POST /valuations/history is a read of public exact-market prices. Its missing global public-POST exemption caused HTTP 401 in production despite route-level tests passing. The exact path now bypasses operator write authentication; no account token or operator secret is required, including after a client token expires. Adjacent paths and write routes remain protected.

The route still validates 1-5000 exact markets, limits the body to 2 MB and requests to twelve per minute, returns Cache-Control: no-store, and chooses both comparison instants on the server exactly 24 hours apart. It reads no user holdings, stores no basket and starts no provider refresh.

Regression tests now mount the real global authentication hook alongside the valuation routes. They cover configured write authentication, anonymous and expired-client reads, invalid markets, protected adjacent paths and writes. The existing history test failed after enabling the hook before the fix (503 without an operator token; the configured production gate returned 401).

Local Node 22.23.4 validation: API 1605 passed, 20 skipped, zero failed; ingest 554 passed, zero failed. Source compilation passed. Optional database/fixture tests were skipped and the full database/scan E2E suite was not rerun.

No migration, naming application, account deletion or emulator launch is needed. Deploy only the API from staging, retain the previous image and runtime for rollback, and verify a real unauthenticated history request returns 200. Missing historical coverage must remain unavailable, never a fabricated zero.