Latent holes
Source of truth
These are in the tree — not missing files. They were found in the
2026-09-02 audit and deliberately not fixed: each
needs an owner decision, spans a module boundary, or is too invasive
for a conservative pass. The running list is
IMPROVEMENTS.md at the repo root. This page is the desk
index of the ones that change how you read a green check or a red day.
If the markdown and this page disagree, the markdown wins.
Contrast not built: that page is absence. This page is presence with a known failure mode.
Silent failure
| Where | What happens |
|---|---|
| ingest/common/cli.py | A job whose summary dict contains a reserved key (rows, bytes, job, duration_s) crashes job_end logging after succeeding → job_error + a /fail ping. Latent today. |
| ws_minute_bars | A 0-row capture pings Healthchecks /fail but main still exits 0. Exit code and monitoring disagree. |
| grouped_daily | Empty records on a trading day logs grouped_empty and exits 0 (green healthcheck). |
| scripts/cronjob.sh | fixed: the lock is taken on fd 9 before the command runs, so an exit 99 from the job is no longer misreported as job_skipped. |
| snapshot_sweep | fixed: chains fail independently. One bad chain is recorded and the rest still land; the run fails only when every chain does. snapshot_sweep_all_chains is pinged only on a fully clean sweep, so a chain down longer than the grace pages by absence. |
Monitoring
| Where | What happens |
|---|---|
| prune | fixed: monthly prune_raw.sh --apply has a Healthchecks check. cronjob.sh pings it for bash *.sh jobs; the generated unit has OnFailure=massive-alert@massive-prune. See red day / disk. |
| drift_check --date | date.fromisoformat runs before the logger and the /start ping, so a malformed --date dies with a bare traceback and no Healthchecks signal. |
Ops / consistency
| Where | What happens |
|---|---|
| coverage_audit + crontab | On 13:00 early-close days the cron cadence still runs to 16:30, so ~178 post-close sweeps read as stray and the 13:32–16:30 window is unchecked. Do not repair those strays — red day / early close. |
| coverage_audit / reconcile T-1 | Default T-1 is computed without data_root (unlike history_audit), so a non-standard DATA_ROOT picks T-1 against the wrong holiday calendar. |
| marketdata.opra vs ingest.jobs | Two OPRA year-pivot decoders disagree on yy >= 80 (19xx vs 20xx). Unreachable at today's roots; hoist one shared decoder before the universe widens. |
Also in IMPROVEMENTS.md and not copied here: the
unbounded trades_cursor.json, first-run
contracts_sync baseline, CRR shared-bump cost, holiday
cache with no mtime check, and the macOS-vs-Ubuntu
test_prune_raw coreutils split. Read the file when
touching those modules.