feat: dealer flow, mirror portfolio (M21), options convexity, FINRA short interest, alert producers, vendor gate

Snapshot of in-progress module work across multiple slices:

- Dealer Flow: dealerExposureEngine, dealerMapService, dealerMapExplain,
  dealerMapIntegrity, dealerMapReplay, dealerStudyEngine, hanStyleLevels
- Mirror Portfolio (M21): fundRepository, captureIngest, mirrorAlertProducers,
  fund holdings strip, live book, position capture ingest
- Options: BSM, NormalizedOptionSurface types, OptionsChainRouter,
  ConvexityGate, option legs panel
- Alert producers: vixLevel, rotation, thesis, unlock, portfolioRisk,
  mirror (fund_capture, fund_13f, mirror_diff)
- FINRA short interest adapter + queue integration
- SEC company tickers adapter + ingest (symbol search index seed)
- Vendor gate (rate-limit-first data plane, ADR-0009)
- CUSIP registry, reverse 13F refresh, stock float service
- LRU cache, portfolio backtest engine
- Frontend: dealer-flow, funds, journal, lab, monitor, plan, portfolio,
  reports, screener, strategies, theses, guided-start, exits, more pages
- Volume profile, workspace profile, visibility-aware poll
- ADRs 0010 (mirror math not advice), 0011 (symbol search index)
- VENDOR_INTEGRATIONS.md, END_USER_TEST.md
- .gitignore: exclude DBs, .DS_Store, local config, agent scratch

docs/adr/0009-rate-limit-first-data-plane.md

@@ -70,7 +70,27 @@ Queue health exposes active **source cool-downs** so operators can see “Yahoo
 - **Positive:** New features have a clear rule: “cache first, queue refresh, static if needed.”
 - **Trade-off:** After a cool-down, data may be minutes-to-hours stale until the next successful drain.
 - **Trade-off:** Static ETF weights drift until the next successful Yahoo refresh (acceptable for education peek panels).
-- **Follow-ups:** Route remaining live Yahoo calls in `market.condition` / peer resolution through the same cache-or-queue pattern; surface cool-downs in admin queue UI.
+- **Follow-ups:** Surface per-family cool-downs in admin queue UI (process-wide `vendorGate` + queue_state).
+
+## Implementation (2026-08 hardening)
+
+All vendors share `app/server/src/services/vendorGate.ts` with **runtime registration** so future integrations do not require editing a closed union:
+
+1. `registerVendorIntegration({ family, sourceKinds, policy })` before traffic  
+2. `VendorSourceAdapter` / `defineVendorAdapter` auto-wrap `fetchOne`  
+3. `AdapterQueue` constructor **throws** if any adapter `source_kind` lacks a family  
+4. CI: `vendorHttpGuard.test.ts` fails on bare `fetch(` outside the gate modules  
+5. Handbook: `docs/VENDOR_INTEGRATIONS.md`
+
+| Family | Call style | Drain budget |
+|--------|------------|--------------|
+| yfinance | `withVendorGate` (yahoo-finance2 + options) | 3 |
+| sec | `secHttp` → vendorGate | 1 |
+| fred / finra / nasdaq / reddit | `vendorFetch` | 1 |
+| x | `withVendorGate` around bird CLI | 1 |
+| *(future)* | `registerVendorIntegration` + `VendorSourceAdapter` | policy.drainJobBudget |
+
+A 429 cools the **family** (every `source_kind` in that family), not just the one job. Per-request min gaps are process-wide; job min-intervals in AdapterQueue are coarser backup.
 
 ## Rejected alternatives