Pricing Pipeline Changelog

Impact Notes

• `dexscreener-prices` now protects only the exact token-address stablecoin pricing fallback
• `dexscreener-liquidity` protects optional DEX liquidity and discovery pool lookups and is excluded from public-impact breaker counts
• `sync-dex-liquidity` records one aggregate DexScreener fallback outcome per run, so target-level failures or budget exhaustion cannot trip a source breaker multiple times in one run

Impact Notes

• The single-protocol replacement exception no longer requires the published soft result itself to be inside the peg depeg threshold
• The replacement still requires at least $5M of protocol-level DEX TVL, depeg-sized DEX evidence, material divergence from the published soft result, and hard market/oracle/protocol candidate agreement
• Uncorroborated single-protocol divergence, same-protocol noisy pools, and incoherent cross-protocol DEX prices still preserve the original price while downgrading confidence

Impact Notes

• Each `REDSTONE_SYMBOL_CONFIG` entry declares the stablecoin id that may consume that feed
• Consensus looks up RedStone quotes by stablecoin id, not by bare asset symbol
• The live RedStone `USDH` feed is pinned to Native Markets USDH because its source set is Hyperliquid/HypEVM-specific, so Hubble USDH no longer receives that quote

Impact Notes

• The standard replacement path still replaces when at least two protocol medians diverge beyond the peg-aware pool threshold
• A high-TVL multi-protocol path now also replaces a near-peg soft result when at least two protocol medians each carry at least $5M TVL, cross the peg depeg threshold in the same direction, diverge from the soft result by at least the depeg threshold, and agree with each other inside the existing pool-challenge bps band
• The single-protocol exception remains hard-corroborated only; same-protocol noisy-pool protection and incoherent cross-protocol prices still preserve the original price while downgrading confidence

Impact Notes

• The standard replacement path still requires at least two independent diverging DEX protocols
• A single-protocol replacement is now allowed only when the protocol median carries at least the existing $5M high-TVL threshold, the published price is still inside the peg depeg threshold, and a hard market/oracle/protocol candidate agrees with that DEX mark
• This keeps same-protocol noisy-pool protection while allowing APXUSD-style Curve on-chain plus Curve DEX evidence to override a near-peg soft cluster

Impact Notes

• Exact-address augmentation can still fill or corroborate near-peg prices for thin assets
• A fallback/search-family source such as CoinGecko Onchain address pricing is rejected when it is at least 500 bps from a fixed peg and no stronger source corroborates the move
• Rejected weak address-provider candidates fall through to later enrichment, allowing exact DefiLlama contract fallback to repair assets such as Tangent USG when that contract quote remains near peg

Impact Notes

• sBOLD and yBOLD can publish ERC-4626 NAV prices from BOLD when BOLD's same-run consensus is fresh and high-confidence
• KAST USDK and XO Cash can inherit fresh high-confidence wM pricing as scoped M0 extension units

Impact Notes

• MNEE and VEUR join the allowlisted `coingecko-low-volume` fallback
• CADD and Mento JPY/ZAR/XOF stables can use FX-par `protocol-redeem` pricing plus fail-closed on-chain zero-supply repair

Impact Notes

• `dexscreener-search` remains visible as a legacy circuit key, but new stablecoin sync runs no longer call `/latest/dex/search`
• DexScreener exact-address fallback remains available through the separate `dexscreener-prices` lane
• Addressless assets that cannot resolve through DefiLlama, CoinMarketCap, Jupiter, CoinGecko low-volume recovery, or an exact tracked deployment now remain explicitly missing instead of probing noisy symbol search

Impact Notes

• `dexscreener-address` remains available as a weight-1 soft primary-consensus source when operators explicitly include it in `ADDRESS_PRICE_PROVIDERS_ENABLED`
• Unset address-provider configuration now defaults to DexPaprika plus configured key-backed providers, avoiding quarter-hourly calls to DexScreener's Cloudflare/WAF-protected public token endpoint
• Open address-provider circuits no longer accumulate additional failures from skipped blocked runs; only actual upstream attempts can fail the provider breaker

Impact Notes

• `dexscreener-address` remains a weight-1 soft primary-consensus source, but its public `/tokens/v1/{chain}/{addresses}` lane is now explicitly opportunistic under the 15-minute sync cadence
• A DexScreener `429` / Cloudflare 1015 response no longer causes the same sync run to send the remaining address batches, reducing repeated source-wide breaker opens
• Valid empty DexScreener token-batch responses still count as healthy coverage misses, so thin or unindexed addresses do not poison breaker state

Impact Notes

• `xofm-mento` can be tracked as an active XOF-pegged stablecoin instead of being forced into OTHER or rejected by peg metadata validation
• `peggedXOF` uses the same dated `fawazahmed0/currency-api` secondary FX cadence as CNH, RUB, UAH, ARS, KGS, NGN, and VND for live sync, realtime fallbacks, and historical backfills
• Price validation now classifies XOF as `fiat_fx` with explicit USD/XOF hardcoded bounds for no-reference guardrails
• The CoinGecko native-peg lane remains disabled for XOF because CoinGecko does not currently expose a usable `xof` simple-price quote

Impact Notes

• `m-m0` inherits the tracked `wm-m0` live price through the same trusted-parent gate used by downstream M0 extension units
• `weusd-picwe` inherits tracked `usdc-circle` pricing with the documented 1% redemption-fee haircut, so market cap reflects the bounded USDC exit rather than a missing secondary-market quote
• `sofid-sofi`, `usbd-bima`, and `usdq-quill` can publish nominal `protocol-redeem` USD parity when active supply is observable and the redemption path is already source-reviewed in the backstop registry
• `chfau-allunity` can publish `protocol-redeem` CHF parity only when the current CHF/USD FX reference is fresh or static; stale or absent FX data fails closed

Impact Notes

• Hard Curve on-chain coverage now includes audited direct pools plus explicit opt-in one-hop and chained-hop routes that fail closed on missing dependencies or cycles
• `uniswap-v3-dex` and `uniswap-v4-dex` can enter consensus as soft DEX lanes when `dex_prices.price_sources_json` publishes corroborated protocol evidence
• `dex-promoted` is withheld only when a promoted protocol DEX lane is actually admitted, so rejected lone protocol candidates no longer suppress the aggregate DEX voice
• Exact-address providers prioritize missing and low-depth priced assets, report request-cap skips, and Jupiter can append bounded soft evidence to agreeing low-depth Solana prices without replacing the primary price

Impact Notes

• `gtusdc-gauntlet` recovers its ERC-4626 `protocol-redeem` price from on-chain `convertToAssets(1 share)` times the tracked `usdc-circle` parent instead of publishing a weak DEX/GeckoTerminal market price
• The fallback applies only to replay-safe composite parents with a fresh `priceSyncedAt`; low-confidence, stale-sync, cached, single-source, or non-replay-safe parent prices still cannot upgrade into child `protocol-redeem` prices
• The CoinGecko drift status comparison explicitly ignores frozen archive rows, so discontinued assets such as BUCK do not dominate the active price-drift watchlist

Impact Notes

• `moralis-address` remains a weight-1 soft primary-consensus candidate and is still optional through `ADDRESS_PRICE_PROVIDERS_ENABLED`
• The Moralis pass is capped at 3 batch requests per sync, down from 10 smaller batches, reducing worst-case daily usage from about 96k CUs/day to about 28.8k CUs/day at the current 15-minute cadence
• CoinGecko-only detail pages now record circuit health from upstream transport success instead of stale or empty per-asset history, so expected history gaps fall back to local supply history without opening the source-wide breaker

Impact Notes

• DexScreener exact token endpoint, DexPaprika, GeckoTerminal simple token prices, Alchemy Prices, Moralis token prices, and Birdeye Solana prices can contribute weight-1 soft primary-consensus candidates
• Targets are built only from canonical `asset.address`, `contracts`, or `tradedContracts` metadata and require exact chain+address identity; symbol search remains confined to the existing final DexScreener fallback pass
• `ADDRESS_PRICE_PROVIDERS_ENABLED` can restrict or disable the provider set, while unset auto-enables no-key providers plus configured key-backed providers
• The new sources are non-replay-safe and non-depeg-authoritative on their own, so they improve source depth without weakening depeg confirmation rules

Impact Notes

• `chainlink-nav` and `superstate-liquidity` are registered primary-consensus sources that read authoritative reserve_composition rows matched to reserve_sync_state success timestamps
• USD-denominated NAV rows publish directly, while non-USD NAV rows such as EUTBL convert through fresh/static FX references before entering USD consensus
• `curve-dex` can now promote retained Curve DEX evidence from `dex_prices.price_sources_json`; the aggregate `dex-promoted` lane is still withheld whenever a promoted protocol lane exists
• Binance `BFUSDUSDT` and `BFUSDUSDC` markets convert through tracked USDT/USDC USD pairs, and Binance-derived DEX aggregate rows are suppressed when the direct Binance hard-market source is already present
• `usyc-hashnote` and `ustb-superstate` now carry verified Pyth feed metadata, and `syrupusdc-maple` includes Maple's verified Solana syrupUSDC mint for DEX discovery coverage

Impact Notes

• Replay safety, pool-challenge eligibility, fallback-only classification, depeg authority, and severe-downside corroboration now expand composite labels such as `coingecko+geckoterminal` before applying source policy
• CoinGecko-family and DefiLlama-family variants collapse for independence checks, CoinMarketCap and DefiLlama contract fallback are treated as list aggregators, and fallback/search lanes remain non-authoritative
• Promoted DEX protocol lanes keep protocol-specific `dex:*` families instead of collapsing into one generic DEX family
• `susds-sky`, `susde-ethena`, `syrupusdt-maple`, `sdai-sky`, `thbill-theo`, `usdv-solomon`, and `usdxl-last` now have verified Pyth feed metadata for the existing Pyth Hermes source path
• The source-depth audit script measures candidate, agreeing, and depeg-authoritative source distributions without changing live pricing selection

Impact Notes

• `ybold-yearn` is admitted through Ethereum on-chain total supply and publishes `protocol-redeem` pricing from `convertToAssets(1 share)` multiplied by the tracked `bold-liquity` parent price
• `sbold-k3-capital` and `ybold-yearn` are both covered by regression tests for BOLD-derived ERC-4626 NAV pricing
• The parent-trust gate, parent provenance metadata, and 0.5-10.0 share-to-asset bounds remain unchanged

Impact Notes

• `usp-pareto-credit` and `tryb-bilira` can use `coingecko-low-volume` fallback pricing when CoinGecko has a positive row inside the relaxed low-volume freshness window and all earlier missing-price passes fail
• The recovery is explicitly allowlisted, keeps `priceConfidence: fallback`, and does not change the strict primary CoinGecko freshness gate
• DefiLlama supply rows remain authoritative for these assets; the new pass only fills missing price provenance and cannot overwrite an already-published primary price

Impact Notes

• `zsd-zephyr-protocol` keeps CoinGecko as the preferred market price when available, but its circulating supply is sourced from Zephyr's official `zsd_circ` value instead of CoinGecko market cap
• `zys-zephyr-protocol` is admitted through the supplemental Zephyr Scanner path using official ZYS circulation and share price, so the yield wrapper can appear in `/api/stablecoins` without a supported chain contract
• `zephyr-scanner` is registered as an explicit pricing source with no dedicated breaker; the fetch remains scoped to the supplemental Zephyr asset path

Impact Notes

• `jupiter-prices` still records failures for non-OK responses and malformed envelopes, but decimals-only rows for unsupported mints no longer open the circuit
• Quoted rows still require `usdPrice`, `decimals`, fresh `blockId`, optional liquidity gating, and peg-aware validation before a price can be accepted

Impact Notes

• `susdc-spark`, `gtusdcp-gauntlet`, `steakusdt-steakhouse`, `steakusdc-steakhouse`, `srusde-strata`, `savusd-avant`, `susn-noon`, and `syzusd-yuzu` now use guarded ERC-4626 `convertToAssets(1 share)` pricing when their tracked parent assets are fresh and replay-safe
• `iusd-initia` now inherits tracked `ausd-agora` pricing, `usdcx-movement` inherits tracked `usdc-circle` pricing, and `sgho-aave` uses a protocol-specific `previewRedeem(uint256)` quote against tracked `gho-aave`
• `susdc-spark` can now appear in the stablecoins sync even without a DefiLlama or CoinGecko market row by using curated Ethereum vault supply, after which the authoritative NAV override supplies the live price
• Existing parent-trust gates, parent provenance metadata, and NAV ratio bounds are unchanged

Impact Notes

• `usdk-kast` and `xo-exodus` can recover from `priceSource: missing` when `wm-m0` becomes a fresh high-confidence parent through primary consensus or GeckoTerminal probing during the same run
• The parent-trust guard remains unchanged: low-confidence, stale, cached, or non-replay-safe parent prices still cannot upgrade into `protocol-redeem` child prices
• The earlier pre-enrichment override pass is retained, but the final completion pass no longer reuses its stale override map after source enrichment has changed asset prices

Impact Notes

• `usx-dforce` can now recover from `priceSource: missing` through its tracked Base USX contract when DexScreener publishes a sufficiently liquid exact-address market
• The change does not use stale CoinGecko rows and does not enable symbol search when exact tracked contracts exist
• Metadata-derived DexScreener targets require the tracked-token symbol in the matched pool to equal the asset symbol, preventing wrapper quotes such as `cUSDO` from being accepted for `USDO`
• Existing upstream-provided addresses still take precedence; tracked metadata contracts are only used for addressless rows

Impact Notes

• `usg-tangent` can now recover from `priceSource: missing` when DefiLlama publishes the live USG contract quote under a lower-case EVM address
• The DefiLlama fallback still requires exact quote-symbol agreement, so unrelated symbols such as `stkGHO` are not accepted for `sgho-aave`
• Non-EVM identifiers, including Solana mints, keep their original case because those addresses are case-sensitive

Impact Notes

• `aa-falconx-mev-capital` now publishes a `protocol-redeem` high-confidence NAV from the CDO `virtualPrice` reading and the tracked `usdc-circle` parent price, instead of staying at `priceSource: missing`
• The provider reuses the shared parent-trust gating, parent provenance metadata, and 0.5–10.0 NAV bound from the ERC-4626 NAV lane so untrusted, stale, or degenerate quotes cannot upgrade into a high-confidence child price

Impact Notes

• `susdt-spark`, `gtusdc-gauntlet`, `yvusdc-yearn`, `stkgho-umbrella-aave`, and `sbold-k3-capital` now publish a `protocol-redeem` high-confidence price derived from the standard ERC-4626 `convertToAssets(uint256)` selector and the tracked parent asset price
• Each vault override carries the parent provenance metadata (source, confidence, observed-at, replay-safety) the same way the inherited tracked-base lane already does
• The provider rejects on-chain quotes outside a 0.5–10.0 share-to-asset bound to prevent silent regressions if the vault contract migrates or returns degenerate data
• Parent-trust gating is shared with the existing inherited-base lane, so low-confidence, stale, cached, or fallback parents cannot upgrade into a high-confidence child vault price

Impact Notes

• Operators can set `JUPITER_API_KEY` so Worker-side Jupiter fallback requests include the required `x-api-key` header for `api.jup.ag`
• The fallback still only applies to tracked Solana mints that remain missing after primary consensus, authoritative overrides, DefiLlama contract lookup, and CoinMarketCap enrichment
• Jupiter responses continue to require documented V3 quote fields, fresh block context, and peg-aware plausibility validation before a price is accepted

Impact Notes

• Bitstamp, Coinbase, oracle, Curve, CoinGecko-derived, and promoted DEX protocol candidates are rejected before primary admission when their timestamps are stale, invalid, missing where required, or future-skewed beyond the shared freshness ceiling
• Promoted DEX protocol lanes are freshness-checked per lane, so a fresh parent dex_prices row cannot carry stale protocol-level sources into consensus
• Severe fixed-peg downside publication now requires independent source-family corroboration; correlated CoinGecko plus DefiLlama-list evidence no longer satisfies the guardrail on its own
• Tracked-base authoritative inheritance now requires a fresh, replay-safe, high-confidence or explicitly authoritative parent and carries parent provenance through accepted overrides
• The methodology now documents the existing trust-tier-first low-confidence selector and upper-middle median estimator for even-sized clusters

Impact Notes

• DEX bridge source drops are now explainable by stale row, malformed JSON, missing registry mapping, below-threshold TVL, or lack of corroboration without changing the existing admission gates
• DEX-inclusive stablecoin prices can carry active protocol-lane count, freshest DEX lane age, and aggregate-only reliance through priceSourceConfidenceProfile
• Direct DEX API fetches now share a 15-second request timeout, run independent protocol fetches with concurrency 2, and emit resume markers when deterministic page caps are reached
• Direct-API and staged-pool merge metadata now count accepted protocol-chain lanes and excluded rows by reason, protocol, chain, threshold, and identity conflict

Impact Notes

• WARS (ARS) and cNGN (NGN) can validate weak live USD marks against direct native-peg and daily FX references, while KGST (KGS) uses daily FX references plus deterministic bounds because CoinGecko does not expose a native KGS quote
• KGS and NGN use the same fawazahmed0 secondary FX cadence semantics as CNH, RUB, UAH, and ARS for live sync and historical backfills
• MYR, KRW, KGS, and NGN now retain deterministic fallback price bounds even during no-reference validation paths
• Direct-API protocol DEX bridges (Meteora, PancakeSwap, Aerodrome Slipstream, Velodrome Slipstream) now register as first-class soft-DEX pricing families (`meteora-dex`, `pancakeswap-dex`, `aerodrome-dex`, `velodrome-dex`) so they can contribute directly to primary consensus when promoted

Impact Notes

• FX cron requests MYR and KRW from Frankfurter and validates them against per-peg bounds
• Native-peg implied-price lane corroborates MYR / KRW depegs via direct CoinGecko myr / krw quotes
• Stablecoin charts reconciliation, price-validation classifyPegClass, and FX cadence metadata cover the new pegs

Impact Notes

• Pool challenge replacement now updates allPrices so severe-downside corroboration carry-through uses the replacement source
• curve-oracle now enforces a 5-minute on-chain staleness guard using block timestamp and has its own circuit breaker
• curve-onchain and Bitstamp / Coinbase now publish upstream-observed freshness instead of local-fetch
• NAV tokens are no longer subject to pool-challenge downgrade / replacement
• Cluster tiebreak now prefers hard-tier clusters over equal-weight soft-tier clusters before spread / peg proximity
• Two-source clusters composed only of list-style aggregators (coingecko, defillama, defillama-list) are now downgraded to single-source regardless of which two combine, closing the CG+defillama-detail tautology
• Replay cache enforces per-source max trusted age in addition to the composite 6-hour cap
• DefiLlama /coins contract-price fallback and DexScreener dex-liquidity / dex-discovery fallbacks now gate on and record against their own circuit breakers
• A lone promoted DEX protocol is admitted only when no non-DEX source exists, or when a hard market/oracle/protocol source agrees within threshold; two or more promoted DEX protocols are admitted as candidate sources before consensus determines agreement
• Binance short-circuits to the secondary host on HTTP 5xx / 429 instead of retrying the first host
• RedStone solo-retry is bounded to 5 requests per run and spaced to respect Worker connection budget
• GT-probe evidence rejection downgrades the pre-GT primary to low-confidence when divergence was significant
• Provider diagnostics and GT-probe statistics are now surfaced on /api/status for operator visibility

Impact Notes

• Near-peg or stale DEX liquidity can no longer overwrite a severe depeg already corroborated by independent live candidates such as CoinGecko, DefiLlama-list, and Pyth
• The same severe-downside candidate evidence satisfies the temporal-jump guard when the previous trusted price was near peg
• The pool challenge remains active for weak or uncorroborated soft-source prices, and still replaces prices when independent DEX protocol medians are the only corroborating disagreement
• USR now preserves the market price near the live CoinGecko/DefiLlama/Pyth severe-depeg level while marking the result low-confidence when DEX pools disagree

Impact Notes

• Low-confidence severe depeg prices can stay published when multiple live candidate sources independently confirm the downside even if they do not form a tight high-confidence cluster
• The severe-downside guardrail is unchanged for genuinely single-source prices because candidate evidence is reused only when the current asset price, source, and confidence still match the primary result
• Assets such as USR no longer flap to `N/A` after primary pricing accepted a corroborated severe depeg and a later generic validation pass lost the candidate-price evidence

Impact Notes

• When every attempted Binance host returns 403 or 451, the run records diagnostics but closes the source-wide breaker instead of escalating a persistent false outage
• Binance contributes zero prices in that state, so consensus continues through Kraken, Bitstamp, Coinbase, Pyth, RedStone, Curve, DEX, CoinGecko, and DefiLlama inputs
• Transport errors, server errors, malformed responses, or successful responses with zero tracked matches still follow the normal failure diagnostics path

Impact Notes

• If authoritative pricing removes all Jupiter fallback candidates, the stale `jupiter-prices` breaker can recover without spending a provider request
• The change prevents irrelevant provider-edge blocks from keeping the public circuit list open when Jupiter is not part of the current pricing path
• Future eligible Jupiter fallback candidates still go through the normal circuit breaker and provider diagnostics path

Impact Notes

• Binance pricing now tries `data-api.binance.vision` first and falls back to `api.binance.com` before recording the source as failed
• Provider diagnostics preserve each attempted Binance endpoint so operators can see which host succeeded or failed
• The change keeps the same tracked `USDTUSD` and `USDCUSD` market mappings and does not alter consensus weighting

Impact Notes

• Jupiter fallback and health probes now use `https://api.jup.ag/price/v3` instead of the Lite gateway
• The source-level circuit can recover through the same official V3 response shape already used by the fallback parser
• The fallback remains best-effort, liquidity-gated, and downstream of authoritative protocol-backed prices

Impact Notes

• `sync-stablecoins` cron metadata now records Binance and Jupiter attempt status, endpoint, candidate counts, response counts, matched counts, and sanitized snippets for non-OK responses
• Protocol-backed live overrides are pre-applied before fallback enrichment and re-applied after GeckoTerminal probing, preserving final authoritative price semantics while keeping inherited-price assets out of unnecessary fallback probes
• The Jupiter breaker can run a bounded health probe when no fallback candidates remain, allowing a previously open breaker to recover once the provider is reachable instead of staying stale-open indefinitely

Impact Notes

• Addressless DefiLlama stablecoin rows can now recover prices through exact curated `contracts` metadata instead of requiring the upstream row to carry its own `address` field
• `ctusd-citrea` can publish the fresh DefiLlama `citrea:<contract>` quote surfaced by the coins API without relying on symbol search or stale CoinGecko rows
• `usdnr-nerona` now inherits tracked `wm-m0` live pricing and historical replay through the existing authoritative `protocol-redeem` lane used by other M0 extension assets

Impact Notes

• Primary pricing requests `last_updated_at` from CoinGecko `/simple/price` and records it as upstream freshness when present
• CoinGecko simple-price rows older than the source trust window are excluded from primary consensus rather than being treated as current
• Downstream consumers such as PegScore and DEWS now see missing, lower-confidence, or non-CoinGecko corroborated inputs instead of replaying stale CoinGecko marks as fresh

Impact Notes

• Live pricing now publishes `usdk-kast` and `xo-exodus` from the authoritative `protocol-redeem` lane by inheriting tracked `wm-m0` pricing when that parent rail is available
• Historical depeg backfills for those assets now replay the tracked `wm-m0` market series instead of relying on missing or thin child-market history
• This extends the same tracked-base inheritance pattern already used for `usdai-usd-ai -> pyusd-paypal`, keeping wrapper-style M0 extension assets aligned with their executable parent value

Impact Notes

• `dexscreener-prices` now reflects only `/tokens/v1/{chainId}/{address}` availability in the late-stage stablecoin pricing fallback
• The symbol-search recovery path now records independently under `dexscreener-search`, which keeps search-specific failures visible without poisoning exact-address availability
• Public-health grouping excludes the search-only breaker so a best-effort addressless fallback issue does not count as a separate top-level availability circuit group

Impact Notes

• Pass 4 still prioritizes exact-target assets first and then larger circulating names, but it now walks the full sorted missing set until it spends the 10-request DexScreener budget
• Addressless non-unique symbols that are skipped without making a request no longer consume one of the candidate slots that can reach lower-rank unique-symbol recoveries such as CHFAU or ctUSD
• This reduces false `dexscreener-prices` breaker opens during bad network windows because the pass has more chances to record at least one healthy DexScreener response before giving up

Impact Notes

• Live post-enrichment validation now lets supported non-USD fiat assets replace materially divergent weak or mixed-source USD publications when a direct native quote implies a fresher peg-consistent USD mark
• The same native lane can now fill a missing live price for supported non-USD fiat assets when direct native CoinGecko pricing exists and the derived USD mark passes publication validation
• That native-implied mark remains a fresh fallback-validation lane rather than a replay-safe primary consensus source: it is not written into `price_cache`, and later replay cannot publish it as cached continuity

Impact Notes

• Historical CoinGecko market-chart replay now passes the configured CoinGecko API key through the backfill/admin path so native-fiat history can use the authenticated transport consistently during broad repairs
• Supported non-USD fiat backfills now replay native-fiat history at daily cadence with a two-point confirmation window across a 36-hour gap tolerance instead of opening on isolated thin hourly prints
• Extreme single-point native crashes of 5,000 bps or more are still preserved even when the normal historical confirmation rule would otherwise suppress the event

Impact Notes

• Supported non-USD fiat assets such as EUR, CHF, GBP, JPY, SGD, AUD, CAD, BRL, IDR, TRY, ZAR, PHP, MXN, RUB, and CNH/CNY can now consult fresh direct native-peg quotes before downstream depeg logic trusts a derived USD-versus-FX move
• Historical market replay now prefers direct CoinGecko native fiat pairs for those supported pegs and compares that native series directly to the `1.0` peg instead of replaying through `USD price / FX reference` when native history exists
• The published live USD price path still does not gain a second CoinGecko-derived consensus voice; this remains a downstream validation and historical-replay hardening change rather than a new cached live source

Impact Notes

• Live depeg detection now checks a fresh direct `coin/native-peg` quote for supported fiat pegs such as BRL before opening or extending downstream depeg state
• Pending depeg confirmation uses that same direct native quote first, reducing BRZ-style false positives caused by USD/FX reference drift
• The published live price remains the normal USD pipeline output; this change hardens downstream validation rather than introducing a new cached price source

Impact Notes

• Live pricing now treats `usdai-usd-ai` as a redeemable PYUSD wrapper and publishes it from the authoritative `protocol-redeem` lane when tracked PYUSD pricing is available
• Historical depeg backfills for `usdai-usd-ai` now replay the tracked PYUSD market series instead of trusting USDAI's own thin secondary-market history
• USDAI PegScore and depeg event history no longer inherit obvious false positives from wrapper-specific market dislocations that conflict with the token's instant-redemption semantics

Impact Notes

• Bunni slugs are now rejected during DEX crawl intake and DeFiLlama pool processing, so they no longer spend discovery or scoring budget
• Retained-pool filtering, challenger publication, and dex_prices publication all ignore Bunni even if stale or staged rows try to reintroduce it
• Pool-challenge replacement marks and promoted DEX bridge sources can no longer be pulled back toward peg by Bunni rows

Impact Notes

• USR no longer sits in `REDSTONE_TRACKED_SYMBOL_ALLOWLIST` once the live RedStone API stopped serving that exact-case symbol
• The RedStone price lane no longer spends request budget batching and retrying a symbol the provider currently omits
• Pricing-provider audit and merge-gate validation now fail only on live coverage drift that still exists, not on a known stale allowlist entry

Impact Notes

• dex_prices now rebuilds its aggregate and per-protocol bridge sources from retained priced pools after the full liquidity scoring filters run
• Promoted DEX bridge inputs and peg-summary dexPriceCheck now stay aligned with the same retained pool surface used by challenger publication and liquidity UI detail
• Skipped duplicate or low-quality discovery rows can no longer create synthetic near-peg DEX bridge marks for assets whose retained pools still show a depeg

Impact Notes

• Pool challenge still downgrades weak soft-source consensus when any qualifying challenger pool diverges beyond the peg-aware threshold
• Price replacement now requires at least two protocol-level challenger medians to diverge, rather than counting divergence from any one pool inside each protocol
• A rogue pool inside an otherwise agreeing protocol no longer drags severe depegs back toward peg on the published stablecoins snapshot
• The final replacement mark remains the TVL-weighted median across the corroborating divergent protocol groups

Impact Notes

• Pricing sources now carry explicit freshness kind, max trusted age, upstream-timestamp support, single-source authority, and market-capability metadata in the canonical registry
• High-confidence consensus now publishes the winning cluster median while preserving the internally selected cluster member for provenance and downstream policy
• DefiLlama list quotes now enter primary pricing as typed inputs with explicit observed-time provenance instead of inheriting mutable asset-state timestamps
• DEX bridge source freshness now preserves per-source timestamps from `price_sources_json` instead of flattening everything to the row write time
• DefiLlama contract fallback now prefers canonical tracked deployment identities, validates each quote before claiming the asset, and can probe multiple exact tracked coin ids when needed
• DexScreener fallback now prioritizes exact-target assets under the request cap and keeps symbol search reserved for addressless assets only
• Pyth confidence weighting is now smoother across medium-confidence prints, and RedStone requires at least 60% venue agreement before entering primary consensus
• The provider-config pricing audit is now part of CI validation instead of remaining a local-only check

Impact Notes

• DefiLlama pass 1 and pass 1b now validate quotes against the shared peg-aware bounds before marking an asset as resolved
• A bad DL contract response can no longer block later CoinMarketCap, Jupiter, or DexScreener fallback passes in the same run
• DexScreener symbol search now stays disabled whenever the asset already has a canonical chain+address lookup path; only addressless assets can use the unique-symbol search fallback
• This reduces wrong-identity recovery risk while preserving the exact-address DexScreener recovery path for assets with tracked deployments

Impact Notes

• GeckoTerminal probing now collapses pools to one TVL-weighted-median price per protocol before injecting a cross-protocol weighted-median mark
• Pool challenge replacement now uses corroborating divergent protocol groups rather than a raw all-pool weighted mean, making replacement marks less sensitive to repeated same-protocol pools
• Provider-config audit tests now guard CEX and RedStone coverage allowlists against duplicate or stale untracked entries
• The stale untracked `sUSDe` RedStone allowlist entry was removed so the runtime config matches the tracked registry again

Impact Notes

• Stablecoin payloads, peg-summary outputs, and `price_cache` rows now preserve `priceObservedAtMode` alongside `priceObservedAt`
• Primary consensus now carries freshness provenance per source and resolves a conservative effective mode for the selected price
• Hard single-source prices remain depeg-authoritative only when they retain source-native freshness provenance; local-fetch hard single-source prices now stay `confirm_required`
• Older rows remain backward-compatible: cached data that predates explicit freshness-mode storage does not automatically lose authority just because the mode is absent

Impact Notes

• Cached-fallback FX runs now keep probing Open Exchange Rates, Chainlink reference feeds, and gold-api.com instead of freezing their last known state until Frankfurter recovers
• A single stale intraday peg can no longer pin the whole FX lane in repeated cached fallback when OXR or Chainlink can refresh that subset independently
• If those independent probes restore fresh coverage for the expected fiat reference set, the run now exits cached fallback immediately and resets the fallback streak
• Operator metadata remains explicit about the failed Frankfurter / mirror path while no longer overstating the duration of an otherwise recovered FX incident

Impact Notes

• Previous-trusted price lookup now merges the last authoritative stablecoins publication with fresh replay-safe `price_cache` metadata
• Cached replay can keep publishing the last fresh corroborated depeg price through brief single-run corroboration gaps instead of dropping the asset to `N/A`
• Confirmed severe depegs no longer lose continuity just because an intervening stablecoins run published a `low` or unusable price state
• This closes the intermittent USR-style divergence where PSI could still explain the open depeg while detail surfaces lost the current price

Impact Notes

• Pricing source capabilities now come from one canonical registry shared by consensus, replay safety, pool challenge, GT probing, status health, and depeg trust classification
• Cached stablecoin payloads now preserve `priceObservedAt` and `priceSyncedAt`; compatibility `priceUpdatedAt` now reflects the true observation timestamp rather than the sync write time
• Soft single-source prices and soft-only high-confidence consensus can no longer mutate live depeg state directly; hard single-source sources such as Pyth, CEX, Curve, and protocol-redemption can still be authoritative
• Weak fixed-peg price jumps versus the previous trusted price now require corroboration before publication, closing the USR-style wrong-price path
• Pool challenge now uses the live $100K threshold in its published challenger snapshots and can harden weak soft-source outcomes, not only pre-downgrade high-confidence clusters
• GeckoTerminal probing now revisits weak CoinGecko / DL-list soft outcomes rather than only strict one-source cases
• Direct-API DEX quote conversion now reuses only authoritative tracked stablecoin prices; weak or stale tracked prices fall back to peg references instead of feeding the bridge loop
• Replay cache rows now keep source, confidence, observation time, sync time, and source lists; RedStone now derives its price from the venue median instead of the provider aggregate
• CoinMarketCap, Jupiter, and DexScreener enrichment passes now fail independently instead of aborting the whole late-enrichment block

Impact Notes

• Primary pricing candidates are no longer gated on `geckoId`; tracked assets can still enter consensus through Pyth, CEX, RedStone, Curve, DL-list, or DEX bridge inputs
• DefiLlama pass 1b now probes only tracked alternate deployments instead of synthesizing same-address identities across chains
• CoinMarketCap and DexScreener symbol fallbacks now require uniqueness within the tracked registry, reducing symbol-collision poisoning
• RedStone prices now require at least two corroborating venues before entering primary consensus
• Pool challenge now applies to DEX-inclusive soft consensus clusters unless an exempt hard source is present
• GeckoTerminal probing now cross-checks eligible single-source DL-list results in addition to single-source CoinGecko results
• Direct-API DEX pair conversion now prefers tracked cached stablecoin prices for quote legs and will not treat unknown addressed `USDC`/`USDT`-style symbols as automatic `$1` references
• Price-cache replay now stores only replay-safe non-low, non-fallback prices and the replay window is shortened from 24h to 6h
• Severe fixed-peg downside publication now requires corroboration unless the source is an explicit protocol-redemption or pool-challenge replacement mark

Impact Notes

• DEX identity is now canonical-only at runtime: DeFiLlama and subgraph parsing no longer mutate chain-aware token ownership
• Symbol fallback remains available only for addressless tokens; addressed unknown tokens are dropped instead of being reinterpreted by symbol
• DeFiLlama pools with `underlyingTokens` now match tracked assets by canonical addresses only, preventing positional symbol/address poisoning
• Promoted per-protocol DEX bridge sources are admitted into primary consensus only when corroborated or when no non-DEX voices exist
• The overlapping `dex-promoted` aggregate is withheld whenever promoted per-protocol DEX bridge data exists for the same asset

Impact Notes

• Quarter-hour FX runs no longer poison status simply because Frankfurter and mirror transports failed to re-deliver an already-current daily source snapshot
• Carry-forward runs preserve per-peg source dates and cadence metadata, so status still degrades normally once the underlying daily references actually age out
• Operator metadata still records the failed live transport path, but public health now aligns with source freshness rather than transport availability alone

Impact Notes

• Jupiter fallback now relies on V3 liquidity gates and peg-aware validation instead of treating optional `createdAt` metadata as a hard freshness cutoff
• Tracked Solana assets can recover through Jupiter even when V3 responses include old createdAt values alongside current block-level pricing
• DexScreener fallback now prefers exact chain+address pool lookups when an asset has a resolvable token address, reducing dependence on noisy symbol search results
• DexScreener search remains as the last fallback path, still capped by the shared request budget and liquidity sanity gates

Impact Notes

• Frankfurter remains the preferred ECB-backed business-day source for the core fiat set
• The existing `fawazahmed0/currency-api` mirrors still serve CNH/RUB/UAH/ARS and can backstop the wider fiat set when Frankfurter is unavailable
• When both current FX paths fail, ExchangeRate-API can now publish a daily full-set fiat snapshot instead of forcing an immediate cached-fallback run
• The About page and pricing methodology now disclose ExchangeRate-API as an externally visible FX reference source

Impact Notes

• CNH/RUB/UAH/ARS still use the secondary daily feed as their normal source path
• When Frankfurter fails, the fresher `fawazahmed0/currency-api` mirror can now populate the broader fiat FX set instead of forcing an immediate cached-fallback run
• Per-peg FX metadata preserves calendar-daily cadence and source-date semantics during this live fallback path
• Public health no longer needs to report long consecutive cached-fallback FX runs for a Frankfurter-only outage when the secondary feed is healthy

Impact Notes

• Pool challenge no longer depends on dex_liquidity.top_pools_json, so display truncation cannot hide a large challenger pool
• Published challenger snapshots are coverage-gated per stablecoin and fall back safely during migration gaps
• Cached FX fallback runs preserve per-peg source timestamps and source modes instead of refreshing them implicitly
• Health and status now report usable FX freshness, underlying source freshness, and consecutive fallback runs separately
• Non-USD and commodity validation consumers now read shared FX state instead of inferring freshness from cache updated_at alone

Impact Notes

• Kraken joins primary consensus at weight 2 for supported USD pairs
• Bitstamp joins primary consensus at weight 1 as a lower-weight corroborating CEX venue
• Primary CEX fetches remain grouped so the quarter-hour pricing lane does not add new peak connection fan-out
• Missing Solana prices can now resolve through Jupiter before DexScreener, gated by liquidity and peg-aware plausibility checks
• Curated Chainlink EUR/USD, GBP/USD, JPY/USD, XAU/USD, and XAG/USD feeds can now refresh the FX/reference cache when fresh and aligned
• Status source distribution now reports Kraken, Bitstamp, and Jupiter participation explicitly

Impact Notes

• Transitive source chains can no longer create fake multi-source high confidence
• Equal-size cluster ties now resolve deterministically by weight, spread, peg proximity, then label
• Fixed-peg assets no longer silently fall back into NAV-style 500 bps clustering when peg references are missing
• Stale or aggregate-only RedStone entries are excluded before consensus
• Protocol-backed redemption prices can no longer be overwritten by the GeckoTerminal probe
• Direct-API pools must pass shared TVL sanity gates before they suppress overlapping DeFiLlama pools

Impact Notes

• Fluid, Balancer, Raydium, and Orca now contribute at most one promoted consensus source each
• Repeated high-TVL pools from the same protocol can no longer overweight primary consensus by appearing multiple times
• dex_prices.price_sources_json now stores per-protocol aggregates for the pricing bridge
• Pool challenge no longer depends on dex_prices.price_sources_json; it reads current top pools from dex_liquidity instead
• Non-USD tracked stablecoin pairs use peg-reference-aware conversion when deriving direct-API DEX prices

Impact Notes

• Pool-level individual prices added as fourth depeg confirmation source — fixes dUSD-like depegs going undetected
• Pool challenge threshold now peg-type-aware: 300 bps for non-USD (was 500 bps for all)
• Pyth feeds with >200 bps confidence excluded from consensus; 100-200 bps downweighted
• RedStone excluded when internal venue agreement < 50%
• CG+DL-only consensus downgraded from high to single-source (illusory agreement)
• NAV tokens (FPI) now visible in peg-summary API with null deviation
• Full source list preserved in consensus label (no more truncation)
• Protocol override divergence warnings logged when >100 bps from consensus

Impact Notes

• Dropped DL coins API from primary consensus — it returned CG-sourced data, making CG+DL agreement tautological
• Added DefiLlama stablecoins list price (weight 1) as a genuinely independent aggregator voice
• Added GeckoTerminal pool probe (weight 1) for single-source CG-only assets with $10K TVL gate
• Pool challenge guard: downgrades soft-only high confidence to 'low' when any $100K+ TVL DEX pool diverges ≥500 bps
• Pool challenge price correction: replaces soft consensus price with TVL-weighted mean of all qualifying individual pool prices
• DEWS scoring suppresses degradation bonus for high→single-source transitions to prevent alert spikes
• ~130 assets retain genuine high confidence via CG+DL-list agreement; ~27 gain GT cross-check

Impact Notes

• 8 independent price sources with per-source circuit breakers and configurable weights
• Consensus algorithm clusters sources within 50 bps, picks highest-weight in largest cluster
• Authoritative protocol-redemption overrides for wrapper assets (cUSD, iUSD, crvUSD)
• 4-pass enrichment pipeline for assets still missing prices after primary consensus
• Price confidence tagging: high (2+ agree), single-source, low (disagree), fallback
• CoinMarketCap enrichment optimized from per-slug to batch listings endpoint

Impact Notes

• CoinGecko primary prices with DefiLlama cross-validation
• Basic price reasonableness checks against peg references
• DexScreener enrichment for assets missing from aggregators