[daggerok]

What changed

• ISH-1 (review 2026-10-24, HIGH): only the Holdings worksheet was guarded. If the provider renamed or dropped a worksheet of the fund download:
  • no Historical sheet -> every history page was written empty and the old pages were deleted
  • no Performance sheet -> all returns null, still labelled official
  • no Distributions sheet -> distribution rows emptied
• worksheetsProblem() rejects such a download when the published meta.json has history rows, official returns (officialReturns.asOfDate) or distribution rows: the fund keeps its previous complete state and counts as failed, like a holdings guard rejection. A fund that never published them (new fund, metal trust without distributions) passes
• README: the fund-level consistency paragraph names the three worksheets
• The array-row page format of PR 97 is unchanged

Not in this PR

• ETF-C3 (watchlist by CUSIP) and ETF-H2 (shared N-PORT reader): done later across all brands
• ISH-2..ISH-9 are MEDIUM or LOW in the review; ISH-6 (feed size) was done in feat(feed): compact json and holdings and history rows as arrays #97

Checks

• bun test: 37 pass, 0 fail; the new pipeline 3 test fails on the old code for each worksheet separately (Historical, Performance, Distributions)
• bun build --target=bun scripts/update-data.ts --outfile=/dev/null, bun build --target=bun src/main.tsx --outfile=/dev/null
• .claude/tools/etfs/tc/check.sh: same 53 lines as main (pre-existing ide-mode baseline), no new errors
• check-readme.ts: ok; git diff --check: clean
• Full real run with the new guard: 482 funds, 1 updated (IDU, fresh data, discarded), 481 unchanged, 0 failed, so no live fund trips it today; api/ restored