Takeable audit: the ledger is contaminated, and I caused it

READ-ONLY. Nothing enforced or fixed; the five challengers untouched.

VERDICT: gaps exist, and one is LIVE CONTAMINATION of the ledger -- the
exact table every accruing holdout resolves against. book, locked_odds and
the takeable flag ITSELF are being stamped from books you cannot bet: DFS
dabble (707 rows, 24% of all rows), offshore bovada (214), onexbet (42),
exchange kalshi (7, mean |odds| 1120).

0% before 2026-08-01. 47.9% on 08-01. 42.5% on 08-02. It began the day I
widened the books for display.

LEAK LOCATED, not inferred: recordPipelineGrades indexes byKey over the
FULL display-widened props list, then prefers that prop -- book:
(prop && prop.book) || g.book, and locked_odds/takeable both fall back to
oddsForSide(prop). The grade is computed on a MODEL book and the ledger row
is then re-stamped from whatever book indexed first. The takeable flag is
therefore not merely mislabelled: it is computed FROM the contaminated
price, so it is wrong on its own terms.

The served grade path is clean TODAY (428 grades, 100% MODEL books), so
dedupeProps' gate works. But MODEL_BOOKS is NOT a subset of TAKEABLE_BOOKS
-- pinnacle is model-eligible and correctly not takeable -- so the
projection may anchor to a reference line by design. Harmless while
pinnacle returns nothing; live again when it recovers.

BLAST RADIUS bounded but growing: 47 contaminated rows have already
settled (21% of settled rows since 08-01) and ~700 are still pending and
will settle into the holdouts. The damage is mostly ahead of us, which is
what makes this urgent rather than historical.

NOT VERIFIED and not claimed either way: whether the stored `line` is also
contaminated. It traces to the graded prop, but I did not check it
end-to-end; the enforcement order should.

The prediction-vs-reference distinction HOLDS and must not be collapsed:
the prediction target must be takeable, while fair_prob / consensus / edge
stay reference. The bug is not the three-way split -- it is that one write
path ignores it.

Stack sequenced in the plan: (a) takeable enforcement, (b) structural
Number(null)===0 guard (hits will re-trigger it -- its 0.5 lines make P(0)
the whole game), (c) hits. Carry-forward: tb-v1 verdict, the third
pre-registered branch, and the 100s Cloudflare timeout vs a ~115s snapshot.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QJs13VsyiSKYQP6rj3NNmc

specs/MASTER-PLAN.md

@@ -29,25 +29,34 @@ stay provisional until re-run** · documented ≠ verified.
 
 ## ▶ NEXT EXECUTABLE ORDER
 
-**AWAIT the tb-v1 verdict, then `hits`.** `specs/tb-v1-compound.md`.
+**🔴 (a) TAKEABLE ENFORCEMENT — urgent.** `specs/takeable-enforcement-audit.md`.
 
-**tb-v1 is LIVE as a challenger** — total_bases modelled as the compound outcome
-it is (per-component Poisson rates convolved exactly) instead of one negative
-binomial that treats a home run as four events. Firing on **10/10 TB props**;
-means agree with the ladder, **only the shape differs** — the intended
-intervention.
+**The ledger — the table every accruing holdout resolves against — is stamping
+`book`, `locked_odds` and the `takeable` flag itself from books you cannot bet**
+(DFS `dabble` 707 rows, offshore `bovada` 214, `onexbet` 42, exchange `kalshi` 7).
+**0% before 2026-08-01, 47.9% on 08-01, 42.5% on 08-02** — it began with the
+display widening. `recordPipelineGrades` indexes over the FULL widened props list
+and prefers that prop's book/odds over the graded one.
 
-**The diagnosis is on trial, and the branch is pre-registered:**
-- **tb-v1 improves TB resolution** → family-mismatch **HOLDS**, similarity stays
-  **off** the critical path, **`hits` is next** (AB-bounded, mostly 0.5 lines, so
-  it rides on P(0)).
-- **tb-v1 does not improve** → hypothesis **WRONG**, the **mean-weakness /
-  MLB-similarity branch REOPENS**.
+**47 contaminated rows have already settled; ~700 are pending and will settle into
+the holdouts.** The damage is mostly ahead of us.
 
-**Verdict n-blocked:** 0 settled TB rows carry tb-v1 yet; first settle is
-tomorrow. `scripts/tb-compound-holdout.sql` is TB-rows-only and direction-aligned.
+Also latent: **`MODEL_BOOKS` ⊄ `TAKEABLE_BOOKS`** (`pinnacle` is model-eligible but
+not takeable) — harmless while pinnacle returns nothing, live again if it recovers.
 
-**Then:** `archetype_x_archetype` → retire/rewrite `bayesianEngine`.
+**Keep the split:** the *prediction target* must be takeable; `fair_prob` /
+consensus / `edge` **stay reference** and must not be over-enforced.
+
+**Then (b) a structural `Number(null) === 0` guard** — six occurrences, most
+recently in my own new module. **`hits` will re-trigger it**: its 0.5 lines make
+P(0) the whole game, where a null rate read as zero is maximally wrong.
+
+**Then (c) the `hits` fix**, built on both invariants — not before them.
+
+**Carry-forward:** tb-v1 verdict (accruing) · the third pre-registered branch
+(improves-ranking-but-low → promote **and** recalibrate) · the **100s Cloudflare
+origin timeout** vs a ~115s snapshot (work completes; the trigger returns 524 —
+flag it before it reads as a failure).
 
 ### FIVE challengers accruing in parallel — do NOT re-run early
 Verified firing on a real prod snapshot (293 grades), not inferred: