Thanks for fixing the engine-routing half of #550. One blocking issue remains: when an explicit source=local loader returns no benchmark data or raises, _fetch_benchmark() silently falls back to yfinance. That contradicts the PR’s offline/reproducible contract and introduces an unexpected network request.

Please make explicit source=local fail closed for benchmark loading—return no external benchmark rather than falling back to yfinance—and replace test_falls_back_to_yfinance_when_source_loader_has_no_data with a regression proving YfinanceLoader is never constructed for explicit local runs. source=auto may retain the existing yfinance fallback.

Done, in later commit local now fails closed for benchmark loading: no yfinance fallback when the local loader yields no data or raises (or when no loader is passed at all), so the run returns no external benchmark instead of making a network request. The replacement regression test monkeypatches YfinanceLoader to assert it is never constructed for explicit local runs, parametrized over the empty-loader, raising-loader, and missing-loader cases. source: auto and other explicit sources keep the existing yfinance fallback. Also merged main to resolve the CHANGELOG conflict.

Holding this — the fix doesn't fully close the gap it's meant to close yet. Ran a focused test directly against this PR's code: when the existing (unrelated to this diff) empty-result fallback in fetch_data_map() silently swaps the loader for a network source (e.g. the yahoo fallback, which triggers whenever the primary local loader returns nothing for a requested symbol — an easy case to hit, not contrived), config['source'] never gets updated to reflect that. resolve_benchmark() then calls .fetch() on whatever loader it's handed before checking allow_fallback — so a source=local run can still make a real network call for the benchmark. That's exactly the behavior the CHANGELOG/docstring claim this PR prevents, and the same class of problem flagged in the original review thread.

The new regression tests only assert YfinanceLoader is never constructed, which doesn't cover this path since the leak goes through a different loader class entirely.

Could you add a check in resolve_benchmark/_fetch_benchmark that respects allow_fallback/source before calling .fetch() on the handed-in loader, not just before constructing a fresh YfinanceLoader? Happy to merge once that's closed — the engine-routing half of this fix is solid.

Done in 488fc2f. resolve_benchmark() now verifies the handed-in loader actually belongs to the configured source (via the registry name attribute) before calling .fetch() on it so a loader silently swapped by fetch_data_map()'s empty-result fallback is dropped and the run fails closed, instead of the check only applying to a fresh YfinanceLoader.

The fail-closed regression is now parametrized over four cases for explicit source=local: empty local loader, raising local loader, a swapped-in network loader (whose fetch() asserts if ever invoked), and no loader at all, with YfinanceLoader construction also asserting. That covers both leak paths: fetching through a foreign loader and constructing a fresh network loader.

Thanks so much, @xor-xe — this is now merged into main as part of a reviewed batch integration, with your original commits and authorship preserved. Really appreciate the contribution!