fix(stats): guard daily mileage source selection marking

.superpowers/sdd/task-3-report.md

@@ -80,3 +80,31 @@ Corrected the remaining `projectDailyMileageSQL` contract issue so `trusted_sour
   - explicitly verify no fallback expression using `s.source_endpoint` remains.
 
 This enforces the strict source-of-truth rule that endpoint data for final projection must come from latest connection metadata only, even when it is null/empty.
+
+## Fix (reviewer findings #3)
+
+Addressed stale candidate selection re-flagging by narrowing source marking to the same eligibility rules used by projection:
+
+- In `go/vehicle-gateway/internal/stats/source_mileage.go`, `markSelectedSourceSQL` now:
+  - No longer joins `vehicle_daily_mileage` to discover the selected source.
+  - Selects the same single winning candidate directly from `vehicle_daily_mileage_source`, constrained by:
+    - VIN/date/protocol
+    - `quality_status = QualityOK`
+    - mileage bounds (`0..maxSelectedDailyMileageKM`)
+    - enabled source metadata
+    - same trust/sample/time ordering
+  - Marks only that candidate as `is_selected = 1`.
+- In `go/vehicle-gateway/internal/stats/source_mileage_test.go`, `TestProjectDailyMileageSelectsCandidateAndMarksSource` now verifies:
+  - the mark query includes candidate filters and ordering, including `s2.quality_status`, `s2.daily_mileage_km`, and `COALESCE(ds.enabled, 1) = 1`.
+  - it no longer references `vehicle_daily_mileage` as a join source.
+  - it passes the selection window arg through to marking (`maxSelectedDailyMileageKM`) and uses seven bind args.
+
+Validation commands:
+
+```bash
+cd go/vehicle-gateway && go test ./internal/stats -run TestProjectDailyMileage -count=1
+# PASS: lingniu-vehicle-ingest/go/vehicle-gateway/internal/stats
+
+cd go/vehicle-gateway && go test ./internal/stats -count=1
+# PASS: lingniu-vehicle-ingest/go/vehicle-gateway/internal/stats
+```