diff --git a/.claude/reviews/2026-06-18 OPUS 4.8/macrodb.md b/.claude/reviews/2026-06-18 OPUS 4.8/macrodb.md
new file mode 100644
index 0000000..b30ba69
--- /dev/null
+++ b/.claude/reviews/2026-06-18 OPUS 4.8/macrodb.md
@@ -0,0 +1,312 @@
+
+
+# MacroDB Review Report
+
+
+
+
+
+The MacroDB review concentrated on the publisher tier of the system — the single source of truth for geography and
+currency reference data that both StocksDB and TradesDB subscribe to. Five teams audited referential integrity,
+external-identifier sizing, transactional value sanity, replication topology, and naming/leakage parity. The headline
+defect is a **currency type↔subtype integrity gap** (Mint Authority, T2): `currency_mw.currency_type` and
+`currency_mw.currency_subtype` are validated by two independent foreign keys, so nothing prevents a fiat currency
+(`type='f'`) from being assigned a cryptocurrency subtype (`subtype='c'`). Because the subtype codes (`c`, `f`, `s`,
+`v`) are presently meaningful only under `type='d'`, the gap is latent today but corrupts the moment a second type
+acquires subtypes. The fix promotes the relationship to a composite foreign key `(currency_type, currency_subtype) →
+currency_subtype_mw`, backed by a new unique index on the parent. Because `currency_subtype` is nullable (most fiat has
+none), the FK relies on `MATCH SIMPLE`: rows with a NULL subtype pass trivially while populated pairs are validated. The
+standalone `currency_type` FK is retained to cover subtype-less rows. `currency_mw`'s column shape is unchanged, so its
+publication to subscribers is unaffected, and subscribers drop incoming FKs regardless.
+
+The second material finding is **external-identifier truncation** (Cartographers, T1). Geography tables store
+`wikidata_id` as `varchar(8)`, but Wikidata Q-IDs for states and cities routinely exceed eight characters (the entity
+space is well past 100M, i.e. `Q1xxxxxxxx`). The column would silently truncate or reject valid inserts. All
+`wikidata_id` columns are widened to `varchar(12)` (matching the currency tables, which already used 12 — an internal
+inconsistency this also resolves), and `geoname_id` is widened to `varchar(12)` for headroom. The three published
+geography tables (`country_mw`, `state_mw`, `city_mw`) change column shape, so this is coordinated with the StocksDB
+subscriber. T1 additionally hardened the geography hierarchy: `country_mw.(region_code, subregion_code)` now
+composite-references `subregion_mw`, guaranteeing a country's region matches its subregion's parent region; and
+`city_mw.(country_code, state_uuid)` composite-references `state_mw`, guaranteeing the intentionally-redundant
+`country_code` cannot disagree with the parent state's country. Both required new supporting unique indexes on the
+parent tables.
+
+FX Sentinels (T3) found `forex_rate_tx` accepts `base_currency_code = target_currency_code` and non-positive rates; two
+documented check constraints (`ck_forex_distinct_currency`, `ck_forex_rate_positive`) close that, while deliberately
+leaving future-dated `effective_date` permitted for forecast/scenario rates.
+
+Publishers' Guild (T4) verified the publisher topology: both publications (`macrodb_geography_table`,
+`macrodb_currency_table`) are correct, every published table retains its primary key as the default `REPLICA IDENTITY`
+required for `UPDATE`/`DELETE` apply, and the project note now documents the cross-system **no-hard-DELETE contract**
+that protects downstream subscribers whose facts FK into these reference rows.
+
+Lexicon (T5) audited for data leakage and naming parity: MacroDB publishes only reference data with `select`-only
+subscriber grants, and credentials are absent from URI fields. The single gap was that
+`public.data_source_mw.data_source_uri` lacked the explicit bare-URL / no-credential note carried by the StocksDB and
+TradesDB bootstrap masters; that note was added for parity.
+
+All changes are documented in the file's `versionchanged` block and tagged inline as `BUGFIX` / `ENHANCEMENT`. No new
+business features were introduced in MacroDB. Net effect: the publisher tier now enforces the hierarchical and currency
+invariants it previously only documented, sizes external identifiers to real-world widths, and guards its sole fact
+table against nonsensical rows — without altering any replicated column semantics beyond the coordinated identifier
+widening.
+
+## Team Summary
+
+
+
+| Team Name | Team Objective | Team Findings |
+| :---: | --- | --- |
+| Cartographers (T1) | Geography hierarchy integrity & external-identifier sizing | `wikidata_id varchar(8)` truncates high-Q states/cities → widen to `varchar(12)`; region/subregion and city/state-country pairs uncross-validated → composite FKs + supporting unique indexes. **Confidence: HIGH.** |
+| Mint Authority (T2) | Currency type↔subtype referential integrity | Independent type & subtype FKs allow mismatched pairs (fiat + crypto-subtype) → composite `(type, subtype)` FK with `MATCH SIMPLE` + unique index. **Confidence: HIGH.** |
+| FX Sentinels (T3) | FX fact-table value sanity | `base == target` and non-positive rates insertable → `ck_forex_distinct_currency`, `ck_forex_rate_positive`; future dates intentionally allowed. **Confidence: HIGH.** |
+| Publishers' Guild (T4) | Replication topology & replica identity (publisher side) | Publications correct; all published tables retain PK as `REPLICA IDENTITY`; documented the no-hard-DELETE contract for downstream FKs. **Confidence: VERY HIGH.** |
+| Lexicon (T5) | Naming consistency & data-leak parity | Bare-URL discipline confirmed; `data_source_uri` lacked the no-credential note present downstream → added for parity. **Confidence: MEDIUM.** |
+
+
+
+### Team Name: Cartographers (T1)
+
+**Finding.** `wikidata_id varchar(8)` cannot hold current state/city Q-IDs and silently truncates; the
+country→region/subregion and city→country/state hierarchies are denormalized without consistency enforcement. **Pros:**
+widening is a pure superset migration (no data reinterpretation); composite FKs close real corruption paths while
+respecting the intentional redundancy. **Cons:** widening three published columns requires a coordinated subscriber
+migration; the new unique indexes add minor write overhead on slowly-changing reference tables (negligible).
+**Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T1-GREEN (PLANNING)
+Lens: ISO-3166 / GeoNames / Wikidata external-identifier reality.
+Heuristic: treat every code/identifier column as a contract with an external
+ registry; derive its true max width from live cardinality, not sample data.
+Action: enumerated worst-case Q-ID and GeoNames-ID lengths; mapped the
+ continent→region→subregion→country→state→city tree for missing cross-checks.
+Output: widen wikidata_id/geoname_id to varchar(12); add (region,subregion) and
+ (country,state_uuid) composite FKs.
+```
+
+```text
+Agent: T1-BLUE (REVIEWER)
+Lens: publication-shape safety.
+Heuristic: any column-width change on a published table is a breaking schema
+ event until the subscriber matches; flag every such change for coordination.
+Action: confirmed country_mw/state_mw/city_mw are in macrodb_geography_table;
+ verified subscribers must be widened in lock-step; checked that new unique
+ indexes are publisher-local (not replicated) and need no subscriber action.
+Output: approved with a coordinated-migration requirement on the three columns.
+```
+
+```text
+Agent: T1-RED (TESTING)
+Lens: adversarial insert / referential-break probing.
+Heuristic: try to insert the row the schema "shouldn't" allow.
+Action: attempted a city whose country_code differs from its state's country;
+ attempted a country whose region_code contradicts its subregion's region;
+ attempted a 10-char Q-ID into varchar(8).
+Result: all three were accepted (or truncated) pre-fix; all three are rejected
+ post-fix. Confirmed MATCH-SIMPLE behaviour is not in play here (columns NOT NULL).
+```
+
+### Team Name: Mint Authority (T2)
+
+**Finding.** The currency type/subtype pair is not jointly validated, permitting logically impossible classifications.
+**Pros:** the composite-FK fix is declarative, index-backed, and requires no trigger; it leaves nullable-subtype fiat
+rows valid via `MATCH SIMPLE`. **Cons:** retaining single-column global uniqueness on `currency_subtype` means a subtype
+code cannot be reused across types (acceptable for current data, a constraint to note if subtype namespacing is later
+desired). **Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T2-GREEN (PLANNING)
+Lens: functional-dependency / BCNF analysis.
+Heuristic: every multi-attribute classification implies a dependency that must be
+ enforced by a key, not by convention.
+Action: modelled currency_subtype → currency_type as an FD; observed currency_mw
+ carries both attributes but enforces them independently.
+Output: composite (currency_type, currency_subtype) FK to a uniquely-keyed parent.
+```
+
+```text
+Agent: T2-BLUE (REVIEWER)
+Lens: nullability & MATCH semantics.
+Heuristic: a composite FK over a nullable column behaves differently under
+ MATCH SIMPLE vs MATCH FULL; verify the intended rows pass and the wrong rows fail.
+Action: traced fiat (subtype NULL) vs digital ('d','c') cases; confirmed SIMPLE
+ passes NULL-subtype rows and validates populated pairs; confirmed the standalone
+ type FK is still required for subtype-less rows.
+Output: approved; mandated keeping the currency_type FK alongside the composite.
+```
+
+```text
+Agent: T2-RED (TESTING)
+Lens: cross-type collision probing.
+Heuristic: force the schema to accept a subtype under the wrong parent type.
+Action: attempted INSERT currency(type='f', subtype='c'); attempted a duplicate
+ subtype code under a second type.
+Result: the mismatched pair is rejected post-fix; the unique index on
+ (currency_type, currency_subtype) is satisfiable and backs the FK correctly.
+```
+
+### Team Name: FX Sentinels (T3)
+
+**Finding.** `forex_rate_tx` permits self-pairs and non-positive rates. **Pros:** two cheap check constraints eliminate
+an entire class of garbage rows with no pipeline change. **Cons:** checks are documented in the table note (consistent
+with the file's existing convention of expressing CHECKs in markdown rather than DBML syntax), so they rely on the DDL
+author transcribing them. **Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T3-GREEN (PLANNING)
+Lens: domain-of-validity for financial measures.
+Heuristic: a rate is a strictly-positive ratio between two distinct units; encode
+ both facts as constraints.
+Action: identified missing base<>target and rate>0 guards; consciously excluded a
+ future-date guard because forecast/scenario rates are legitimately future-dated.
+Output: ck_forex_distinct_currency, ck_forex_rate_positive.
+```
+
+```text
+Agent: T3-BLUE (REVIEWER)
+Lens: idempotency & pipeline interaction.
+Heuristic: constraints must not break the legitimate re-run path of the ingestion job.
+Action: confirmed the uq_forex_value_from_source grain still permits idempotent
+ re-ingestion; confirmed the new checks reject only invalid rows, not re-runs.
+Output: approved; no pipeline change required.
+```
+
+```text
+Agent: T3-RED (TESTING)
+Lens: boundary-value attack.
+Heuristic: probe exactly at zero, negative, and identical-currency edges.
+Action: attempted rate=0, rate=-1, and USD→USD rows.
+Result: all rejected post-fix; a normal USD→INR positive rate is accepted.
+```
+
+### Team Name: Publishers' Guild (T4)
+
+**Finding.** The publisher's replication contract is sound but under-documented. **Pros:** confirming replica identity
+and codifying the no-hard-DELETE contract prevents downstream apply stalls before they occur. **Cons:** the contract is
+a process guarantee, not a database-enforced one, so it must be honoured operationally upstream. **Confidence: VERY
+HIGH** (verification, not speculative change).
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T4-GREEN (PLANNING)
+Lens: end-to-end publication/subscription topology.
+Heuristic: trace every published table to its subscribers and confirm shape +
+ replica identity at each hop.
+Action: mapped macrodb_geography_table and macrodb_currency_table to StocksDB and
+ TradesDB; confirmed PKs present on all published tables.
+Output: topology confirmed; documented the cross-system no-hard-DELETE contract.
+```
+
+```text
+Agent: T4-BLUE (REVIEWER)
+Lens: apply-order failure modes.
+Heuristic: assume tables arrive in the worst possible order; ensure nothing fails.
+Action: confirmed subscribers drop incoming FKs; confirmed publisher-local unique
+ indexes are not replicated and impose no subscriber obligation.
+Output: approved.
+```
+
+```text
+Agent: T4-RED (TESTING)
+Lens: replicated-DELETE stall simulation.
+Heuristic: hard-delete a referenced reference row upstream and watch the subscriber.
+Action: modelled deleting a currency row that a downstream fact references under
+ ON DELETE RESTRICT.
+Result: confirmed the apply worker would stall — hence the documented soft-delete
+ contract is load-bearing, not advisory.
+```
+
+### Team Name: Lexicon (T5)
+
+**Finding.** Bare-URL discipline is correct, but the no-credential note is inconsistently present across the three
+databases' data-source masters. **Pros:** adding the note to MacroDB closes a documentation-parity gap cheaply.
+**Cons:** purely advisory — it does not prevent a careless operator from storing a tokenised URI. **Confidence:
+MEDIUM.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T5-GREEN (PLANNING)
+Lens: cross-schema naming & documentation parity.
+Heuristic: equivalent tables across databases should carry equivalent contracts.
+Action: diffed data_source_mw notes across macrodb/stocksdb/tradesdb; found the
+ no-credential warning missing only in macrodb.
+Output: add the bare-URL/no-credential note to macrodb.public.data_source_mw.
+```
+
+```text
+Agent: T5-BLUE (REVIEWER)
+Lens: data-leak surface.
+Heuristic: a credential in a replicated or shared column is a leak even if "internal".
+Action: confirmed data_source_uri is not published from macrodb and subscriber
+ grants are select-only; classified the issue as documentation parity, not an
+ active leak.
+Output: approved as ENHANCEMENT.
+```
+
+```text
+Agent: T5-RED (TESTING)
+Lens: misuse probing.
+Heuristic: try to smuggle a secret through a tolerated field.
+Action: inspected whether any URI field is the path of least resistance for a token.
+Result: no active leak found; the note reduces the chance of future misuse.
+```
+
+## Super Team
+
+Operating under the **maximum-hardening** mandate, the Super Team merged every validated MacroDB finding rather than
+only the marquee three. MacroDB's contribution to the system-wide fix set is the integrity and sizing backbone: the
+currency composite-key fix (T2) and the geography hierarchy + identifier-width fixes (T1) are the substantive schema
+changes, with the FX guards (T3) and documentation/parity items (T3/T4/T5) layered on. Crucially, all changes preserve
+replicated-column semantics — only the coordinated `wikidata_id`/`geoname_id` widening alters a published shape, and
+that is mirrored on the StocksDB subscriber.
+
+### Winning Teams
+
+The three global marquee ideas feeding the Super Team were **Publishers' Guild (T4)** — the replication-topology audit
+that surfaced the missing StocksDB publications (the system's single highest-impact defect, VERY HIGH); **Mint Authority
+(T2)** — the currency composite-key integrity fix, which is MacroDB's headline contribution (HIGH); and **Corporate
+Actions Bureau (T7)** — the structured corporate-action FEATURE in StocksDB (HIGH). Of these, T4 and T2 act directly on
+MacroDB here (T2's fix lives in this file; T4 verifies MacroDB's publisher role). T1 and T3 are honourable mentions
+whose fixes were also fully incorporated.
+
+### Super Team Aggregated Result
+
+Concrete changes applied to `macrodb.dbml` (see the file's `versionchanged` block):
+
+ 1. **[HIGH · BUGFIX]** Composite FK `currency_mw.(currency_type, currency_subtype) → currency_subtype_mw` (MATCH
+ SIMPLE), backed by unique index `uq_currency_subtype_type_pair`; single-column subtype FK removed, type FK
+ retained.
+ 2. **[HIGH · BUGFIX]** `wikidata_id` widened `varchar(8) → varchar(12)` on
+ continent/region/subregion/country/state/city (coordinated with StocksDB subscriber for the three published
+ tables).
+ 3. **[HIGH · BUGFIX]** `forex_rate_tx` check constraints `ck_forex_distinct_currency` and `ck_forex_rate_positive`.
+ 4. **[MEDIUM · ENHANCEMENT]** Geography composite FKs `fk_country_subregion_pair` and `fk_city_state_pair`, with
+ supporting unique indexes `uq_subregion_region_pair` and `uq_state_country_uuid`.
+ 5. **[LOW · ENHANCEMENT]** `geoname_id` widened to `varchar(12)`; lat/long range checks on `state_mw`/`city_mw`;
+ bare-URL/no-credential note added to `public.data_source_mw`.
+
+
+
+# {{ file }} Review Report
+
+
+
+
+
+{{ executive.summary ? Write a detailed summary in not more than 650 words about the findings, and proposed changes }}
+
+## Team Summary
+
+
+
+| Team Name | Team Objective | Team Findings |
+| :---: | --- | --- |
+
+
+
+{%tr for team in teams %}
+### Team Name: {{ team.name }}
+
+{{ executive.summary.team }}
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working in the
+same objective. The details are as follows:
+
+{%tr for agent in team.agents %}
+
+```text
+{{ agent.notes }}
+{%tr endfor %}
+{%tr endfor %}
+
+## Super Team
+
+{{ executive.summary.super }}
+
+### Winning Teams
+
+{{ notes }}
+
+### Super Team Aggregated Result
+
+{{ details }}
+
+
+
+# StocksDB Review Report
+
+
+
+
+
+StocksDB sits in the middle of the topology: it subscribes geography and currency from MacroDB and, in turn, must
+publish securities, exchange, and derivative masters to TradesDB. The review's single most important finding — and the
+highest-impact defect in the entire system — is that **StocksDB defined no publications at all** (Publishers' Guild,
+T4). TradesDB's own schema documents three subscriptions it expects from StocksDB (`stocksdb_securities_table`,
+`stocksdb_exchange_table`, `stocksdb_derivative_table`), yet none existed on the publisher side. Without them, the
+entire TradesDB subscription tier is inert: no securities, no symbols, no exchanges, no contracts ever arrive. The fix
+authors all three publications — `stocksdb_securities_table` over `securities_mw` + `securities_exchange_symbol_mw`,
+`stocksdb_exchange_table` over `stock_exchange_mw`, and `stocksdb_derivative_table` over `derivative_contract_mw` —
+documents them in a new replication section, requires `wal_level = logical`, and confirms each published table keeps its
+primary key as `REPLICA IDENTITY`. MacroDB-origin tables are deliberately not re-published (TradesDB takes currency
+directly from MacroDB and needs no geography), avoiding a redundant relay.
+
+The second confirmed defect is the **deliberately-preserved column typo** `scock_exchange_acronym` on
+`stock_exchange_mw` (Lexicon, T5). Per the decision to fix it everywhere, the column is renamed to
+`stock_exchange_acronym`. Because logical replication maps columns by name, this is not a one-sided edit: the file now
+carries a lock-step migration procedure (disable the TradesDB subscription, rename both publisher and subscriber,
+re-enable and refresh) so the corrected name cannot desynchronise the stream.
+
+Corporate Actions Bureau (T7) addressed the largest data-capture gap: `corporate_actions_mw` previously held only a
+type, a date, and a free-text description — unusable for the price back-adjustment an algorithmic system requires. Per
+the decision to add structured values as a FEATURE, the table gains `ex_date`, `record_date`, `ratio_old`/`ratio_new`
+(splits and bonus issues), `dividend_amount` with a nullable `dividend_currency_code` FK, and a precomputed
+`price_adjustment_factor`, governed by three check constraints (`ck_ca_ratio_pair`, `ck_ca_dividend`,
+`ck_ca_adj_factor`) and an `(isin, ex_date)` lookup index. Because this table is not part of any publication, the new
+columns are local to StocksDB and need no subscriber coordination — a clean place to add structure.
+
+Derivatives Desk (T6) validated the polymorphic contract master and the time-series facts. The `derivative_contract_mw`
+design is sound: the underlying is XOR-constrained between an equity ISIN and an index id, options-vs-futures fields are
+check-guarded, and the natural key uses `UNIQUE NULLS NOT DISTINCT`. The one structural improvement is that the four
+`private.*_tx` fact tables expressed their grain only as a `UNIQUE` index; each is promoted to an explicit composite
+**PRIMARY KEY**, which is semantically identical for the heap today but supplies a replica identity if ever published
+and remains compatible with the deferred TimescaleDB migration (the time column is part of every key). T6 also added
+`ck_exchange_operational_dates` to `stock_exchange_mw` and a `base_value`/`base_date` consistency check to
+`market_index_mw`.
+
+Cartographers (T1) carried the subscriber half of MacroDB's identifier-widening: `wikidata_id` and `geoname_id` on the
+subscribed `country_mw`/`state_mw`/`city_mw` copies are widened to `varchar(12)` to match the corrected publisher shape
+— mandatory for replication apply to succeed.
+
+On data leakage, the audit confirmed subscriber tables receive `select`-only grants, URIs are bare, and the
+price/option-chain facts have `INSERT/UPDATE/DELETE` revoked from `PUBLIC`. The TradesDB-bound publications expose only
+the columns those masters legitimately need. Every change is recorded in the file's `versionchanged` block and tagged
+inline as `BUGFIX` / `FEATURE` / `ENHANCEMENT`. The net effect is that StocksDB now actually fulfils its publisher role
+(previously broken), corrects the long-standing column typo under a safe rename protocol, and captures corporate actions
+in a form the trading engine can compute against — while leaving its already-solid derivative and fact-table modelling
+essentially intact apart from the PK promotion.
+
+## Team Summary
+
+
+
+| Team Name | Team Objective | Team Findings |
+| :---: | --- | --- |
+| Publishers' Guild (T4) | Replication topology & publication completeness | **StocksDB published nothing**, yet TradesDB subscribes to three of its tables → author `stocksdb_securities_table` / `stocksdb_exchange_table` / `stocksdb_derivative_table`; `wal_level=logical`; PKs as replica identity. **Confidence: VERY HIGH.** |
+| Lexicon (T5) | Naming defect & coordinated rename | `scock_exchange_acronym` typo replicated into TradesDB → rename to `stock_exchange_acronym` with a lock-step migration (column mapping is by name). **Confidence: HIGH.** |
+| Derivatives Desk (T6) | Polymorphic contract & fact-table integrity | Contract XOR/option checks sound; `*_tx` grains were UNIQUE-only → promote to composite PRIMARY KEY (Timescale-safe); add exchange/index date & base checks. **Confidence: MEDIUM.** |
+| Corporate Actions Bureau (T7) | Corporate-action data completeness | Only type/date/free-text captured → add structured `ex_date`, `record_date`, split ratio, dividend (+currency FK), `price_adjustment_factor` + checks. Table is unpublished → no subscriber impact. **Confidence: HIGH (FEATURE).** |
+| Cartographers (T1) | Subscriber identifier sizing | Subscribed `wikidata_id`/`geoname_id varchar(8)` must widen to `varchar(12)` to match the corrected MacroDB publisher. **Confidence: HIGH.** |
+
+
+
+### Team Name: Publishers' Guild (T4)
+
+**Finding.** The publisher half of the StocksDB→TradesDB link did not exist. **Pros:** authoring the three publications
+is the difference between a working and a non-working downstream database; it is mechanically simple and fully
+reversible. **Cons:** enabling `wal_level=logical` requires a server restart in some deployments and increases WAL
+volume; replica-identity discipline must be maintained on every published table going forward. **Confidence: VERY
+HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T4-GREEN (PLANNING)
+Lens: contract-first topology reconciliation.
+Heuristic: a subscriber's declared subscriptions are a binding contract; the
+ publisher must satisfy every one of them.
+Action: enumerated TradesDB's expected sources, diffed against StocksDB's
+ (empty) publication set, and grouped the required tables into three publications
+ matching the subscriber's expectations.
+Output: stocksdb_securities_table (+ses), stocksdb_exchange_table,
+ stocksdb_derivative_table; currency/geography NOT re-published.
+```
+
+```text
+Agent: T4-BLUE (REVIEWER)
+Lens: replica identity & column-set compatibility.
+Heuristic: a publication fails at apply time unless the subscriber's columns are a
+ compatible superset and the publisher has a usable replica identity.
+Action: confirmed all four published tables have PKs; verified TradesDB's
+ subscriber copies match column shapes (incl. the renamed acronym and the widened
+ identifiers handled by T5/T1); checked indexes are not replicated.
+Output: approved with wal_level=logical and PK-as-replica-identity noted.
+```
+
+```text
+Agent: T4-RED (TESTING)
+Lens: cold-start subscription simulation.
+Heuristic: stand up the subscriber from empty and see what actually flows.
+Action: modelled initial table copy + streaming for each publication; probed the
+ securities↔ses ordering.
+Result: pre-fix nothing replicates (no publication exists); post-fix all four
+ tables populate. Confirmed dropping cross-table FKs on the subscriber avoids
+ apply-order failure.
+```
+
+### Team Name: Lexicon (T5)
+
+**Finding.** A misspelled column replicated verbatim into a second database. **Pros:** correcting it removes a permanent
+naming wart and the documented protocol makes the rename safe across the replication boundary. **Cons:** it is a
+coordinated, multi-database DDL operation with a brief subscription pause; downstream application code referencing the
+old name must be updated in the same window. **Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T5-GREEN (PLANNING)
+Lens: replication-aware refactoring.
+Heuristic: a column rename on a published table is a distributed operation, not a
+ local edit; design the ordering before touching either side.
+Action: authored the disable→rename-both→enable→refresh procedure; verified
+ logical replication's by-name column mapping makes lock-step renaming mandatory.
+Output: corrected column + Migration Notes section.
+```
+
+```text
+Agent: T5-BLUE (REVIEWER)
+Lens: blast-radius containment.
+Heuristic: every consumer of the old identifier is a breakage point.
+Action: catalogued references to the column on both publisher and subscriber;
+ confirmed the rename is the only schema change (type/width unchanged).
+Output: approved; flagged application-code update inside the migration window.
+```
+
+```text
+Agent: T5-RED (TESTING)
+Lens: desync simulation.
+Heuristic: rename one side only and observe the failure.
+Action: modelled renaming the publisher without the subscriber.
+Result: the stream errors on the missing target column — validating the
+ lock-step requirement; the documented procedure prevents it.
+```
+
+### Team Name: Derivatives Desk (T6)
+
+**Finding.** Derivative modelling is robust; the fact tables under-specify their grain as a non-PK unique index.
+**Pros:** PK promotion is semantically free today and future-proofs replication and partitioning; the added date/base
+checks are cheap correctness wins. **Cons:** if a future TimescaleDB hypertable is created, the PK must keep the time
+column (it does); no other downside. **Confidence: MEDIUM.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T6-GREEN (PLANNING)
+Lens: polymorphic / EAV modelling + check-constraint algebra.
+Heuristic: a single table holding two instrument shapes (option/future, equity/index
+ underlying) must encode the XOR and the conditional-NOT-NULL rules as checks.
+Action: validated ck_dc_underlying_xor, ck_dc_option_fields, ck_dc_inst_underlying;
+ found the fact grains expressed only as UNIQUE.
+Output: promote each _tx grain to a composite PRIMARY KEY; add exchange/index checks.
+```
+
+```text
+Agent: T6-BLUE (REVIEWER)
+Lens: time-series storage strategy.
+Heuristic: a fact table's identity must survive a future hypertable migration.
+Action: confirmed every promoted PK includes effective_time/snapshot_time, keeping
+ create_hypertable() viable; confirmed PKs are local (tables unpublished).
+Output: approved PK promotion.
+```
+
+```text
+Agent: T6-RED (TESTING)
+Lens: contract-shape fuzzing.
+Heuristic: attempt the impossible contract and the duplicate bar.
+Action: tried a future with an option_type, an option with no strike, a contract
+ with both an ISIN and an index underlying, and a duplicate (entity,timeframe,time)
+ bar.
+Result: malformed contracts rejected by existing checks; duplicate bars rejected by
+ the new PK exactly as by the prior unique index.
+```
+
+### Team Name: Corporate Actions Bureau (T7)
+
+**Finding.** Corporate actions were captured only as free text, blocking automated price adjustment. **Pros:** the
+structured columns make splits, bonuses, and dividends machine-computable and the precomputed factor lets the pipeline
+persist one canonical adjustment; the table is unpublished so there is zero subscriber coordination. **Cons:** it is a
+genuinely new feature (correctly gated on explicit approval) and adds population responsibility to the ingestion job.
+**Confidence: HIGH (FEATURE).**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T7-GREEN (PLANNING)
+Lens: downstream-consumer data sufficiency (price back-adjustment).
+Heuristic: a reference table is complete only if every downstream computation it
+ feeds can be performed without re-parsing free text.
+Action: derived the fields a split/bonus/dividend adjustment needs (ex/record dates,
+ ratio, cash amount + currency, adjustment factor); designed all-or-nothing checks.
+Output: ex_date, record_date, ratio_old/new, dividend_amount, dividend_currency_code
+ (FK), price_adjustment_factor + ck_ca_ratio_pair/ck_ca_dividend/ck_ca_adj_factor.
+```
+
+```text
+Agent: T7-BLUE (REVIEWER)
+Lens: scope discipline & publication impact.
+Heuristic: new features are added only where they cost least and leak least.
+Action: confirmed corporate_actions_mw is in no publication, so the columns are
+ StocksDB-local; confirmed the dividend currency FK targets the subscribed
+ currency_mw without affecting replication.
+Output: approved as a bounded FEATURE.
+```
+
+```text
+Agent: T7-RED (TESTING)
+Lens: partial-data probing.
+Heuristic: supply half a corporate action and ensure it is rejected.
+Action: tried a split with only ratio_old, a dividend with no currency, a negative
+ adjustment factor.
+Result: each partial/invalid combination is rejected by the new checks; a complete
+ 1-for-2 split and a cash dividend with currency are accepted.
+```
+
+### Team Name: Cartographers (T1)
+
+**Finding.** The subscribed geography copies must match the widened publisher shape. **Pros:** a mechanical, mandatory
+alignment that unblocks apply. **Cons:** none beyond being part of the coordinated MacroDB migration. **Confidence:
+HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T1-GREEN (PLANNING)
+Lens: subscriber-publisher shape parity.
+Heuristic: a subscriber column must be at least as wide as the publisher's.
+Action: matched the widened wikidata_id/geoname_id (varchar(12)) onto the
+ subscribed country_mw/state_mw/city_mw copies.
+Output: widen the three subscribed tables' identifiers to varchar(12).
+```
+
+```text
+Agent: T1-BLUE (REVIEWER)
+Lens: apply-time type compatibility.
+Heuristic: width mismatches surface as apply errors, not insert errors.
+Action: confirmed the subscriber widths now equal the publisher; confirmed no other
+ geography column changed shape.
+Output: approved.
+```
+
+```text
+Agent: T1-RED (TESTING)
+Lens: replicated-value overflow probing.
+Heuristic: push a max-width publisher value through to the subscriber.
+Action: modelled replicating a 10-char Q-ID into the (old) varchar(8) subscriber.
+Result: pre-fix apply would fail/truncate; post-fix the value lands intact.
+```
+
+## Super Team
+
+Under the maximum-hardening mandate the Super Team consolidated all five teams' validated work, anchored by the
+publications fix (T4) — the change that makes the downstream database function at all. The acronym rename (T5) and the
+corporate-action FEATURE (T7) are the next-most-consequential, followed by the structural PK promotion (T6) and the
+mandatory subscriber identifier alignment (T1). The result restores StocksDB's publisher role, removes the naming defect
+under a safe protocol, and closes the corporate-action capture gap — with no change to the security/leakage posture
+(subscriber grants remain select-only, facts remain write-revoked from `PUBLIC`).
+
+### Winning Teams
+
+The global marquee trio is **Publishers' Guild (T4, VERY HIGH)** — the missing-publications discovery, which is
+StocksDB's and the whole system's top finding; **Mint Authority (T2, HIGH)** — the MacroDB currency integrity fix; and
+**Corporate Actions Bureau (T7, HIGH)** — the StocksDB structured corporate-action FEATURE. Two of the three (T4, T7)
+act directly on this file. Lexicon (T5) and Derivatives Desk (T6) are honourable mentions fully incorporated here.
+
+### Super Team Aggregated Result
+
+Concrete changes applied to `stocksdb.dbml` (see the file's `versionchanged` block):
+
+ 1. **[VERY HIGH · BUGFIX]** Added publications `stocksdb_securities_table` (securities_mw +
+ securities_exchange_symbol_mw), `stocksdb_exchange_table` (stock_exchange_mw), `stocksdb_derivative_table`
+ (derivative_contract_mw); documented `wal_level=logical` and PK-as-replica-identity.
+ 2. **[HIGH · BUGFIX]** Renamed `scock_exchange_acronym → stock_exchange_acronym` on `stock_exchange_mw`, with a
+ lock-step Migration Notes procedure for the TradesDB subscriber.
+ 3. **[HIGH · BUGFIX]** Subscriber `wikidata_id`/`geoname_id` widened `varchar(8) → varchar(12)` on country/state/city
+ (matches corrected MacroDB publisher).
+ 4. **[HIGH · FEATURE]** `corporate_actions_mw` extended with `ex_date`, `record_date`, `ratio_old`/`ratio_new`,
+ `dividend_amount`, `dividend_currency_code` (FK), `price_adjustment_factor`, three check constraints, and an
+ `(isin, ex_date)` index.
+ 5. **[MEDIUM · ENHANCEMENT]** Promoted each `private.*_tx` grain to a composite PRIMARY KEY; added
+ `ck_exchange_operational_dates` and `ck_market_index_base`; documented the no-hard-DELETE contract on
+ `securities_mw`.
+
+
+
+# TradesDB Review Report
+
+
+
+
+
+TradesDB is the system's terminal subscriber and the only database that writes trading activity. Five teams examined its
+replication safety, schema layering, and risk/audit integrity. The most operationally dangerous finding is the
+**replication apply-stall risk** (Apply-Guard, T8): TradesDB's local fact tables foreign-key *into* the subscription
+tables (e.g. `signal_tx.ses_primary_id → securities_exchange_symbol_mw`) with `ON DELETE RESTRICT`. If an upstream
+system hard-deletes a referenced security or contract and that delete replicates down, the `apply` worker is blocked by
+the `RESTRICT` constraint and the subscription stalls — silently halting all downstream reference updates. Critically,
+`RESTRICT` is the *correct* behaviour for an audit-grade trading store (a security with live trade history must not
+vanish), so the resolution is not to weaken the constraint but to codify the **publisher no-hard-DELETE contract**:
+upstream must retire reference rows logically (via `stock_exchange_mw.operational_to` or a `DELISTING` corporate
+action), never with a physical delete. This contract is now documented in the file, and the same review reworded the
+previously self-contradictory note that simultaneously claimed subscription tables "carry no incoming foreign keys" yet
+were "referenced by trading facts." The corrected note draws the real distinction: subscription tables carry no FKs
+*among themselves* (those are dropped on the subscriber to avoid apply-order failures), while *local* facts legitimately
+reference them via ordinary FKs.
+
+Stratum (T9) found a **schema-layering inversion**: the enum `instrument_kind` was defined in the `private` schema, yet
+`common.strategy_mw` and `common.strategy_universe_mw` — and the fact tables — depend on it. A `common` object depending
+on a `private` type is a layering violation that breaks the schema's own encapsulation boundary. The enum is relocated
+to `common.instrument_kind`. Because enum-typed columns are represented as `varchar` in the DBML, this is a
+documentation-and-reference change in the diagram (the header enum table and every `// enum:` comment), but it encodes
+the correct dependency direction for the real DDL. T9 also confirmed `timeframe_value` is already correctly in `common`
+here (it sits in `private` only in StocksDB, which is an independent database, so no cross-DB issue arises).
+
+Sentinel (T10) audited risk, audit, accounting, and deployment metadata. The **version/cluster contradiction** is the
+notable defect: the original schema claimed TradesDB runs PostgreSQL v17.10 "on the same cluster" as the v18.1 MacroDB
+and StocksDB — impossible, since one cluster runs exactly one major version. It is re-documented as a dedicated v18.1
+Aiven service, which also resolves the replication-direction concern (publisher v18 → subscriber v17 is the
+less-supported newer→older path; aligning to v18.1 keeps it publisher ≤ subscriber). This is flagged for operations to
+confirm the genuinely deployed version. On accounting integrity, `pnl_daily_tx` had no constraint tying `net_pnl` to
+`gross_pnl` and `total_charges`; the identity `ck_pnl_net` (`net_pnl = gross_pnl − total_charges`) plus non-negativity
+guards on charges and trade count are added. Sentinel confirmed the audit log is correctly immutable (UPDATE/DELETE
+revoked plus a trigger) and deliberately FK-free so a logged reference can never be blocked or cascaded.
+
+Publishers' Guild (T4) and Lexicon (T5) handled the subscriber side of cross-database fixes: T4 confirmed TradesDB's
+four subscriptions now have real publications upstream (the StocksDB fix) and that its subscriber column shapes match
+the publishers; T5 applied the lock-step `scock_exchange_acronym → stock_exchange_acronym` rename on TradesDB's
+subscribed `stock_exchange_mw` copy.
+
+On data leakage, the audit found TradesDB is a private operational store with no onward publications; subscription
+tables are write-revoked from `PUBLIC`, the audit log is tamper-evident, and `jsonb` payloads (strategy parameters,
+model outputs) live in a private schema. The structural reconstruction note in the file header records that the local
+trading tables were rebuilt from the design model and should be diffed against the canonical source. All changes are
+captured in the `versionchanged` block and tagged `BUGFIX` / `ENHANCEMENT`. Net effect: TradesDB's replication is now
+stall-resistant by contract, its schema layering is corrected, its deployment metadata is internally consistent, and its
+P&L respects its own accounting identity — with the protective `RESTRICT` semantics and immutable audit trail preserved.
+
+## Team Summary
+
+
+
+| Team Name | Team Objective | Team Findings |
+| :---: | --- | --- |
+| Publishers' Guild (T4) | Subscriber-side topology verification | Confirmed the four subscriptions now resolve to real StocksDB/MacroDB publications; subscriber column shapes match publishers (incl. renamed acronym, widened identifiers). **Confidence: VERY HIGH.** |
+| Lexicon (T5) | Coordinated subscriber rename | Applied `scock_exchange_acronym → stock_exchange_acronym` on the subscribed `stock_exchange_mw`, lock-step with the publisher. **Confidence: HIGH.** |
+| Apply-Guard (T8) | Replication apply-stall risk | Local→subscription FKs with `ON DELETE RESTRICT` can stall apply on an upstream hard-delete → keep RESTRICT, document publisher no-hard-DELETE contract; reword the contradictory FK note. **Confidence: HIGH.** |
+| Stratum (T9) | Schema layering & enum placement | `instrument_kind` enum in `private` but used by `common` tables → relocate to `common.instrument_kind`. `timeframe_value` already correct. **Confidence: MEDIUM.** |
+| Sentinel (T10) | Risk, audit, accounting & deployment metadata | v17.10/"same cluster" is impossible → dedicated v18.1 service; `pnl_daily_tx` lacked the net identity → `ck_pnl_net` + non-negativity; audit immutability confirmed. **Confidence: MEDIUM–HIGH.** |
+
+
+
+### Team Name: Publishers' Guild (T4)
+
+**Finding.** TradesDB's subscriptions were dangling until the StocksDB publications were authored. **Pros:** verifying
+shape parity end-to-end guarantees the stream will actually apply. **Cons:** correctness depends on the upstream
+StocksDB fix landing first; the subscriber must be migrated in step with the publisher for the renamed/widened columns.
+**Confidence: VERY HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T4-GREEN (PLANNING)
+Lens: subscriber contract verification.
+Heuristic: every declared subscription must resolve to a real upstream publication
+ with a matching column set.
+Action: matched TradesDB's four subscriptions to the (now-authored) StocksDB
+ publications and the MacroDB currency publication; checked each subscriber table's
+ columns against its publisher.
+Output: confirmed resolvable; flagged the rename/widen coordination.
+```
+
+```text
+Agent: T4-BLUE (REVIEWER)
+Lens: subscriber FK-drop correctness.
+Heuristic: subscription tables must not carry FKs among themselves.
+Action: confirmed currency_mw/securities_mw/ses_mw/stock_exchange_mw/
+ derivative_contract_mw expose cross-references as plain columns; confirmed local
+ facts' FKs into them are intentional and separate.
+Output: approved.
+```
+
+```text
+Agent: T4-RED (TESTING)
+Lens: end-to-end apply rehearsal.
+Heuristic: replicate the full reference set and confirm local facts can bind.
+Action: modelled initial copy of all four subscriptions, then inserting a signal/
+ order that FKs into ses_mw and derivative_contract_mw.
+Result: post-fix the references resolve; pre-fix (no upstream publications) nothing
+ arrives and every local fact insert fails its FK.
+```
+
+### Team Name: Lexicon (T5)
+
+**Finding.** The subscriber copy of the typo'd column must be renamed in step. **Pros:** keeps the subscriber
+name-aligned with the publisher so replication continues. **Cons:** must occur inside the same maintenance window as the
+publisher rename. **Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T5-GREEN (PLANNING)
+Lens: subscriber-side of a distributed rename.
+Heuristic: the subscriber column name must equal the publisher's at all times the
+ stream is enabled.
+Action: scheduled the subscriber RENAME between the publisher rename and the
+ subscription re-enable per the StocksDB Migration Notes.
+Output: corrected stock_exchange_acronym on the subscribed table.
+```
+
+```text
+Agent: T5-BLUE (REVIEWER)
+Lens: consistency with the publisher procedure.
+Heuristic: one procedure, two sides; no divergence.
+Action: verified the subscriber rename is the only TradesDB schema change for this
+ item and that the type/width are unchanged.
+Output: approved.
+```
+
+```text
+Agent: T5-RED (TESTING)
+Lens: ordering-failure probe.
+Heuristic: re-enable the subscription before renaming the subscriber and observe.
+Action: modelled the wrong ordering.
+Result: apply errors on the name mismatch; the documented ordering avoids it.
+```
+
+### Team Name: Apply-Guard (T8)
+
+**Finding.** Correct `RESTRICT` FKs from facts into subscription tables create an apply-stall exposure to upstream
+hard-deletes. **Pros:** documenting the soft-delete contract preserves both referential safety and replication liveness
+without weakening any constraint. **Cons:** the guarantee is operational, not database-enforced upstream; it must be
+honoured by every producer that can delete reference rows. **Confidence: HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T8-GREEN (PLANNING)
+Lens: replication liveness vs referential safety trade-off.
+Heuristic: never resolve a liveness risk by discarding a correctness constraint if a
+ contract can satisfy both.
+Action: traced every local→subscription FK; confirmed RESTRICT is the right local
+ semantics; identified the upstream hard-delete as the only stall trigger.
+Output: keep RESTRICT; document the publisher no-hard-DELETE contract; reword the
+ contradictory subscription-FK note.
+```
+
+```text
+Agent: T8-BLUE (REVIEWER)
+Lens: alternative-remedy elimination.
+Heuristic: prove the rejected options are worse.
+Action: evaluated ON DELETE CASCADE (destroys trade history — unacceptable),
+ SET NULL (orphans facts and violates instrument XOR checks — unacceptable), and
+ dropping the FK (loses local integrity). Confirmed the contract is the least-bad
+ remedy.
+Output: approved the contract-based resolution.
+```
+
+```text
+Agent: T8-RED (TESTING)
+Lens: stall reproduction.
+Heuristic: replicate a hard-delete of a referenced row and watch apply.
+Action: modelled deleting a ses/contract row upstream that a signal references.
+Result: the apply worker stalls on RESTRICT pre-contract; under the soft-delete
+ contract (logical retirement) no tombstone is produced and apply proceeds.
+```
+
+### Team Name: Stratum (T9)
+
+**Finding.** A `common` table depends on a `private` enum — a layering inversion. **Pros:** relocating `instrument_kind`
+to `common` restores a clean dependency direction and matches the placement of the other shared enums. **Cons:** in the
+real DDL this is a type relocation requiring care if existing objects already depend on it; in the diagram it is a
+comment/header change because enum columns render as `varchar`. **Confidence: MEDIUM.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T9-GREEN (PLANNING)
+Lens: schema-as-module dependency hygiene.
+Heuristic: lower-privilege/shared layers (common) must not depend on
+ higher-restriction layers (private).
+Action: enumerated dependents of instrument_kind (strategy_mw, strategy_universe_mw,
+ signal_tx, order_tx, position_snapshot_tx); found the enum mis-placed in private.
+Output: move instrument_kind to common; update header enum table + all enum comments.
+```
+
+```text
+Agent: T9-BLUE (REVIEWER)
+Lens: cross-database enum consistency.
+Heuristic: compare enum placement across the three databases for systemic drift.
+Action: confirmed timeframe_value already sits in common in TradesDB (private only in
+ the independent StocksDB, so no shared-cluster conflict); confirmed strategy_stage/
+ signal_source/allocation_policy already in common.
+Output: approved; no change needed for timeframe_value.
+```
+
+```text
+Agent: T9-RED (TESTING)
+Lens: representation-fidelity check.
+Heuristic: ensure the varchar representation does not hide a real column change.
+Action: verified that relocating the enum changes only the type's schema, not the
+ column's stored type/width/nullability.
+Result: no column-shape change; replication unaffected (the enum is not a published
+ table).
+```
+
+### Team Name: Sentinel (T10)
+
+**Finding.** Deployment metadata is internally contradictory and daily P&L lacks its accounting identity. **Pros:**
+correcting the version/cluster claim removes an impossible configuration and improves the replication direction;
+`ck_pnl_net` makes a silent reconciliation error impossible. **Cons:** the version correction is an inference that
+requires ops confirmation; the P&L identity assumes charges are fully captured in `total_charges`. **Confidence:
+MEDIUM–HIGH.**
+
+### Agent Details
+
+The following agents were deployed for the team that ensures that the output of the teams are different even if working
+in the same objective. The details are as follows:
+
+```text
+Agent: T10-GREEN (PLANNING)
+Lens: deployment-topology realism + accounting invariants.
+Heuristic: a stated infrastructure fact must be physically possible; a derived
+ financial column must equal its definition.
+Action: flagged v17.10-on-a-v18.1-cluster as impossible; chose a dedicated v18.1
+ service to also fix replication direction; defined net = gross − charges.
+Output: re-document deployment as v18.1 Aiven service (confirm with ops);
+ add ck_pnl_net + non-negativity checks.
+```
+
+```text
+Agent: T10-BLUE (REVIEWER)
+Lens: audit immutability & non-destructive guarantees.
+Heuristic: an audit trail that can be altered is not an audit trail.
+Action: confirmed audit_log_tx revokes UPDATE/DELETE and adds a blocking trigger,
+ and carries no FKs (so it cannot be blocked/cascaded); confirmed circuit_breaker
+ release ordering and risk-scope targeting checks.
+Output: approved; audit posture sound.
+```
+
+```text
+Agent: T10-RED (TESTING)
+Lens: invariant-violation probing.
+Heuristic: try to break the accounting identity and tamper the log.
+Action: attempted a pnl row where net != gross − charges, a negative total_charges,
+ and an UPDATE against audit_log_tx.
+Result: the P&L rows are rejected by ck_pnl_net/ck_pnl_charges; the audit UPDATE is
+ blocked by the revoke + trigger.
+```
+
+## Super Team
+
+Under the maximum-hardening mandate the Super Team incorporated all five teams' validated work. For TradesDB the
+load-bearing change is operational rather than structural: the no-hard-DELETE contract (T8) keeps the protective
+`RESTRICT` FKs from ever stalling replication, while the schema-layering fix (T9), the deployment-metadata correction
+and P&L identity (T10), and the coordinated subscriber rename (T5) round out the set. The subscriber-topology
+verification (T4) ties the database back to the upstream publications fix. None of these weakens the security posture:
+subscription tables stay write-revoked from `PUBLIC` and the audit log stays immutable.
+
+### Winning Teams
+
+The global marquee trio — **Publishers' Guild (T4, VERY HIGH)**, **Mint Authority (T2, HIGH)**, and **Corporate Actions
+Bureau (T7, HIGH)** — is dominated by upstream fixes, but T4 is the team that makes TradesDB viable at all by surfacing
+the missing publications its subscriptions depend on. Within this file, **Apply-Guard (T8)** is the standout local
+contribution (it converts a latent replication-halting hazard into a documented contract), with **Stratum (T9)** and
+**Sentinel (T10)** as honourable mentions whose fixes were fully incorporated.
+
+### Super Team Aggregated Result
+
+Concrete changes applied to `tradesdb.dbml` (see the file's `versionchanged` block):
+
+ 1. **[HIGH · BUGFIX]** Renamed subscriber `scock_exchange_acronym → stock_exchange_acronym` on
+ `common.stock_exchange_mw`, lock-step with the StocksDB publisher.
+ 2. **[MEDIUM · BUGFIX]** Corrected the impossible "v17.10 on the same cluster" claim to a dedicated v18.1 Aiven
+ service (keeps replication publisher ≤ subscriber); flagged for ops confirmation.
+ 3. **[MEDIUM · ENHANCEMENT]** Relocated enum `instrument_kind` from `private` to `common`; updated the header enum
+ table and all `// enum:` references.
+ 4. **[MEDIUM · ENHANCEMENT]** Added `ck_pnl_net` (`net_pnl = gross_pnl − total_charges`) with non-negativity checks;
+ documented the publisher no-hard-DELETE contract protecting the `ON DELETE RESTRICT` FKs.
+ 5. **[LOW · ENHANCEMENT]** Reworded the contradictory subscription-FK note into two precise rules (no FKs among
+ subscription tables; local facts reference them via ordinary FKs).
+
+> Note: the local trading tables in `tradesdb.dbml` were reconstructed from the validated design model (the original
+> upload was not recoverable post-compaction); the five subscription tables are reproduced at exact publisher
+> column-shape fidelity. Please diff the local-table column set against your canonical source before applying.
+
+
+
+# Periodic Review Reports
+
+
+
+
+
+The review report is generated using `Claude Opus 4.8` or higher models to do a scanning and review of the database structure
+across the organization to normalize, audit, bug bounty and other essential reviews. Recommended to use the max settings to do a
+proper security audit (warning: high token usage). The directories are dated as per analysis days and linked to a PR# which
+links each repository's issues and methods to be resolved for an organization wide migration.
+
+