feat: make the COT / price seam explicit (ADR-0007 step 1)

[mspinola]

Step 1 of ADR-0007: make the COT / price seam explicit inside cotdata, before anything moves out.

Why now

cotdata has two producers by design: the CFTC downloader (free, any OS) and the price producer (Norgate needs Windows). They share one manifest.json, and _touch_manifest is a read-modify-write, so two producers running against one store eventually lose an entry.

That hazard was theoretical until a second producer host appeared. It isn't any more.

1. Manifest per half, dual-written

Each domain declares its owning half (_DOMAIN_HALF, half_for). Writes land in manifests/<half>.json and the legacy top-level manifest.json.

Readers merge legacy first, then overlay per-half, so fresher half data wins and a half whose producer has not run yet still resolves from legacy.

That ordering is what makes this safe today rather than after everyone migrates. A concurrent producer clobbering the shared aggregate no longer loses anything for a reader on this version, because the per-half file is authoritative. There is a test that simulates exactly that clobber.

The legacy file exists only for consumers pinned to an older cotdata, and gets dropped in a follow-up once they have moved. No flag day, reversible.

half_for() raises on an undeclared domain, so adding one forces a decision about which side of the seam it belongs on rather than defaulting silently.

2. Half-scoped CLI entry points

cotdata-cot     --cot-all                              # CFTC half, any OS
cotdata-prices  --prices --metadata --require-final    # price half, Windows for Norgate
cotdata-update  ...                                    # both, single-machine deployment

Each scoped entry point refuses the other half's flags:

cotdata-prices: error: --cot-all belong(s) to the cot half. This entry point runs the
prices half only, so one host does one job. Use cotdata-cot for those, or cotdata-update
to run both from one machine.

This is the operational half of the same hazard. A Windows price box that could also run --cot-all would become a second COT producer racing the first. Now it cannot, structurally.

--check and --reconcile are read-only and work from either.

Verification

• Real store (legacy-only, 241 manifest entries across 5 domains): reads correctly, writes nothing on read.
• Suite: 127 passed, was 110. Seventeen new tests, including the simulated concurrent clobber, a legacy-only store, a mid-transition store where only one producer has run on the new code, and an assertion that every action flag is assigned to a half.
• Verified cotdata-prices --cot-all is refused by the installed console script, not just in-process.

Not in this PR

Dropping the legacy aggregate. That is the second half of step 1 and waits until both producers have run cleanly on this version.

🤖 Generated with Claude Code