Phase 1: ship the backup cron as CODE + a manual regrade trigger

FOUNDATION-FIRST re-order, phase 1 (tooling + safety).

BACKUP (highest-severity open item) — INSTALLED, not re-proven.
src/backupScheduler.js runs scripts/backup-db.sh nightly from inside the
API container, armed at boot in server.js. The container already has
SUPABASE_DB_URL, pg_dump and the Supabase route, so deploy == installed:
no host crontab, no Coolify click. Arming is deliberately opt-OUT (armed
whenever SUPABASE_DB_URL exists; BACKUP_CRON=0 kills it) because the S62
design was opt-in and nobody ever opted in — the DB went unbacked every
night for weeks. A failed run pages high-priority ntfy; silence is the
danger with backups.

Durability is the one part still needing a human: the container FS is
ephemeral, so a dump dies on redeploy unless BACKUP_REMOTE (off-box
rsync) or BACKUP_DIR (persistent volume) is set. The scheduler detects
that and pages a WARNING at boot rather than letting an undurable backup
read as "backed up". Runbook rewritten to lead with the code path.

MANUAL REGRADE TRIGGER — scripts/run-snapshot.js, runnable via
docker exec with no VYNDR_INTERNAL_KEY and no new HTTP surface. Runs the
SAME snapshotService.runSnapshot the cron runs (including the team-stats
refresh that powers opp_rank_stat), supports `all` and `--settle`, and
prints the grade/confidence distribution plus p_win/ev_pct presence —
which is the thing you actually want when verifying a grading change.

ACCESS BLOCKER, logged honestly in specs/model-train.md: there is no
VYNDR_INTERNAL_KEY in the local .env and SSH to the box times out from
WSL2, so I can neither curl the internal endpoints (which already exist
from S45) nor docker exec. The trigger is built and correct but only Kev
can run it until a key or SSH access exists. This is the highest-leverage
unblock for phases 2 and 3, which both need on-demand regrade+settle to
verify anything.

Also logged the standing cautions: CLV ledger stays private until
backtest-proven; "self-improving model" is unsupported marketing until
the loop closes; the engine is MLB/WNBA-calibrated and NFL/NBA/soccer
need their own calibration before the hub grades them (scaling gate).

Suite 277/3300 green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

specs/model-train.md

@@ -153,6 +153,50 @@ timestamp) is unchanged. `toHero` now also passes through
 
 ---
 
+## 2B. FOUNDATION-FIRST RE-ORDER (Kev, 2026-07-19) — supersedes the arc order
+
+New features are paused until the foundation is real. Phases run in order:
+1 (tooling+safety) → 2 (the instrument) → 3 (corruption fixes) → 4 (depth).
+
+| # | Item | Phase | Status |
+|---|---|---|---|
+| 1 | Manual regrade trigger | 1 | ✅ `scripts/run-snapshot.js` shipped — **but see ACCESS BLOCKER** |
+| 2 | Backup cron INSTALLED | 1 | ✅ shipped as CODE (`src/backupScheduler.js`) — deploy == installed |
+| 3 | Backtest harness | 2 | open — REPORT-FIRST on replayable history |
+| 4 | Settlement-correctness audit | 2 | open — REPORT |
+| 5 | Sample-size discipline | 2 | open — report the floor |
+| 6 | edge_pct → ev_pct migration | 3 | open — REPORT-FIRST (ledger bleed) |
+| 7 | Grade-lock + directional CLV + C4 | 3 | open — REPORT-FIRST (does a snapshot overwrite a prior grade?) |
+| 8 | Model uncertainty | 4 | open — REPORT-FIRST (design proposal) |
+| 9 | Calibration by odds band | 4 | open — runs ON the harness |
+
+### 🔴 ACCESS BLOCKER (Session 64) — I cannot reach the box
+
+Verified this session: **no `VYNDR_INTERNAL_KEY` in the local `.env`** (it holds
+only Supabase + `ODDS_API_KEY`), and **SSH to `git.builtbykev.com` /
+`api.vyndr.app` / `vyndr.app` times out from WSL2.** So I can neither call the
+internal endpoints that already exist (S45 shipped
+`POST /api/internal/snapshot/:sport|/all`) nor `docker exec` anything.
+
+Consequences, stated plainly:
+- The manual trigger is BUILT and correct, but **only Kev can run it** until one
+  of these exists: `VYNDR_INTERNAL_KEY` shared with the agent env, or box SSH.
+- Verifying a grading fix still depends on the cron or on Kev running one command.
+- **This is the single highest-leverage unblock for every future phase** — Phase 2
+  and 3 both need on-demand regrade + settle runs to verify anything.
+
+### Standing cautions (Kev, logged 2026-07-19)
+
+- **CLV ledger stays PRIVATE** until the model is backtest-proven. Publishing CLV
+  before then broadcasts our weaknesses to sharps. (Also currently broken — C4.)
+- **"Self-improving model" is UNSUPPORTED marketing** until the loop actually
+  closes: backtest → calibration → weight correction. No such loop exists today
+  (no harness, no calibration gate, `weightAdjuster` is not in the grade path).
+  Do not claim it.
+- **The engine is MLB/WNBA-calibrated. NFL/NBA/soccer are NOT.** "Unified engine"
+  is currently "MLB engine, others guessing." Each sport needs its own calibration
+  before the offseason hub grades it — this is a **scaling gate**, not a nice-to-have.
+
 ## 2A. ARC 2+ BOARD — STATUS (Kev's arc list, 2026-07-19)
 
 Full arc definitions live in the Session-63 order. Status only here; update as each ships.