Heal execute: quarantine markers, re-enable DNP voiding, two exclusion scopes

Order 2 Phases 2 + 4. Pre-heal rollback point secured first:
vyndr-20260720-093821.dump (856,890 bytes) VERIFIED ON THE BOX, not just
exit 0.

MIGRATION 027 — two DISTINCT exclusion scopes, deliberately separate:
- quarantine_reason: the row's GRADE is untrustworthy (wrong_opponent_grade).
  The row REMAINS a real public settled result — the bet happened, the
  outcome is real — but it must never train or validate, so
  getModelAggregate now excludes it from the denominator alongside
  void/unrecoverable.
- analysis_flags: the row is VALID for settlement and the record but
  unattributable for PER-GAME analysis (doubleheader dates). Explicitly NOT
  filtered from aggregates.
Collapsing these would either wrongly drop 166 doubleheader rows from the
record or wrongly keep 25 wrong-opponent grades inside model validation.
Tests assert both directions, including that analysis_flags is NOT filtered.
Also adds re_settled_at + settlement_source to model_snapshots.

DNP VOIDING RE-ENABLED — reversing my own Order 1.5 disable, with scrutiny,
because its premise was FALSE. Order 1.5 assumed a missing player row meant
the row's DATE was wrong. The Phase 0 dry-run disproved it: across every
bindable row the stored date matched a real game (MIS-DATED: 0), and the
players I had cited as counter-evidence were genuine DNPs on their true
dates (Freeman 07-18; Kwan/Hedges/Davis 07-17 — their teams played, they
did not). The evidence is positive: games FINAL + no line in a full-season
log = no bet existed.

I got this wrong twice tonight in opposite directions; the dry-run is what
caught it. Recording the reasoning in the code so the next reader sees why
the flag flipped back.

Suite 282/3386 green, build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

src/services/ledgerService.js

@@ -564,6 +564,13 @@ async function getModelAggregate(opts = {}) {
     // enter a record denominator, exactly as pushes are excluded from hit_pct.
     // Without this, voiding a row would silently move the public record.
     .not('outcome', 'in', '("void","unrecoverable")')
+    // Session 64 (Order 2) — QUARANTINE. A row whose GRADE is untrustworthy
+    // (wrong_opponent_grade) stays a real public settled result but must never
+    // train or validate a model, so it leaves the denominator exactly as
+    // void/unrecoverable do. NOTE: `analysis_flags` (e.g. doubleheader) is
+    // deliberately NOT filtered here — those rows settle validly and belong in
+    // the record; they are excluded only from per-game/opponent analysis.
+    .is('quarantine_reason', null)
     // 2026-07 — a grade with a non-positive model_value had NO real projection
     // (the pre-fix degradation). Those locks are kept in the append-only ledger
     // but must not count toward the public model record — their hit/miss is

src/services/settleSource.js

@@ -135,17 +135,19 @@ async function resolveOutcome(args = {}) {
     if (allVoid) {
       return { state: 'void', value: null, reason: 'game_postponed_or_cancelled', source: 'schedule' };
     }
-    // ── DO NOT VOID ON PLAYER-ABSENCE ALONE. ──────────────────────────────
-    // This branch used to return void/'player_dnp' and it was WRONG: absence
-    // from a date can equally mean the ROW'S DATE IS WRONG. Verified live —
-    // Freddie Freeman's 97-game log has no 2026-07-18 because he played the
-    // 17th and 19th (a doubleheader), and ledgerService derives game_date from
-    // the GRADE timestamp when the feed carries no game_time, so a 01:00/03:00
-    // UTC snapshot labels rows with the PREVIOUS ET day.
-    // We cannot distinguish "did not play" from "mislabelled date" here, so we
-    // must not claim DNP. Unresolvable rows age out to 'unrecoverable' via the
-    // retry cap — honest, and excluded from the record either way.
-    return { state: 'unknown', value: null, reason: 'player_absent_unconfirmed', source: 'schedule' };
+    // DNP VOIDING — RE-ENABLED (Order 2 Phase 4), deliberately reversing the
+    // Order 1.5 disable because its premise was FALSE.
+    //
+    // Order 1.5 assumed a missing player row meant the ROW'S DATE was wrong.
+    // The Phase 0 dry-run disproved that: across every bindable row the stored
+    // date matched a real game (MIS-DATED: 0), and the specific players cited
+    // as counter-evidence were genuine DNPs on their true dates (Freeman
+    // 07-18, Kwan/Hedges/Davis 07-17 — their teams played, they did not).
+    //
+    // So the evidence here IS positive: the day's games are FINAL and the
+    // player has no line in a full-season log. That is a DNP — no bet existed.
+    // The date is trustworthy; the absence is real.
+    return { state: 'void', value: null, reason: 'player_dnp', source: 'schedule' };
   }
   return { state: 'unknown', value: null, reason: 'state_undetermined', source: 'schedule' };
 }