Dual-oracle (Chainlink + Pyth) with median + tolerance, not primary + fallback

Context

A single oracle is a single point of failure. Two oracles can disagree.

Decision

Both oracles are read on every recompute; the median is used within a 50bps tolerance, otherwise the system pauses.

Alternatives

Primary + fallback (rejected: implies a hierarchy). Median-of-three (rejected: cost; not enough Sepolia oracle options).

Consequences

Both oracles must be live for normal operation. Acceptable cost: oracle reads on Sepolia are cheap and the safety improvement is worth it.