Pricing Pipeline Changelog: v3 archive

Impact notes

• Live post-enrichment validation now lets supported non-USD fiat assets replace materially divergent weak or mixed-source USD publications when a direct native quote implies a fresher peg-consistent USD mark
• The same native lane can now fill a missing live price for supported non-USD fiat assets when direct native CoinGecko pricing exists and the derived USD mark passes publication validation
• That native-implied mark remains a fresh fallback-validation lane rather than a replay-safe primary consensus source: it is not written into `price_cache`, and later replay cannot publish it as cached continuity

Impact notes

• Historical CoinGecko market-chart replay now passes the configured CoinGecko API key through the backfill/admin path so native-fiat history can use the authenticated transport consistently during broad repairs
• Supported non-USD fiat backfills now replay native-fiat history at daily cadence with a two-point confirmation window across a 36-hour gap tolerance instead of opening on isolated thin hourly prints
• Extreme single-point native crashes of 5,000 bps or more are still preserved even when the normal historical confirmation rule would otherwise suppress the event

Impact notes

• Supported non-USD fiat assets such as EUR, CHF, GBP, JPY, SGD, AUD, CAD, BRL, IDR, TRY, ZAR, PHP, MXN, RUB, and CNH/CNY can now consult fresh direct native-peg quotes before downstream depeg logic trusts a derived USD-versus-FX move
• Historical market replay now prefers direct CoinGecko native fiat pairs for those supported pegs and compares that native series directly to the `1.0` peg instead of replaying through `USD price / FX reference` when native history exists
• The published live USD price path still does not gain a second CoinGecko-derived consensus voice; this remains a downstream validation and historical-replay hardening change rather than a new cached live source

Impact notes

• Live depeg detection now checks a fresh direct `coin/native-peg` quote for supported fiat pegs such as BRL before opening or extending downstream depeg state
• Pending depeg confirmation uses that same direct native quote first, reducing BRZ-style false positives caused by USD/FX reference drift
• The published live price remains the normal USD pipeline output; this change hardens downstream validation rather than introducing a new cached price source

Impact notes

• Live pricing now treats `usdai-usd-ai` as a redeemable PYUSD wrapper and publishes it from the authoritative `protocol-redeem` lane when tracked PYUSD pricing is available
• Historical depeg backfills for `usdai-usd-ai` now replay the tracked PYUSD market series instead of trusting USDAI's own thin secondary-market history
• USDAI PegScore and depeg event history no longer inherit obvious false positives from wrapper-specific market dislocations that conflict with the token's instant-redemption semantics

Impact notes

• Bunni slugs are now rejected during DEX crawl intake and DeFiLlama pool processing, so they no longer spend discovery or scoring budget
• Retained-pool filtering, challenger publication, and dex_prices publication all ignore Bunni even if stale or staged rows try to reintroduce it
• Pool-challenge replacement marks and promoted DEX bridge sources can no longer be pulled back toward peg by Bunni rows

Impact notes

• USR no longer sits in `REDSTONE_TRACKED_SYMBOL_ALLOWLIST` once the live RedStone API stopped serving that exact-case symbol
• The RedStone price lane no longer spends request budget batching and retrying a symbol the provider currently omits
• Pricing-provider audit and merge-gate validation now fail only on live coverage drift that still exists, not on a known stale allowlist entry

Impact notes

• dex_prices now rebuilds its aggregate and per-protocol bridge sources from retained priced pools after the full liquidity scoring filters run
• Promoted DEX bridge inputs and peg-summary dexPriceCheck now stay aligned with the same retained pool surface used by challenger publication and liquidity UI detail
• Skipped duplicate or low-quality discovery rows can no longer create synthetic near-peg DEX bridge marks for assets whose retained pools still show a depeg

Impact notes

• Pool challenge still downgrades weak soft-source consensus when any qualifying challenger pool diverges beyond the peg-aware threshold
• Price replacement now requires at least two protocol-level challenger medians to diverge, rather than counting divergence from any one pool inside each protocol
• A rogue pool inside an otherwise agreeing protocol no longer drags severe depegs back toward peg on the published stablecoins snapshot
• The final replacement mark remains the TVL-weighted median across the corroborating divergent protocol groups

Impact notes

• Pricing sources now carry explicit freshness kind, max trusted age, upstream-timestamp support, single-source authority, and market-capability metadata in the canonical registry
• High-confidence consensus now publishes the winning cluster median while preserving the internally selected cluster member for provenance and downstream policy
• DefiLlama list quotes now enter primary pricing as typed inputs with explicit observed-time provenance instead of inheriting mutable asset-state timestamps
• DEX bridge source freshness now preserves per-source timestamps from `price_sources_json` instead of flattening everything to the row write time
• DefiLlama contract fallback now prefers canonical tracked deployment identities, validates each quote before claiming the asset, and can probe multiple exact tracked coin ids when needed
• DexScreener fallback now prioritizes exact-target assets under the request cap and keeps symbol search reserved for addressless assets only
• Pyth confidence weighting is now smoother across medium-confidence prints, and RedStone requires at least 60% venue agreement before entering primary consensus
• The provider-config pricing audit is now part of CI validation instead of remaining a local-only check

Impact notes

• DefiLlama pass 1 and pass 1b now validate quotes against the shared peg-aware bounds before marking an asset as resolved
• A bad DL contract response can no longer block later CoinMarketCap, Jupiter, or DexScreener fallback passes in the same run
• DexScreener symbol search now stays disabled whenever the asset already has a canonical chain+address lookup path; only addressless assets can use the unique-symbol search fallback
• This reduces wrong-identity recovery risk while preserving the exact-address DexScreener recovery path for assets with tracked deployments

Impact notes

• GeckoTerminal probing now collapses pools to one TVL-weighted-median price per protocol before injecting a cross-protocol weighted-median mark
• Pool challenge replacement now uses corroborating divergent protocol groups rather than a raw all-pool weighted mean, making replacement marks less sensitive to repeated same-protocol pools
• Provider-config audit tests now guard CEX and RedStone coverage allowlists against duplicate or stale untracked entries
• The stale untracked `sUSDe` RedStone allowlist entry was removed so the runtime config matches the tracked registry again

Impact notes

• Stablecoin payloads, peg-summary outputs, and `price_cache` rows now preserve `priceObservedAtMode` alongside `priceObservedAt`
• Primary consensus now carries freshness provenance per source and resolves a conservative effective mode for the selected price
• Hard single-source prices remain depeg-authoritative only when they retain source-native freshness provenance; local-fetch hard single-source prices now stay `confirm_required`
• Older rows remain backward-compatible: cached data that predates explicit freshness-mode storage does not automatically lose authority just because the mode is absent

Impact notes

• Cached-fallback FX runs now keep probing Open Exchange Rates, Chainlink reference feeds, and gold-api.com instead of freezing their last known state until Frankfurter recovers
• A single stale intraday peg can no longer pin the whole FX lane in repeated cached fallback when OXR or Chainlink can refresh that subset independently
• If those independent probes restore fresh coverage for the expected fiat reference set, the run now exits cached fallback immediately and resets the fallback streak
• Operator metadata remains explicit about the failed Frankfurter / mirror path while no longer overstating the duration of an otherwise recovered FX incident

Impact notes

• Previous-trusted price lookup now merges the last authoritative stablecoins publication with fresh replay-safe `price_cache` metadata
• Cached replay can keep publishing the last fresh corroborated depeg price through brief single-run corroboration gaps instead of dropping the asset to `N/A`
• Confirmed severe depegs no longer lose continuity just because an intervening stablecoins run published a `low` or unusable price state
• This closes the intermittent USR-style divergence where PSI could still explain the open depeg while detail surfaces lost the current price

Impact notes

• Pricing source capabilities now come from one canonical registry shared by consensus, replay safety, pool challenge, GT probing, status health, and depeg trust classification
• Cached stablecoin payloads now preserve `priceObservedAt` and `priceSyncedAt`; compatibility `priceUpdatedAt` now reflects the true observation timestamp rather than the sync write time
• Soft single-source prices and soft-only high-confidence consensus can no longer mutate live depeg state directly; hard single-source sources such as Pyth, CEX, Curve, and protocol-redemption can still be authoritative
• Weak fixed-peg price jumps versus the previous trusted price now require corroboration before publication, closing the USR-style wrong-price path
• Pool challenge now uses the live $100K threshold in its published challenger snapshots and can harden weak soft-source outcomes, not only pre-downgrade high-confidence clusters
• GeckoTerminal probing now revisits weak CoinGecko / DL-list soft outcomes rather than only strict one-source cases
• Direct-API DEX quote conversion now reuses only authoritative tracked stablecoin prices; weak or stale tracked prices fall back to peg references instead of feeding the bridge loop
• Replay cache rows now keep source, confidence, observation time, sync time, and source lists; RedStone now derives its price from the venue median instead of the provider aggregate
• CoinMarketCap, Jupiter, and DexScreener enrichment passes now fail independently instead of aborting the whole late-enrichment block

Impact notes

• Primary pricing candidates are no longer gated on `geckoId`; tracked assets can still enter consensus through Pyth, CEX, RedStone, Curve, DL-list, or DEX bridge inputs
• DefiLlama pass 1b now probes only tracked alternate deployments instead of synthesizing same-address identities across chains
• CoinMarketCap and DexScreener symbol fallbacks now require uniqueness within the tracked registry, reducing symbol-collision poisoning
• RedStone prices now require at least two corroborating venues before entering primary consensus
• Pool challenge now applies to DEX-inclusive soft consensus clusters unless an exempt hard source is present
• GeckoTerminal probing now cross-checks eligible single-source DL-list results in addition to single-source CoinGecko results
• Direct-API DEX pair conversion now prefers tracked cached stablecoin prices for quote legs and will not treat unknown addressed `USDC`/`USDT`-style symbols as automatic `$1` references
• Price-cache replay now stores only replay-safe non-low, non-fallback prices and the replay window is shortened from 24h to 6h
• Severe fixed-peg downside publication now requires corroboration unless the source is an explicit protocol-redemption or pool-challenge replacement mark

Impact notes

• DEX identity is now canonical-only at runtime: DeFiLlama and subgraph parsing no longer mutate chain-aware token ownership
• Symbol fallback remains available only for addressless tokens; addressed unknown tokens are dropped instead of being reinterpreted by symbol
• DeFiLlama pools with `underlyingTokens` now match tracked assets by canonical addresses only, preventing positional symbol/address poisoning
• Promoted per-protocol DEX bridge sources are admitted into primary consensus only when corroborated or when no non-DEX voices exist
• The overlapping `dex-promoted` aggregate is withheld whenever promoted per-protocol DEX bridge data exists for the same asset

Impact notes

• Quarter-hour FX runs no longer poison status simply because Frankfurter and mirror transports failed to re-deliver an already-current daily source snapshot
• Carry-forward runs preserve per-peg source dates and cadence metadata, so status still degrades normally once the underlying daily references actually age out
• Operator metadata still records the failed live transport path, but public health now aligns with source freshness rather than transport availability alone