Session 45: Snapshot pipeline + GameCard swap + live ticker (2100 tests)

The on-demand "Read" grade model is RETIRED. A scheduled pipeline pre-grades the
slate, locks grades to the line, tracks movement; the dashboard shows them already
there. Orchestrates existing services — nothing rebuilt.

- snapshotService.runSnapshot(sport): getOdds → gradeAndCacheSlate → classify
  archetype per player → lock gradedAt → line deltas vs previous snapshot → write
  snapshot:{sport}:latest/previous + grades:{sport} → ticker events. Fully
  injectable, zero-network unit tests. runAllSnapshots = cron entrypoint.
- Internal trigger POST /api/internal/snapshot/:sport + /all (requireInternalAuth).
  In-process cron (SNAPSHOT_CRON=1, UTC 14,19,22,1,3) in server.js, no new dep.
- Public reads: GET /api/snapshot/:sport (cache-only) + GET /api/ticker (merges
  TICKER_MANUAL pins) + Next proxies.
- GameCard swap: live Slate renders vyndr/GameCard (legacy kept for types only),
  overlays locked grades onto game props → player name once + archetype badge +
  "Graded Xh ago at -115 · Current 2.5 · ▲ TOWARD +1.0". Ungraded → "Awaiting next
  scan", NO Read button. On-demand onGrade flow deleted.
- Ticker polls /api/ticker every 30s, graceful fallback to hardcoded items.
- NBA/WNBA: espnStatsAdapter free fallback (defensive parse → found:false on shape
  mismatch) wired into resolvePlayerStats after the offline Python service.

Env: PROPLINE_API_KEY_1/2/3, VYNDR_INTERNAL_KEY, SNAPSHOT_CRON=1, TICKER_MANUAL.
Backend 2061 -> 2100 tests (+39), 173 suites. Web build clean (exit 0).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/internal.js

@@ -82,4 +82,38 @@ router.post('/prefetch/tank01', async (req, res) => {
   }
 });
 
+/**
+ * POST /api/internal/snapshot/:sport (Session 45)
+ *
+ * Trigger one snapshot cycle for a sport (pre-grade the slate, lock grades,
+ * compute deltas, emit ticker events). Internal-only (requireInternalAuth at the
+ * router root). This is what the cron / n8n schedule calls — never public, so a
+ * bad actor can't drain the PropLine quota by spamming it.
+ */
+/** POST /api/internal/snapshot/all — every active sport, sequentially.
+ *  Registered BEFORE /snapshot/:sport so "all" isn't captured as a sport. */
+router.post('/snapshot/all', async (req, res) => {
+  const snapshot = require('../services/snapshotService');
+  try {
+    const results = await snapshot.runAllSnapshots();
+    return res.json({ ok: true, results });
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    console.error('[internal/snapshot/all] failed:', message);
+    return res.status(500).json({ ok: false, error: message });
+  }
+});
+
+router.post('/snapshot/:sport', async (req, res) => {
+  const snapshot = require('../services/snapshotService');
+  try {
+    const summary = await snapshot.runSnapshot(req.params.sport);
+    return res.json({ ok: true, summary });
+  } catch (err) {
+    const message = err && err.message ? err.message : String(err);
+    console.error('[internal/snapshot] failed:', message);
+    return res.status(500).json({ ok: false, error: message });
+  }
+});
+
 module.exports = router;

src/routes/snapshot.js

@@ -0,0 +1,38 @@
+'use strict';
+
+/**
+ * GET /api/snapshot/:sport (Session 45) — the latest pre-graded slate.
+ *
+ * Public, cache-only read of `snapshot:{sport}:latest` (enriched grades with
+ * archetype + gradedAt, plus line deltas). Falls back to the `grades:{sport}`
+ * envelope when no snapshot has run yet. NEVER triggers a snapshot (that's the
+ * internal cron's job) — so it can't drain the PropLine quota.
+ */
+
+const express = require('express');
+const { createRateLimit } = require('../middleware/rateLimit');
+const { cacheGet } = require('../utils/redis');
+
+const router = express.Router();
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
+
+router.get('/:sport', async (req, res) => {
+  const sport = String(req.params.sport || '').toLowerCase();
+  try {
+    const snap = await cacheGet(`snapshot:${sport}:latest`);
+    if (snap && Array.isArray(snap.grades)) {
+      res.set('Cache-Control', 'public, max-age=30');
+      return res.json({ sport, updated_at: snap.updated_at, grades: snap.grades, deltas: snap.deltas || [] });
+    }
+    // Fallback: the grades envelope (no deltas yet).
+    const env = await cacheGet(`grades:${sport}`);
+    const grades = env && Array.isArray(env.grades) ? env.grades : [];
+    res.set('Cache-Control', 'public, max-age=30');
+    return res.json({ sport, updated_at: env && env.updated_at, grades, deltas: [] });
+  } catch (err) {
+    console.error('[snapshot]', err.message);
+    return res.status(200).json({ sport, grades: [], deltas: [] });
+  }
+});
+
+module.exports = router;

src/routes/ticker.js

@@ -0,0 +1,48 @@
+'use strict';
+
+/**
+ * GET /api/ticker (Session 45) — the live ticker feed.
+ *
+ * Returns the latest snapshot-generated events from the `ticker:items` Redis
+ * list (newest first), merged with editorial pins from the TICKER_MANUAL env
+ * var (a JSON array of { tag, text, color }). Public + cached 30s. Reads cache
+ * only — never triggers a snapshot.
+ */
+
+const express = require('express');
+const { createRateLimit } = require('../middleware/rateLimit');
+const { cacheGet } = require('../utils/redis');
+
+const router = express.Router();
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
+
+const LIMIT = 30;
+
+function parseManual() {
+  const raw = process.env.TICKER_MANUAL;
+  if (!raw) return [];
+  try {
+    const arr = JSON.parse(raw);
+    return Array.isArray(arr)
+      ? arr.filter((x) => x && x.text).map((x) => ({ tag: x.tag || 'ALERT', text: String(x.text), color: x.color || 'var(--text-0)' }))
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+router.get('/', async (req, res) => {
+  let items = [];
+  try {
+    const stored = await cacheGet('ticker:items');
+    if (Array.isArray(stored)) items = stored;
+  } catch {
+    items = [];
+  }
+  // Snapshot events are already newest-first; editorial pins follow.
+  const merged = [...items, ...parseManual()].slice(0, LIMIT);
+  res.set('Cache-Control', 'public, max-age=30');
+  res.json({ items: merged, count: merged.length });
+});
+
+module.exports = router;