Committed source fixtures are versioned snapshots, not live feeds. Each source note records a URL, license, version or coverage period, and last review date. A refresh must compare hashes, schema, notes, license metadata, and derived conclusions before replacing the snapshot.
Reference-only sources are checked by URL and metadata. Their bodies remain outside the vault.