Validate the complete investment rework and rehearse database upgrades #135

Goal

Confirm the complete epic is financially correct, responsive and safe to integrate, with concrete migration evidence before a final main PR.

Scope

Audit every epic acceptance criterion against its sub-issue implementation and remove temporary fixtures/TODO flows. Run the relevant full workspace, integration, typecheck, client build/lint and deployment-test checks; complete a desktop/mobile/theme/privacy/accessibility and empty/stale/error/failed-save pass. Verify no regression in Dashboard/Analytics/Accounts, locks/archive, posted/pending semantics, FX warnings, exports, source revisions and the independent MCP read contract/write boundary.

Validate all newly added migrations in sequence on a fresh disposable D1 database and an upgrade from the real preceding schema. Rehearse against an up-to-date export if available at implementation time; use only disposable local copies and preserve the source export. Compare existing financial rows, quantities, cash balances, reciprocal links, audits and revision behavior; enumerate every intentional backfill and test failure rollback. The earlier October 12 backup rehearsal only validates migration 017, not future migrations or later live data. Keep private data, local configs and database copies out of Git and issue output; publish a sanitized result.

Measure request fan-out and responsiveness with a representative synthetic many-holdings fixture and record results against the market/history budgets. Prepare the final epic-to-main PR only when all required features are complete, with migration/deployment order, limitations and recovery notes. Do not merge main, apply remote migrations or deploy as part of validation.

Completion criteria

• All sub-issues and the original design interactions are accounted for, with no mock financial values in production code.
• Required automated checks and desktop/mobile/theme/privacy/error-state checks pass with recorded evidence and remaining limitations.
• Fresh/upgrade/disposable-export rehearsals cover every new migration, preserve existing financial data except documented intentional changes, and verify integrity/foreign keys/rollback.
• API/client/MCP values, bounded loading behavior, exports and source-revision invalidation agree with the chosen contract.
• A reviewable final integration PR and sanitized migration report are ready; main and production remain unchanged pending explicit merge/deployment authorization.

References

Parent: #123. Milestone: Investment Page Rework.

Design: user-supplied Investments Redesign.dc.html, sections 1a (desktop), 1b (mobile), and the holdings-table screenshot in the Codex conversation. Its generated prices, fixed FX, dates and sample holdings are visual fixtures, not calculation rules or migration data.

Branch from the fetched epic/123-investment-rework tip, use this sub-issue number in the branch name, and target its PR to that epic. Final integration into main requires completion of the epic and explicit user approval.

Implementation dependencies: #133, #134. Native blocked-by relationships record these prerequisites.

Accounting contract from #126

Review checkpoint: MR #136; version 1 contract. Apply the reviewed contract when this prerequisite is integrated; this note does not start this child or approve a merge.

Validate runtime adapters against the reviewed v1 synthetic examples and coverage rules. The 25 checks in #136 verify specification arithmetic and shared FX; they are not evidence that legacy runtime paths already implement the contract. Keep separate runtime parity, Worker/D1 migration/write tests and UI verification. Check opening-basis versus lifetime-cash distinction, full liquidation/rebuy, included fees, cross-FX basis, zero/negative net invested, gross-flow daily estimates, manual total/per-unit mirrors and view-specific net-worth exclusions. Each future migration must update any explicitly enumerated financial UPDATE trigger fields and export coverage. #136 adds no migration and performs no production writes.

Integration checks identified during #128

Exercise deliberate interleavings between the new atomic trade writer and legacy ordinary cash creation/edit/deletion, cash transfers, recurring cash execution and account balance corrections on the same cash account. A new writer’s guarded snapshot does not by itself make an older multi-step writer atomic; verify final ledger-derived balances and rollbacks across those mixed paths before the final epic rollout, and fix discovered failures. Also cover trade receipt expiry/capacity, original editor versions across refresh, and source-revision invalidation for all migration 019 fields. #139 provides focused linked-trade concurrency tests and export-upgrade evidence; it does not replace this integrated audit.

Overview integration checks from #133

Exercise current metric and history coverage with an opening anchor older than the provider’s bounded daily-history horizon, including a split between the opening and the fetched window. Verify that missing historical corporate-action coverage cannot be treated as verified cost/units merely because the current holding quantity matches. Compare the independent current-metrics and historical-replay paths; retain explicit unavailable coverage if the inputs cannot support a result. Also compare the full overview/history scopes after filtering, sold/archived holdings and missing FX, and measure distinct-symbol request fan-out with many holdings.

Completed integration checkpoint

Validation MR #146 is merged into epic/123-investment-rework. Final epic-to-main MR #147 is ready, with the full implementation, migration/deployment order, recovery notes and documented limits. Final PR CI passed on 8d019fdda2ddd731f7b496c816826e63b6eb12de, including both client runtimes and full Worker/D1 integration.

Both supplied October 8 and October 12 schema-016 exports passed fresh/upgrade rehearsals through 021 and real-copy migration failure/rollback checks. Existing columns/row IDs across 15 tables and migration history were preserved. Original files unchanged; private databases removed; zero outbound provider requests. Additional real-copy tests covered protected/unlocked existing holdings, linked trade/cash round trips, new asset categories, accounting/rebuy, concurrent retries/mixed writers, pending isolation, exact cross-currency cash, write rollback, API/MCP parity, twelve history ranges, export and due recurring occurrences with repeat execution. Synthetic local prices/FX validate behavior, not live market coverage.

Legacy precision boundary: some saved numeric balances cannot be used by the strict trade writer without explicit reconciliation. Refusal was nonmutating. Explicit Accounts corrections in private copies followed by new trades and reversal passed; old trade/cash legs were not rewritten. The PR records the required production review step; migrations do not round these values automatically.

All completion criteria are met. The implementation is integrated in the epic and the final review PR is prepared. Epic #123 remains open until the complete rework is merged into main. No main merge, remote migration, deployment or release was performed.