented. Focused proof: browser registry tests passed 5/5; Contracts, Storage, and Application builds plus contract-impact, generated-route, and schema checks passed. Added .NET endpoint/collision tests await a serialized rerun; aggregate CI has not run. |
-| 3 | Unified data quality + browser dashboard | Done (2026-07-13) | `CompositeDataQualityReadService` combines stored completeness, streaming freshness, and adapter gap integrity, issues stable opaque gap IDs, and resolves exact provider/range remediation through `AutoGapRemediationService`; browser and WPF consume the shared contract. Focused proof: browser quality tests passed 18/18 and the Application, Ui.Shared, and Ui.Services builds passed. Aggregate CI has not run. |
-| 4 | Backfill feedback loop | Done (2026-07-13) | Live progress carries range, provider, fallback attempt, and retry through typed contracts to browser and WPF; bounded execution history durably retains typed SLA/remediation evidence. Focused proof: browser view-model tests passed 39/39, rendered screen tests passed 26/26, the Contracts build passed, and the WPF XAML parsed. New durable-history/.NET/WPF tests await execution after shared MSBuild contention; aggregate CI has not run. |
-| 5 | Failure & rate-limit hardening | Done (2026-07-13) | The catalog exposes immutable, sanitized registration failures; historical and streaming rate diagnostics use coherent lock-guarded snapshots, and NYSE maps HTTP 429 to typed `RateLimitException`. Browser and WPF show current usage, reset, failure, and retry posture while stating that history is unavailable. Focused ProviderSdk/Infrastructure builds and 24 browser tests passed; added .NET/WPF filters await a serialized rerun. Aggregate CI has not run. |
-| 6 | Mark-to-market wiring | Done (2026-07-13) | Trusted historical-provider close marks retain observed-date and confidence evidence and must pass staleness and coverage gates. Persisted, explicitly scoped daily-valuation schedules run through the due-run host into governed workbench drafts for human approval and durable posting; restart hydration feeds marked statements and NAV, the close cockpit exposes a "Daily valuation" lane, and NAV already computes assets − liabilities. Focused `Meridian.Application` and `Meridian.FinancialOperations` builds passed (the latter with one existing analyzer warning), along with generated-route, static, and diff checks. Added scheduler/E2E, cockpit, and stale/low-confidence tests await execution; `Meridian.Ui.Shared` reached the new code before two sibling `BackfillCoordinator` ambiguities stopped its build. Aggregate CI has not run. |
-| 7 | Automated journal drafts | Done (2026-07-06) | Corporate-action/dividend producers, management/performance-fee accrual (`FeeScheduleAccrualEventProducer` + `RunFeeAccrualIntakeAsync` + endpoint), and dividend withholding-tax accrual (`WithholdingTaxRate` on the dividend intake lane) all land governed drafts in the workbench queue. Operator/cockpit-triggered; recurring scheduling remains optional follow-on. |
-| 8 | Closing entries + retained-earnings roll | Done (2026-07-06) | `AutomatedJournalIntakeRunner.RunPeriodCloseIntakeAsync` projects closing entries from a closed period's trial balance and lands the governed draft in the workbench queue via `/api/ledger/journal-automation/period-close-intake`; open periods are rejected loudly. |
-| 9 | One ledger spine | Done (2026-07-08) | `DurableAutomatedJournalPoster` posts approved drafts through `ILedgerJournalStore`; `LedgerJournalStoreHydrationExtensions` hydrates as-of and book/period projections from the durable journal store; `Ledger` keeps balance/posting snapshots for point-in-time reads; tests cover hydration, durable-first posting, as-of snapshots, and the F#/C# enum-ordinal contract. |
-| 10 | Fill-to-ledger durability | Done | `LedgerPostingConsumer.Publish` now blocks on channel capacity (`WaitToWriteAsync` loop) instead of dropping fills, with a regression test covering the full-channel case. |
+| 1 | Streaming unification + honest status | Implementation complete; validation pending | Provider diagnostics now live at the ProviderSdk contract boundary; NYSE, Robinhood polling, live IB, and direct IB simulation paths report supervised state honestly. Subscription replay, bounded heartbeat teardown, explicit caller cancellation, and `unknown`/`unavailable` endpoint behavior have focused tests. `Meridian.ProviderSdk` builds with zero errors; the Infrastructure variants and focused tests still need the serialized validation pass. |
+| 2 | Canonical symbol spine | Implementation complete; validation pending | `SecurityId`-aware provider aliases, comparison/canonical modes, production backfill resolver composition, and atomic persisted migration markers are implemented. Tests cover worker translation, inline/external migration inputs, restart no-op, changed fingerprints, malformed data, cancellation, and reload. Focused builds/tests and aggregate CI remain. |
+| 3 | Unified data quality + browser dashboard | Implementation complete; validation pending | Shared stored/streaming/adapter scoring, stable gap identity, exact remediation requests, WPF dependency injection, and a rendered browser Data Quality region are implemented. The browser shows partial/unavailable evidence and accessible disabled-action reasons. Focused browser/.NET/WPF execution and aggregate CI remain. |
+| 4 | Backfill feedback loop | Implementation complete; validation pending | Typed progress and retained execution/SLA history flow through shared contracts to browser and WPF. Completed backfills refresh history after final progress with stale-response protection, and the shared API client reads the typed history envelope. Focused browser/.NET/WPF execution and aggregate CI remain. |
+| 5 | Failure & rate-limit hardening | Implementation complete; validation pending | Provider catalog failures remain immutable/sanitized; recursive aggregate classification preserves provider attribution and `Retry-After`. Alpha Vantage symbol and corporate-action paths map HTTP 429 and quota payloads to typed rate-limit failures without message-text heuristics. Focused tests and aggregate CI remain. |
+| 6 | Mark-to-market wiring | Implementation complete; validation pending | Daily delta carrying values, per-security lineage, fresh tenant-owned position snapshots, Security Master/currency gates, all-member batch lifecycle, isolated same-day corrections, current-run status precedence, and browser configure/run/approve/retry actions are implemented. A two-security correction/restart scenario was added; its focused execution and aggregate CI remain. Legacy unowned snapshots now fail closed and require ownership backfill. |
+| 7 | Automated journal drafts | In progress (completion audit) | Recurring schedules, durable restart/CAS/rearm behavior, exact corporate-action currency, immutable draft identity, and evidence policy are present. The latest audit still requires four corrections before completion: prevent rearmed work from inheriting stale posted readiness; resolve capital-account reconciliation from a server-owned source rather than client assertions; send exact tenant/company/fund/book/entity WPF scope; and evaluate delayed-run evidence at the actual execution/review time. |
+| 8 | Closing entries + retained-earnings roll | Implementation complete; validation pending | Prepare-only queueing and hard lock are distinct in browser/WPF and server contracts. The backend now performs JIT readiness/version checks, atomic correction-pair persistence, durable reopen intent and exact retry convergence, source-linked SoftClosed reversal, strict tenant/company ownership, and a transactional Postgres temporary-balance guard plus period CAS/close event. Focused tests and aggregate CI remain. |
+| 9 | One ledger spine | Implementation complete; validation pending | In-memory as-of indexes now preserve chronological out-of-order/dimensional reads. Durable posting detects global journal/command collisions, aggregate-scoped source/idempotency collisions, validates book context, and compares a canonical full-command fingerprint before treating crash retries as equivalent. `Meridian.Ledger` builds with zero errors; focused Storage/Ledger tests and aggregate CI remain. |
+| 10 | Fill-to-ledger durability | Implementation complete; validation pending | Accepted fills are synchronously retained in an execution-owned WAL, acknowledged only after idempotent ledger posting, and replayed after restart. Forced shutdown and per-fill failures retain pending work; OMS fill side effects are resumable, use bounded `WriteAsync`, and expose explicit caller-scoped composition without inventing a global ledger. Focused Execution tests and aggregate CI remain. |
 
 ## The Two Headline Findings
 
@@ -326,6 +329,15 @@ idea 9.
 > compiled the new scheduler, DI, and cockpit code before stopping on two unrelated sibling
 > `BackfillCoordinator` ambiguities. Aggregate CI has not run.
 
+> **Completion-audit correction (2026-07-15):** the 2026-07-13 foundation did not yet prove a
+> postable, non-compounding multi-security batch. The audit reopened this item after finding that
+> full cumulative unrealized P&L could be posted again on a later day, aggregate drafts lacked the
+> single-security lineage required by the posting guard, configured position lists could become
+> stale, and an older posted draft could mask a blocked current run. The status table above tracks
+> the delta-carrying, position-freshness, Security Master, batch/correction, tenant-isolation, and
+> cockpit-precedence work now in progress; this section must not be read as complete until those
+> paths pass their focused end-to-end tests.
+
 ### 7. Automated Journal Drafts in the Close Cockpit
 
 `AutomatedJournalDraftProjector` + `AutomatedJournalApproval` model exactly the postings the live