Correction: the track-record funnel briefly showed a collapsed baseline

What was wrong

The constraint funnel on the track record page — the table that starts from every name-day of the watchlist universe and shows what each added constraint removes — was briefly computed over a tiny fraction of the real record:

• Window 1: 18:45 AEST 2026-08-19 to ~09:55 2026-08-20 (15 hours)
• Window 2: 22:00 AEST 2026-08-22 to ~11:00 2026-08-23 (13 hours)

In the second window the baseline row showed n=265 name-days at a 40.8% win rate where the true figures were n≈6,100 at ~30%. The smaller rows below it were computed over similarly tiny slices. Numbers elsewhere on the page (the hit tables, the registered receipts) were unaffected — they are stored records, not recomputed aggregates.

What actually happened

Forward returns for every name-day are stamped by a morning job that fetched prices from an external source for the whole universe on every run. During two internet outages this week that source returned empty data for every name — and the job wrote those empty results over the good ones, downgrading ~10,000 measured outcomes to "no data". The export then faithfully published a funnel computed over what remained. The measured returns were never lost; only their status rows were overwritten, and a later healthy run restored them.

Why it reached the page

Nothing between the job and the site checked the shape of the result: a funnel whose baseline collapsed from six thousand rows to a few hundred deployed exactly like a normal daily refresh.

The fix, in three layers (all live as of 2026-08-23)

1. A result can no longer be degraded. A measured outcome is never overwritten by a failed fetch; a failed lookup writes nothing and is logged loudly.
2. The price source is now local-first. Returns are computed from the pipeline's own stored daily bars; the external source is only a fallback for names outside that coverage — an internet failure can no longer touch the stored record.
3. A collapsed funnel cannot publish. The pre-publish gate now refuses any batch whose funnel baseline falls below a floor no legitimate day can cross, and the job itself aborts entirely if a run would shrink the measured population by more than 20%.

The discipline note

The registered receipts and hit records were untouched throughout — this failure was in the derived display layer. It still counts: wrong numbers were public for about 28 hours across two windows, and the standard here is that anything wrong for more than a day gets a dated correction, not a quiet fix. This is that correction.