[plainprogrammer]

Closes #365.

What this does

Prices refresh once a day, and each change is recorded once. A scheduled job (Prices::RefreshJob, queue sync, at 11:30am every day, production only) reads the bulk file the catalog already downloads and, per quote:

• unchanged: nothing is written;
• changed or new: the current price is updated and a history row is written for the run's date (the UTC date of the file, so the same file twice changes nothing);
• gone: the current price is removed and a blank history row is written, in one transaction, and only when the file can be trusted to say so;
• a printing the catalog lacks: skipped and counted.

A Malformed quote is never read as absent. A file cut short, empty, with an unreadable line that names no printing, or that would remove more than 10 percent of the candidate prices (MAX_REMOVED_SHARE, a guess until #366 measures it) removes nothing. Writes go in batches of 1,000 printings, no network call or primary read happens inside a transaction on the prices database, and two runs never overlap.

Spec: docs/specs/089-daily-price-refresh/spec.md (v0.5.0), plan and verification.md beside it. The rules are distilled into docs/architecture/prices.md and catalog-operations.md.

The issue's open point, and the rulings

• Shared download, separate lifecycle (maintainer, 2026-11-13): the price refresh asks the catalog source for the same file, but has its own job, run record and guard, not Catalog::Operation. One change to the catalog source: a partial download file per download, stale partial files pruned, and the Catalog::Sources contract comment says #download must tolerate concurrent calls (supersedes spec 002 FR-3's "a partial file"; recorded in the index both ways).
• The run record holds identity, times, status and the counts this issue names (quotes_seen, unchanged, repriced, added, removed, removals_withheld, unknown_printings, malformed); Each price refresh records what it did and how large the database is #366 owns timings, sizes and memory. run_on becomes nullable and job_id and languages are added, by two new migrations in db/prices_migrate/ (the released one is untouched).
• A price's freshness is the latest finished run's date, not a column; a file older than a run that wrote rows is skipped.

Deviations and things the reviews changed

• The count column changed is repriced: Active Record reserves the name (found in Phase 2; spec v0.4.3; a second migration renames it).
• AC-4.4 measures savepoint spans, not transaction depth, because the suite's non-joinable transaction makes every write a savepoint (spec v0.4.2).
• The implementation review (SPEC-ALIGNED) found a gap: a series the source no longer declares would read as absent. Such a price is now left alone (spec v0.5.0, AC-3.7).
• An automated security review found the pending unreadable records unbounded; fixed.
• Accepted, recorded in prices.md and on Each price refresh records what it did and how large the database is #366: the judged-pairs set in memory (about 30 MB for 300,000 quotes), one DELETE per printing in a removal slice, and a process resuming after the 6-hour lock lapsed could overwrite an interrupted run.

Evidence

• Full pre-push bin/ci passed at 8a035683 (RuboCop, YARD, the comment ratchet, Brakeman, bundler-audit, importmap audit, the licence check, the whole RSpec suite). A first push attempt was blocked by one failing example, spec 081's column-list spec (prices_record_spec.rb:78), which I then fixed.
• Timing (hand run, development machine, no threshold): 110,000 cards, 275,000 quotes: first run 18.4 s, a typical day (about 17 percent repriced) 7.4 s.
• Not run here: bin/upgrade-smoke (needs a container engine; CI's image job runs it). No UI change, so no screenshots.

Owed to the maintainer

• The schedule time (11:30 server time, a guess from one day's publication time, 10:06 UTC on 2026-11-13) is a one-line change in config/recurring.yml.
• A real, lasting drop in prices above 10 percent is refused every day until MAX_REMOVED_SHARE moves; there is no override and no prices page until An admin reads the price refresh log #367.
• The README's backup advice now keeps backups clear of 11:30.

Model split: spec drafts, rulings and wiring by the worker's main session (Sonnet 5.5, with a stretch on Opus 5.5 that wrote the Gate A record and the plan draft); spec and plan reviews by read-only Fable 5.2 subagents; implementation by Sonnet 5.5 subagents; the implementation review by a read-only Opus 5.5 subagent.

🤖 Generated with Claude Code