vyndr/BUILD-STATE.md

VYNDR — Build State

Last Updated

2026-08-03

Session 94 (2026-08-04) — Causally-correct platoon + park inputs ✅

4,307 tests / 344 suites green, build exit 0. Counter + frozen clusters byte-identical.

• PLATOON SEVERITY built + tested: n=452, 48 short of the gate. CANDIDATE_PENDING — not proven, not theatre. Uses each hitter's own vs-LHP/ vs-RHP split, shrunk by the smaller side's PA, refused below 60 PA. It moves LESS than flat platoon (0.021 vs 0.026), consistent with the pattern.
• The refusal costs sample honestly — 452 vs 741 rows is exactly the hitters whose splits are unreadable.
• PARK DIMENSIONS INGESTED (free, statsapi venue endpoint): fence distances, roof, turf, elevation. Prod-verified 15 venues. Joined by real venue_id from the schedule, never inferred from the home team.
• RAW WEATHER RETAINED (temp/wind_mph/wind_dir/precip) — and the old guard that dropped the environment entirely when the multiplier was 1 is fixed, which had been discarding the forecast on every ordinary night.
• PLATOON/PARK ingest prod-verified: 270 lineups, 265 platoon, 15 park dims.
• NOT built: park+weather→hit-type. Its inputs landed this session and carry ONE as_of date; testing it on total_bases needs accumulated dated rows, so building it now would be plausibility not proof.
• Proven for hits: pitcher_contact_profile, defense_by_direction.

Session 93 (2026-08-04) — Causally-correct defence atom PROVES ✅

4,297 tests / 342 suites green, build exit 0. Counter + frozen clusters byte-identical.

• ATOM 1 BUILT AND PROVEN. defense_by_direction (spray×trajectory × positional OAA, joined by handedness) PROVES on hits: n=528, Brier −0.0034, CI [−0.0059,−0.0009] at 99.9%. Team-average defense remains NOT PROVEN. Kev's insight confirmed: the crude operationalization was the problem.
• It moves the number LESS (0.013 vs 0.030) and is more reliably right — bigger movement is often the tell, not the signal.
• Zero new sourcing, as predicted: Savant leaderboard/batted-ball has pull/straight/oppo × gb/air (609 hitters, free); per-position OAA is a regrouping of the fielding feed. Prod-verified: spray 609, team_defense 31.
• Proven set for hits now: pitcher_contact_profile + defense_by_direction. Both pooled; per-archetype still sample-blocked (BOMBER 225–294, GHOST 86–125).
• ATOM 2 INPUT-BLOCKED. Weather free source PASSES (Open-Meteo wired, exposes temp/wind_mph/wind_dir/precip) but raw fields are collapsed to a scalar and wx_forecast is 0/1119. Park dimensions are not ingested at all — a hit-type conversion needs them. Not half-built.
• Next: retain raw weather fields (cheap), source park dimensions, then build ATOM 2. Sequence/reliever layer stays gated behind proven atoms.

Session 92 (2026-08-04) — The two-part factor gate; one factor proves ✅

4,286 tests / 340 suites green, build exit 0. Counter + frozen clusters byte-identical.

• factorGate.js — a factor must MOVE the prediction off the base rate AND improve out-of-sample Brier. Movement alone = THEATER, rejected by name. Baseline is the player's leave-one-out base rate (the literal "he's due" null).
• Cumulative correction applied to the INTERVAL (99.9% at 50 tests). This flipped defense and platoon out of "proves" — a plain 95% CI would have shipped two unproven factors.
• NOT_PROVEN_AT_CORRECTED_BAR added as distinct from THEATER; conflating them would repeat "insufficient evidence = evidence of absence".
• RESULT (hits, n=741): pitcher_contact_profile PROVES (Brier −0.0066, CI [−0.0114,−0.0016]). defense (−0.0043) and platoon (−0.0039) NOT_PROVEN at the corrected bar. park_hits sample-blocked (n=405). Zero theater.
• Per-archetype all sample-blocked (BOMBER 252–294, GHOST 67–125).
• Spec gaps found: approach identities (SPRAY/DAMAGE-DEALER/COUNT-WORKER) don't exist; parkFactors has no hits-specific factor (hits → run_base).
• Grade rescale NOT run — it was gated on factors proving, and one pooled factor with a −0.0066 Brier gain is not a factor-informed distribution.

Session 91 (2026-08-04) — Hits calibrated point-in-time; parlay partially unblocked ✅

4,275 tests / 339 suites green, build exit 0. Counter + frozen clusters byte-identical (p_win untouched).

• PARTIAL PASS. Fit <2026-08-02 (n=589) → held-out >= (n=383). Corrected held-out: 0.477→0.506, 0.587→0.580, 0.667→0.603 (raw was +0.191/+0.279/+0.246). Ordering preserved. Certified band 0.40–0.60 (n=276, err −0.029).
• HONEST CEILING 0.667 — no 80%+ hit reads survive calibration. 4-leg ticket at ceiling = 0.198, against 0.686 implied by the raw numbers.
• Banded certification (certifyBands/inCertifiedBand) instead of a blanket flag: middle honest (−0.029/+0.007), edges not (−0.167/+0.063).
• calibrationService fits strictly-before-today, splits by TIME, returns null on thin history (⇒ nothing stackable). Wired into the snapshot: hits grades carry p_win_calibrated + calibrated; p_win untouched.
• Parlay surface unblocked for in-band legs only — chainAcross compounds them, cross-game preferred, same-game a labelled approximation.
• Caught: a pass condition that demanded ≥0.70 bins exist would have failed the map for succeeding (calibration removes that band).

Session 90 (2026-08-04) — chaining-v1: portable chain + the calibration gate ✅

4,269 tests / 339 suites green, build exit 0. Counter + frozen clusters byte-identical.

• HIT-PARLAY BLOCKED (the order's own prerequisite, failed decisively). n=972: predicted 0.911 → actual 0.630; flat ~63% above 0.70. A 4-leg 91% ticket is 0.686 by the model, 0.157 in fact. chainAcross refuses uncalibrated atoms — verified end-to-end on real data.
• calibration.js — reliability table, isCalibrated gate (tolerance 0.05, high-end weighted), and fitIsotonic (monotone: ordering preserved, numbers corrected). Real map: 0.65→0.594, 0.85→0.639, 0.91→0.639.
• chain.js — the portable core. Aggregator pluggable (ACROSS=parlay, UP=score), sport parts as inputs, archetype-redistribute hook (dormant in baseball, live in basketball). Self-check flags internal inconsistency as LOW CONFIDENCE; market divergence flags a contested script WITHOUT claiming we're right. propagate is shrinkage-weighted by sample.
• NOT built this order: the independent game-script projection. It needs proven team-level atoms + out-of-sample validation vs actual margins, and no atom has passed the gate yet — building it now would be plausibility, not proof.
• Next: fit the point-in-time isotonic map and re-gate hits; that is the unlock for the parlay surface.

Session 89 (2026-08-04) — Lineup + baserunner context ingested ✅

Spec: commit history + src/services/lineupContextService.js. 4,250 tests / 338 suites green, build exit 0. Counter + frozen clusters byte-identical.

• THE INPUT RBI/RUNS ALWAYS NEEDED, ingested free from statsapi. lineup_context (batting order, 153 rows / 10 games) + hitter_opportunity (RISP share, 149 rows, range 0.170–0.528). Both DATED in the PK.
• Rung 2 was cheap: situational splits give the RISP aggregate in ONE call per player, not play-by-play reconstruction.
• Prod-verified via the new POST /api/internal/lineup-context/refresh (added because the first run wrote 0 while the parser worked locally — a 0 is a wiring bug until proven otherwise).
• Coherence check passes: top RISP-share hitters all bat 4th/5th.
• DRIVER/CATALYST theories now INPUT-READY, sample-blocked. Proofs run later under native cumulative correction — ingesting is not proving.

Session 88 (2026-08-04) — Re-adjudication: nothing to demote, hole closed ✅

Spec: specs/re-adjudication.md. 4,238 tests / 337 suites green, build exit 0. Counter byte-identical. Nothing recalibrated — nothing needed to be.

• PROVEN SET IS EMPTY, verified 3 ways (proven-status, featureRegistry summary, validatedSkills). Zero conditioning entries ever reached PROVEN, so STEP 3 (demote) and STEP 4 (recalibrate) are vacuous — correctly.
• Correction: the cumulative gate did NOT catch a false positive last session. It caught nothing; it tightened α 0.0026 → 0.0013, demonstrating the mechanism.
• THE REAL HOLE, CLOSED: promote() could bypass cumulative correction. isSufficient now requires bonferroni_tests, refuses anything below the cumulative count, and refuses a p that doesn't clear 0.05/tests. Same guard on recordConditioning(PROVEN). Verified: no-correction / per-session-8-vs-38 / weak-p all refused; cumulative-38 with p=0.0005 accepted.
• Cumulative correction now NATIVE on all analysis paths — pitcher-prove-k and tb-solo-and-interactions migrated off per-session counts.
• reAblation.js built (standing second line): pure/injectable, records both p-values + both test counts per verdict, PENDING_RETEST when there is no fresh measurement (absence is not evidence).
• Net effect on the proven set: ZERO. No demotions, no recalibrations, no ledger event — announcing a recalibration that changed nothing would itself be a false signal of rigour.

Session 87 (2026-08-03) — Defence ingested; cumulative correction locked ✅

Spec: specs/defense-ingest-and-cumulative-correction.md. 4,228 tests / 336 suites green, build exit 0. Counter + clusters byte-identical.

• DEFENCE INGESTED (free): Statcast OAA feed → 514 fielders → team_defense (31 teams, dated from row one). Prod-verified: fielding rows 514, team_defense_written 31. Cubs +56 best, Mariners −29 worst.
• CUMULATIVE BONFERRONI LOCKED (testLedger.js + mc_test_ledger): the denominator is now distinct hypotheses across the programme lifetime, not the session. Demonstrated 19 → 38, α 0.0026 → 0.0013. Re-tests don't inflate it.
• THE PREDICTED DIFFERENTIAL APPEARS: defence solo r = +0.130 GHOST (contact/speed) vs −0.018 BOMBER (power). Exactly "defence matters, and for whom". Both UNDERPOWERED (n=104/245, p=0.188 vs α=0.0013) — signal shape only.
• Bug class recorded: the feed 404'd on a doubled /leaderboard path and, because feeds degrade to an empty index by design, reported "0 rows" — which reads like an honest absence. Any feed reporting 0 is suspect.
• Nothing proved → nothing recalibrated, nothing shipped. validatedSkills() is {} everywhere; proven set still EMPTY.
• Next: sample only. GHOST×hits needs ~396 more rows, BOMBER×hits ~213. Prefer re-testing standing candidates — every new hypothesis now tightens α for everything after it.

Session 86 (2026-08-03) — Conditioning registry + a probe so "proven" stops drifting ✅

Spec: specs/conditioning-registry.md. 4,221 tests / 335 suites green, build exit 0. Counter + batter model + pitcher engine byte-identical.

• scripts/proven-status.js recomputes the proven set from the ledger. PROVEN_SET = EMPTY. Built because four consecutive orders opened by calling null results proven; prose decays, a recomputed number does not.
• COUNTING BUG CAUGHT: joining model_snapshots to ledger_entries fans out (one snapshot row per cycle) — BOMBER x hits read 641, true distinct 287. Fixed in both the analysis and the status probe.
• NO archetype x stat reaches the gate. BOMBER x hits 287 (short 213) is closest; pitcher archetypes untestable (58 settled Ks total).
• Structured registry built: recordConditioning keys archetype x SKILL x interaction x status + lift, with the skill tag ENFORCED (untagged refused, PROVEN-without-evidence refused). validatedSkills() = {} everywhere, by design.
• BOMBER x hits conditioning tested, all UNDERPOWERED: arsenal (barrel x breaking share) incr +0.043, batted-ball (launch x pitcher GB) +0.001, contact quality −0.020/−0.015, K x K −0.063. Within BOMBER the counter still leads (0.218 vs 0.160).
• Bug fixed mid-run: fromStatcastRow doesn't carry pitch_mix, so the arsenal category read n=0 — it was measuring nothing, not failing.
• DEFENSE: genuinely not derivable from ingested data (no OAA/DRS; pitching proxies conflate skills). Needs Savant's free fielding feed — not sourced, because sourcing it to test at n=282 answers nothing.
• Nothing proved → nothing recalibrated, nothing shipped.

Session 85 (2026-08-03) — Rung 1 derived free; the cap fix fingerprinted ✅

Spec: specs/lineup-k-rate-rung1.md. 4,221 tests / 335 suites green, build exit 0. Counter + batter cluster + pitcher engine byte-identical.

• CAP FIX VERIFIED IN PROD: 334 -> 907 grades/snapshot; strikeouts 6 -> 17. n>=500 for Ks is ~a week out instead of ~3 months. NOTE: the manual internal snapshot endpoint now 524s at Cloudflare (>100s) but COMPLETES server-side.
• RUNG 1 DERIVED, zero new sourcing: opposing-team K-rate from the roster joined to batter k_pct we already ingest, 94.7% coverage — now PA-WEIGHTED. That change flipped its contribution: unweighted HURT (0.174->0.129), PA-weighted HELPS (0.174->0.195). Head-to-head delta +0.259, CI [−0.0167,+0.5645] — nearly excluding zero, still INCONCLUSIVE at n=57.
• Within-archetype: FLAME incremental −0.152, non-FLAME +0.145 — opposite signs, invisible when pooled (+0.077). But n=20/24 and the direction contradicts the theory. Structure to re-test, not a finding.
• Rungs 2/3 NOT triggered — Rung 1 is n-blocked, not failed. Do not source confirmed lineups.
• Nothing proven, nothing calibrated, nothing shipped. Counter is still anti-predictive on Ks (−0.064); skill model leads by 0.26.
• Next: wait ~1 week for n>=500 + a statcast_history window, re-run, re-test the strata at ~200/stratum, and give arm_angle a registry entry + mechanism.

Session 84 (2026-08-03) — Pitcher engine built; the cap was eating the board ✅

Spec: specs/pitcher-engine-strikeouts.md. 4,221 tests / 335 suites green, build exit 0. Batter model + counter byte-identical (verified by diff).

• THE REAL FIND: the grade cap, not pitcher data. 1,244 unique gradeable props/slate; the 500 cap graded ~334, and first-row-wins-in-feed-order gave pitchers 6 props a slate. Raised 500 -> 1500 on measured cost (~179s for the full board at concurrency 5, cron 5x/day). Unblocks EVERY n-blocked stat. Pitcher props were never being refused (graded 5, refused 0, suppressed 0).
• pitcherEngine.js — own archetypes (FLAME/SCALPEL/SINKER/DEFAULT), own inputs (stuff), own projection (log5 K% vs THIS lineup x batters faced). Test asserts its weight keys differ from the batter engine's. 17 tests.
• Strikeouts NOT proven (n=57 vs 500): pitch-v1 0.1285 vs counter −0.0639, delta +0.192 CI [−0.098,+0.509]. Four solo features clear the |r|>=0.15 bar and fail only on n — arm_angle −0.250 (largest in the programme), whiff +0.213, k_pct +0.206, chase +0.195.
• The counter is ANTI-PREDICTIVE on Ks (−0.064) — recent K counts track opponent and workload, not skill.
• Bug caught: resolveTeam needs an abbreviation; the game log gives names, so lineup coverage was 0% and the theorized carrier was never tested. Fixed via NAME_TO_ABBR → 94.7%. The carrier still shows no incremental signal (n=54).
• Calibration not reached — nothing passed BAR 1.
• Next: let the cap accrue (~2 weeks to n>=500), re-run with a point-in-time window from statcast_history; give arm_angle a registry entry + mechanism.

Session 83 (2026-08-03) — Batter cluster measured; the proven set is EMPTY ✅

Spec: specs/batter-cluster-prove.md. 4,204 tests / 334 suites green, build exit 0. skillProjection byte-identical (TB frozen, verified by diff); counter untouched.

• PREMISE CORRECTED: total_bases has NOT passed BAR 1. It is inconclusive at parity (CI includes zero) and contaminated. Installing it as the "proven reference" would make the cluster's bar "be inconclusive at parity".
• HITS CLOSED — well-powered negative. n=803 CLEARS the gate sample bar, so features were tested not refused: max |r| 0.053, interactions ≈0, head-to-head −0.096 CI [−0.165,−0.029].
• Others n-blocked: TB 383, rbi 391, HR 228, runs 188. Leads: home_runs barrel r=−0.135 (negative = a correction, not a predictor); runs K×K incremental +0.132 (largest in cluster).
• RBI is half-unmodellable — power × opportunity, and baserunner state is not ingested at all.
• statcast_history retention LIVE + verified in prod (1,387 rows, as_of 2026-08-03). First run failed on a drifted hand-written schema; table now mirrors the source via LIKE. Usable point-in-time window starts 2026-08-04.
• Stage B has nothing to calibrate. Proven set is empty.
• Next (waiting, not building): let history accrue a week + TB/rbi reach n>=500, then re-run scripts/cluster-prove.js. Ranked: TB → rbi (needs baserunner state) → HR → runs. Do not re-run hits.

Session 82 (2026-08-03) — TB solo+interactions; point-in-time validation unblocked ✅

Spec: specs/tb-solo-and-interactions.md. 4,204 tests / 334 suites green, build exit 0, counter byte-identical.

• BLOCKER FOUND + FIXED FORWARD: statcast_aggregates keeps ONE as-of date (upsert in place). Yesterday's backtest was clean only because the refresh was dead code and the table sat at 2026-07-21; fixing the cron destroyed the window. New statcast_history table + retention on every refresh (best-effort, never fails the refresh). Until it accrues, all skill results are CONTAMINATED.
• SOLO (n=383, Bonferroni-12): nothing passes. hard_hit_pct marginal r=0.135 (p=0.0080) fails both the 0.15 bar and α=0.00417 — and DRIFTED DOWN from 0.153 at n=295. Everything else <0.09.
• INTERACTIONS: none pass. barrel×power_archetype is the only one whose incremental partial (−0.101) exceeds its parts (0.019), at n=260. A lead.
• Caught a fabricated finding: the archetype proxy was a transform of barrel itself, so the "interaction" was barrel² — it produced the only positive result until a scale-free collinearity check + real model_snapshots.archetype labels replaced it.
• COMBINED vs COUNTER on TB: 0.2718 vs 0.2647, delta +0.0071, INCONCLUSIVE — the first challenger that did not LOSE (hits was −0.116, CI excluding zero).
• BUILT: compound TB projection (per-PA bases convolution, barrel→HR share, exit velo→XBH share). Replaces the refusal; non-degeneracy locked by test.
• Next: let statcast_history accrue a point-in-time window (~a week) while TB reaches n>=500 (~117 short), then re-run. Do not re-run hits.

Session 81 (2026-08-03) — The gate, built and run: hits is dead, total bases is the stat ✅

Spec: specs/stagea-gate-result.md. 4,200 tests / 334 suites green, build exit 0. Counter byte-identical (zero diff on probabilityEstimator/analyzeViaEngine1).

• PREMISE CORRECTED: statModel.js and correlateValidator.js do NOT exist in this repo. The spec lived only in an offline Python blueprint, and supplementSystems.test.js inlines its own validateFactor (requires just fs/path). Nothing to connect — so the gate was BUILT to spec.
• correlateValidator.js — n>=500, |r|>=0.15, p<0.05, Bonferroni. Exact p-value (incomplete beta), unit-verified against known values.
• GATE RUN, hits (n=570, Bonferroni-8): EVERYTHING FAILS. Max marginal |r| 0.062 vs the 0.15 bar — an effect-size failure at a well-powered n. Head-to-head also loses: 0.0499 vs counter 0.166, delta −0.116 CI [−0.189,−0.043].
• GATE RUN, total_bases (n=295): CANNOT TEST — and that is the finding. hard_hit_pct marginal r=0.153 (above threshold), exit_velo 0.124; refused only on n. ~205 more settled rows needed. Matches the physics: contact quality drives extra bases, not singles.
• Architecture change the run forced: per-STAT feature verdicts, so a feature dead for hits stays alive for TB. Gate now reports r/p when underpowered.
• Next: build the compound TB value projection (per-hit bases distribution from launch/barrel — skillProjection still refuses TB by design), accrue to n>=500, re-run the gate. Leave hits alone. Do not lower the bar.

Session 80 (2026-08-03) — The skill engine: built, gated, and Stage A honestly lost ✅

Spec: specs/skill-engine-architecture.md. 4,182 tests / 333 suites green, build exit 0.

• BUILT src/services/model/: featureRegistry (CANDIDATE/PROVEN/DEAD per sport; liveFeatures() = PROVEN only; promotion needs n>=200 + positive lift + CI excluding zero, no override) and skillProjection (PA outcome tree, log5 odds-ratio K/BB, archetype-selected contact quality, Binomial over a PA distribution). 22 tests assert the five disciplines as BEHAVIOUR.
• The gate works by construction: with only PROVEN features allowed the projection returns NULL. Registry ships with ONE proven feature (the counter).
• STAGE A: skill-v1 LOSES → NOT PROMOTED. Out-of-sample (profiles frozen 07-21, only later games scored), 570 rows, 91.9% pitcher coverage: resolution 0.0499 vs champion 0.166, delta −0.116 CI [−0.189,−0.043]. Not selective either (top-8 hit 50%, lift −0.065).
• Two false starts caught: (1) units — statcast stores PERCENTAGES, raw rows made bip negative and refused 568/576; now one chokepoint fromStatcastRow. (2) an INVALID first verdict — ledger team/opponent are NULL, so the pitcher resolved for 1 of 570 rows and it was silently measuring a batter-only model. Fixed via each player's statsapi game log.
• Not exercised yet (so the loss is real but partial): park (passed 1.0), handedness, opportunity_drift, and PA projection is season-PA/103. And the skill profiles carry NO recency while the champion has last-5.
• Fixed: Statcast nightly refresh was UNREACHABLE CODE — inside tick() below the HOURS_UTC guard while testing h===11. Never ran; 13 days stale; both alerts in the same dead branch. Now its own tick; test rewritten to catch it.
• Next: recency into the skill profile, wire park/handedness/opportunity_drift, real PA from lineup slot, then re-run Stage A.

Session 79 (2026-08-03) — Reality assessment vs the FORWARD-PROJECTION objective ✅

Spec: specs/forward-model-reality-assessment.md. READ-ONLY (src/web untouched).

• Finding: the forward model's parts all EXIST and are all wired downstream of the grade. probabilityEstimator (the served p_win) reads 3 features + the game log. Statcast/arsenal/park/weather/platoon/archetype load in snapshotService AFTER grading, into challenger columns nothing serves. mlbContext has zero consumers.
• Statcast nightly refresh is DEAD CODE by guard — tick() returns for hours not in HOURS_UTC (14,19,22,1,3); the block tests h===11. Data frozen at 2026-07-21 (13 days stale); its own failure alert is in the same dead branch.
• Inputs are HAVE — 1,354 statcast rows, handedness complete both sides, pitch mix/velo/break, GB/FB, barrel, exit velo, launch. MISSING: team defense (OAA/DRS), catcher framing/umpire. PARTIAL: batter GB/FB (in metrics JSONB), lineup slot (role tables 0 rows).
• Design shows the COUNTER. Factor labels are all l5_hot_vs_line-family plus NBA leftovers (refs, coach pace). The card's forward-read slots (archetypeBlend "Why this grade", vyndrIntel.matchup, propDNA) exist and go unfilled. Needs feeding, not redesign.
• STAGED DISTANCE: Stage A (forward baseball model) = ONE real build, ZERO data acquisitions — assemble hitter profile × pitcher stuff × conditions as the SPINE with frequency demoted to a prior; risk is sample, not feasibility. Stage B (calibrated + scouting surface) = short once A exists (clamp/calibration already diagnosed + swap the factor vocabulary). Stage C (per sport) = blocked on mechanism data we do not have for NBA/WNBA (ESPN is box scores, Python service offline) and soccer is odds-api quota-blocked.
• Verdict re-checks: proj-v1.1 + hits-v1 stay refuted AS DISTRIBUTION SWAPS (neither tested a matchup-fed projection); arch-v1 is market-relative by construction = the one measured on the wrong axis; "AT CEILING" is provisional.

Session 78 (2026-08-03) — Champion decomposed: the edge is a hit-rate counter ✅

Spec: specs/champion-input-diagnosis.md. READ-ONLY (src/web untouched); 4,159 tests green.

• The champion is 5 lines. base = empirical frequency of (stat > THIS line), 0.6/0.4 blend with last-5, ±0.03 opponent, ±0.015 home/away, cv>0.40 pull, clamp [0.10,0.95]. It reads 3 features; featureCache retains a dozen more that p_win never touches.
• Exact analytic ablation, per stat, paired bootstrap. Removing ALL THREE adjustments changes resolution by nothing everywhere (hits −0.0059, TB −0.0015, rbi +0.0106, runs +0.0130, walks +0.0008) — and rbi's home/away is mildly HARMFUL (+0.0053, CI excludes 0). ~100% of the edge is base+recency.
• Pooled 0.46 is an artifact — per stat 0.196 (hits) … 0.499 (rbi). Corrected last session's reading; paired differences unaffected.
• BIGGEST LOSS = the clamp. 20.6% of settled rows pinned to a constant (no ranking possible there), and 0.900 covers home_runs-under truly 99.5% AND hits-under truly 51.9%. Global over-prediction +3.5pt (TB +7.6). No new data needed to fix.
• One real lead: opportunity_drift (residual +0.156 hits, +0.145 TB — repeats across stats, unlike the weather hits which sit inside the expected false-positive count). We ALREADY compute it; arch-v1's opportunity axis extracts nothing from it. Wrong implementation, not a missing feature.
• Archetype: UNMEASURABLE — 2 of 41 labels have testable n. Not refuted.
• Next order priority: (1) clamp + calibration, (2) opportunity as a rate scaler, (3) prune the diluting axes, (4) get archetype coverage. Explicitly NOT another projection variant.
• Flagged: model_snapshots.outcome NULL on all 22,032 rows — retention is never settled, so replays must join the ledger for labels.

Session 77 (2026-08-03) — Settlement was dead for two days; scoreboard now readable ✅

Specs: specs/challenger-scoreboard.md, specs/odds-429-diagnosis.md. 4,159 tests / 332 suites green, web build exit 0.

• THE FIND. Three challenger axes read exactly ZERO settled rows. Not low — zero, on games played days earlier, with settle_attempts = 0. settleLedger refetched rows via .in('id', ids); 500 UUIDs = an 18,499-char URL the fetch layer rejects, and the result was destructured with no error binding, so it returned all-zeros indistinguishable from a clean "nothing to settle". Volume-triggered: 2026-08-01 was the first day past the 500-row limit. The zero-settle ops alarm reads those same return values and was blind to it.
• FIXED + DRAINED. One query, all columns, no id list; failed fetches surface. captureClosing chunked at 100 (same defect family). 1,444 rows from 08-01 settled (1,376 hit/miss + 68 void, 0 remaining). Settled n 493 → 1,741.
• SCOREBOARD — nothing promoted, nothing earned it. arch-v1 n=1,741 Δ0.0000 CI[−0.0050,+0.0054] (moves 76% of rows by 2.5pp mean = active movement carrying no information); contact-v1 n=1,055 +0.0008 inconclusive; proj-v1.1 ladder n=1,664 −0.0301 CI[−0.0543,−0.0060] = reliably WORSE. matchup/tb-v1/hits-v1 STILL PENDING (rows dated 08-02+, settle after ET midnight). Champion byte-identical; all challengers stay wired.
• 429 DIAGNOSED (read-only) — premise refuted with numbers. PropLine 5/3,000 daily (0.17%); the 429 is odds-api at 478/500 monthly, blocked at 95%, surfacing whenever PropLine returns empty. One snapshot = ONE PropLine call per sport. Change-based pull is NOT the fix and no tier upgrade is needed. Could NOT verify PropLine movement endpoints (auth-gated docs, prod-only keys) — not asserted. Book-breadth invariant recorded: we never discard books; DFS is excluded from PRICING only.
• Next: the silent PropLine fall-through (empty slate must not report the backup's 429); diagnose the projection family's INPUTS (two independent measurements now say it trails the champion).

Session 76 (2026-08-02) — hits-v1: a challenger built, measured, and REFUTED ✅

Spec: specs/hits-v1-binomial.md. 4,156 tests / 332 suites green, web build exit 0. Scope was hits only; champion, ladder, ranking, calibration, reference ruler and the four accruing challenger verdicts are byte-identical (the diff has ZERO deleted lines).

• What was built. src/services/projection/binomialHits.js — hits as a bounded conversion: N ~ the player's empirical at-bat distribution, hits | N ~ Binomial(N, q). At the 0.5 line (84% of real hits rows) this states P(>=1) = 1 − E[(1−q)^N] directly instead of inferring P(0) from a count family. The multiplier scales q (conversion), never N (opportunity). Wired in projectionChallenger as proj_hits_p_over / proj_hits_meta (new ledger columns, migration applied).
• STEP 0 first — inputs before model. scripts/hits-input-coverage.js: 30/30 real ledger players, 100% combined-input coverage, mean 3.518 AB/G, mean per-AB rate 0.248.
• FIRING, on the real board. scripts/verify-hits-v1.js runs the production attachProjection over the live prod snapshot: 158/159 hits props (99.4%), one honest abstention. 94 of 159 props sit OUTSIDE the promotion band and 93 were modelled anyway — scoping by book identity kept 59% of the board a price-shape rule would have deleted.
• AND IT LOST. Point-in-time replay (log truncated strictly before each row's game_date, real grade-time multiplier), hits-only, direction-aligned, n=242: resolution champion 0.195 / ladder 0.048 / hits-v1 0.026. Paired bootstrap: hits-v1 − ladder = −0.022, CI95 [−0.046, −0.0003]. NOT PROMOTED.
• The finding is what it eliminates. Family was wrong AND mean was not the constraint (hits-v1 moved the line-0.5 mean 0.554→0.581 toward a 0.598 base rate while resolution FELL). The hits deficit is per-prop DISCRIMINATION — the ladder's inputs, not its distribution.
• A pre-registered branch recorded as WRONG. The spec's fallback ("hits may be genuinely low-resolution for anyone") is refuted by the champion scoring 0.276 on the identical 189 rows. Kept in the doc rather than deleted.
• Next order is a DIAGNOSIS, not a model: what does the champion's p_win read on a hits prop that the projection ladder does not? Building another projection variant first would repeat this session's mistake.
• Logged not fixed: local .env has a transposed Supabase ref — local scripts need SUPABASE_URL= override; prod unaffected.

Session S11 (a1 board, 2026-07-12) — Live Tracking: the read locked, the game watched ✅

Spec: specs/LIVE-TRACKING.md (+ ROW-GRAMMAR §2/§3 S11 amendment). 2698 → 2757 tests (229 suites), web build exit 0.

• liveTrackingService — MLB statsapi (schedule?hydrate=linescore identifies Live games + inning in ONE call → boxscore per live game) + WNBA ESPN (scoreboard 'in' → summary boxscore). Pure parsers built on REAL feed shapes captured while PHI@DET was live (bottom 8th, 2026-07-11). LOCAL LIVE_BOX_FIELD map (batting/pitching split + IP thirds — deliberately decoupled from outcomeService.MLB_LOG_FIELD, same rule as settlement). A player with empty box stats is ABSENT, never 0.
• POLLING RULE — live:{sport}:{date} TTL 90s, written cache-aside by public GET /api/live/:sport (60/min, mounted in app.js + Next proxy app/api/live/[sport]). Quota: 1 schedule + N-live-games boxscore calls per 90s across ALL users; zero boxscore calls when nothing is live.
• lib/liveProgress.js (pure, CommonJS) — propState (over: HIT ✓ / ON PACE / NEEDS N beats-the-push; under: HOLDS-IF — never hit until final, LINE PASSED amber when exceeded; never red in-progress), buildLiveIndex, attachLiveProgress (graded+unsettled+non-dead props only, joined on nameKey + the new canonical statType strip field, state vs the LOCKED line), gameLiveProximity + sortLiveFirst.
• LIVE SLATE MODE — Slate polls /api/live/{sport} every 60s ONLY while live mlb/wnba games are on screen; live games with tracked props float to the top by proximity-to-hit. StatStrip.LiveTracker renders 3/1.5 TB · ▼8th + game-progress bar + state chip in the ROW-GRAMMAR OUTCOME slot (proto-outcome; actions suppressed while live); GameCard shows "TRACKING — READ LOCKED PRE-GAME" once per live card. GRADES NEVER CHANGE IN-GAME.
• Acceptance (real feed): Bryce Harper 3/1.5 TB · ▼8th → HIT ✓, Cristopher Sánchez 1/2.5 ER · ▼8th → HOLDS — full pipeline on the live capture. Verify tonight: curl -s https://vyndr.app/api/live/mlb | head -c 400 (or node -e "require('./src/services/liveTrackingService').getLiveTracking('mlb').then(o=>console.log(JSON.stringify(o).slice(0,400)))" on the box during a live window).

Session S6 (a1 board, 2026-07-11) — Display: the full picture under the grammar ✅

Spec/law: specs/ROW-GRAMMAR.md (locked by tests/unit/rowGrammar.test.js). 2654 → 2698 tests (226 suites), web build exit 0.

• ROW-GRAMMAR.md — canonical prop-row slot order (identity → viability → stat+line → market context → model output → outcome → actions → provenance), color law (green=edge/best/positive, amber=caution/steam, red=settled-negative only, dim=absent), mark law, mobile stacking, no-truncation law. StatStrip violations FIXED: MovementChip moved before the grade (market before model); ViabilityChips moved after the archetype (identity is one contiguous run).
• Line-movement sparklines — intradayRefreshService.trackHistory appends real {t, line} points per grade (seeded with the lock, deduped when flat, capped 24) inside the snapshot it already writes back. StatStrip.LineSparkline renders at ≥3 points (green toward / amber against / dim flat — never red).
• Last-10 dot strips — services/last10Dots (streaksService accessors) → /api/snapshot/:sport attaches last10_dots from rosterlogs:{sport}; StatStrip.DotStrip renders ●/○ vs the LOCKED line, newest first.
• CLV distribution — getModelAggregate emits clv_distribution (7 signed buckets, outliers clamped) ONLY past the n≥20 gate (null below — gate stays centralized). Ledger MODEL header renders the green/red/dim bar strip.
• Global search — SearchModal (⌘K / Ctrl-K via GlobalHosts, window.__search), players per sport via /api/players/search + static lib/teams.js (30 MLB / 30 NBA / 13 WNBA; soccer deliberately absent — no canonical registry). Nav search icon (mobile path) + Search first in the BottomTabBar More sheet. Explore tab untouched.
• Landing LCP — fade-up floored at opacity .6 (hero h1 is contentful on first frame; also fixes the S33 visible-floor rule) + IBM Plex Mono preload:false (4 decorative font files off the slow-4G critical path). PageSpeed re-measure is a post-deploy runbook step (cannot run here).

Session S9 (a1 board, 2026-07-11) — Slip Reader: zero-API OCR ✅

Spec: specs/a1-s9-slip-reader.md. +34 tests (24 unit + 10 integration).

• slipReader service — tesseract.js (self-hosted WASM, Apache-2.0, zero API spend) + PURE per-book layout parsers (DraftKings, FanDuel, BetMGM, Caesars) on OCR-text fixtures. Per-field confidence; below 0.6 → field null + needs_review — the reader never guesses. Stats normalize to the scan-route vocabulary; names through playerName.
• POST /api/slips/parse — auth, free 1/day paid 10/day (slips:{user}: {day} Redis + memory mirror), 4MB image cap, text paste path. Next proxy added. Mounted in app.js.
• /slip page (gated) — upload/paste screenshot → manual-correct UI (amber = uncertain) → per-leg grade via existing /api/scan (honest refusals) → add-all to Parlay Lab → "VYNDR read my slip" share card.
• Acceptance: FULL image path — synthetic DK slip PNG (sharp SVG→PNG) → real tesseract.js OCR → parser → 3/3 complete legs. Untested on a real phone screenshot yet — grab one post-deploy.
• Vision-model upgrade logged post-revenue in specs/vyndr-roadmap.md.

Session S10 (a1 board, 2026-07-11) — Public Ledger Profiles v1 ✅

Stage-3 seed (Strava for betting), zero out-of-pocket. Branch off day1/a1-board (aaafc3e). 2574 → 2612 tests (220 suites), web build exit 0. Spec: specs/a1-s10-public-profiles.md.

• Migration 022_public_profiles.sql — COMMITTED, NOT APPLIED (founder applies migrations). public_profiles (user_id PK → auth.users, handle UNIQUE + regex CHECK, published DEFAULT FALSE). RLS: published rows readable by anyone, own row by owner, writes service-role only.
• API — /api/profiles: GET/POST /me (requireAuth; handle regex 400, taken handle 409, published only flips on explicit boolean true) and public GET /:handle (published → user-scoped 30d aggregate + settled rows newest 50, same columns as /api/ledger; unknown AND unpublished → byte-identical 404 — no existence leak). getModelAggregate gained a userId option (public .is('user_id', null) default untouched).
• Frontend — /u/[handle] (PUBLIC, in OPEN_ROUTES): server shell with "CLV-verified record — @handle · VYNDR" metadata + client record (hit% + beat-close% at n≥20 else RECORD BUILDING; outcome + CLV chips) + OG card (Node runtime, never edge). Settings PUBLIC PROFILE section: claim handle
  • one explicit publish toggle with the private-by-default copy.
• Next: profile OG card could embed the live record once n≥20 profiles exist; user-scan settlement coverage beyond MLB is the limiting factor.

Session S3 (a1 board, 2026-07-11) — Affiliate + Partnership Plumbing ✅

Zero out-of-pocket; everything config-flip-ready but DISABLED/organic. 2398 → 2439 tests (209 suites), web build exit 0.

• BOOK IT deep links — web/src/lib/bookLinks.js + affiliateConfig.js (every book enabled:false; Impact/Partnerize param shapes documented). StatStrip BOOK IT is a real anchor now (organic); scan hand-off links moved to the builder. Every book anchor renders rel="sponsored noopener noreferrer".
• Best-price marker — slateAdapter.detectBestBook (≥2 books, SAME line, differing prices, else null) + green dot in StatStrip; books[] (the grouped odds rows) now threads Slate → strips instead of being discarded by pickLine.
• Partner refs — ?ref=CODE → 90d first-party vyndr_ref cookie (first-touch, PartnerRefCapture in layout) → signup metadata partner_ref → internal GET /api/partners/report/:code (zeros + note until the TODO migration in docs/PARTNERS.md adds user_profiles.partner_ref; NOT run).
• docs/PARTNERS.md — ref link spec, Stripe promo-code mapping convention (partner code == promotion code), TODO migration SQL.

Session S7 (a1 board, 2026-07-11) — Newsletter: THE VYNDR REPORT ✅

Branch off day1/a1-board (e4d2e79). 2398 → 2429 tests (207 suites), web build exit 0. Spec: specs/feature-a1-s7-newsletter.md. Runbook: docs/NEWSLETTER.md.

• Capture: NewsletterCapture (dark terminal, mono data) on the landing (below FAQ) + /welcome (the real signup success surface — the signup "done" card auto-redirects in 1.5s, useless for a form). Double-opt-in note under the field; "Signups open soon" when Listmonk env is unset.
• Backend: POST /api/newsletter/subscribe (public, 10/min IP limit, honeypot, server-side email validation) → Listmonk subscribers API with preconfirm_subscriptions:false (Listmonk sends the confirmation). No env → calm 200 { ok:false, reason:'not configured' }. Next proxy web/src/app/api/newsletter/subscribe/route.ts (S25 rule).
• Assembly: newsletterService.buildDailyReport — signals from snapshot:{sport}:latest, STREAK WATCH via rosterLogs → streaksService → streakLens (one row per player), THE RECORD via getModelAggregate (percentage ONLY when hit_pct != null — the n≥20 gate — else "RECORD BUILDING · N pending"). RG footer (21+, 1-800-GAMBLER, {{ UnsubscribeURL }}) in html + text. VOICE lint locked by tests: no !, no banned vocabulary, numbers only from injected pipeline data.
• Send: sendDailyReport creates + starts a Listmonk campaign; operator-triggered ONLY via POST /api/internal/newsletter/send (internal key). NOT scheduled. Empty report (0 signals + 0 streaks) refuses to send.
• Env for Coolify (all four required, else graceful no-op): LISTMONK_URL, LISTMONK_USER, LISTMONK_TOKEN, LISTMONK_LIST_ID.

Session S2 (a1 board, 2026-07-11) — BUILT ✅ COMPLIANCE + APPROVAL PACK

Branch worktree off day1/a1-board. 2429 tests (206 suites), web build exit 0 (next build --webpack). No backend routes touched.

• /responsible-gambling REBUILT sincerely — 21+, 1-800-GAMBLER (1-800-426-2537) as the primary helpline, 17-state resource list, warning signs, state self-exclusion guidance, links to the EXISTING /settings Responsible Play + Danger Zone surfaces. Zero marketing adjacency (no pricing/scan/upgrade links — a test enforces it).
• /terms + /privacy redrafted as honest approval-pack drafts (marked DRAFT: JULY 2026). Entity details are placeholder tokens Kev must fill: [ENTITY NAME], [STATE OF FORMATION], [ARBITRATION VENUE], [CONTACT EMAIL]. Privacy sub-processors now match reality (Stripe, Supabase, Resend, Sentry; PostHog described honestly — autocapture off, banner is disclosure-only, NOT consent-gated).
• /methodology NEW (server component + metadata, footer COMPANY link, OPEN_ROUTES): pipeline → engine → 11-step letter grades, refusals (insufficient_data), VYNDR Originals (41), Ledger settle (locked at grade time, box-score settle, CLV vs captured close, n≥20, public revisions), why misses are public.
• /about audited to North Star framing: data intelligence platform, THE PROOF card (Ledger + n≥20 + refusals + methodology link). Kept the "give it back" h1 (Phase-E test) + Wordmark (QA.5).
• Footer: helpline updated 1-800-522-4700 → 1-800-GAMBLER; Methodology link added. Compliance audit: footer is global in the root layout, no nested layout or CSS suppresses it on any page — zero pages missing it.
• content/articles/ — 5 Ghost-ready seed drafts (front matter, VOICE v1.1, zero exclamation points, test-enforced) + docs/GHOST-PUBLISHING.md manual runbook (no Ghost credentials used; nothing auto-posts).
• Tests: tests/unit/compliancePages.test.js (31 assertions, source-text style).

Current Phase

SHIP BUILD v59.0 — Overnight session: ledger team/opponent addendum, work-order 1.6 closed (canonical player keys + slate join invariant), Phase 2 slate UX, Phase 3 mobile P0. DEPLOY GATE: Coolify by Sat 10 AM ET; first snapshot locks against freshly posted lines (manual internal trigger).

Session 8 (A1 board, 2026-07-11) — SHIPPED ✅ OPS: THE PRODUCT WATCHES ITSELF

Branch off day1/a1-board tip. 2398 → 2437 tests (208 suites). Backend-only.

• Settlement alarm (snapshotScheduler): outcome/ledger settle pass THROW → ntfy high. Morning zero-settle alarm: ledger settle found pre-today Postgres rows but settled none → page once per ET date (signal = settleLedger's own return values — survives the Redis-TTL failure mode that silently killed morning settles in S60; documented in opsWatch.zeroSettleAlarm). Genuinely empty yesterday never alerts.
• Persistent-failure pager (opsWatch.createFailureTracker, pure): 3 consecutive error / skipped-'no props' slots for a sport pages once (high); any good slot resets and re-arms. Single-slot misses stay quiet.
• Quota (opsWatch.checkQuotaDaily): odds-api ≥80% after a snapshot run → one alert/day, Redis-deduped (ops:quota_day:{provider}:{date}).
• Box health (services/systemHealth, pure + injectable): fs.statfs
  • os mem → {disk_pct, mem_pct}; pages high at disk>85 / mem>90.
• Daily pulse 13:00 UTC (9 AM EDT; PULSE_HOUR_UTC to move), ONE notification: ledger rows yesterday (ledgerService.countRowsForDate, 'n/a' when Supabase off — never a fabricated 0), settles last 24h, quota pct, disk/mem, 'desk pack: see /desk'. Dedupe: in-process date + ops:pulse:{date}.
• docs/OPS-RUNBOOK.md: Uptime Kuma monitors (vyndr.app 200, api /api/health keyword 'healthy', /api/snapshot/summary), Coolify deploy-failure webhook → ntfy, ntfy phone-subscription steps.
• Live acceptance alert POSTed to ntfy.sh/vyndr-pipeline-kev2026.
• All alert copy VOICE v1.1 — deadpan, numbers, zero exclamation points (tests lint for !). Spec: specs/session-8-ops-watch.md.

Session 60 (night2/full-board, 2026-07-11) — BUILT ✅ THE WHOLE BOARD (awaiting "merge the train")

Branch night2/full-board off d10bb4c — ZERO pushes to main. 2352 → 2396 tests (205 suites), web build exit 0. Sessions A–H all shipped:

• A AUTONOMY.md + P0: SNAP_TTL 6h→24h (the 11h overnight cron gap expired the snapshot before the morning settle — accuracy loop silently settled nothing; the Postgres ledger settle was immune).
• B Streaks engine RESURRECTED + fed: the snapshot pipeline now writes rosterlogs:{sport} from the stats it already fetches (producers were all external/unarmed — that's why panels never rendered). Form heat (hot hitters/sluggers/shooters, Σ/Σ rate math) + THE LENS (built-vs, tonight's matchup + opposing SP ERA, step-up/down, one-line read). LIVE acceptance: 32 real rows (Turang 12-gm on-base, Reynolds 8-gm, Pratt 7-gm, Meidroth 5-gm, Cortes 5-gm).
• C Aggregator mounted: Explore = SEO server shell + hub (leaders + full streaks + hot lists); streaks FREE for all tiers (the picture is free); landing teaser fixed (pointed at off-season NBA → never showed); one stat selection filters props+streaks+hotlists; player-dossier ACTIVE STREAKS block (+?player= on /api/streaks).
• D Phase 2.5: 20-min odds-only refresh in slate hours (skips snapshot slots, INTRADAY_REFRESH=0 kill switch, POST /api/internal/refresh/all). STEAM ▲ (with, no re-grade) / VALUE ▲ (against ≥1.0, re-grade holds) / PUBLIC revision (grade drops → revised_from_grade, strikethrough). Refresh-fidelity closing capture; ticker MOVEs at refresh frequency. Quota: ≤144 PropLine calls/day vs 9,000 free capacity. Post-deploy: set SNAPSHOT_EXPECTED_INTERVAL=1200 and SYNC goes live.
• E Phase 4: /api/players/search built (didn't exist — the Ohtani bug); nameKey fuzzy match live-verified vs the real 1,299-player list. §7 reveal (steps → DECLASSIFIED stamp → 90ms staggered panels, reduced-motion safe). PRIOR READS chips. Parlay: shared statLabel, 1-leg provisional grade, Nav entry via window.__openParlay.
• F Phase 5: archetype definition line on-page; VYNDR-on-team (ModelRecord team scope); WNBA minutes-usage; Settings meter from the LIVE limiter (3/day free, 15/day analyst, ∞ desk); per-tier calibration chips (n≥20 PER TIER).
• G Phase 6: landing first-paint root cause KILLED (page blocked its render on Supabase auth init for anonymous visitors; now a sync localStorage gate — anon paints instantly). Proof Strip: A-tier-gated header, "TONIGHT'S BOARD" fallback, yesterday's settled reads with outcome chips when ungraded. /api/content/top-signals + /streak-watch (zero-grade format) + /daily-report (self-flags do_not_post until n≥20). Per-player OG images (Node runtime) + player metadata.
• H Design pass: QA.20–22 locks (STEAM amber/VALUE green/STALE-only red, revisions struck through, new data surfaces mono, honest waiting copy everywhere).

The word: "merge the train" → main fast-forwards → Coolify ships board #2.

Session 59 (2026-07-10 overnight) — SHIPPED ✅ ADDENDUM + 1.6 + PHASE 2 + PHASE 3

Backend 2327 → 2352 tests (+25), 202 suites. Web build clean (exit 0). Migration 020 (team/opponent) APPLIED while ledger_entries was at 0 rows — zero backfill needed; VYNDR-on-team unblocked.

• Task A — ledger_entries.team/opponent populated in both write paths (pipeline: stats-resolve team + prop's other side via nickname match, NEVER guessed; scan: snapshot-grade team, opponent null). Roadmap: Phase 4.5 (WNBA ESPN box-score settlement — DUE ~Jul 24) + Phase 5 calibration- by-grade-tier logged.
• Task B (work-order 1.6 CLOSED) — mlbStatsAdapter.searchPlayer now resolves via canonical nameKey (the old matcher DELETED accents: "Sánchez"→"snchez"≠"sanchez", then substring-guessed → wrong player's last-10). Fallback = UNIQUE last-name+first-initial or null. buildPlayerStripsFromProps gained the JOIN INVARIANT: a graded prop whose player's real team isn't a game participant is DROPPED (TB player can't render under MIL@PIT — suite fails if it regresses). Snapshot grades now carry team. Root cause of /team "No active props": grades:{sport} TTL (2h) < cron gap (5h) → now SNAP_TTL (6h).
• Task C (Phase 2) — 2.1 sport tabs are THE filter, URL-driven (?sport=, deep-linkable); the dashboard's duplicate legacy tablist is GONE (legacy sections subscribe via onTabChange). 2.2 cards cap at 6 graded props sorted A+→F with "ALL N READS →" expanding in place. 2.3 waiting states show the REAL next pipeline run ("Grades post ~6:00 PM ET" via lib/pipelineSchedule — mirrors SNAPSHOT_HOURS_UTC; update BOTH if the cron changes). 2.4 = TTL fix + join fix (verify on the live Yankees page post-deploy).
• Task D (Phase 3) — ROOT CAUSE of vanished mobile nav: HIDE_ON included '/' — the landing had NO nav at 390px (desktop links hidden, hamburger retired S37, tab bar suppressed). '/' removed. 3.2: html/body overflow-x hidden <768; GAME LINES collapses to a best-line summary + "N BOOKS ⌄" expander <640; venue (.gc-venue) drops first on phones.
• Live verification: raw ESPN (no date pin) STILL returns the Jun 13 NYK@SA Finals game today; the pinned fetch returns 0 games, 0 off-date.

Morning deploy runbook (Sat, before ~10 AM ET)

1. Push already sent to gitea (Coolify betonblk) — confirm deploy finished.
2. GET /api/internal/snapshot/status (x-internal-key) → cron_armed true.
3. When the day's lines post: POST /api/internal/snapshot/all (x-internal-key) → first public ledger rows lock against fresh lines.
4. Verify: SELECT count(*), count(*) FILTER (WHERE team IS NOT NULL) FROM ledger_entries WHERE user_id IS NULL; + one sample row.

Session 58 (2026-07-10) — SHIPPED ✅ PHASE 1: TRUTH INFRASTRUCTURE

Backend 2309 → 2327 tests (+18), 201 suites. Web build clean (exit 0). Spec: specs/phase-1-truth-infrastructure.md. Migration supabase/migrations/019_ledger_entries.sql APPLIED to prod (betonblk) — dedupe (UNIQUE NULLS NOT DISTINCT) + RLS verified live (anon reads public rows only; anon INSERT rejected 42501).

• ledgerService — recordPipelineGrades (public model record, idempotent ignoreDuplicates upsert), captureClosing (every snapshot overwrites today's closing_line/odds from the real feed; last write before game start = close), settleLedger (outcome + actual + SIGNED CLV: over = locked−closing), getModelAggregate (30d; percentages NULL under 20 settles). No-ops without SUPABASE env. Number(null)===0 fabrication bug caught by tests → strict numOrNull everywhere.
• Write paths: snapshotService → ledger (user_id null, priority path); Next /api/scan → ledger row for AUTHED users only (anon would pollute the public record). Refused reads write NOTHING (no scan_history either) and don't burn a scan.
• Honest refusal (work-order 1.5): analyzeViaEngine1 returns insufficient_data: true, grade: null when the model has no projection (l5→l20→{stat}_per_90→xG for soccer). The web gradeAdapter no longer displays the LINE as the projection (the audit's model==line degenerate); GradeResultCard renders "—" absent states; scan page renders "INSUFFICIENT DATA — NO READ".
• /ledger: MY READS | MODEL tabs; model header shows "H-M · X% HIT · Y% BEAT CLOSE" only at n≥20, else "RECORD BUILDING" + pending count. ModelRecord component mounted on landing + player hero (deferred-render).
• SYNC (Task 5): thresholds vs SNAPSHOT_EXPECTED_INTERVAL (default 18000s): normal <1.5x · amber ≥1.5x · STALE red ≥3x.
• Phase 2.5 LOGGED in specs/vyndr-roadmap.md (intraday refresh + STEAM/VALUE/revision handling; build after Phase 3).
• Settle trigger: scheduler settle pass + POST /api/internal/ledger/settle.

Session 57 (2026-07-10) — SHIPPED ✅ PHASE 0: KILL THE LIES

Backend 2289 → 2309 tests (+20), 199 suites. Web build clean (exit 0). Spec: specs/phase-0-kill-the-lies.md. Work order: Phase 0 of the overhaul (audit-driven; Phases 1–6 queued).

0.1 — Fake NBA game (root cause found + fixed at the source)

• scheduleService.fetchScheduleFromEspn hit ESPN with NO ?dates= param and NO date filter → off-season ESPN returns the NEAREST slate (the Jun 13 NYK@SA Finals game rendered as "tonight" all July). Now pins ?dates=YYYYMMDD AND filters events to the requested ET date; undated events dropped.
• Honest per-sport empty states: web/src/lib/emptyState.js (month-aware — "NBA returns in October." vs in-season "No NBA games today."), used by the dashboard NO SLATE block + the Slate empty state.

0.2 — Fake header counters deleted

• liveTick.js stripped to { tick } (1s re-render pulse only). The fake auto-incrementing "247 graded", sin-driven brain-%, aPlus/cascades: DEAD.
• New GET /api/snapshot/summary (public, cache-only, registered before /:sport) → { graded, updated_at, sports }. Next proxy added.
• HeartbeatBar shows the REAL graded count + SYNC = elapsed since the last pipeline run (amber past 5 min). No data → "SYNC —", nothing invented.

0.3 — Ticker: real items only

• Nav's hardcoded fallback items (fake Wembanyama A+/"NYK vs SA Q3"/invented Tatum MOVE) deleted. MOVE stays — computeLineDeltas is real movement.
• Spec §3 rule: <4 real items → ticker renders nothing. It publishes --ticker-h (32px/0px) on <html>; layout main paddingTop and Slate sticky top are now calc(base + var(--ticker-h)) so the header collapses cleanly.

0.4 — /terminal retired (fabricated surface)

• Route now redirect('/dashboard'). Layouts preserved UNROUTED at web/src/components/intel/TerminalTemplates.tsx (§12 content-engine templates — feed real data before ever routing them).
• Nav PRIMARY = Slate/Scan/Ledger. BottomTabBar: Terminal→Explore. PWA manifest shortcut Terminal→Ledger. routes.js: /terminal out of OPEN_ROUTES; #terminal → /dashboard.

0.5 — ›Query nav pill deleted (duplicate /scan link)

Next (work order Phase 1 — starts the settle clock)

• ledger_entries table + write-on-grade (user scans AND pipeline pre-grades)
• Settlement worker; populate /ledger (personal + MODEL tabs)
• Degenerate scan output (model==line, +0% edge) → honest "INSUFFICIENT DATA"
• Canonical player_key normalization (blocks 2.4, 4.1)

Session 56 (2026-07-10) — SHIPPED ✅ THE FULL AUDIT

Backend 2276 → 2289 tests (+13), 197 suites. Web build clean (exit 0). Docs: specs/propline-audit.md, specs/vyndr-roadmap.md, specs/audit-data/propline-audit-raw.json, scripts/propline-audit.js.

Research (Phases 1–3, 5) — verified against LIVE APIs

• Fetched real data: The Odds API /v4/sports (in-season now: MLB, WNBA, NFL preseason, NBA summer league, 40+ soccer leagues; NHL dark), a real MLB boxscore (Braves@Pirates 2026-07-09 — every settle field confirmed), ESPN WNBA/soccer scoreboards. PropLine inventory derived from code (no dev keys).
• Headline bug found: oddsNormalizer mapped batter_rbis → 'rbis' but the entire grade/feature/outcome chain keys on 'rbi' → every PropLine RBI prop silently failed to grade AND settle. Fixed.
• Coverage truth: MLB is the only end-to-end-live sport. Outcome settlement is MLB-only (WNBA/NBA/soccer never settle → accuracy is MLB-only). Documented as the #1 roadmap gap.

Phase 4 — wired missing MLB stat types (a full vertical slice)

• batter_rbis → rbi (unblocks a market already requested).
• PropLine MLB MARKETS 6 → 12: +batter_runs, +batter_walks, +batter_doubles, +pitcher_earned_runs, +pitcher_hits_allowed, +pitcher_outs (same request, no extra quota; runs/walks/earned_runs/hits_allowed were already supported downstream — just never asked for).
• doubles + outs (+triples) added to featureCache + outcomeService MLB_LOG_FIELD AND all three grade whitelists (analyze/scan/validation.py).

Phase 6 — pipeline alerting + resilience

• src/utils/opsNotify.js — ntfy.sh push (vyndr-pipeline-kev2026), never throws, auto-disabled under test / PIPELINE_ALERTS=0. Injectable fetchImpl.
• snapshotService.runSnapshot: success alert ("✅ MLB snapshot: N graded, D deltas, X% accuracy"), stale alert (empty slate), failure alert; retry-once on a hard odds error/null (NOT on a legit empty slate — that's off-hours, not a failure).
• Missed-cron watchdog: snapshotScheduler.mostRecentExpectedSlot + isSnapshotOverdue (pure, tested); the tick alerts once per missed slot; the status probe (GET /api/internal/snapshot/status) now returns overdue.

Phase 7 — the master roadmap

specs/vyndr-roadmap.md — priority-ordered Sessions 57–64 (WNBA/NBA settlement → ESPN features → soccer e2e → live calibration → NFL/NBA readiness), stat-type + sport coverage targets, operating invariants.

Session 55 (2026-07-10) — SHIPPED ✅ SELF-LEARNING LOOP + REAL-TIME LAYER

Backend 2255 (4 failing) → 2274 tests (all green; +19 new, +4 fixed), 196 suites. Web build clean (exit 0). Spec: specs/session55-self-learning.md.

Phase 2 — the self-learning loop (the crown jewel; nothing like it existed)

• src/services/outcomeService.js — settles each locked snapshot grade against the REAL result (MLB Stats API game log — free, same source the grade pipeline uses) → hit/miss/push, aggregated by grade tier over a trailing 30-day window. Presence of a game-log row for the graded date ⇒ FINAL. Fully injectable → unit-tested with zero network. Idempotent (dedupe by nameKey|stat|line|side|date). NBA/WNBA degrade to pending (offline stats), never throw.
• Redis: outcomes:{sport}:log (settled, cap 1000), accuracy:{sport}, accuracy:overall ({ overall, byGrade } over 30d; pct excludes pushes).
• Routes: GET /api/accuracy (public, cached 5m), GET /api/ledger/accuracy (buckets — fills the pre-existing Next proxy that had no writer), internal POST /api/internal/outcomes/:sport|/all. Cron: settleAllOutcomes() runs on the snapshot scheduler tick BEFORE grading (settle yesterday, grade today).
• UI: AccuracyBadge (dashboard header + scan result + landing) — honest by construction: below MIN_SAMPLE (8) it reads "MODEL · LEARNING" (amber) instead of faking a number; above it, "A-RATED · 68% HIT · 30D" (green). Settled outcome chips (✓ HIT (2) / ✕ MISS) on slate props via a snapshot-route overlay + StatStrip.OutcomeChip.

Phase 1 — the real-time layer (make it feel ALIVE)

• Slate auto-refresh: silent 60s poll (no skeleton flash, never wipes a good view on a transient blip) + a "SIGNAL LIVE · N PROPS GRADED · M LIVE · UPDATED Xs ago" strip with a ticking freshness clock (nowTick, 15s).
• Ticker: anchored LIVE badge (pulsing dot) that flashes green when a fresh event slides in (breaking-news feel).

Phase 3 — landing top-signals preview

• TopSignals.tsx — pulls tonight's REAL top-3 A-rated grades from /api/snapshot/{mlb,nba,wnba} as mini grade cards (archetype + grade + line) + the live AccuracyBadge. Self-hides off-hours. The product shown, not described.

Founder pricing (the real cause of the "4 stripe failures")

FOUNDER_CODE_EXPIRY default was 2026-06-30 — lapsed as of the current date (2026-07-10), silently disabling every founder code (and the ClaimMeter scarcity pitch). Extended the default to 2026-12-31 (operators still override via env). That restored founder pricing AND turned the 4 failing tests green.

Honest scope (deferred — NOT built this session)

The prompt's Phases 4–8 (dashboard card redesign, scan reveal polish, Parlay Lab derivatives-desk polish, nav/mobile/onboarding/settings/team-hub polish) are real follow-on work. This session invested in the two TRANSFORMATIVE, differentiated systems (real-time + self-learning) end-to-end with tests + the highest-leverage first-visit surfaces (landing signals, dashboard accuracy). Live calibration adjustment (spec 2.3, feeding outcomes back into grade confidence) is scaffolded by the accuracy record but not yet wired into the engine.

Session 54 (2026-06-19) — SHIPPED ✅ AUDIT CLEANUP

Backend 2246 → 2255 tests (+9), 194 suites. Web build clean (exit 0).

Phase 1 — name edge cases (BOTH playerName.js copies, kept identical)

• Hyphens stripped in normalizeName display+key (.replace(/-/g,' ')) so "Jung-hoo Lee" === "Jung Hoo Lee".
• Middle single-letter tokens stripped in nameKey (keep first + last) so "Josh H Smith" === "Josh Smith". Guarded: real middle names ("Juan Carlos Smith") and collapsed first initials ("JC Escarra") are untouched.
• richie: 'richard' added to NICKNAMES.

Phase 2 — polish

• Team Hub names normalized at the source: teamService.getTeamHub now maps every roster player (MLB + snapshot-fallback) through normalizeName().display → "J.C. Escarra" renders as "JC Escarra", matching the dashboard.
• Accent-keeping dedup (snapshotService): when collapsing variant grades, the GRADE picked is still highest-confidence, but the DISPLAY now prefers the accented variant ("José" over "Jose") so prop rows match the pitcher line.
• Parlay copy: same-game (different-team) warning now names the game — "⚠ 2 legs from the same game (NYY @ BOS) — correlated".

Session 53 (2026-06-19) — SHIPPED ✅ SOCIAL PREVIEW FIX

Session 53 (2026-06-19) — SHIPPED ✅ SOCIAL PREVIEW FIX

Backend 2239 → 2246 tests (+7), 193 suites. Web build clean (exit 0).

• OG/Twitter copy de-jargoned (layout.tsx): the openGraph description had "Bayesian intelligence / kill conditions"; the main description had "xG regression / penalty taker". Replaced with "Pre-graded player props with proprietary archetypes. Correlation-aware Parlay Lab. Real-time line movement tracking. Built in Detroit." Title → "VYNDR — The edge the books don't want you to have". NOTE: did NOT write "45 archetypes" (the spec said 45, but the codebase has 41 — used "proprietary archetypes" to stay accurate).
• Dynamic OG image (app/opengraph-image.tsx + twitter-image.tsx re-export): 1200x630, #06060B bg, VYNDR wordmark (green R), "The books have every advantage. / We built this to give it back." + feature row. Node runtime (NOT edge — this is a self-hosted standalone build). Both routes prerender to a real PNG at build.
• The stale static /og-image.png reference was removed from metadata so the file-based convention owns the image (no duplicate/conflicting og:image tag).

Session 52 (2026-06-19) — SHIPPED ✅ TEASER + INFRA VERIFICATION

Backend 2234 → 2239 tests (+5), 192 suites. Web build clean (exit 0).

Phase 1 — Push-to-Book teaser (feature NOT live; teaser only)

• StatStrip: a BookItTeaser ("BOOK IT ⟶", hover tooltip "Push-to-Book coming soon — connect your sportsbook") after the parlay "+" on every graded prop.
• GradeResultCard: a "PUSH-TO-BOOK · COMING SOON" footer section.

Phase 2 — infrastructure verification

• snapshotScheduler now logs BOTH states: armed ([snapshotScheduler] armed — SNAPSHOT_CRON=1, hours=…) and disarmed (so container logs disambiguate off-vs-crashed). Test asserts the armed log.
• NEW GET /api/internal/snapshot/status (internal-key gated): { cron_armed, cron_hours_utc, last_snapshot:{sport:{updated_at,gradeCount,deltaCount}}, redis_keys:{…:bool}, ticker_count }. The single probe to verify the pipeline post-deploy.
• REDIS PERSISTENCE FINDING: the app uses REDIS_URL (ioredis) — AOF/RDB persistence is a server-side (Coolify Redis) config the app can't set/verify. If snapshot keys vanish on restart, enable persistence on the Redis instance.

Phase 3 — delta pipeline (verified sound; no fix needed)

runSnapshot already reads :latest as prev → computeLineDeltas(enriched, prev.grades) → writes old→:previous, new→:latest. So deltas populate on the 2nd+ run. Added an opt-in debug log (SNAPSHOT_DEBUG=1) + a trace test asserting :previous is preserved verbatim and the delta math is correct.

Session 51 (2026-06-19) — SHIPPED ✅ TEAM HUB

Session 51 (2026-06-19) — SHIPPED ✅ TEAM HUB

Backend 2215 → 2234 tests (+19), 190 suites. Web build clean (exit 0). New routes: /team/[abbr], /api/team/[abbr].

Phase 1 — team data API

• mlbStatsAdapter gained getTeams() / resolveTeam(abbr) (statsapi /teams?sportId=1, cached 24h, abbr→id) + getTeamRoster(teamId) (active roster, cached 6h).
• src/services/teamService.js getTeamHub(sport, abbr) assembles the hub: resolve team → roster → per-player season stats (bounded concurrency 8, reuses playerIntelService mappers) → archetype (from the snapshot grade, else classify) → tonight's graded props (from grades:{sport}). Whole result cached 15 min. MLB = real; NBA/WNBA = a snapshot-built partial roster (graceful note).
• GET /api/team/:abbr (public, 404 on unknown MLB team) + Next proxy.

Phase 2 — Team Hub page

team/[abbr]/page.tsx (server, generateMetadata) + TeamHub.tsx (client): team header + sport badge, sort (archetype / graded / A–Z), archetype filter chips, roster rows (archetype badge + player link + position + horizontal stats

• graded props with grade badges + parlay "+"), "No active props" greyed state, loading/error states.

Phase 3 — game card team links + back nav

vyndr/GameCard team abbreviations are now TeamLinks → /team/:abbr?sport= (green hover, stops propagation from the open-game handler). Team Hub has "← Back to Slate".

Session 50 (2026-06-19) — SHIPPED ✅ PARLAY LAB

Session 50 (2026-06-19) — SHIPPED ✅ PARLAY LAB

Backend 2185 → 2215 tests (+30), 187 suites. Web build clean (exit 0).

Phase 1 — correlation-score model (parlayService.js, ADDED to S28 funcs)

Numeric, GAME-AWARE model: correlationScore(l1,l2) → 0.7 same-player/game / 0.4 same-team/game / 0.2 same-game-diff-team / 0.0 diff-game. combinedGrade = leg-grade avg penalized by avgCorrelation * 0.5. estimatedPayout = product of per-grade fair odds × (1 − avgCorrelation) discount. correlationWarning → "⚠ N legs from {TEAM}…". gradeParlay bundles it all.

Phase 2 — POST /api/parlay/grade

Returns { combined, correlation, payout, legs } (2–6 legs, public/stateless). The Next /api/parlay/grade proxy was forwarding to the wrong upstream (/api/scan/parlay) — fixed to the new route.

Phase 3 — ParlayContext extended

ParlayLeg gained team/game/archetype; MAX_LEGS now 6 with a tier-aware maxLegs (set by the panel). Auto-grades the slip (debounced) via the endpoint when legs ≥ 2 → live combined/correlation/payout. + hasLeg/legKey/atCap.

Phase 4 — "+" buttons

StatStrip renders a "+"/"✓" per graded prop (toggles add/remove); vyndr/GameCard wires it via useParlay (builds a leg with team + game id). GradeResultCard's existing "Add to Parlay" feeds the same context from the scan page.

Phase 5 — ParlayPanel (replaces legacy ParlayTray in the layout)

Bottom slide-up: legs (archetype + grade + remove), correlation warning, combined grade, est. payout, CLEAR ALL + a floating leg-count badge (bottom-right) when closed. Tier-gated: free 2 legs (payout blurred → Desk upgrade), Analyst 4, Desk 6.

Session 49 (2026-06-19) — SHIPPED ✅ ONBOARDING FLOW

Session 49 (2026-06-19) — SHIPPED ✅ ONBOARDING FLOW

Backend 2156 → 2185 tests (+29), 184 suites. Web build clean (exit 0). New routes: /onboarding, /api/preferences.

Phase 1 — name micro-fixes (closes the normalization arc)

playerName.js (both copies): collapse adjacent single-letter words ("J C Escarra" → "JC Escarra", display + key) + added mickey: 'michael'.

Phases 2–5 — onboarding, end-to-end

• Storage: Supabase user_metadata.preferences — NO migration. Shape: { sports[], books[], weekly_limit, onboarding_complete }.
• API: src/routes/preferences.js GET/POST (requireAuth; service-client admin getUserById/updateUserById; POST is a PARTIAL merge + sanitized) + /api/preferences Next proxy (forwards the bearer).
• Page: web/src/app/onboarding/page.tsx — 3 self-contained steps (sports [≥1 required] → books [skip] → weekly bankroll [presets + custom + skip]) → "SIGNAL ACTIVE / You're locked in" → POST onboarding_complete:true → 2s → /dashboard. Redirects to /login when unauthenticated.
• Redirect: the dashboard fetches /api/preferences (fresh — avoids stale session metadata); if onboarding_complete !== true AND the user is NEW (created_at >= 2026-06-19 cutoff), → /onboarding. Never fires while auth is loading (would bounce unauthenticated users). Existing users are exempt.
• Personalization: the Slate defaults its tab to prefs.sports[0]; preferred books are highlighted (green glow) in each game card's lines grid (isPreferredBook in lib/books.js, threaded dashboard → Slate → GameCard).
• Settings: a PREFERENCES section loads (GET) + edits + saves (POST) sports, books, and weekly limit.

Session 48 (2026-06-19) — SHIPPED ✅ NORMALIZATION AT EVERY LAYER

Session 48 (2026-06-19) — SHIPPED ✅ NORMALIZATION AT EVERY LAYER

The normalizer functions were correct (S47) but raw names still flowed through paths that skipped them. Traced top-down, fixed each. Backend 2149 → 2156 tests (+7), 181 suites. Web build clean (exit 0).

The trace (3 leaking paths)

1. Snapshot grades stored RAW player names + no dedup → Explore/leaders/ profile/GameCard-overlay all saw variants.
2. Game-card strips merged the player but pushed EVERY variant prop → "Ks 5.5 AND Ks 3.5" duplicate rows.
3. Scan player grid (tonightsPlayers) grouped by raw p.player → variant tiles.

Fixes

• 2a (source chokepoint): snapshotService.runSnapshot now normalizes each grade's player to the de-dotted display AND dedupes to ONE grade per normalized player+stat (highest confidence) BEFORE writing grades:{sport} + snapshot:{sport}:latest. Every consumer now gets clean, merged names for free.
• 2b: buildPlayerStripsFromProps dedupes a player's props by stat (prefers the graded over an awaiting row) → one row per stat.
• 2c: scan tonightsPlayers groups by nameKey, displays normalizeName().display.
• 3 (profile usage/rest): the "+0%"/"—" was the PLAYER PROFILE's buildIntel (separate from the grade card's buildIntelFields, which already works — the full feature merge carries ab_per_game/rest_days, NOT filtered by FEATURE_NAMES which is meta-only). resolvePlayerStats (MLB) now attaches real usage (AB/G) + rest (B2B/Xd) and buildIntel renders them; REST default is now "—" not "+0%".

Session 47 (2026-06-19) — SHIPPED ✅ NAME NORM + INTEL + TICKER POLISH

Session 47 (2026-06-19) — SHIPPED ✅ NAME NORM + INTEL + TICKER POLISH

Backend 2122 → 2149 tests (+27), 179 suites. Web build clean (exit 0).

Phase 1 — complete name normalization

playerName.js (both copies) gained: parenthetical-tag strip ("Jose Fermin (STL)" → "Jose Fermin"), a ~50-entry NICKNAMES table resolved in nameKey ("Matt"↔ "Matthew", "Mike"↔"Michael"), and the existing accent-fold now verified for Iván/Ivan, José/Jose. The slate strip now DISPLAYS the normalized de-dotted name (buildPlayerStripsFromProps uses normalizeName().display) — "A.J. Ewing" shows as "AJ Ewing", not the raw PropLine string.

Phase 2 — complete VYNDR INTELLIGENCE for MLB

The audit showed only Form. mlbGameLogFeatures now also derives rest_days (days off between the two most recent game-log dates; 0 = B2B, matching the NBA convention) and ab_per_game (the MLB "usage" equivalent). buildIntelFields renders usage as "X AB/G", rest as "B2B"/"Xd rest", and a matchup grade from bvp_advantage when no opp rank. So MLB grade cards now show Form + Usage + Rest (+ Matchup when available).

Phase 3 — ticker SCAN dedup

pushTickerItems keeps only the LATEST SCAN per sport (drops prior SCAN events for any sport with a fresh scan; parses the sport from a sport field or the text prefix for legacy items). MOVE/GRADE events preserved; cap stays 50.

Phase 4 — archetype threshold

BOMBER's HR thresholds prorated for mid-season (hr>=15 strong / hr>=10 moderate, was >=20/>=15), so June sluggers (Schwarber/Harper ~17-18 HR) classify as BOMBER instead of FLEX/DRIVER. computeLineDeltas re-verified structurally sound (deltas populate on the 2nd+ snapshot).

Session 46 (2026-06-18) — SHIPPED ✅ P1 FIXES

Session 46 (2026-06-18) — SHIPPED ✅ P1 FIXES

Backend 2100 → 2122 tests (+22), 176 suites. Web build clean (exit 0).

Phase 1 — grade card intel (ROOT CAUSE)

The STAT CONTEXT + VYNDR INTELLIGENCE sections were empty for MLB because gameLogService.getGameLogs is NBA/WNBA-only (offline Python service) — MLB props NEVER got l5_avg/l20_avg, so buildIntelFields always returned {}. FIX: featureCache.gameLogFeatures now has an MLB branch that derives l5/l10/l20 averages from mlbStatsAdapter.getPlayerStats (free statsapi.mlb.com) via the pure mlbGameLogFeatures + an MLB stat_type→game-log-field map. buildIntelFields(features, opts) also gained playerStats/projection fallbacks so partial intel renders (Sessions 43/44 had the wiring; the engine just never produced the values for MLB).

Phase 2 — player name normalization

src/utils/playerName.js + web/src/lib/playerName.js (identical; cross-checked by a test): normalizeName(raw) → { display, key }. Strips periods, de-dots suffixes, accent-folds the key. Applied in snapshotService (grouping/deltas), slateAdapter (grade index + buildPlayerStripsFromProps merges variants, displays the longest), and playerIntelService.sanitizePlayerName/normName. "A.J. Ewing"/"AJ Ewing" and "Jazz Chisholm"/"Jazz Chisholm Jr." now merge.

Phase 3 — MLB starting pitchers

The ESPN schedule lacks probable pitchers. NEW GET /api/schedule/:sport/pitchers (MLB) → probablePitchers service wrapping mlbStatsAdapter.getScheduleWithPitchers

• best-effort season ERA. The Slate fetches it, builds a team→pitcher map (slateAdapter.buildPitcherMap/pitchersForGameTeams, matched by full name + mascot), and attaches pitchers to MLB GameCardData. + Next proxy.

Phase 4 — verify

computeLineDeltas confirmed structurally sound (S45 tests); deltas: 0 in the audit was just the first snapshot (no previous to diff). BACKEND_HANDOFF.md updated.

Session 45 (2026-06-18) — SHIPPED ✅ SNAPSHOT PIPELINE

Session 45 (2026-06-18) — SHIPPED ✅ SNAPSHOT PIPELINE

The on-demand grade model is retired. Backend 2061 → 2100 tests (+39), 173 suites. Web build clean (exit 0).

Phase 1 — snapshotService (orchestration of existing services)

src/services/snapshotService.js runSnapshot(sport): getOdds (PropLine rotation) → gradeAndCacheSlate (captured via injected cacheSet) → classify each player's archetype (resolvePlayerStats + archetypeService, pure math) → attach gradedAt {line, odds, timestamp} (LOCKED) → compute line deltas vs the previous snapshot → write snapshot:{sport}:latest|previous + grades:{sport} → emit ticker events. runAllSnapshots() loops mlb/nba/wnba/soccer. Everything injectable → fully unit-tested with zero network. Deltas: toward = market confirming our side, away = opposing; noise filtered <0.5.

Phase 2 — internal API + cron + ticker API

• POST /api/internal/snapshot/:sport + /snapshot/all (existing requireInternalAuth; /all registered first so it isn't captured as a sport).
• GET /api/ticker (public, cache-only, merges TICKER_MANUAL pins) + Next proxy.
• In-process cron src/snapshotScheduler.js (gated SNAPSHOT_CRON=1, UTC hours 14,19,22,1,3 = 10AM/3PM/6PM/9PM/11PM ET), armed in server.js. No new dep — 1-min unref'd interval, fires once per slot. Prefer external n8n cron hitting the internal endpoint for multi-replica deploys.

Phase 3 — GameCard swap (THE product shift)

The live Slate now renders vyndr/GameCard (legacy kept for TYPES only). Reads GET /api/snapshot/:sport (cache-only, public; falls back to grades:{sport}), overlays the locked grades onto each game's odds-derived props via slateAdapter.buildPlayerStripsFromProps → player name ONCE + archetype badge + locked grade + "Graded Xh ago at -115 · Current 2.5 · ▲ TOWARD +1.0" line delta. Ungraded props → "Awaiting next scan" (NO Read button). The on-demand onGrade flow was deleted.

Phase 4 — live ticker

vyndr/Ticker now polls /api/ticker every 30s (graceful: keeps the passed hardcoded items as initial/fallback, never blanks). Tag colors: A+/A/SCAN green, MOVE/CASCADE amber, ALERT white.

Phase 5 — NBA/WNBA ESPN fallback

espnStatsAdapter.getSeasonAverages(name, sport) — free public ESPN stats, DEFENSIVE (parseAthleteStats returns null on any unrecognized shape → caller degrades to found:false; never a wrong-but-confident number). Wired as the NBA/WNBA fallback in resolvePlayerStats after the offline Python service. Note: the live ESPN athlete-stats shape may need tuning against production — the parser is tolerant and tested against a representative payload.

Env vars (set in Coolify)

• PROPLINE_API_KEY_1/2/3 — PropLine props rotation (snapshot odds source).
• VYNDR_INTERNAL_KEY — the internal-auth secret (header x-internal-key) for the snapshot trigger. (This is the existing key, NOT a new INTERNAL_AUTH_TOKEN.)
• SNAPSHOT_CRON=1 — arm the in-process scheduler (omit if using n8n).
• TICKER_MANUAL — JSON array of editorial pins, e.g. [{"tag":"ALERT","text":"VYNDR 2.0 is live."}].

Session 44 (2026-06-18) — SHIPPED ✅ MAKE IT VISIBLE

Session 44 (2026-06-18) — SHIPPED ✅ MAKE IT VISIBLE

Wired existing backend work into the pages users see + renamed archetypes to VYNDR Originals. Backend 2045 → 2061 tests (+16), 167 suites. Web build clean (exit 0). BACKEND_HANDOFF.md added as the canonical data contract.

VYNDR Original archetype rename (proprietary names)

All 41 archetypes renamed in archetypeService.js + lib/archetypes.js + ArchetypeBadge, each keeping legacyName/legacy (never displayed; resolves for stale data). NBA: TORCH, CONDUCTOR, FORTRESS, ARTILLERY, SURGE, DUAL THREAT, CONNECTOR, FASTBREAK, PAINT BOSS, LOCKDOWN, SWITCHBOARD, ARCHITECT, PISTON, SENTINEL, IGNITER. WNBA-unique: DISTRIBUTOR, SHIELD, RANGE, SPARK, ANCHOR. MLB: BOMBER, BRUSH, DRIVER, ALPHA, WHIFF, GHOST, HYBRID, FLEX, WORKHORSE, CATALYST, MIRROR, HAMMER, SINKER, BRIDGE, SWITCH. Soccer: FINISHER, MAESTRO, TOWER, MOTOR, BLADE, WALL. MLB note: the old taxonomy had two power hitters (POWER PULL/POWER SLUGGER) but the new set has one power name (BOMBER), so BOMBER now fires for any high-HR bat (Judge → BOMBER per the audit checklist) and the freed slot became a real WHIFF strikeout-artist pitcher (improves pitcher coverage). getArchetype/archetypeInfo resolve legacy names → VYNDR Originals.

Phase 2 — grade-card intel now populates (the real bug)

The chain engine→tierGating→/api/scan proxy already PRESERVED the intel fields (all spread ...result/...data). The ONE broken link: scan/page.tsx called mapScanToGradeResult with a hardcoded field subset and DROPPED season_avg/ form/usage/matchup_grade/etc. Now forwards them (+ extended ScanResponse), so STAT CONTEXT + VYNDR INTELLIGENCE sections light up on a real MLB grade.

Phase 3 — stale-game filtering

slateAdapter.isRelevantGame(game, now): upcoming/live always show; a COMPLETED game is dropped once >24h old (no more 5-day-old FINALs). Applied in Slate's filteredGames. Schedule TTL was already 60s (≤30min) — no change.

Phase 4 — landing copy

Features.tsx rewritten: no more "Point-biserial", "Zone 14", "ABS intelligence", "Auto-calibrating", "Phi-coefficient". User-facing benefit copy (Player DNA archetypes / Self-improving model / Lineup intel before tip-off / Deep pitcher-batter matchups).

Phase 5 — depth chart proxies (404 fix)

Added the missing Next proxies /api/stats/lineup/[team], /depth/[team], /cascade/[player] → return JSON, not 404.

Phase 1 — GameCard swap DEFERRED (decision: Kev)

The live Slate keeps the legacy "Read"/on-demand grade card as a temporary bridge. The vyndr/GameCard swap lands WITH the snapshot pipeline (next session): the on-demand "Read" model is being retired for a pre-graded snapshot model (full slate graded at scheduled intervals, grades locked to the line), and the new card is designed for that. Swapping now would remove grading + show blank cards (grades cache unpopulated). BookChip brand colors already render in the legacy card (S43).

Session 43 (2026-06-18) — SHIPPED ✅ DATA PIPELINE + AUDIT FIXES

Session 43 (2026-06-18) — SHIPPED ✅ DATA PIPELINE + AUDIT FIXES

Post-S42 Chrome audit: architecture renders but no real data flowed (every player found:false, leaders empty, grade intel hidden) + a P0 dropdown bug. Backend 2011 → 2045 tests (+34), 163 suites. Web build clean (exit 0).

Phase 1 — P0 bug fixes

• Avatar/More dropdown z-index — the <nav> has backdrop-filter (a stacking context); <Ticker> + <HeartbeatBar> render after it as siblings and painted OVER the dropdowns (which overflow below the 60px bar), eating clicks. Fix: position:relative; zIndex:2 on the nav floats it (and its menus) above those bars; menus also carry zIndex:100. Avatar "Settings" → /settings (was /settings/security). Explore was already in MORE (S42) — the audit "missing" was a deploy cache.

Phase 2 — real player stats

• mlbStatsAdapter gained searchPlayer(name) (season player-list lookup, cached 24h) + getPlayerStats(name) (resolve id → season + game log, picks pitching/hitting by position). The adapter only had id-keyed methods before.
• playerIntelService.resolvePlayerStats(name, sport) normalizes the raw MLB stat object → classifier input + display season rows + last-10 log. getPlayerIntel now classifies the archetype from REAL stats and returns found:true with real season data. Aaron Judge → POWER PULL, not the empty-stats fallback. NBA/WNBA path wired to nbaStatsClient (degrades quietly — the Python nba_api service is usually offline in prod). All adapters injectable for tests; everything still degrades gracefully.
• Leaders: /api/stats/leaders + the explore page already share the grades:{sport} cache source — no mismatch to fix. Emptiness is data population (the slate must be graded first); the snapshot pipeline (Session 44) keeps it warm.

Phase 3 — game card enhancements

• slateAdapter gained groupPropsByPlayer (→ playerStrips, name once) + mapPitchers (MLB probables → GameCard pitchers); both folded into mapScheduleToGameCards output (vyndr/GameCard consumes them; legacy ignores the extras). Legacy GameCard line grid now renders BookChip (brand colors) instead of plain grey book text (the audit's complaint).

Phase 4 — grade card intelligence

• analyzeViaEngine1 attaches stat-context + VYNDR-intelligence fields (season_avg/last10_avg/form/usage/matchup_grade/rest) computed from the EXISTING feature vector — zero extra I/O. gradeAdapter maps them in, so the card's STAT CONTEXT + VYNDR INTELLIGENCE sections light up. Archetype is intentionally NOT set here (the per-prop feature vector lacks a multi-stat season line; the archetype strip stays hidden until Session 44 feeds it).

Phase 5 — depth chart foundation

• src/services/depthChartService.js: getLineup (MLB probable starter from the schedule), getDepthChart (positions from an injected roster), getCascadeProjection (usage redistribution weighted by archetype — sponges heaviest). All graceful + injectable. Endpoints: /api/stats/lineup/:team, /depth/:team, /cascade/:player. (Next proxies + UI = Session 45.)

Phase 6 — mobile + cosmetics

• Player-profile hero name was clipping ("Wembanyam") at 390px — added overflow-wrap:anywhere + a mobile rule (.player-hero-name 24px). Font CDN already gone since S41 (next/font).

Deferred (honest scope)

• Full live-slate swap to vyndr/GameCard (needs inline grading ported) — the data layer is now ready (playerStrips/pitchers).
• Per-player archetype badges on slate cards + grade-card archetype strip — need per-player season lines at grade time (Session 44 snapshot pipeline).
• Depth chart UI + lineup/minutes projections (Session 45).

Session 42 (2026-06-18) — SHIPPED ✅ PLAYER INTELLIGENCE SYSTEM

Session 42 (2026-06-18) — SHIPPED ✅ PLAYER INTELLIGENCE SYSTEM

Built the full Player Intelligence design bundle (10 sections; the 6 spec items

• extras). Backend 1940 → 2011 tests (+71), 157 suites. Web build clean (exit 0). Both gates green.

What shipped (by design section)

1. Archetype system — src/services/archetypeService.js: 41 archetypes (15 NBA + 5 WNBA-unique + 15 MLB + 6 soccer), each with tag/color/glyph/ description/propDNA/education. classify(sport, stats) returns PRIMARY + optional SECONDARY + a normalized blend. Visual map mirrored in web/src/lib/archetypes.js (CommonJS, colors verified == backend). Components: ArchetypeBadge (full/ghost/tint + glyphs), ArchetypeBlend (the production-DNA bar).
2. StatStrip — components/vyndr/StatStrip.tsx, compact + expanded. The player name appears ONCE; stats flow horizontally (JetBrains Mono); props inline with GradeBadge; onPlayerClick → profile.
3. Stats API + Player Profile — extended src/routes/stats.js with /player/:name, /leaders, /game/:id (rate-limited 60/min). Aggregation in src/services/playerIntelService.js (sanitizes the name param; reads grades:{sport} cache for props; graceful on cold caches). Page: app/player/[name]/page.tsx — all 9 design sections (hero+DNA blend, injury, prop DNA, VYNDR intelligence, active props, season, last 10, splits, grade history). Next proxies under app/api/stats/player|leaders.
4. Enhanced game cards + Grade Result — vyndr/GameCard gained optional MLB starting pitchers + player-grouped playerStrips (StatStrip, name once); GradeResultCard gained archetype strip + STAT CONTEXT + VYNDR INTELLIGENCE (all optional/self-hiding; populated by gradeAdapter.buildIntelFields). Header player name now links to the profile.
5. Settings page — app/settings/page.tsx REPLACES the S41 redirect: account (tier from useAuth), subscription, notifications, display (→ Prefs modal via window.__prefs), responsible play, danger zone (delete button gated on typing DELETE exactly). LINKS to /settings/security — does NOT replace the real MFA page. + BookChip component (lib/books.js).
6. Stats Explorer (bonus, design §07) — app/explore/page.tsx: tonight's league leaderboard from the real /api/stats/leaders, sport tabs, search, rows → player profile. Added to the Nav MORE menu (Explore + Settings→/settings).

Player-name links wired

Game cards, Grade Result header, Stats Explorer rows, profile active props — all route to /player/:name?sport= via lib/playerHref.js.

Deferred (design sections present but NOT built this session)

Team Hub (§09), Offseason Intel (§08), and the Slate redesign (§10), plus the Stats Explorer sub-panels (hit-rate trends, head-to-head, market-vs-VYNDR, matchup ratings). These need historical / projection / depth-chart data pipelines that don't exist yet — they belong with the Session-43 snapshot pipeline. The archetype + leaders + profile foundations they'd build on are now in place.

Session 41 (2026-06-17) — SHIPPED ✅ P0 AUDIT FIXES

The Chrome audit's P0 list only. No features. Backend 1907 → 1940 tests

Session 41 (2026-06-17) — SHIPPED ✅ P0 AUDIT FIXES

The Chrome audit's P0 list only. No features. Backend 1907 → 1940 tests (+33), 149 suites, all green. Web build clean (compiled successfully, exit 0).

Fixes

1. MLB stat_type gate (BACKEND) — the Scan frontend sends MLB IDs (hits, strikeouts, total_bases, rbi, home_runs, earned_runs, hits_allowed, innings_pitched, runs, walks, stolen_bases) but VALID_STAT_TYPES in src/routes/analyze.js + src/routes/scan.js only whitelisted the NBA/soccer set, so every MLB scan 400'd. Added the MLB set to both gates, mirroring the already-correct python/utils/validation.py VALID_STAT_TYPES.mlb. The live grade path is the generic engine1 feature pipeline (note: mlbGrader.js is dead code — required nowhere), which keys off these exact stat names.
2. /settings → /profile, /report → /blog — new server-component redirect() pages (app/settings/page.tsx, app/report/page.tsx). /profile is the canonical account surface; /blog is where "The Report" lives.
3. Profile tier mismatch — app/profile/page.tsx showed "Free" (from the /api/user/profile fetch) while the nav showed the real tier (from useAuth().tier). Profile now derives the displayed tier from useAuth().tier (authTier || profile.tier || 'free'); the fetch still supplies scan_count/subscription_*/founder.
4. Self-hosted fonts — replaced the runtime fonts.googleapis.com stylesheet <link> (503 in prod, ~4s page load) with next/font/google: Inter→--font-sans, JetBrains_Mono→--font-mono, IBM_Plex_Mono→--font-ibm, variables set on <html>. globals.css :root maps --sans/--mono/ --ibm-mono onto them. Because next/font obfuscates family names, literal 'JetBrains Mono'/'IBM Plex Mono' references in CSS + inline component styles were rewired to the variables (Hero, upgrade/desk, NotificationBell, responsible-gambling, globals.css wordmark/.lines).

Deviations from the spec (flagged)

• Did NOT overwrite /settings/security. The spec said redirect it to /profile too, but that route is a working MFA enrollment flow — clobbering it would be a security-feature regression. Left intact; only the bare /settings 404 was fixed.
• /report link doesn't exist in current code — Nav's "The Report" already points to /blog. The redirect is harmless defensive coverage (PWA shortcut / external / stale share links).
• ShareCard canvas still uses literal "JetBrains Mono"/"Instrument Sans" (canvas ctx.font can't read CSS vars). Out of P0 scope; pre-existing.

Session 39 (2026-06-16) — SHIPPED ✅ DESIGN CONVERSION COMPLETE

Session 39 (2026-06-16) — SHIPPED ✅ DESIGN CONVERSION COMPLETE

Phase H: the QA pass against the §13 parity checklist. Verify → fix → lock. Frontend-only; ZERO backend changes. Backend 1890 → 1907 tests (+17), 146 suites, stable across 3 consecutive full-suite runs (the S38 flaky test is fixed). Web build clean (compiled successfully, exit 0).

This completes the 7-session VYNDR 2.0 conversion (Sessions 33–39): tokens → components → shell → screens → mobile → systems → QA.

§13 AUTOMATED CHECKLIST — RESULTS

• QA.1 Token resolution — FIXED. #00ffb8 (= the A+ token) → var(--g-ap) in ProcessingGrade (7 sites); game/[id] sport literals (#E94B3C/#1E90FF/ #FFB347) → var(--s-nba/mlb/wnba). Remaining hex are INTENTIONAL + documented: var(--token, #fallback) belt-and-suspenders (soccer/offline/ admin), Next metadata themeColor (can't be a var), and bespoke intel-surface / red-tint text shades (#e8fff4,#bdf5e2,#ff8a8a,#ff8b7a,#ffb0a4, #ffd9a8,#04140f) ported verbatim from the prototype — no token equivalent; retokenizing would visibly deviate from the design.
• QA.2 Typography — PASS. Data rows/chips use var(--mono); the GradeResult hero LETTER is var(--sans) (display) faithful to the prototype's grade-card.
• QA.3 Grade prominence — PASS. Hero 92–116px (80px mobile), GradeBadge hero=100.
• QA.4 Best/worst lines — PASS. Legacy GameCard (live slate) + vyndr/GameCard tint best green (rgba(0,212,160,.13) + green left border) / worst red.
• QA.5 Wordmark everywhere — PASS. Nav, Footer, login, about, 404 (+ social cards).
• QA.6 Glitch discipline — PASS. ZERO glitch classes in GradeResultCard / GameCard(s) / ProcessingGrade. Glitch stays on chrome only.
• QA.7 Heartbeat/ticker/live counters — PASS (Phase G; under the nav).
• QA.8 Scan reveal — PASS. ProcessingGrade factor-ignite → CRT-sweep → card.
• QA.9 Command palette (⌘K) — DEFERRED (documented). Nav › Query links to /scan; a true ⌘K palette was never in scope for 33–39.
• QA.10 Parlay correlation — PASS (Phase G lib/parlayMath.js, tested).
• QA.11 Mobile parity — PASS. 5-tab bar (Slate/Terminal/Scan/Ledger/More).
• QA.12 Auth gate / deep-links / paywall — PASS (AuthGate, HashRedirect, read-meter→paywall).
• QA.13 i18n / odds — PASS. fmtOdds converts ML; totals pass through (tested).
• QA.14 Accessibility — PASS. Prefs modal sets <html data-*>, persists.
• QA.15 PWA — PASS (S27 SW + S37 manifest/shortcuts/viewport-fit). Not touched.
• QA.16 No dead buttons — PASS. Zero onClick={} (asserted by a tree-walk test).
• QA.17 No AI slop — MANUAL (flagged for Kev's browser review — see below).
• QA.18 Auth-gate integration — PASS. Gates via lib/routes → /login?next=.

De-flake (completion-quality)

The S38-flagged flaky test (soccerFeatureExtractorCascade › nextMatch cascade) intermittently hit Jest's 5s default under full-suite concurrency (the extractor falls through to live adapters on a cache miss). Added jest.setTimeout(20000) to that test file — same fix family as S32's CPU-bound pipeline test. Test-only, no service change. Verified: 3 consecutive clean full-suite runs (1907/1907).

Files created

• tests/unit/vyndrParityQA.test.js (17 tests locking QA.1/4/5/6/11/16/18 — glitch-free data, token resolution, best-line tint, wordmark presence, 5 tabs, no dead buttons, auth-gate list)

Files modified

• web/src/components/vyndr/ProcessingGrade.tsx (#00ffb8 → --g-ap)
• web/src/app/game/[id]/page.tsx (sport literals → tokens)
• tests/unit/soccerFeatureExtractorCascade.test.js (de-flake timeout)

⚠️ MANUAL CHECKS for Kev (browser, post-deploy)

• No AI slop (gradient bg / rounded-pill SaaS cards / stray emoji / exposed- algorithm copy). NOTE: 🔥 STREAKS + ◎ scan glyph are deliberate data markers.
• North-star energy — every page belongs with the 404.
• Auth gate end-to-end: incognito → /ledger → /login?next=/ledger → sign in → /ledger.
• Mobile: tab bar native feel, More sheet slide, touch targets.
• Scan grade reveal plays; ticker scrolls; best/worst line tints; PWA installs.
• Still-open operator item (since S31): rotate the leaked GitHub PAT in the origin remote URL and scrub it from .git/config.

---

Session 38 (2026-06-16) — SHIPPED

Session 38 (2026-06-16) — SHIPPED

Phase G: the systems that make the design alive. All 5 wired (minimal-wire path where a full path risked regressions, per the scope guidance). Frontend-only; ZERO backend changes. Backend 1872 → 1890 tests (+18), 146 suites, zero regressions. Web build clean (exit 0).

Testable CommonJS lib modules (the reliable surface)

• lib/parlayMath.js (§12) — getCorrelation (same player 0.62 / same team 0.34 / same league 0.06 / cross-sport 0), parlayGrade (averages leg grades + bumps the slip down a tier when any pair correlates >0.4), GRADE_ODDS, amToDec/decToAm, combinedDecimal/combinedAmerican, correlationPairs. Frontend model that powers the Parlay Lab matrix; the BACKEND parlayService (Session 28) still owns server combined odds + suggestions.
• lib/oddsFormat.js (§9) — fmtOdds(value, format) (american/decimal/ fractional/implied), REGIONS/CURRENCIES/regionPreset. Deliberately SAFER than the prototype's parseAm, whose regex accepted decimals and would mis-convert O/U totals (228.5 → fake implied %). Our parseMoneyline only treats explicitly-signed integer STRINGS (+150/-110) and integer NUMBERS (the grade→odds map) as odds; totals/lines/spreads ("228.5","229","-7.5") pass through unchanged. (Honest spec-over-prototype correction, like the S32 NFL keys.)
• lib/prefs.js (§10) — applyPrefs sets <html data-motion|contrast|text| cb|font> (the CSS layer from Session 33 keys off these), loadPrefs/ savePrefs to localStorage('vyndr_prefs'). Injectable element + storage → fully unit-tested.
• lib/liveTick.js (§8) — single tick store, fan-out subscribers. Does NOT auto-start on import (SSR/test-safe); start() begins the 1s interval (unref'd), tick() advances + emits a FRESH state object (so React re-renders); reset() for tests.
• lib/checkout.js (§12) — checkoutUrl(plan) → /api/checkout?tier=….

React glue + wiring

• components/vyndr/LiveLayer.tsx — useLive() hook (starts the shared tick, one interval many subscribers), LiveNumber (count-tick pop on change), HeartbeatBar (scrolling EKG + SIGNAL LIVE + live graded count + breathing neural % + sync clock). Mounted under the Ticker in the Nav.
• components/vyndr/GlobalHosts.tsx — mounted once in layout. On mount: applies stored prefs to <html>, registers window.__prefs / __goPaywall / __checkout. Hosts the Preferences modal (region→odds+currency cascade, odds format, text size, reduce-motion, high-contrast, colorblind, readable font — persisted) and the Paywall modal (Analyst/Desk tiers → __checkout).
• Nav — mounts HeartbeatBar; added a globe prefs trigger (__prefs); the free-tier read meter is now a button → __goPaywall (the §12 live paywall trigger). Header is now nav 60 + ticker 32 + heartbeat 30 → layout main paddingTop 96 → 124; Slate sticky header top 64 → 122 to match.

Animations gated behind reduced-motion

The living-layer classes (ekg-track, live-dot, count-tick, etc.) are already in the Session-33 reduced-motion kill list (both prefers-reduced-motion and html[data-motion="reduced"]), which the prefs toggle now sets. The tick still fires (data updates); only the animation is killed.

Files created

• web/src/lib/{parlayMath,oddsFormat,prefs,liveTick,checkout}.js
• web/src/components/vyndr/{LiveLayer,GlobalHosts}.tsx
• tests/unit/vyndrSystems.test.js (18 tests: correlation tiers + grade penalty
  • odds combine, odds formats + totals-pass-through + region presets, applyPrefs
  • storage round-trip, tick fan-out/increment, checkout URL, React-glue wiring)

Files modified

• web/src/app/layout.tsx (GlobalHosts mount + paddingTop), web/src/components/ Nav.tsx (HeartbeatBar + prefs + paywall meter), web/src/components/Slate.tsx (sticky top)

Notes / gotchas

• BUILD GOTCHA (caught + fixed): a useEffect returning liveTick.subscribe(...) directly failed type-check — Set.delete returns boolean, not a valid effect cleanup. Wrapped in () => { unsub(); }.
• FLAKY (pre-existing, NOT this session): one full-suite run showed 1 failing backend test (computeFeatures/oddsService async-timing warnings); it passed on re-run (1890/1890 twice). Unrelated to these frontend changes — flagged for a future stabilization pass.
• Did NOT touch the PWA/service worker (Session 27/37 own it) per the no-overlap rule.

---

Session 37 (2026-06-16) — SHIPPED

Session 37 (2026-06-16) — SHIPPED

Phase F: mobile parity — the mobile build is the PWA we launch first. Converted the bottom nav to the §6 5-tab spec, added the More bottom sheet, mobile CSS, and PWA polish. Frontend-only; ZERO backend changes. Backend 1853 → 1872 tests (+19), 145 suites, zero regressions. Web build clean (exit 0).

F.2/F.3 — Bottom tab bar + More sheet (components/BottomTabBar.tsx rewritten)

• 5 tabs per §6: Slate · Terminal · Scan · Ledger · More. Scan is the prominent raised action — a 46px grade-green circle lifted above the bar (it's the core action). Active = --g-a, inactive = --text-2, 9px mono labels, 64px bar, env(safe-area-inset-bottom), ≥44px touch targets.
• More opens an integrated bottom sheet: fade-in backdrop (dismiss on tap)
  • sheet-up scanlines panel, handle pill, MORE title + × close, 10 secondary routes (Compare/Tracker/Report/Invite/Pricing/Account/Settings/Help/About/ Responsible) as 48px mono rows. Dismisses on item nav / backdrop / ×.
• BEHAVIOR CHANGE: the bar now shows for ANON users too (previously hidden when signed-out). Slate/Terminal/Scan are open routes and this is the only mobile nav; gated taps (Ledger/Account) bounce through the Session-34 AuthGate. Still hidden on auth flows + landing (HIDE_ON). Dropped the old Parlay tab (the global ParlayTray keeps its own trigger).

F.4 — Mobile header

• Retired the Nav hamburger on mobile (display:none) — the tab bar + More sheet own mobile nav now. The Nav already hid desktop links <768px, so the mobile header is just wordmark + bell + read-meter + avatar. Mobile panel is now dead code (harmless).

F.5 — Mobile CSS (globals.css)

• .mobile-tab-bar hidden ≥768px; main bottom-padded calc(84px + safe-area) <768px so content clears the bar; .grade-hero → 80px <640px (GradeResultCard letter tagged grade-hero); .terminal-grid stacks to 1fr ≤768px (Terminal grid tagged); .game-lines-grid horizontal-scroll + sticky .team-col <640px.

F.6 — PWA polish

• manifest.json: added shortcuts (Slate/Scan/Terminal deep-links), categories → ["sports","finance","productivity"]. Already standalone + theme/bg #06060B.
• layout.tsx viewport: added viewportFit: 'cover' (notch/home-indicator) so the tab bar's safe-area padding has room. apple-mobile-web-app-* already set via metadata.appleWebApp (Session 27).

Files created

• tests/unit/vyndrMobile.test.js (19 tests: 5 tabs, prominent Scan, safe area, More sheet items/backdrop/44px, mobile CSS rules, Nav hamburger hidden, grade-hero hook, manifest standalone/shortcuts/categories, viewport-fit)

Files modified

• web/src/components/BottomTabBar.tsx (full rewrite), web/src/components/Nav.tsx (hamburger hidden), web/src/app/globals.css (mobile section), web/src/components/vyndr/GradeResultCard.tsx (grade-hero class), web/src/app/terminal/page.tsx (terminal-grid class), web/public/manifest.json (shortcuts/categories), web/src/app/layout.tsx (viewportFit)

Gotcha logged

• as const on the TABS array made each entry a distinct literal type, so isSheet/primary/href failed type-check on tabs lacking them. Fixed with a shared TabDef interface. (The build worker exits code 1 on type errors; a piped | tail masked it — always check the build exit code, not just the tail.)

Deferred (Sessions 38+)

• Living-layer ticker/heartbeat data, i18n, a11y toggle wiring, SW, paywall, parlay math = Phase G (Session 38). §13 QA = Session 39.

---

Session 36 (2026-06-16) — SHIPPED

Session 36 (2026-06-16) — SHIPPED

Phase E of the VYNDR 2.0 conversion + Session 35's #1 deferred item (the dashboard line upgrade). Frontend-only; ZERO backend changes. Backend 1839 → 1853 tests (+14), 144 suites, zero regressions. Web build clean (exit 0).

E.1 — Dashboard GameCard (Session 35's #1 deferred) — DELIVERED via reskin

• KEY DECISION: the live Slate's legacy GameCard carries inline per-prop grading (PlayerCard/PropRow → onGrade/gradedProps). The Session-35 display-only vyndr/GameCard has no grading, so a wholesale swap would DELETE the slate's core interaction. Instead, reskinned the legacy GameCard's game-lines grid with the Bloomberg best/worst pattern + SportBadge + SectionHead, keeping grading 100% intact — the #1 visual win without the regression.
• web/src/lib/slateAdapter.js (CommonJS, unit-tested): parseAmericanOdds (American → decimal payout), detectBestLines(books) (marks best/worst ML per side, only when ≥2 books disagree), mapScheduleToGameCards(schedule, gamelines, streaks, grades) (the §7 contract mapper, for the future full swap). GameCard now renders the lines grid via detectBestLines: best = green tint + green left border, worst = subtle red. Dropped the emoji marker for SportBadge.

E.3 — Four stubs → real pages (zero regression risk)

• compare — head-to-head: two TerminalInputs, side-by-side stat table (winner-highlighted), intel-surface VYNDR VERDICT. Sample data.
• invite — referral: progress 0/3, mono referral link + copy button, share CTA. Code derived from the session email.
• help — searchable FAQ: TerminalInput filter + expandable Card Q&A by category + support mailto.
• about — brand page in system voice (glitch Wordmark, "give it back", Detroit signature). Server component.

E.2 — Reskins (logic preserved)

• login — scanlines background, new .wm Wordmark (beta), system voice ("ACCESS THE SIGNAL"), Level-1 card. ALL auth logic (form, OAuth, next redirect) untouched.
• pricing — mounted ClaimMeter under the grid; removed the now-doubled paddingTop (layout already offsets 96 since Session 34).
• account is a redirect to /profile — left as-is (canonical surface).

Files created

• web/src/lib/slateAdapter.js
• tests/unit/vyndrPhaseE.test.js (18 tests: adapter odds/best-line/mapping logic, GameCard reskin, the 4 real pages, login/pricing reskins)

Files modified

• web/src/components/GameCard.tsx (Bloomberg lines + SportBadge/SectionHead)
• web/src/app/{compare,invite,help,about,login,pricing}/page.tsx
• tests/unit/vyndrAppShell.test.js (only /notifications remains a stub)

Deferred (Sessions 37+) — honest scope

• The FULL GameCard swap (replacing legacy GameCard with vyndr/GameCard) needs inline grading ported into the new component first — bigger than a reskin; the slateAdapter + new GameCard are both ready for it. Reskinned instead this session to avoid deleting grading.
• Profile/settings/blog/game-detail/responsible reskins + scan-input TerminalInput polish: light or deferred (tokens already mostly resolve there; prioritized dashboard + paid-user-visible + new pages per the impact order). Settings destructive-action confirmations (type-DELETE) are Phase G utility flows.

---

Session 35 (2026-06-16) — SHIPPED

Session 35 (2026-06-16) — SHIPPED

Phase D of the VYNDR 2.0 conversion: the screens users touch. Frontend-only; ZERO backend changes. Backend 1818 → 1839 tests (+21), 143 suites, zero regressions. Web build clean (exit 0, 36 routes).

Strategy (5 screens, time-boxed → prioritized + honest scoping)

Built the high-value NEW components fully + wired the core moment, with deliberate restraint where ripping out a working flow would regress monetization or features (paywall polish is Phase G, Session 38).

D.1 — Grade Result Card (the product's core moment) ✅ full + wired

• components/vyndr/GradeResultCard.tsx — faithful port: header, intel-surface grade hero (92–116px grade letter, grade-reveal + crt-sweep-local), confidence strip, phosphor-confirmed pill, MODEL/LINE/EDGE row, signal breakdown, amber kill-conditions, best-book strip (green tint + green left border), Desk alt ladder, action row. Every section self-hides when its data is empty. Callback props (onShare/onAddToParlay/onReadAnother) instead of window.__.
• components/vyndr/ProcessingGrade.tsx — the "weighing factors" reveal: factor-ignite sequence + proc-scan bar + % rail + minimal inline neural SVG (brain-node/brain-link), then reveals the card. Full NeuralBrain = Session 38.
• lib/gradeAdapter.js (CommonJS, unit-tested) — maps our engine output (/api/scan ScanResponse + GradeCard props) → the §7 GradeResultCard contract: direction→side, humanized stat, computed % edge (projection vs line), phosphor-confirmed heuristic, factor→signal bullets. Tier-gates content so the new card doesn't give paid content away: free = 3-signal teaser + no kill conditions + no alt ladder; analyst = full signals + kill conditions; desk = + alt ladder.
• Scan page wired: result render swapped from the legacy GradeCard to ProcessingGrade → GradeResultCard via the adapter, keeping ALL existing scan logic (fetch, scan-limit gating, parlay add). Preserved reads tracking (markReadComplete, sessionStorage-deduped) and the sportsbook deep-links (target=_blank + rel=noopener noreferrer). Added a free-tier upgrade nudge.

D.2 — Slate GameCard (Bloomberg pattern) ✅ component, ⏳ live-swap deferred

• components/vyndr/GameCard.tsx — faithful: sport badge + team abbrs (18px/800 mono), live-dot + score/clock, grade-summary chip, 4-col book-lines grid with best = green tint + green left border, worst = subtle red, graded PropRow (GradeBadge + add-to-parlay), inline 🔥 streaks. Deterministic (no random live-flash — that's the living layer, Session 38).
• HONEST SCOPE: did NOT rewire the live dashboard/Slate.tsx data flow onto this card this session — that mapping (schedule+gamelines+streaks → GameCard contract) is involved and the working slate shouldn't be destabilized inside a 5-screen session. The component + contract are ready for that swap next.

D.3 — Scan ✅ result converted (input surface left intact)

Result/grade moment now uses the new design. The rich existing search (player suggestions, tonight's-players chips, validation) was left as-is — swapping the wired <input> for TerminalInput risked the suggestion flow for low visual gain. Input-surface polish can follow.

D.4 — Landing ✅ ClaimMeter added (additive)

• components/vyndr/ClaimMeter.tsx — amber "47 / 100 CLAIMED" founder-seat scarcity bar; mounted under the Hero. Existing Hero/Pricing/Features kept (they already use tokens). Full hero/grade-preview rebuild deferred — additive only to avoid destabilizing the working conversion page.

D.5 — Terminal ✅ full new page (replaced the stub)

• app/terminal/page.tsx — real league-intelligence screen (server component): VVI most-impacted games on intel-surface cards, injury-wire cascade analysis, factor pulse, gradeable leaders, matchup exploits. Uses §7 data shapes with sample data (real wiring to scheduleService.getGameSummary/schedule/odds is a later session, per the prompt). SectionHead/GradeBadge/SportBadge throughout.

Files created

• web/src/lib/gradeAdapter.js
• web/src/components/vyndr/{GradeResultCard,ProcessingGrade,GameCard,ClaimMeter}.tsx
• tests/unit/vyndrCoreScreens.test.js (22 tests: adapter logic + tier gating, card/processing/gamecard/claimmeter/terminal contracts, scan+landing wiring)

Files modified

• web/src/app/scan/page.tsx (new card + adapter + reads + deep-links + nudge)
• web/src/app/terminal/page.tsx (stub → real), web/src/app/page.tsx (ClaimMeter)
• web/src/components/vyndr/index.ts (barrel exports)
• tests/unit/vyndrAppShell.test.js (terminal no longer a stub)

Deferred (Sessions 36+)

• Live dashboard/Slate swap onto the new GameCard; scan input → TerminalInput; full landing hero/grade-preview rebuild; Terminal real-data wiring; the richer blurred-paywall treatment (Phase G). Remaining screens = Session 36.

---

Session 34 (2026-06-15) — SHIPPED

Session 34 (2026-06-15) — SHIPPED

Phase C of the VYNDR 2.0 conversion: the app shell every page sits inside. Frontend-only; ZERO backend changes. Converted the nav/footer/404 to the design and added the routing + auth-gate frame. Backend 1792 → 1818 tests (+26), 142 suites, zero regressions. Web build clean (exit 0, 36 routes).

Honest reconciliations (spec ↔ our reality — same discipline as the S32 NFL-key fix)

• Auth gate is CLIENT-side, not server middleware. The prompt's example used createMiddlewareClient from @supabase/auth-helpers-nextjs — that package isn't installed, our auth is client-side Supabase (session in localStorage via @supabase/supabase-js), and the existing middleware.ts is locale-only. A server middleware physically can't read that session. So the gate runs in <AuthGate> (client) on top of the existing Supabase auth (rule 5 honored). Locale middleware left untouched.
• Narrowed the GATED set. The prototype gated dashboard + scan; those are OUR free-scan acquisition funnel (anon/free get 5 reads), so gating them is a monetization regression. GATED = ledger/tracker/account/profile/settings/ notifications/invite (genuinely personal surfaces). dashboard/scan stay OPEN.
• Did NOT stub over existing real pages. The prompt's stub list assumed ledger/tracker/blog/game/responsible/offline didn't exist — they do, with real content. Stubs created ONLY for genuinely-missing routes.
• Redirect param is ?next=, not the prompt's ?redirect= — that's the param our /login page already reads (router.replace(next)).

C.1 — Traced the shell

Nav used legacy @/components/Wordmark (.wordmark). Auth = AuthContext/ useAuth (user/tier/scansRemaining/loading/signOut). middleware.ts = locale only. Footer existed but was mounted only on the landing page. 28 route pages.

C.2 — Nav (components/Nav.tsx rewritten)

• New @/components/vyndr Wordmark (size md, cursor, beta — .wm markup).
• Primary links SLATE/TERMINAL/SCAN/LEDGER + a More dropdown (Compare, Tracker, The Report, Invite, Pricing, Settings). All nav chrome JetBrains Mono, uppercase, 11px, 0.08em; active = --g-a, hover --text-0, default --text-1.
• Right cluster: › Query search trigger, NotificationBell (signed-in), read meter (n/5 · MO, free + scan/dashboard only) / ∞ TIER plan badge, avatar menu (Account/Settings/Upgrade/Log out). Mobile toggle kept (full mobile shell is Session 37).
• Ticker mounted under the bar (sample items; real feed = Session 38). Header is now a fixed wrapper = 60px nav + 32px ticker → layout main paddingTop 64 → 96.

C.3 — Routing + auth gate

• web/src/lib/routes.js (CommonJS, unit-testable): GATED_ROUTES, OPEN_ROUTES, HASH_ALIASES, isGatedRoute(path), resolveHashAlias(hash).
• components/AuthGate.tsx — waits for loading, then bounces signed-out users off gated routes to /login?next=<path>. Mounted around <main> in layout.
• components/vyndr/HashRedirect.tsx — maps #scan/#terminal/… to real routes once on mount (keeps Next file-based routing; honors old share links). Mounted in layout.
• Stub pages (design-system RouteStub, system language "ROUTE UNDER CONSTRUCTION · SESSION xx"): /terminal, /compare, /invite, /help, /about, /notifications.

C.4 — Footer (components/Footer.tsx rewritten)

System voice: Wordmark sm+beta, mono columns PRODUCT/COMPANY/LEGAL, legal/21+ line with --amber 1-800-522-4700, and BUILT BY KEVON BUTLER · DETROIT · © 2026 VYNDR. Now mounted GLOBALLY in the layout (removed the per-page import from the landing page to avoid a double footer).

C.5 — 404 north star (app/not-found.tsx rewritten)

Full-page .scanlines, .crt-sweep on load, glitch Wordmark (lg), amber-glow "TRANSMISSION INTERRUPTED", giant --amber 404 (.wm data-text), "This page doesn't exist. / The signal was lost.", VBtn CTAs (client NotFoundActions so the page stays a server component for metadata).

Files created

• web/src/lib/routes.js
• web/src/components/AuthGate.tsx
• web/src/components/vyndr/{HashRedirect,NotFoundActions,RouteStub}.tsx
• web/src/app/{terminal,compare,invite,help,about,notifications}/page.tsx
• tests/unit/vyndrAppShell.test.js (26 tests: routing logic, gate, nav/footer/ 404 contracts, layout wiring, stubs-don't-clobber-real-pages)

Files modified

• web/src/components/Nav.tsx, web/src/components/Footer.tsx
• web/src/app/layout.tsx (mount HashRedirect + AuthGate + global Footer, paddingTop 96), web/src/app/not-found.tsx, web/src/app/page.tsx (drop dup footer)

Deferred (Sessions 35+)

• Real screens for the stubbed routes (D/E), mobile shell (F), living-layer ticker/heartbeat data + nav-string i18n (G). The Nav search › currently links to /scan; the ⌘K command palette is Phase G.

---

Session 33 (2026-06-15) — SHIPPED

First session of the multi-session VYNDR 2.0 design-system conversion. Fetched the design handoff bundle (claude.ai/design share → gzipped tar of the prototype: vyndr.css + ~35 .jsx + VYNDR_HANDOFF.md), read the README + handoff spec, and implemented Phase A (foundation) and Phase B (shared components) only — pages, mobile, and systems are Sessions 34+. Frontend-only; ZERO backend changes. Backend 1718 → 1792 tests (+74), 141 suites, zero regressions. Web build clean (exit 0).

PHASE A — Tokens + global CSS + fonts + glitch keyframes

• Tokens (§2, exact): added the canonical short-name token set to web/src/app/globals.css :root — --g-ap/--g-a/--g-b/--g-c/--g-d, --s-nba/--s-mlb/--s-wnba/--s-soccer, --amber/--amber-glow, --live/--hit/--miss, --scan-op: 0.04, --grade-hero, --sans (Inter), --mono (JetBrains Mono). Set --glitch: 1 (§2 baseline, was 0.5). Kept the full legacy alias block so every existing component still resolves during the migration — additive, not a rip-out.
• Typography wired to tokens: base body / h1–h6 / .mono / .num / .lbl now resolve var(--sans) / var(--mono) instead of hardcoding Instrument Sans / IBM Plex Mono → the whole app picks up Inter + JetBrains Mono from the foundation (the §2 monospace-for-data rule).
• Fonts (§2): layout.tsx Google Fonts link now loads Inter (400–900) + JetBrains Mono (400–800); IBM Plex Mono + Instrument Sans kept loaded so un-converted pages don't lose their type before Sessions 34+.
• Glitch system (§4, ported verbatim from vyndr.css): appended a "VYNDR 2.0 DESIGN SYSTEM" block with every keyframe — wm-tear, glitch-shift-r/-b, wm-caret, head-tear, crt-sweep, crt-sweep-local, phosphor-pulse, grade-reveal, ticker-scroll, live-pulse, flash-up/-down, ekg-scroll, node-pulse, synapse-travel, count-tick, factor-ignite, signal-in, proc-scan, data-blink, toast-in, sheet-up, cmd-in, fade-in, scan-drift — plus .scanlines::after texture, .intel-surface (Level-3 "VYNDR is speaking" green), .wm* wordmark, .glitch-hover, living-layer classes, and the §10 a11y data-* layer (contrast/text/colorblind/readable-font/reduced-motion). Where keyframe/class names collide with the legacy block, the new (appended) definitions are authoritative (later-wins). Entrance keyframes floor at the visible state (fade-in from opacity .6) per the §4 hard-won note.

PHASE B — Shared components (§5)

• web/src/lib/vyndrTokens.js — plain CommonJS helpers (GRADE_COLORS, GRADE_HEX, SPORT, GRADE_BADGE_SIZES, gradeColor, gradeHex, gradeBadgeSize). CommonJS on purpose: the .tsx components import it (allowJs) AND the Jest suite requires it directly (no TS/Babel transform in the plain-JS test config) → the helper LOGIC is genuinely unit-tested, not just text-asserted.
• web/src/components/vyndr/ — Wordmark, GradeBadge, SportBadge, TerminalInput, SectionHead, VBtn, Card, Sparkline, Ticker + barrel index.ts. Ported faithfully from vyndr-core.jsx → TS, token-only colors. 'use client' only where needed (TerminalInput, VBtn). GradeBadge hero size maps to 100px (within the §5 80–120px rule). NOTE: the existing root components/Wordmark.tsx (legacy .wordmark markup, used by Nav) is untouched — the new one lives at @/components/vyndr/Wordmark (.wm markup) and supersedes it as pages convert in Sessions 34+.

Files created

• web/src/lib/vyndrTokens.js
• web/src/components/vyndr/{Wordmark,GradeBadge,SportBadge,TerminalInput, SectionHead,VBtn,Card,Sparkline,Ticker}.tsx, web/src/components/vyndr/index.ts
• tests/unit/vyndrDesignSystem.test.js (74 tests via parameterized it.each: token presence, exact §2 hex, font loading, all keyframes, scanline + a11y + reduced-motion, helper logic, component contracts)

Files modified

• web/src/app/globals.css (§2 tokens, token-wired typography, full §4 glitch
  • §10 a11y block appended)
• web/src/app/layout.tsx (Inter + JetBrains Mono font link)

Deliberately deferred (per the session spec — Sessions 34+)

• A.7 hardcoded-hex sweep across the 40+ existing components is page-conversion work (Sessions 34–37), NOT Phase A. New vyndr components are token-only.
• Phases C–H: app shell/routing, core + remaining screens, mobile parity, living layer / i18n / a11y wiring / PWA / paywall / parlay math, QA vs §13.
• The prompt's RYAN MONTGOMERY note (sessionStorage auth → httpOnly cookies in prod) is a systems concern for Phase G, not Phase A/B.

---

Session 32 (2026-06-15) — SHIPPED

Surgical close of the four functional gaps Session 31's audit documented. No new feature scope (design session runs in parallel). Backend 1695 → 1718 tests (+23), 140 suites, zero regressions. Web build clean. Tracked data/ tree stays clean after a full test run (artifact fixed).

PHASE 1 — Grades cache writer (closes the content pipeline)

• Traced: analyzeViaEngine1 (computeFeatures → engine1 → toLegacyShape) produces the legacy grade shape; contentTemplateService reads grades:{sport}:{utc} then grades:{sport}, accepting an array or {grades:[...]}. The legacy shape already matches normalizeGrade — no remap needed. Session 31 confirmed NO writer existed.
• gradeSlateService.gradeAndCacheSlate(sport, props, opts) — dedupes to unique player+stat+line (cap 25, concurrency 5), grades BOTH sides (engine1 is direction-aware) keeping the higher-confidence verdict, sorts by confidence desc, writes grades:{sport} = {grades, updated_at, source} TTL 2h. Injectable grader/cacheSet/now → fully unit-tested.
• Wired fire-and-forget into oddsService.recordDownstream (fires on a fresh odds fetch only, never blocks the odds response). Gated by shouldGradeSlate(): default ON, OFF under NODE_ENV==='test' (its feature-compute fan-out otherwise pollutes the odds integration tests' axios call-count assertions via floating promises), GRADE_SLATE_ON_FETCH override (0 = operator kill-switch). 12 tests. Self-eval 9/10.

PHASE 2 — NFL + NHL sport-key wiring

• Corrected the spec's sport keys. Spec said football_nfl/hockey_nhl for oddsService.SPORT_KEYS, but that file maps to the-odds-api, whose keys are americanfootball_nfl / icehockey_nhl (verified against the the-odds-api sports list). The spec's values would have silently 404'd — the exact silent-failure class this session fights. (football_nfl/ hockey_nhl ARE correct for PropLine in proplineAdapter, unchanged.)
• Added nfl/nhl to SPORT_KEYS + SPORT_MARKETS (NFL_MARKETS/NHL_MARKETS). Filled proplineAdapter.MARKETS.nfl/nhl. Added NHL keys (player_shots_on_goal, goalie_saves) to MARKET_MAP so NHL props don't normalize to zero in-season (same fix family as Session 31's NFL MARKET_MAP gap). 10 tests, incl. end-to-end MARKET_MAP normalization + off-season empty handling. Self-eval 9/10.

PHASE 3 — Rate limiting on public routes

• Mounted the existing middleware/rateLimit (createRateLimit, in-memory per-IP, independent bucket per call site) via router.use on every public cached router: odds + parlay = 30/min; schedule/gamelines/streaks/hotlist/ content/lines/books = 60/min. /api/analyze keeps its own 10/min.
• 3 route-level tests (429 after limit, tighter odds limit, independent per-router buckets) complementing the existing middleware-level tests. Self-eval 9/10.

PHASE 4 — Test artifact + cleanup

• jsonlLogger ROOT now resolves to os.tmpdir()/vyndr-training-test under NODE_ENV==='test' (override TRAINING_DATA_DIR), so tests no longer append to the tracked data/training/resolutions-YYYY-MM.jsonl. Reverted the dirtied artifact; verified the tree stays clean after a full run.
• Gave the 5MB-payload pipeline regression test a 20s timeout — it's CPU-bound and flaked on Jest's 5s default under the heavier full-suite load from the +23 new tests (Jest's own error message recommends this).

Files created

• src/services/gradeSlateService.js
• tests/unit/gradeSlateService.test.js, tests/unit/nflNhlWiring.test.js, tests/integration/publicRouteRateLimit.test.js

Files modified

• src/services/oddsService.js (SPORT_KEYS/SPORT_MARKETS nfl+nhl, recordDownstream grades trigger + shouldGradeSlate gate)
• src/utils/oddsNormalizer.js (NHL MARKET_MAP keys)
• src/services/adapters/proplineAdapter.js (MARKETS.nfl/nhl)
• src/services/training/jsonlLogger.js (test-env temp path)
• 8 public route files (rate-limit mount): odds, parlay, schedule, gameLines, streaks, hotlist, content, lineMovement, bookComparison
• tests/integration/pipeline.test.js (5MB test timeout)
• CLAUDE.md

Deliberately deferred (per spec — await design session)

• CLV tracking + prop resolution (need PropLine Hobby-tier endpoint access confirmed). Design implementation. Player watchlists + push.
• The grades auto-grade trigger is ON by default but its per-prop feature-compute cost is unmeasured in prod; GRADE_SLATE_ON_FETCH=0 is the kill-switch. Worth profiling once real PropLine slates flow.

---

Session 31 (2026-06-14) — SHIPPED (audit)

Full-codebase audit, not a feature build. Validated 30 sessions of assumptions across the API→normalizer→cache→route→proxy→frontend chain. Backend 1694 → 1695 tests (+1), 137 suites, zero regressions. Web build clean. npm audit: 7 vulns (3 high, 4 moderate) → 0.

FIXES APPLIED

1. MARKET_MAP NFL gap (silent-failure class, same family as the MLB bug Session 30 fixed). oddsNormalizer.MARKET_MAP had ZERO NFL keys — when NFL wires up (season approaching) every NFL prop would normalize to nothing. Added defensive mappings for both odds-api _yds and _yards spellings → internal stat_types aligned with config/statFilters.js (passing_yards/rushing_yards/receiving_yards/ interceptions + pass/rush/reception TDs, receptions, anytime_td, kicking_points). Additive/zero-risk (only fires when those markets are returned). +1 explicit NFL surface test.
2. npm audit fix — resolved ws (uninitialized memory disclosure)
   • qs (DoS) + transitive Supabase deps, all semver-safe. 0 vulns.

SECURITY AUDIT (Ryan Montgomery)

• Stripe webhook: ✅ verified via stripe.webhooks.constructEvent (stripeService.constructWebhookEvent, signature + 400 on failure).
• CORS: ✅ allowlist (localhost, vyndr.app, *.vercel.app preview), FRONTEND_ORIGINS override — NOT open *.
• Internal routes: ✅ requireInternalAuth via router.use on the whole /api/internal router (VYNDR_INTERNAL_KEY).
• Hardcoded secrets in SOURCE: ✅ none (only doc-comment references).
• npm audit: ✅ 0 after fix.
• Supabase service-role: scoped to src/utils/supabase.js (backend-only; Express enforces its own auth) — acceptable.
• 🔴 CRITICAL (operator action): live GitHub PAT (ghp_…) embedded in the origin remote URL in .git/config. Not in tracked source (not committed/pushed) but exposed on disk. ROTATE the token and scrub the URL (use a credential helper). Not auto-fixed — needs rotation.

FINDINGS DOCUMENTED (deliberately left)

• grades:{sport} cache has NO writer. contentTemplateService collector reads it ("when present"), so content slate/POTD never reach dataLevel: 'full' in prod — degrades to lines/schedule. Graceful by design; wiring a grades-cache writer is feature work. Severity: medium.
• NFL/NHL props not wired end-to-end. oddsService.SPORT_KEYS has no nfl/nhl; proplineAdapter.MARKETS.nfl/nhl are empty. Not a current silent failure (nothing expects them yet). NFL MARKET_MAP now ready; full wiring is feature work. NHL: no product support anywhere (absent from statFilters/streaks) — left entirely.
• Inbound rate limiting only on /api/analyze. Public cached endpoints (/odds, /schedule, /gamelines, /streaks) have no inbound throttle. Real risk bounded (Redis-cached, no per-hit upstream cost). Recommend adding the existing middleware/rateLimit to public routers.
• Tests mutate a tracked file (data/training/resolutions-2026-06.jsonl gets resolution rows appended on every run → spurious git diff). Reverted the artifact; logging path should write to a temp/ignored location under test. Severity: low (hygiene).
• Cache keys VERIFIED aligned: oddsService writes odds:{sport}:{UTC}; content getBestLines reads the same. No mismatches found.
• Edge cases already covered: PropLine unsupported-sport→null, error→null, all-3-keys-exhausted→null, no-keys→null, and PropLine-error→odds-api fallback all have tests.

Files modified

• src/utils/oddsNormalizer.js (NFL MARKET_MAP keys)
• tests/unit/oddsNormalizer.test.js (NFL surface test)
• package-lock.json (npm audit fix)

---

Previous Phase

SHIP BUILD v30.0 — Provider backbone: PropLine 3-key adapter, MLB Stats API, ESPN summary (Session 30)

Session 30 (2026-06-14) — SHIPPED

Wired three VERIFIED-live data sources (Chrome infra session, Jun 14). Props never go dark again: PropLine gives 3,000 req/day FREE vs odds-api's 500/month. Tank01 player props confirmed EMPTY — skipped entirely.

Backend 1660 → 1694 tests (+34), 137 suites, zero regressions. Web build clean.

PHASE 1 — Traced existing architecture

Registry (providers.js) keyed by id (envKey presence = configured, quotaType/quotaLimit, priority). providerGateway.fetch(id, cb, opts) quota-checks via quotaTracker, falls over the getFallbackChain on QUOTA failure only. Normalization lives in utils/oddsNormalizer (normalizeProps filters books to ALLOWED_BOOKS + markets to MARKET_MAP).

PHASE 2 — PropLine adapter + 3-key rotation

• proplineAdapter.js — thin (PropLine IS Odds-API-compatible → reuses normalizeProps/extractSpreads). ?apiKey= query auth, base api.prop-line.com/v1. 3-key rotation: per-key daily usage in Redis (propline:usage:{i}:{date}, in-memory fallback), picks least-used key under the 900 threshold, returns null when all 3 exhausted (gateway falls through). Routes through the gateway for the 3,000/day total cap.
• Registry: propline priority 1 (PRIMARY); odds-api dropped to 2.
• Found + fixed a latent bug: MARKET_MAP had NO MLB market keys, so PropLine/odds-api MLB props would normalize to ZERO. Added batter_/ pitcher_ keys → internal stat_types. Added pinnacle to ALLOWED_BOOKS.
• 12 tests. Self-eval 9/10.

PHASE 3 — getOdds prefers PropLine + source tracking

• getOdds() tries PropLine first when hasKeys() (gated → zero impact on existing tests/envs), falls back to odds-api. Response + cache carry a provider field ('propline' | 'odds-api'). Extracted the shared movement/cascade/snapshot block into recordDownstream (DRY). 5 tests. Self-eval 9/10.

PHASE 4 — MLB Stats API adapter

• mlbStatsAdapter.js — statsapi.mlb.com, FREE/no-auth/unlimited, NOT via the gateway. getScheduleWithPitchers, getPlayerGameLog, getSeasonAverages, getBatterVsPitcher. Cached TTLs (schedule 30m, logs/season 6h, BvP 24h), stale-on-error. Registry mlb-stats (noAuth: true → getConfiguredProviders now counts no-auth providers). 11 tests. Self-eval 9/10.

PHASE 5 — ESPN summary enrichment

• scheduleService.getGameSummary(sport, eventId) → ESPN summary (injuries, ESPN Bet odds, ATS, leaders, box score). Empty-default shape, cached 10m, never throws. 7 tests. Self-eval 9/10.

PHASE 6 — Registry + docs

• CLAUDE.md "Provider Strategy" section added.

Files created

• src/services/adapters/proplineAdapter.js, mlbStatsAdapter.js
• tests/unit/{proplineAdapter,oddsProviderPreference,mlbStatsAdapter,espnSummary}.test.js

Files modified

• src/config/providers.js (propline + mlb-stats, odds-api→priority 2, isProviderConfigured/noAuth)
• src/utils/oddsNormalizer.js (MLB market keys + pinnacle)
• src/services/oddsService.js (PropLine-first + provider field + recordDownstream)
• src/services/scheduleService.js (getGameSummary), CLAUDE.md

---

Previous Phase

SHIP BUILD v29.0 — Content generation templates: structured social/newsletter content from live data (Session 29)

Session 29 (2026-06-13) — SHIPPED

The data engine that produces raw material for daily social content. Each template consumes live VYNDR data and returns STRUCTURED OBJECTS (not text, not images) that degrade gracefully by data level. A formatter renders plain text; the image/design layer comes later.

Backend 1623 → 1660 tests (+37), 133 suites, zero regressions. Web build clean.

PHASE 1-3 — Template engine + slate thread + POTD

• contentTemplateService.js:
  • collectSlateData(sport, deps?) — gathers schedule + game lines + grades + streaks + movers + best lines via Promise.allSettled, INJECTABLE collectors (default wires the real services). Sets dataLevel: full / lines / schedule / empty.
  • generateSlateThread — hook + content posts + CTA. Full → top-5 graded picks; lines → game-line highlights (best ML, consensus total/spread, book disagreement) + movers; schedule → game list.
  • generatePOTD — best grade (full) or game-of-the-day (lines) or { available: false }.
  • Field-alias normalizers so grades from any shape (player/player_name, side/direction, edge/edge_pct) work.

PHASE 4-5 — Recap + matchup preview

• generateResultsRecap(sport, resolvedGrades) — record, win rate, top hits, biggest miss, by-tier (A/B/C), Brier score + avg CLV. Pure.
• generateMatchupPreview(game, gameLines, streaks) — teams, lines summary (consensus spread/total, home-favorite), streaks matched to the two teams, one-line narrative. Degrades to lines: null.

PHASE 6 — Content API

• GET /api/content/{slate,potd,recap,preview}/:sport (preview takes /:gameId). ?format=text adds post-ready strings. Mounted in app.js; Next proxy api/content/[...path]/route.ts.

PHASE 7 — Formatter

• contentFormatter.js — slate thread → array of plain-text posts (one per role), POTD + recap text blocks. Defensive: never emits "undefined".

Files created

• src/services/contentTemplateService.js, src/services/contentFormatter.js
• src/routes/content.js
• web/src/app/api/content/[...path]/route.ts
• tests/unit/contentTemplateService.test.js (22), tests/unit/contentFormatter.test.js (7), tests/integration/contentRoutes.test.js (8)

Files modified

• src/app.js (mount /api/content)

---

Previous Phase

SHIP BUILD v28.0 — Parlay builder, line-movement tracking, book comparison (Session 28)

Session 28 (2026-06-13) — SHIPPED

The three features every competitor has: parlay building, line movement, book comparison. All zero-credit (pure math / Redis snapshots / cached odds). Reused existing primitives heavily (payoutCalculator, the existing ParlayTray/ParlayContext frontend).

Backend 1584 → 1623 tests (+39), 130 suites, zero regressions. Web build clean.

PHASE 1-2 — Parlay builder

• parlayService.js — combined American/decimal odds (reuses payoutCalculator), confidence-weighted combined grade, correlation detection via an interaction matrix (same-game teammates = positive, opposing rebounds = negative, cross-game = independent), kill-condition aggregation, and suggestParlays (greedy, conflict-avoiding).
• POST /api/parlay/calculate + /suggestions. Frontend parlay builder already existed (ParlayTray + ParlayContext → /api/scan/parlay grading); left intact. Added the calculate proxy for the lightweight path.
• 15 unit + 3 route tests.

PHASE 3-4 — Line movement

• lineSnapshotService.js — Redis-only rolling history (linehistory:{sport}:{gameId}:{player}:{stat}, cap 100, 48h TTL), classifyMovement (stable/rising/dropping + sharp signal ≥1.5 pts), getBiggestMovers (scan + classify + sort by |delta|). Complements the existing Supabase-backed lineMovementService rather than replacing it.
• Wired recordSnapshots into oddsService's existing best-effort block.
• GET /api/lines/:sport/movers + per-prop history.
• Frontend: LineMovementChart (dependency-free SVG sparkline) + MoversPanel (mounted in the Slate, self-hiding, tier-gated).
• 9 unit + 2 route tests.

PHASE 5-6 — Book comparison

• bookComparisonService.js — best line per side (highest decimal payout), savings vs field average per $100, over the grouped odds lines[]. GET /api/books/:sport (best lines) + per-prop grid, reading CACHED odds props (zero credits).
• Frontend: BookComparison (book grid, BEST badge) + BestLinesPanel (mounted in the Slate, self-hiding, tier-gated).
• 7 unit + 3 route tests.

PHASE 7 — Wiring

• Mounted /api/parlay, /api/lines, /api/books in app.js.
• Next proxies: parlay/calculate/route.ts (explicit, avoids catch-all conflict with existing grade/add-leg), lines/[...path], books/[...path].
• MoversPanel + BestLinesPanel added to the Slate below streaks/hot lists.

Files created

• src/services/parlayService.js, src/routes/parlay.js
• src/services/lineSnapshotService.js, src/routes/lineMovement.js
• src/services/bookComparisonService.js, src/routes/bookComparison.js
• web/src/components/{LineMovementChart,MoversPanel,BestLinesPanel,BookComparison}.tsx
• web/src/app/api/parlay/calculate/route.ts, api/lines/[...path]/route.ts, api/books/[...path]/route.ts
• 4 new test files (parlayService, lineSnapshotService, bookComparisonService, session28Routes)

Files modified

• src/app.js (3 mounts), src/services/oddsService.js (snapshot recording)
• web/src/components/Slate.tsx (2 panels)

---

Previous Phase

SHIP BUILD v27.0 — PWA autopilot: deployment-aware service worker, push foundation, offline fallback, install + cookie + tier polish (Session 27)

Session 27 (2026-06-13) — SHIPPED

Upgraded the PWA from "caches stale content after deploy" to bulletproof. The service worker stays — it powers push/offline/installs — but its cache POLICY is now deployment-aware. Much of the foundation already existed (skipWaiting/clientsClaim, push handlers, InstallPrompt, CookieConsent); this session fixed the cache strategy and filled the gaps.

Backend 1579 → 1584 tests (+5), 126 suites, zero regressions. Web build clean.

PHASE 1 — SW cache policy (the deploy-staleness fix)

• Replaced defaultCache with explicit runtimeCaching (Serwist v9 strategy classes): API + navigations + RSC/everything-else are NetworkFirst (5s timeout) so sports data is never stale; only content-hashed /_next/static/ and images/fonts are CacheFirst.
• skipWaiting/clientsClaim already set — kept.
• Added an activate handler that deletes legacy cache buckets (the old defaultCache set: start-url, next-data, apis, pages-rsc, …), preserving CURRENT_CACHES + Serwist-managed precache.

PHASE 2 — Push foundation

• SW push + notificationclick handlers already existed — kept + added a tag. Created web/src/lib/pushNotifications.ts (subscribeToPush / unsubscribeFromPush / isPushSupported / pushPermission). Returns null gracefully until NEXT_PUBLIC_VAPID_PUBLIC_KEY exists.

PHASE 3 — Offline fallback

• Created web/src/app/offline/page.tsx (dependency-free client page).
• SW pre-caches /offline on install; navigation handler serves it via a handlerDidError plugin when network + cache both miss.

PHASE 4 — Manifest polish

• manifest.json: full name "VYNDR — Sports Prop Intelligence", added categories, explicit icon purpose. Kept brand #06060B (NOT the spec's #0A0A0F) for splash/status-bar consistency. Layout already emits theme-color + apple-mobile-web-app-* via Next metadata API.

PHASE 5+6 — Install prompt & cookie consent (verified, already done)

• InstallPrompt (beforeinstallprompt + iOS hint + 7-day dismissal cooldown, gated on ≥2 reads) and CookieConsent (persists vyndr_cookie_consent, shows once) already implemented and mounted in layout. No change needed.

PHASE 7 — Copy

• The literal "NBA · MLB · WNBA" hero badge was already gone (Session 24 → "EVERY SPORT · EVERY PROP"). Reframed the layout metadata description to lead with "every sport" (kept per-sport SEO keywords).

PHASE 8 — Profile tier

• {profile.tier} rendered blank when the API returned null/undefined. Now falls back to 'free' so the tier field is never empty.

Files created

• web/src/app/offline/page.tsx
• web/src/lib/pushNotifications.ts
• tests/unit/pwaManifest.test.js

Files modified

• web/src/sw.ts (cache strategies + activate cleanup + offline precache)
• web/public/manifest.json (name, categories, icon purpose)
• web/src/app/layout.tsx (description), web/src/app/profile/page.tsx (tier)

---

Previous Phase

SHIP BUILD v26.0 — Cross-sport tab counts, scan copy, game-card visual polish, empty-section auto-hide (Session 26)

Session 26 (2026-06-12) — SHIPPED

Finished making every sport visible and polished the presentation. Traced the MLB/WNBA "no count" symptom to its real cause before touching code.

Backend unchanged: 1579 tests, 125 suites, zero regressions. Web build clean.

PHASE 1 — MLB/WNBA tab counts (traced)

• TRACE: hit ESPN live — MLB returns 15 events, WNBA 2, with exactly the shape scheduleService.normalizeEvent expects. The backend was correct; Session 25's proxy fix already unblocked the data flow.
• Real gap: the Slate's tab counts were derived ONLY from the active tab's loaded games, so a sport showed no count until you clicked its tab.
• FIX: a mount-time effect fetches schedule counts for nba/wnba/mlb (free, cached) so every tab shows "MLB (15)" / "WNBA (2)" regardless of which tab is active. tabCount prefers loaded data, falls back to the count.

PHASE 2 — Scan copy

• Removed "Books usually open player props 2–3 hours before tip" from scan/page.tsx and game/[id]/page.tsx (we don't assume book timing). Kept Features' "30 min before tip" — that's a lineup-intel claim, not a book-line timing assumption.

PHASE 3 — Game-card visual polish

• Header: 18px/800 abbreviations, 16×20 padding for breathing room.
• Game-lines strip: aligned 4-column grid (book · away · home · O/U) with em-dash placeholders, more padding.
• Inline streaks: accent-colored label + subtle red gradient wash, premium.
• Empty-props line: smaller, left-aligned, dimmed — informational, not an error wall.
• Verified StatFilterPills (filled active pill) and the Hero sport-badge strip (active filled / coming-soon dimmed, all 9 sports) already match the design spec; notice banner already neutral (no red).

PHASE 4 — Empty-section auto-hide

• "Most parlayed tonight" now hides entirely when loaded-but-empty instead of showing a "be the first" prompt (dead space on a fresh platform).

PHASE 5 — BACKEND_URL (verified)

• All proxies (new + odds) default to http://localhost:3000, consistent with odds-cache.ts. Prod sets BACKEND_URL; the new routes inherit it. No change — deliberately kept consistent with the working odds proxies rather than introducing a 3001 default that would diverge from them.

Files modified

• web/src/components/Slate.tsx (schedule-count effect, tabCount fallback)
• web/src/components/GameCard.tsx (header, lines strip, streaks, empty)
• web/src/app/scan/page.tsx, web/src/app/game/[id]/page.tsx (copy)
• web/src/app/dashboard/page.tsx (auto-hide Most-parlayed)

---

Previous Phase

SHIP BUILD v25.0 — Fix every data-rendering bug: the frontend now actually SHOWS the backend's data (Session 25)

Session 25 (2026-06-12) — SHIPPED

Traced data from API response → normalizer → cache → frontend fetch → render and fixed every break. The backend was serving real data; the frontend showed "NO SLATE." Root causes found and fixed.

Backend 1571 → 1579 tests (+8), 125 suites, zero regressions. Web build clean.

PHASE 1 — Tank01 game-lines normalizer (traced + fixed)

• TRACE: the real Tank01 betting-odds shape puts each sportsbook as a TOP-LEVEL key on the game object ({ awayTeam, homeTeam, bet365:{...}, betmgm:{...} }), NOT inside a sportsBooks array. The old normalizer looked for the array → books: {} every time.
• FIX: extractBooks() filters out NON_BOOK_KEYS and treats remaining object values as books (counted only if they yield a real odds field). normalizeBook now reads homeTeamML/totalOver/homeTeamRunLine (MLB) alongside the older spellings. Legacy array shape still handled.

PHASE 2 — Slate schedule rendering (THE root cause)

• TRACE: the all-day endpoints (/api/schedule, /api/gamelines, /api/streaks, /api/hotlist) existed on Express but had NO Next.js proxy route — so the browser's fetch('/api/schedule/mlb') 404'd on the Next origin and the slate was always empty.
• FIX: created 4 Next.js proxy route handlers (mirroring /api/odds/*).
• Sport tabs now show merged counts ("MLB (8)") from schedule+odds.
• Games already rendered with 0 props (Session 24 merge); now they get data.

PHASE 3 — Dashboard

• The Session 24 schedule fallback was 404ing for the same proxy reason; the Phase 2 proxy unblocks it. Dashboard now shows ESPN schedule games.

PHASE 4 — Hero prop

• The static Jokic fallback card is now labelled "EXAMPLE" so its fixed stats don't read as stale live data when no live hero-prop is flowing.

PHASE 5 — Per-game inline streaks

• GameCard renders a 🔥 STREAKS section inline (below props/lines), matched to the game by team abbreviation in the Slate. Renders only when streaks exist for that game's teams. Sport-wide panels kept as the board.

PHASE 6 — Game-log cache key alignment (traced + bridged)

• TRACE: prefetch writes tank01:{sport}:boxscore:{gameId}; rosterLogs read gamelogs:{sport}:* / rosterlogs:{sport}. NBA/WNBA are fed by gameLogService (Python) during grading — ALIGNED. MLB had NO writer for the keys rosterLogs read — MISALIGNED, so MLB streaks were always empty.
• FIX: rosterLogs now falls back to aggregating the cached Tank01 box scores (tank01:{sport}:boxscore:*) into per-player multi-game logs, flattening MLB _raw and ordering games most-recent-first by the date in the gameID. Honest limitation: streaks need 2+ cached games to surface, so coverage grows as box scores accumulate across prefetch runs.

Files created

• web/src/app/api/schedule/[sport]/route.ts
• web/src/app/api/gamelines/[sport]/route.ts
• web/src/app/api/streaks/[sport]/route.ts
• web/src/app/api/hotlist/[sport]/route.ts

Files modified

• src/routes/gameLines.js (normalizer rewrite + extractBooks)
• src/services/rosterLogs.js (box-score aggregation bridge)
• web/src/components/Slate.tsx (streaks fetch+match, tab counts)
• web/src/components/GameCard.tsx (inline streaks section)
• web/src/components/LiveHeroProp.tsx (EXAMPLE label)
• tests/integration/gameLinesRoute.test.js, tests/unit/rosterLogs.test.js

---

Previous Phase

SHIP BUILD v24.0 — Connect Everything: wired the all-day intelligence layer into the live UI + killed stale copy (Session 24)

Session 24 (2026-06-12) — SHIPPED

Connected Session 23's backend to what users actually see. The Ferrari engine got wheels. Frontend-heavy: the Slate now fetches every free/cheap layer, the site shows content even with odds-api at 0 credits, and every piece of stale copy is gone.

Backend 1567 → 1571 tests (+4), 125 suites, zero regressions. Web build clean.

PHASE 1 — Slate wired to ALL sources

• fetchSlate now fetches odds + schedule (ESPN) + gamelines (Tank01) per sport in parallel. mergeSlate() makes the SCHEDULE the foundation (always shows), overlays odds props (matched by nickname token) and Tank01 lines (matched by team abbreviation). Unmatched odds games are appended so props are never dropped. Schedule empty → odds-only fallback.
• GameCard extended with optional status/score (LIVE/FINAL badge + score) and gameLines (book-by-book ML / spread / total strip).
• Odds-down-but-schedule-up → soft inline notice, NOT a wall-of-error.

PHASE 2 — Stat filter pills

• Pills hidden on the ALL tab (filtering by "points" across mixed sports is meaningless). Sport-specific categories on a single-sport tab.
• Switching sport resets activeStat to 'all' (stale filter would blank the panels).

PHASE 3 — Copy

• Hero badge "NBA · MLB · WNBA" → "EVERY SPORT · EVERY PROP"; subhead de-listed the three leagues. Features "Three sports, one engine" → "Every sport, one engine". FAQ updated. LivePropsStrip "TONIGHT'S GRADES LOAD AT 5 PM ET" → "LIVE GRADES APPEAR HERE AS BOOKS POST LINES". Removed the developer-facing "odds endpoint not configured yet" footer. No BetonBLK references existed.

PHASE 4 — Nav for paid users

• Paid (analyst/desk) users see "Account" where free/anon see "Pricing".
• /account page created → redirects to /profile (canonical plan + subscription-management surface; no duplicate UI).

PHASE 5 — Cache population

• src/startupPrefetch.js — non-blocking, crash-safe Tank01 cache warm scheduled 5s after boot (server.js). Skips when RAPID_API_KEY unset; prefetch failure never crashes the server. Bounded by prefetch's budget.

PHASE 6 — Language switcher

• Removed <LocaleSwitcher /> from the Nav (no translations behind it). i18n infrastructure (LocaleContext, useT, react-i18next, the LocaleSwitcher component file) kept for when translations land.

PHASE 7 — Empty states

• Dashboard falls back to the free ESPN schedule when the odds slate is empty, so it shows today's matchups instead of "NO SLATE". "NO SLATE" now appears only when BOTH odds and schedule are genuinely empty.
• "Tonight's slate is loaded. 0 games across 3 sports." → honest, sport-aware count (or "Your ledger starts here." when zero).

Files created

• src/startupPrefetch.js
• web/src/app/account/page.tsx
• tests/unit/startupPrefetch.test.js

Files modified

• web/src/components/Slate.tsx (parallel fetch + merge, notice, pills)
• web/src/components/GameCard.tsx (status/score/game-lines layers)
• web/src/components/Nav.tsx (paid→Account, locale switcher removed)
• web/src/components/Hero.tsx, Features.tsx, FAQ.tsx, LivePropsStrip.tsx (copy)
• web/src/app/dashboard/page.tsx (schedule fallback + copy)
• src/server.js (startup prefetch hook)

---

Session 23 (2026-06-12) — SHIPPED

Built the all-day content layer that makes VYNDR an intelligence terminal, not a prop-grading widget. EVERYTHING coexists: schedule, stats, streaks, hot lists, and game lines all visible at once — nothing replaces anything. When odds-api props are empty, the other (free/cheap) layers keep the platform alive. NO odds-api credits were spent this session.

Baseline 1505 → 1567 tests (+62), 124 suites, zero regressions. Web build clean.

PHASE 1 — Schedule API (/api/schedule/:sport)

• src/services/scheduleService.js — cache-aside read of free ESPN scoreboards. Reads schedule:{sport}:{date} first; on a miss it self-heals by fetching ESPN directly (the same free endpoint the pollers hit), normalizes, caches 60s. The platform is NEVER empty.
• Per-game hasOdds / hasGameLines flags read OTHER caches (odds-api props, Tank01 lines) WITHOUT triggering a fetch.
• src/routes/schedule.js — returns an empty slate (never 5xx) on error. Unknown sport → 404. Mounted in app.js.

PHASE 2 — Tank01 Game Lines (/api/gamelines/:sport)

• Added getMLBBettingOdds to tank01MlbAdapter (NBA already had getNBABettingOdds). 15-min cache TTL, shares RAPID_API_KEY quota.
• src/routes/gameLines.js — normalizes the book-by-book body (bet365 / betmgm / caesars: ML, spread, total) into a flat shape, parses teams from the YYYYMMDD_AWAY@HOME gameID. Missing key → graceful configured:false. Adapter throw → empty, never 500.

PHASE 3 — Streaks Engine (/api/streaks/:sport)

• src/services/streaksService.js — pure, data-driven. Consecutive run from the latest game backward; collapses tiered specs (25+/20+ pts) to the more impressive one. NBA (14 specs incl. dd/td/PRA/hot- shooter), MLB (9), NFL (5), soccer (4). Through VYNDR's lens — "4-game 28+ scoring streak", not "31 PPG".
• src/services/rosterLogs.js — Redis-only roster loader (prefetch blob fast-path, else SCAN over gamelogs:{sport}:*). Never throws.

PHASE 4 — Hot Lists (/api/hotlist/:sport)

• src/services/hotListService.js — "hot" = ABOVE the player's own baseline (explicit seasonAvg, else games outside the window), not just high raw numbers. Ranked by delta, tie-broken by raw recent average. Date-based 7-day window when rows carry dates.

PHASE 5 — Stat Filtering

• src/config/statFilters.js (+ web/src/config/statFilters.ts mirror). ?stat= param on streaks/hotlist. Discovery endpoint GET /api/stats/filters/:sport. StatFilterPills component.

PHASE 6 — Unified Dashboard

• StreaksPanel + HotListPanel (headshots, tier-gated, self-hide when empty), wired into the Slate below the games AND mounted as landing-page teasers. Stat pills narrow both; schedule + game lines stay visible regardless. Free tier sees 3, paid sees all.

PHASE 7 — Cleanup

• ParlayAPI marked status: 'dead' in src/config/providers.js (Chrome Claude: api.parlayapi.io unreachable on 2026-06-12). Excluded from getFallbackChain + getConfiguredProviders; new isDeadProvider helper. Config still resolves so adapter tests (network-mocked) pass unchanged.

Files created

• src/services/scheduleService.js, src/routes/schedule.js
• src/routes/gameLines.js
• src/services/streaksService.js, src/routes/streaks.js
• src/services/hotListService.js, src/routes/hotlist.js
• src/services/rosterLogs.js
• src/config/statFilters.js
• web/src/config/statFilters.ts
• web/src/components/StatFilterPills.tsx
• web/src/components/StreaksPanel.tsx
• web/src/components/HotListPanel.tsx
• 7 new test files (schedule, gamelines, streaks/hotlist routes, streaksService, hotListService, rosterLogs, statFilters, providersRegistry)

Files modified

• src/app.js (mounted 4 routes)
• src/services/adapters/tank01MlbAdapter.js (getMLBBettingOdds)
• src/routes/stats.js (filters discovery endpoint)
• src/config/providers.js (ParlayAPI dead)
• web/src/app/page.tsx, web/src/components/Slate.tsx
• tests/unit/tank01MlbAdapter.test.js

---

Previous Phase

SHIP BUILD v22.0 — Tracker-driven quota guard, env-configurable cache TTL, opt-in odds prewarmer (Session 22)

Session 22 (2026-06-12) — SHIPPED

Plumbed the cache + quota machinery so the platform can survive a free-tier (500 credits/month) odds-api budget. Honest scope: Chrome Claude's diagnosis ("pollers write to one key, API reads from another") didn't hold up under trace — the keys it pointed at were internal sentinels in cascadeService and lineMovementService, not duplicate caches. No PM2 poller ever fed the odds cache. The actual root cause is that the cache is populated on-demand by getOdds itself, and when odds-api fails the cache stays empty.

After confirming the trace with the user, the agreed scope was:

1. Replace the legacy stale quota guard with Session 20's tracker
2. Make the cache TTL env-configurable (default raised from 15min to 1h)
3. Build an opt-in odds prewarmer script

PHASE 1 — Trace (honest scope correction)

Grepped for odds:players:* and odds:baseline_set:* — both are written by cascadeService.detectScratches and lineMovementService.processNewOdds AFTER a successful getOdds() call, as internal sentinels for scratch detection and opening-line baseline capture respectively. Neither is a duplicate cache feed.

Documented in BUILD-STATE so future operators don't re-chase the same false lead.

PHASE 3 — Tracker-driven quota guard

src/services/oddsService.js#getOdds previously checked getQuotaRemaining(redis) — a Redis hash that only the file itself updated, so it drifted (Chrome Claude observed 46 in the hash while reality was 7). The check is now delegated to Session 20's quotaTracker.getQuotaStatus('odds-api'), which:

• is synced from x-requests-remaining / x-requests-used on every successful odds-api call (via gateway.fetch's syncHeadersFrom hook)
• BLOCKs at ≥95% (matches the WARN/BLOCK constants the dashboard surfaces)
• fails OPEN when Redis is degraded so a Redis hiccup doesn't take down the platform

The 429 error now attaches quotaStatus to the thrown Error so operators inspecting the response can see the actual used / limit / pct that triggered the block.

Three new tests in tests/unit/oddsService.test.js:

• 80% (WARN, not BLOCK) → call proceeds
• 96% (BLOCK) → 429 thrown with quotaStatus attached
• 95% (BLOCK boundary) → axios.get never invoked

The legacy getQuotaRemaining / updateQuota machinery stays exported for now — other call sites (the /api/odds/* route layer pulls quota_remaining straight out of the response envelope) still rely on the hash being populated. The hash is a redundant signal; the tracker is the decision.

Env-configurable cache TTL

oddsService.CACHE_TTL is now resolved from ODDS_CACHE_TTL_SECONDS at module load, falling back to a new default of 3600 seconds (1 hour) — up from the legacy 900s.

Rationale: each cache miss fans out to (1 + N) upstream calls, costing 5–10 credits per refresh. At 15-min TTL across 4 sports that's ~3,840 credits/day — an order of magnitude over the free tier's 500/month. At 1h TTL it's ~960/day — still over, but a factor of 4 closer. Operators on the free tier with many sports should bump to 7200 (2h) via Coolify.

Bounds-checked: rejects overrides <60 (would shred credits) and

86400 (would hold stale forever); both fall back to 3600.

getConfiguredCacheTTL exported for direct test coverage. Five new tests pin the parser.

Opt-in odds prewarmer

scripts/odds-prefetch.js calls getOdds(sport) for each configured sport to warm the cache out-of-band. Gated by ODDS_PREWARM=1 — the first thing main() does is check the flag and bail out with exit code 2 if unset. This is a hard safety: at the free tier the script would blow the monthly budget if run accidentally.

CLI:

ODDS_PREWARM=1 node scripts/odds-prefetch.js --sports=nba,mlb
ODDS_PREWARM=1 node scripts/odds-prefetch.js --dry-run

Returns a structured summary including credits spent (computed as the delta between pre-run and post-run tracker reads). The script bails the moment the tracker reports allowed:false mid-run, so subsequent sports don't add to the bleeding.

Module-exports main and __internals.parseArgs for testing. 11 unit tests cover gating, dry-run, happy path, credit-delta calculation, mid-run block, and per-sport error isolation.

PHASE 4 — Poller frequency review

Audit complete: the existing PM2 pollers (poller.js for NBA/WNBA/MLB) hit ESPN scoreboards — free, no quota. The 60s default is correct for ESPN. The soccer poller (soccer.js) already received quota-aware tick-skipping in Session 20.

No changes — the spec's "60s → 900s" change would have applied to a hypothetical odds-api poller that doesn't exist.

Honest scope flags

• The actual production 503 is NOT fully fixed by this session. This session changes the cost ceiling (4x lower per-cache-miss) and the quota check accuracy (tracker, not drifting hash). It does NOT change the fundamental constraint that the free 500-credit/month tier cannot serve live props across 3+ sports continuously. The real fix is a tier upgrade or accepting longer cache (4h+).
• The prewarmer is deliberately not wired to cron or PM2. When/if the account upgrades, the operator can schedule it manually. Auto-mounting it would silently spend credits.
• The getQuotaRemaining legacy hash is kept, not removed. Other call paths (the routes' response envelope) consume it for the quota_remaining field. Removing requires migrating those consumers — out of scope for a "make the guard trustworthy" pass.

Battery

• Express suite: 116 passed / 1505 tests (+19 over baseline 1476 → 1486 → 1505). 11 prewarmer + 5 TTL parser
  • 3 tracker guard.
• Web build: clean.

Files changed (Session 22)

Created:

• scripts/odds-prefetch.js
• tests/unit/oddsPrefetch.test.js

Modified:

• src/services/oddsService.js — getConfiguredCacheTTL
  • tracker-driven preflight guard + new module exports
• tests/unit/oddsService.test.js — 3 tracker tests + 5 TTL parser tests + 1 informational default-TTL test, removed the legacy hgetall.remaining:0 block test

---

Session 21 (2026-06-12) — SHIPPED

Session 20 built the gateway; Session 21 wires every adapter through it. Plus: ntfy push at WARN (80%) and BLOCK (95%), an end-to-end integration test, and an honest correction to the provider registry that flags a critical misconception in the original spec.

PHASE 1 — Provider trace + registry correction (CRITICAL)

The Session 20 registry classified oddspapi and parlayapi as live-odds fallback providers for the-odds-api. They are not. Tracing the existing adapters revealed:

• oddsPapiAdapter — Pinnacle CLOSING-line capture at tip-off. Writes to closing_lines table for CLV. One row per game. NOT a live-props source.
• parlayApiAdapter — historical archive (1K credits/month). Used by bulk scripts and trap detection. NOT real-time.

Registry corrected:

• oddspapi.capabilities = ['closing_lines'], name = "ODDSPAPI (Pinnacle close)"
• parlayapi.capabilities = ['historical_props', 'historical_lines'], name = "ParlayAPI (historical)"
• Both bumped to priority: 1 for their actual capability sets

Consequence: getFallbackChain('odds', 'nba', 'odds-api') now returns [] because no other configured provider serves live odds. The gateway's QuotaExhaustedError path is honest about this: when the-odds-api hits 95%, there is no fallback to take over. The fix to the original 503 incident is operational (higher tier, better caching, or a real new provider), not architectural.

PHASE 2 — Tank01 NBA + MLB through gateway

Single axios.get call site in each adapter's fetchWithCache — wrapped in gateway.fetch('tank01', () => axios.get(...), { capability: 'box_scores', sport }). Existing cache + stale-while- revalidate logic untouched.

Tests: existing 51 Tank01 tests all pass unchanged.

PHASE 3 — API-Football through gateway

Same surgical pattern at the fetchWithCache axios.get. The adapter keeps its own apifootball:daily_count Redis counter (legacy SOFT_LIMIT=90 trigger); the tracker is now ALSO advancing on every successful call. Two counters, one truth source: tracker drives WARN/BLOCK; legacy counter drives the local stale-while-revalidate switch.

Tests: 16/16 unchanged.

PHASE 4 — Football-Data through gateway

Wrap pattern as above. The adapter's in-process token bucket (8 req/min) short-circuits BEFORE the gateway — so the gateway counter only ticks for calls that actually went over the wire. Order: bucket → gateway → axios.

Tests: 15/15 unchanged.

PHASE 5 — ODDSPAPI + ParlayAPI through gateway

Wired for their actual purposes:

• oddsPapiAdapter.fetchPinnacleProp → gateway with capability: 'closing_lines'
• parlayApiAdapter.fetchWithGuards → gateway with capability: 'historical_props'

Test mock update: parlayApiAdapter.test.js mocked redis without isDegraded, which made the gateway's quotaTracker.recordCall throw. Added isDegraded: () => true so the gateway falls through in degraded-mode fail-open — preserves the test's existing axios+cache assertions.

Tests: 13/13 (10 oddsPapi + 3 parlayApi) pass.

PHASE 6 — ntfy alerts at WARN + BLOCK

quotaTracker.sendQuotaAlert(providerCfg, pct, used, limit):

• WARN (≥80%) → priority 4 ("high"), title Warning
• BLOCK (≥95%) → priority 5 ("urgent"), title BLOCKED
• Disabled when NTFY_URL env unset (default in dev)
• Fire-and-forget (.catch(() => {})) so a slow ntfy server can't add latency to the adapter's HTTP call
• ntfy POST failure → console.warn only; recordCall still returns the normal status

Two dedupe keys per period:

• quota_warned:{provider}:{period} — WARN sentinel
• quota_warned:{provider}:{period}:block — BLOCK sentinel

This handles the WARN→BLOCK transition correctly: a provider that jumps from 79% → 96% in one call fires the BLOCK alert even though the WARN sentinel was never set. Without the separate key, the operator wouldn't get the BLOCK notice (the actionable one).

6 new tests cover: no-post when NTFY_URL unset, priority 4 at 80%, priority 5 at 95%, dedupe (3 calls → 1 alert), WARN→BLOCK transition fires BOTH alerts, axios.post failure preserves recordCall return.

PHASE 7 — End-to-end gateway wiring test

tests/integration/providerGatewayWiring.test.js — 4 tests through the Tank01 NBA adapter (chosen because its fetchWithCache has no token-bucket/circuit-breaker; the gateway behavior dominates):

1. Successful adapter call → tank01 counter goes 0 → 1
2. Cache hit → no HTTP, counter stays
3. Counter seeded to 95% via syncFromHeaders → adapter returns null (cache miss + no stale = degrade to null); axios.get NEVER called
4. axios throws → gateway rolls back the optimistic increment; counter restored to pre-call value

Honest scope flags

• No new ODDSPAPI/ParlayAPI live-props adapter. The spec asked for one; reality is they don't serve live props. Built documentation in the registry instead.
• No "provider-aware callback architecture" abstraction (Phase 2 of the spec). Each adapter is already provider-aware (it knows its URL, key, auth) — adding a meta-adapter that switches between them per-call is premature without a real fallback chain. Worth revisiting if/when a true live-odds alternative provider is onboarded.
• The "documentation" phase wasn't applied to a separate playbook file (none exists at the repo root); the corrections
  • per-provider wiring rationale live in the adapter files and this BUILD-STATE entry, which is the closest the repo has to a playbook.

Battery

• Express suite: 115 passed / 1486 tests (+10 over baseline 1476). Breakdown of new tests:
  • 6 ntfy in quotaTracker.test.js
  • 4 in providerGatewayWiring.test.js (new file)
• Web build: clean, no TS errors. Admin route still resolves.

Files changed (Session 21)

Created:

• tests/integration/providerGatewayWiring.test.js

Modified:

• src/config/providers.js — capability corrections for oddspapi + parlayapi
• src/services/quotaTracker.js — sendQuotaAlert + WARN/BLOCK dedupe key split
• src/services/adapters/tank01NbaAdapter.js — gateway wrap
• src/services/adapters/tank01MlbAdapter.js — gateway wrap
• src/services/adapters/apiFootballAdapter.js — gateway wrap
• src/services/adapters/footballDataAdapter.js — gateway wrap
• src/services/adapters/oddsPapiAdapter.js — gateway wrap
• src/services/adapters/parlayApiAdapter.js — gateway wrap
• tests/unit/quotaTracker.test.js — 6 ntfy tests + axios mock
• tests/unit/parlayApiAdapter.test.js — isDegraded in mock

Provider wiring status (after Session 21)

Provider	Gateway-wired	Capability	Quota visible
the-odds-api	✅ (Session 20)	odds/props	✅
Tank01 NBA+MLB	✅	box_scores	✅
API-Football	✅	lineups/stats	✅
Football-Data	✅	fixtures/tables	✅
ODDSPAPI	✅	closing_lines	✅
ParlayAPI	✅	historical	✅

Every external HTTP call from the app now flows through gateway.fetch(). The admin dashboard's Provider quotas tile shows real numbers for every one of them.

---

Session 20 (2026-06-12) — SHIPPED

Built the data-pipeline backbone: a per-provider quota tracker, a unified gateway that routes through fallback providers when one approaches its limit, and structural visibility into all of it via the admin dashboard. This is the infrastructure that prevents the "odds-api at 0/500 → all sports 503" incident from happening again.

PHASE 1 — Provider registry

src/config/providers.js enumerates the six providers VYNDR talks to (the-odds-api, ODDSPAPI, ParlayAPI, Tank01, API-Football, Football-Data.org). Each entry declares envKey, quotaType (monthly|daily|per_minute), quotaLimit, sports, capabilities, and priority. Exports getProvider, listProviderIds, getConfiguredProviders, getFallbackChain(capability, sport, excludeId). Thresholds (WARN 80%, BLOCK 95%) live in the same module so the tracker and gateway can't drift.

src/server.js now logs which providers have keys at boot: [VYNDR] providers configured (4): odds-api, tank01, api-football, football-data and warns about any with missing keys.

PHASE 2 — Quota tracker

src/services/quotaTracker.js is the Redis-backed counter. Keys:

• quota:{provider}:{period} → {used, limit, syncedAt}
• quota_warned:{provider}:{period} → dedupe the 80% log line

Period format is quota-type-driven: YYYY-MM for monthly, YYYY-MM-DD for daily, YYYY-MM-DDTHH:MM for per-minute. UTC so operators in different timezones see one consistent picture.

API:

• getQuotaStatus(provider) — read without mutation
• recordCall(provider) — increment + return new status
• rollback(provider) — decrement after a failed call
• syncFromHeaders(provider, headers) — truth-source override from upstream response headers (odds-api returns x-requests-used + x-requests-remaining)
• getAllQuotaStatuses() — snapshot for the dashboard
• getTickInterval(pct) — scheduler step function (<50% → 5min, <80% → 15min, <95% → 30min, ≥95% → null)
• shouldThrottle(provider) — composite for schedulers

Degraded mode — when Redis is down, the tracker fails OPEN (allowed: true, degraded: true) rather than closed. The alternative (degrade closed) would mean a Redis blip blocks every provider call platform-wide, which is worse than the original quota-exhaustion bug.

21 unit tests cover period keys, recordCall counting, syncFromHeaders truth-source override, the 80% warning dedupe, threshold flips, rollback, getTickInterval steps, and degraded-mode fail-open.

PHASE 3 — Provider gateway

src/services/providerGateway.js is the single entry point every external-data call passes through:

const result = await gateway.fetch('odds-api', cb, {
  capability: 'odds',
  sport: 'nba',
  fallbackProviders: ['oddspapi'],  // optional
  syncHeadersFrom: (r) => r.headers,  // optional
});

Flow: check quota → invoke callback → on quota block, walk the fallback chain (explicit or capability-derived) → on full exhaustion throw QuotaExhaustedError with the attempt log so operators can see what was tried. The callback receives the provider ID it's running under so adapter code can pick the right base URL / API key per fallback.

Critical safety property: only QUOTA failures trigger fallover. A generic upstream error (network blip, 502) propagates from the primary instead of silently shifting the whole platform to the fallback. That mask was the symptom that hid the original outage.

Wired into oddsService.fetchEventsFromApi + fetchEventOddsFromApi. The gateway's syncHeadersFrom callback pumps x-requests-used / x-requests-remaining straight into the tracker on every successful odds-api response.

8 unit tests cover happy path, single-fallback walk, multi-fallback skip, explicit chain override, full exhaustion, adapter-error propagation, and header sync invocation.

PHASE 4 — Scheduler hooks

getTickInterval(pct) exposed for any future polling code. Wired into poller/soccer.js — each tick checks quotaTracker.shouldThrottle('football-data') and skips if quota is exhausted (logs tick skipped — football-data quota exhausted).

Honest scope flag: the NBA/WNBA/MLB pollers hit ESPN scoreboards (no quota), so they don't need wiring. The spec implied a generic poller that hits odds-api on a schedule; that poller doesn't exist — odds-api is on-demand-cached at 15min in oddsService. The gateway + recordCall on every odds-api call gives the same effect (per-call quota enforcement) without a separate scheduler.

PHASE 5 — Admin integration

GET /api/internal/quota added to src/routes/internal.js. Uses the existing requireInternalAuth({loopbackOnly:false}) gate so the Next.js admin route proxies through with the shared key.

web/src/app/api/admin/stats/route.ts now also fetches the quota snapshot (best-effort, 4s timeout, surfaces missing-key as a note instead of blanking the dashboard).

web/src/app/admin/page.tsx renders a Provider quotas table: provider name + period, used/limit + usage bar, quota type (monthly|daily|/min), status indicator (✅ 18%, ⚠️ 82%, ❌ BLOCKED 97%). Bar color tracks the threshold (green < 80, yellow 80-95, red ≥ 95). Table hides when no providers reported.

3 new integration tests on the /quota endpoint: rejects without internal key, returns snapshot when keyed, returns 500 on tracker error.

PHASE 6 — Header sync into tracker

oddsService.updateQuota now also lazily-requires the tracker and calls syncFromHeaders('odds-api', headers) so the new counter stays current alongside the legacy hash-based quota in Redis. The gateway's syncHeadersFrom already does this on each call — the updateQuota hook is belt-and-suspenders for any call path that bypasses the gateway in the future.

Honest scope flags

• Only oddsService is wired through the gateway. Tank01, API-Football, and Football-Data adapters still call axios directly. They can be migrated by wrapping their existing axios calls in gateway.fetch(<providerId>, () => axios.get(...), { capability, sport }) — no upstream contract change. Holding off this session to avoid blast radius on stable adapter code; the gateway + tracker stand alone and are ready when needed.
• The Provider Quotas tile renders only the providers whose keys are present on the Express side. If a key is set in prod but unset locally, the local admin view will look thinner than prod — by design.
• "Smart scheduler" is wired only for the soccer poller (the one poller that does hit a quota'd provider). The other PM2 pollers don't need it.

Battery

• Express suite: 114 passed / 1476 tests (+32 over baseline 1444; 21 quotaTracker + 8 providerGateway + 3 /quota integration). Two pre-existing test files needed their redis mocks extended with cacheGet/cacheSet/isDegraded for the gateway path; degraded-mode fail-open preserves their axios-driven assertions.
• Web build: clean — /admin + /api/admin/stats register as dynamic; no TS errors.

Files changed (Session 20)

Created:

• src/config/providers.js
• src/services/quotaTracker.js
• src/services/providerGateway.js
• tests/unit/quotaTracker.test.js
• tests/unit/providerGateway.test.js

Modified:

• src/services/oddsService.js — gateway wrap + tracker sync
• src/routes/internal.js — /api/internal/quota endpoint
• src/server.js — startup provider log
• poller/soccer.js — quota-aware tick
• tests/unit/oddsService.test.js — mock extension
• tests/integration/odds.test.js — mock extension
• tests/integration/internalRoutes.test.js — /quota coverage
• web/src/app/api/admin/stats/route.ts — provider_quotas tile
• web/src/app/admin/page.tsx — Provider quotas table

---

Session 19 (2026-06-12) — SHIPPED

The platform had every backend piece in place but read like a spreadsheet. Same player name listed four times in a row, blank scan page, generic game headers. This session restructured the visual hierarchy so the player is the hero of every card.

PHASE 1 — NBA proxy diagnosis

User reported "/api/odds/nba returns 503 while Express has live data." Trace: NBA and WNBA proxies are byte-identical in shape. Probe of production confirmed all three sports (NBA, WNBA, MLB) return 503 with the same payload — root cause is upstream of the proxy. The Express oddsService.getOdds 503 path fires when odds-api fails AND no Redis cache exists.

Likely production cause: ODDS_API_KEY rotation, quota exhaustion, or Redis disconnect (cache always empty so every request goes live, then fails). Not fixable from code without env access.

Code change: added a console.error line at the 503 fallthrough that surfaces upstream status + axios error code + truncated upstream body. Next time someone gets paged with a 503, the log gives them the answer instead of "Odds service unavailable."

Test: pinned the log shape (upstream_status=, sport name, body substring) so a future log-cleanup PR can't silently delete it.

PHASE 2 — PlayerCard + headshot utility

web/src/lib/playerHeadshot.ts exposes getHeadshotUrl({sport, playerId, espnId, cachedPhotoUrl}) with fallback chain:

• cached photo URL → league CDN → ESPN CDN → silhouette
• League CDNs: cdn.nba.com/headshots/nba/latest/260x190/{id}.png, cdn.wnba.com/headshots/wnba/..., img.mlbstatic.com/mlb-photos/...
• ESPN CDN used ONLY when no league ID and espnId present
• Soccer doesn't get a synthetic URL — API-Football's photo field is cached separately and passed as cachedPhotoUrl

web/public/images/player-silhouette.svg — 64x64 generic silhouette, dark-theme colors.

web/src/components/PlayerCard.tsx — new component. Header (headshot + name + team) over N PropRow children. <img onError> falls back to the silhouette so a CDN 404 doesn't leave a broken image. Exports groupPropsByPlayer(props) helper.

web/src/components/GameCard.tsx updated:

• Imports PlayerCard + groupPropsByPlayer
• Visibility budget (defaultVisible=4) now applies to PLAYERS, not raw props — previously a single player with 4+ props consumed the whole budget and other players were hidden
• "+ N more prop(s)" → "+ N more player(s)"

PHASE 3 — Game card header redesign

teamAbbr(fullName, sport) exported from GameCard:

• Override table for 30+ well-known multi-word names (Los Angeles Lakers → LAL, St. Louis Cardinals → STL, etc.)
• Two-word names fall back to the first word's 3 letters
• Soccer composes initials when 2+ words, else truncates

Header now shows: 🏀 BOS vs DEN [NBA] in bold mono, with the sport label on a colored badge to the right. Below: full names in muted text + time/venue meta line. Sport colors:

• NBA #E94B3C · WNBA #FFB347 · MLB #1E90FF · Soccer #00D4A0

PHASE 4 — Scan page tonight's players

New "TONIGHT'S PLAYERS" chip grid above the search input, pulled from /api/odds/{sport} (the canonical list of players who have props posted today — same source The Slate uses). Each chip: 24×24 headshot + name. Click prefills the player and, when only ONE stat type has props for that player, prefills the stat too.

Section auto-hides when the array is empty (off-season, odds-api down, etc.) — no sad "couldn't load tonight's players" stripe.

Search dropdown enhanced: every suggestion now has a 28×28 headshot. Falls back to silhouette via onError for players the CDN doesn't have yet.

PHASE 5 — CSP img-src expanded

web/next.config.ts — img-src now includes cdn.wnba.com and img.mlbstatic.com. Was cdn.nba.com + a.espncdn.com.

PHASE 6 — Tier-gate utility (wired in Session 20)

web/src/lib/tierGate.ts — exports canSeeFullLists(tier), canSeeGradeDetails(tier), getVisibleCount(tier, totalCount), getHiddenCount(tier, totalCount). Free users see top 3; africa, analyst, desk see everything. Free + africa see grade letters but NOT detailed grade breakdowns (analyst+ only).

Not consumed yet — exported for the streaks/hot-lists work planned in Session 20.

Honest scope flags

• I did not run the actual UI in a browser. The web build is clean, types resolve, and the Slate's data flow is intact, but I can't verify the visual end state without a live render.
• Headshot CDNs will 404 for some players (rookies the league hasn't shot yet, traded players whose league ID we haven't re-mapped). The onError fallback prevents broken images, but expect ~5–15% silhouette rate on coverage.
• The NBA proxy 503 is NOT fixed in code. The diagnostic log helps the next operator pinpoint the root cause; the fix itself needs env config access.

Battery

• Express suite: 112 passed / 1444 tests (+1 — odds service diagnostic log test; baseline 1443)
• Web build: clean — all new routes register, no TS errors, no ESLint failures
• All new TypeScript modules tree-shake into existing pages

Files changed (Session 19)

Created:

• web/src/lib/playerHeadshot.ts
• web/src/lib/tierGate.ts
• web/src/components/PlayerCard.tsx
• web/public/images/player-silhouette.svg

Modified:

• src/services/oddsService.js — diagnostic log at 503 path
• tests/unit/oddsService.test.js — pinned log shape
• web/src/components/GameCard.tsx — PlayerCard integration + teamAbbr + sport-colored header
• web/src/app/scan/page.tsx — tonight's players chip grid + headshot-enriched search suggestions
• web/next.config.ts — CSP img-src for cdn.wnba.com + img.mlbstatic.com

---

Session 18 (2026-06-11) — SHIPPED

Built an operator-facing admin dashboard at /admin so Kev can pull the three numbers he needs every morning (total users, paying users, grades today) without dropping into psql. Added the missing HTTP surface for the Tank01 prefetch script so it can be triggered from the dashboard (or any internally-keyed caller) instead of only from a host shell.

Section 1 — Admin allowlist + UI guard

web/src/lib/isAdmin.ts exposes isAdmin(email) over a hard-coded allowlist (kevdevelops@gmail.com). Case-insensitive on input; trims whitespace. Trivial by design — the security boundary is the server check, not this helper.

web/src/app/admin/page.tsx is a client component that uses useAuth() and isAdmin() to redirect non-admins to /dashboard. This is UX-only — anyone with devtools can flip the boolean. The real check is on the API route.

Section 2 — Stats API with server-side admin check

web/src/app/api/admin/stats/route.ts (force-dynamic, no-store) validates the bearer token via getUserFromRequest, then asserts isAdmin(user.email) before any data leaves Supabase. Non-admin tokens get 403 (not 401 / redirect) so the route's existence doesn't leak. Service-role queries are wrapped in Promise.allSettled so one failed aggregate doesn't blank the dashboard — the notes[] field surfaces partial failures inline.

Aggregates returned: total users, tier breakdown (free|africa|analyst|desk), last-24h signups (max 20, emails masked as j***@gmail.com), all-time grade count, today's grade count, per-sport odds health (NBA/WNBA/MLB/soccer-wc), shared odds-api quota remaining.

Spec assumed table grading_log; actual table is grade_history. The route queries the real table.

Health probes share a 4-second AbortController budget so a stalled upstream can't block the page.

Section 3 — Dashboard UI

Key-metrics row → tier breakdown with proportional bars → recent signups table → system-health table. Mono numbers, VYNDR dark tokens (--bg-surface, --grade-a, --grade-d, --text-tertiary). Not linked from nav — operator bookmarks the URL.

Section 5 — Tank01 prefetch HTTP endpoint

src/routes/internal.js mounts at /api/internal/prefetch/tank01, gated by requireInternalAuth({loopbackOnly:false}). Accepts JSON {max?, sports?, dryRun?} and translates it into argv for the existing scripts/tank01-prefetch.js module's exported main().

Deviation from spec: spec suggested execSync('node scripts/...'). We import the module instead — testable in-process, no PATH dependency, no permission-shell stack. Module already supports the exact CLI flags so the body shape stays the same.

Wired through src/app.js (app.use('/api/internal', internalRoutes)). The shared VYNDR_INTERNAL_KEY is set in Coolify; the Next.js admin page never sees the key (UI button will proxy through a server route in a follow-up — out-of-scope for Session 18).

Tests

tests/integration/internalRoutes.test.js — 5 new tests:

• rejects without x-internal-key
• translates body into argv (sports list, max, dryRun)
• forwards --dry-run correctly
• accepts string-form sports (single sport)
• returns 500 with the underlying error message on module rejection

All 5 tests pass. Existing 1438 tests untouched.

Battery

• Express suite: 112 passed / 1443 tests (5 new, baseline was 1438)
• Web build: clean — /admin and /api/admin/stats registered as dynamic routes
• TypeScript: clean (initial build flagged a NextResponse-vs-Response mismatch on jsonError returns; relaxed the route's return type to the shared supertype)

What Kev sees now (next session, in a browser)

Visit /admin while signed in as kevdevelops@gmail.com:

• Three big numbers across the top: Total Users / Paying Users / Free Users / Grades Today
• Tier-distribution bars
• Last-24h signups (masked emails, relative timestamps)
• Per-sport health (NBA · ✅ Live · 234 props / WNBA · ⚪ No props / etc.)
• Odds-api quota remaining

Anyone else visiting /admin → soft-redirect to /dashboard. Anyone calling /api/admin/stats without an admin token → 403.

Files changed (Session 18)

Created:

• web/src/lib/isAdmin.ts
• web/src/app/admin/page.tsx
• web/src/app/api/admin/stats/route.ts
• src/routes/internal.js
• tests/integration/internalRoutes.test.js

Modified:

• src/app.js — mount /api/internal router

Pending (out-of-scope for Session 18)

• Wire a "Prefetch Tank01 now" button on the admin page that POSTs through a Next.js server route (so VYNDR_INTERNAL_KEY stays out of the browser).
• Add a real "monthly revenue" tile (requires Stripe-side aggregation; spec said three numbers — we shipped two and added Grades Today as the third operational signal).

---

Session 17 (2026-06-12) — SHIPPED

A platform audit from a signed-in / signed-out walkthrough flagged 12 issues. This session traced each to root cause and shipped fixes. Stripe is live with real products + webhooks; the symptoms audited were code-side, not Stripe-side.

FIX 1 — Checkout 401 "User profile not found" [CRITICAL]

src/middleware/auth.js 401'd authenticated users whose auth.users row had no matching public.users profile. Signup writes to auth.users automatically; the application-side row never landed for SSO callbacks and legacy accounts that pre-dated the trigger.

Fix: when .single() returns PostgREST's PGRST116 ("no rows"), the middleware now upserts a default {id, email, tier:'free'} row and re-reads. Idempotent under concurrent requests. Distinct 401 message (User profile creation failed) when the upsert itself fails — lets the operator separate missing-row recovery from real DB outages in logs. 9 tests cover happy path, missing row → upsert, message-only PGRST116 detection, upsert error, post-upsert empty re-read, and non-PGRST116 errors NOT triggering an upsert.

FIX 2 — Hero prop 404 [CRITICAL]

web/src/app/api/hero-prop/route.ts shipped Session 16 with BOTH dynamic = 'force-dynamic' AND revalidate = 900. Next.js App Router silently 404s on this conflict. Removed revalidate. The 15-minute cache still works via the existing Cache-Control: s-maxage=900 response header.

FIX 3 — WNBA games not surfacing [HIGH]

Slate.tsx's groupByGame skipped every prop because Number.isFinite(r.line) failed on the actual Express response shape. Express's groupProps returns props with lines: [{ book, line, over_odds, under_odds }], but the Slate expected a flat line: number. Every WNBA / NBA / MLB prop was filtered out.

Fix: added a pickLine() unwrapper that prefers the flat r.line when present (legacy callers + test fixtures) and otherwise picks the first numeric line out of r.lines[]. The Slate now correctly surfaces game cards for any sport with a populated lines array.

FIX 4 — ALL tab error cascade [HIGH]

Slate.tsx's cascade surfaced a top-level error whenever ANY single sport rejected — even when the other sports succeeded with empty data. Reworked to track per-sport failures separately and only show the top-level banner when EVERY attempted sport rejected. Failed- but-attempted sports get appended to the existing footer "endpoint not configured" line.

FIX 5 — Cookie consent visibility [HIGH — Legal]

Root cause was visual overlap, not the component's logic: BottomTabBar and CookieConsent both position: fixed; bottom: 0, and BottomTabBar's 64px height visually obscured the banner. Resolved transitively by FIX 7 — anonymous visitors no longer see BottomTabBar, so the cookie banner has the bottom of the viewport to itself on first visit.

FIX 6 — Scan autocomplete silent failure [MEDIUM]

The dropdown logic was correct — the silent failure happened when /api/players/search returned { players: [] } (NBA service down, or no spelling match). Added a visible "no players matched" state when the search has run but returned empty, so users get feedback.

FIX 7 — Mobile bottom nav auth gate [MEDIUM]

BottomTabBar.tsx rendered for all users on all eligible routes. Anonymous visitors on /pricing saw Home/Read/Parlay/Ledger/Profile — all auth-gated destinations that would 401 on click. Gated behind useAuth() with a loading || !user early-return. Also fixed FIX 5 transitively.

FIX 8 — Footer support email + stale copy [LOW]

Added Support link (mailto:support@vyndr.app) to the Legal column. Removed (test mode while we onboard founders) from Pricing.tsx — Stripe is live. Replaced with "First 100 users lock $14.99/mo Analyst for life."

FIX 9 — Sentry zero events [MEDIUM]

Code wiring is correct in both backend (initSentry() + setupExpress ErrorHandler mounted) and frontend (SentryInit reads NEXT_PUBLIC_SENTRY_DSN). Audit found zero events because the DSN env vars aren't set in Coolify. Code-level no-op; documented as a Coolify env action.

FIX 10 — Read counter visibility [LOW]

Quota pill appeared in the global Nav across every page. Restricted to /scan and /dashboard (the surfaces where it acts as quota context next to the scan action) via a pathname check in Nav.tsx.

FIX 11 — Profile page [NO-OP]

Audit reported "no profile page exists." Verified: it does, at web/src/app/profile/page.tsx (196 lines, includes email, tier, subscription_status, subscription_end, founder_pricing, cancel_at_period_end). Audit looked at a stale build.

FIX 12 — Tonight's slate landing preview [MEDIUM]

web/src/components/TonightsSlate.tsx (new) — game-count strip mounted between Hero and LivePropsStrip. Fetches the three sport-odds proxies in parallel, dedupes games by (away, home, time), renders "X NBA · Y WNBA · Z MLB games being graded right now." with a signup CTA. Hides itself when every sport returns zero.

Tests added (Session 17)

Suite	Tests
tests/unit/requireAuth.test.js	9
Session 17 total	9

Quality gates

• npm test: 1438 / 1438 passing (1429 + 9 new), 111 suites, 0 regressions
• web/npm run build: clean — /api/hero-prop now compiles to ƒ (was silently 404'd in production by the conflicting directives)
• License audit: third-party deps remain permissive

Honest verification status

Build + tests verified. I CANNOT verify the following on the live site from here — they need a deploy + re-audit smoke test:

• Checkout 401 ↔ actual Supabase row creation under load
• Hero prop endpoint returning JSON in production
• WNBA Slate tab actually showing games
• Cookie banner visible on first incognito load
• Mobile bottom nav truly absent for signed-out visitors

Coolify follow-ups (operator action)

1. Set SENTRY_DSN and NEXT_PUBLIC_SENTRY_DSN env vars to enable server-side and browser-side error capture. Currently unset → Sentry dashboard sees zero events even when 503/401 errors occur.
2. The Session 16 sport-scoped markets fix is in code; the NODE_OPTIONS=--require /app/data/patch.js workaround can be dropped from the web service env after this deploy.

---

Session 16 (2026-06-11) — SHIPPED

Phase 1 — Sport-specific market map

src/services/oddsService.js now scopes the markets-list parameter to the requested sport. Previously every odds-api request sent ALL_MARKETS (the union of every sport's markets), which the upstream 422'd on because soccer markets (player_goals, player_shots_on_target, etc.) aren't valid for basketball endpoints. Production briefly worked around this with a runtime axios interceptor injected via NODE_OPTIONS=--require /app/data/patch.js.

This session retires that hack at the code layer:

• New SPORT_MARKETS map alongside SPORT_KEYS — separate lists per sport, all frozen with Object.freeze. NBA + NCAAB share basketball markets; WNBA is basketball minus PRA (odds-api doesn't carry that for WNBA); MLB sends batter + pitcher markets; every soccer league shares the soccer set.
• fetchEventOddsFromApi(sportKey, eventId, apiKey, sport) — third arg added; reads getMarketsForSport(sport) instead of the union. Backwards-compatible: omitted sport falls back to NBA (safe default).
• fetchAllOdds(sport, apiKey) — already had the local sport key; now passes it through.

Coolify follow-up: after this deploy, the operator can drop NODE_OPTIONS=--require /app/data/patch.js from the web service env and delete /app/data/patch.js. The runtime patch is now dead code.

Phase 2 — Live hero prop

web/src/app/api/hero-prop/route.ts (new) — picks one fresh real prop from today's NBA → WNBA → MLB cascade and grades it. Two-stage flow: GET /api/odds/{sport} → POST /api/analyze/prop. Both calls share a 6s AbortController timeout. Server-side cached for 15 minutes via Cache-Control: s-maxage=900. Falls back to a static Jokic example (isStatic: true) when every sport is empty so the landing page never blanks out.

web/src/components/LiveHeroProp.tsx (new) — replaces the hard-coded FloatingDemoCard inside Hero.tsx. Renders the live prop with:

• "LIVE" badge with a pulsing green dot
• Sport-colored category tag (NBA red, WNBA orange, MLB blue, soccer green)
• Player name + line + projection + edge visible (hook)
• Grade letter + confidence visible via GradePill (proof)
• Reasoning section blurred with backdrop blur(4px), a scan-line gradient (repeating-linear-gradient), a bottom-fade mask, and a "CLASSIFIED · Sign up to unlock" label (paywall)
• Single CTA: "Sign up to read the full analysis →"

While loading OR when the API returns isStatic: true, renders the original Jokic mockup byte-for-byte. No flash-of-blank-card.

Hero.tsx — old FloatingDemoCard, Stat, and row constant deleted. GradePill import moved into LiveHeroProp.

Phase 3 — Soccer weather

soccerFeatureExtractor.js now calls weatherService.getWeather() for outdoor WC venues after resolving the venue. Dome venues skip the fetch. Unknown venues skip silently. New feature fields: weather_temp_f, weather_wind_mph, weather_wind_dir, weather_precip_mm. All null when skipped/failed.

Phase 4/5 — OG tags + CSP (mostly already done)

OG meta + Twitter card + og-image.png were all wired in Session 9. Existing CSP in next.config.ts was comprehensive. Session 16 added:

• https://browser.sentry-cdn.com to script-src (Sentry SDK)
• https://*.sentry.io and https://*.ingest.sentry.io to connect-src (event ingestion). Without these the browser Sentry client silently dropped events.

Tests added (Session 16)

Suite	Tests
tests/unit/sportMarkets.test.js	16
tests/unit/soccerWeather.test.js	7
Session 16 total	23

Quality gates

• npm test: 1429 / 1429 passing (1405 + 24), 110 suites, 0 regressions
• web/npm run build: clean
• License audit: third-party deps remain permissive

Honest gaps

• LiveHeroProp's glitch effect (scan lines + blur + fade) renders only in a browser. Build verified. Deploy smoke-test recommended.
• Hero endpoint depends on /api/odds/{sport} returning populated props. If upstream odds-api is rate-limited or proxies aren't reaching Express, the static fallback fires — cold visitors see the Jokic mockup, not live data.
• Sentry CSP entries added but require redeploy to take effect. Until then, the browser SDK silently drops events.

Coolify follow-ups

1. Drop the patch.js workaround: remove NODE_OPTIONS=--require /app/data/patch.js from the web service env. Code-layer fix in Session 16 makes the runtime patch obsolete.

---

Session 15 (2026-06-11) — SHIPPED

Phase 0 — Correctness

• Africa short-circuit removed (Pricing.tsx:152). The Session 14 backend handles 'africa' end-to-end: validation accepts it; missing STRIPE_PRICE_AFRICA returns a 503 with code:'tier_unconfigured' the existing inline error surface displays. The frontend short- circuit was blocking checkout even after the backend was ready.
• Odds + Sentry + welcome email audits: all already correct from prior sessions. Documented for posterity; no fixes required.
• Poller → odds pipeline: confirmed there's NO key-mismatch pipeline issue. Pollers handle game resolution (game:{id}:status, poller:{SPORT}:heartbeat); oddsService populates odds:{sport}:{date} on-demand. The "1 games shown but Slate empty" report would be a separate odds-api quota / key issue.
• Founder price fallback hardened. PRICE_MAP no longer falls back to fake strings like 'price_analyst_monthly' that would 400 from Stripe in live mode. Missing env → PRICE_UNCONFIGURED sentinel → 503 with code:'tier_unconfigured'. Founder codes presented against an unwired founder-price env now fall back GRACEFULLY to the standard tier price rather than dropping the checkout — the founder discount is operator-controlled and shouldn't break the user's purchase.

Phase 1 — Signal audit

Documented in a new comment block at the top of src/services/intelligence/computeFeatures.js. Every signal cited to its data source: injury (ESPN injury feed), coach (Supabase coach_profiles + JSON seed), consistency (game logs via gameLogService), Tank01 fields (Session 14 + 15 prefetch), soccer cascade (Session 9), park factors (Session 15 — static), weather (Session 15 — Open-Meteo), pace factors (Session 15 — static). No phantom signals.

Phase 2 — MLB park factors

src/data/parkFactors.js — all 30 MLB parks indexed to 100 league average. FanGraphs 2024-25 three-year weighted data. Coors at hr=128, SF Oracle at hr=85 (the two extremes by design). getParkFactor() returns null on unknown teams so the feature extractor drops the signal cleanly rather than falsely reporting "neutral".

Wired into computeFeatures.js MLB branch — features pick up park_hr, park_h, park_r, park_home when the home team resolves.

Phase 3 — Weather (Open-Meteo)

src/services/weatherService.js — Open-Meteo proxy (no API key required). 5-second hard timeout, 1-hour Redis cache, silent degrade on failure (never blocks the grade). Fahrenheit + mph units to match the bettors' mental model.

src/data/venueCoordinates.js — lat/lon + dome flag for all 30 MLB venues and all 16 World Cup 2026 venues. Retractable stadiums are marked dome:true because operators close the roof when conditions warrant — weather doesn't drive grade in that case.

Wired into computeFeatures.js MLB branch — fetches weather when the home venue is outdoor + has finite coordinates.

Phase 4 — Tank01 daily prefetch

scripts/tank01-prefetch.js — orchestrator that pulls the Redis cache keys Session 14's tank01Augment.js reads. Default budget ≤80 requests/run, configurable via --max=N. NBA path pulls schedule + final-game box scores + daily odds. MLB path pulls scoreboard + final-game box scores (BvP pull awaits batter/pitcher ID resolution on the scoreboard payload).

Recommended trigger: extend the n8n "Morning Ops" workflow to exec the script daily at 7am UTC.

Phase 5 — MLB matchup context

src/services/intelligence/mlbContext.js — pure functions for platoonAdvantage(pitcherHand, batterHand) and projectedPA(lineupPosition). Tested with all hand combinations + all lineup slots. Wiring into computeFeatures is deferred until odds-api carries those fields (it doesn't today).

Phase 6 — NBA pace factors

src/data/paceFactors.js — all 30 NBA teams (NBA.com/stats 2024-25, indexed to 100). Legacy-abbreviation aliases (NJN→BKN, NOH→NOP, SEA→OKC, CHO→CHA) so historical lookups resolve. Wired into the NBA branch of computeFeatures.js — pace_factor (player's team) + opp_pace_factor (opponent).

Tests added (Session 15)

Suite	Tests
tests/unit/parkFactors.test.js	14
tests/unit/weatherService.test.js	14
tests/unit/tank01Prefetch.test.js	14
tests/unit/mlbContext.test.js	21
tests/unit/paceFactors.test.js	12
Session 15 total	75

Quality gates

• npm test: 1405 / 1405 passing (1330 + 75 new), 108 suites, 0 regressions. One pre-existing computeFeatures test was updated: the contract used to be "ESPN failure → empty features"; the contract is now "ESPN failure → static context augmentation (pace, park) still surfaces."
• web/npm run build: clean
• License audit: third-party deps remain permissive

Honest gaps

• Tank01 prefetch must be triggered by n8n/cron before the augmentor reads return data. Grades work as before until then.
• BvP pull is no-op until probable-pitcher IDs land on the Tank01 MLB scoreboard projection.
• Phase 5 helpers tested but not wired — odds-api doesn't carry batter handedness or lineup position fields today.
• Weather for soccer venues: only MLB is wired this session. Soccer venue weather is a 5-line follow-up in the soccer extractor.

Coolify env (Session 15 additions)

None new from this session.

---

Session 14 (2026-06-11) — SHIPPED

Phase 1 — Africa tier checkout

• src/services/stripeService.js — PRICE_MAP.africa added (reads STRIPE_PRICE_AFRICA, null when unset). getPriceId('africa') returns the new PRICE_UNCONFIGURED sentinel when the env var isn't set. createCheckoutSession translates the sentinel to a 503 with code: 'tier_unconfigured' so the frontend can render a helpful message instead of a generic failure.
• src/routes/stripe.js — validation whitelist extended: ['africa', 'analyst', 'desk']. The catch block recognizes err.code === 'tier_unconfigured' and surfaces it cleanly.
• Tests: +6 (3 integration around /api/stripe/checkout for the africa tier, 3 unit around getPriceId('africa') and the exported sentinel).
• DB CHECK constraint blocker from Session 12 still applies — Stripe webhook writes of tier='africa' to users.tier / user_profiles.tier will 23514 until the manual SQL drops + re- adds the constraint with 'africa' included. Validation-layer fix is in place; the migration is the next step.

Phase 2 + 3 — Tank01 NBA + MLB wired into computeFeatures

Architectural choice: cache-read path only on the user request path. The Tank01 adapters (Session 9) already wrap their primitives behind Redis with TTL'd tank01:* keys. The new src/services/intelligence/tank01Augment.js reads those keys directly without ever calling RapidAPI — that keeps the user request path off the 1000/mo free-tier budget. A daily prefetch (future session) will populate the keys; until then the augmentor returns empty objects and the existing ESPN-derived features stand alone.

• augmentNbaFeatures({gameId, playerName, ymd}) reads tank01:nba:boxscore:{gameId} and tank01:nba:odds:{ymd}, surfaces t01_pts/reb/ast/threes/blk/stl/tov/minutes/_final for the named player when present, plus a t01_market_present marker when daily odds are cached.
• augmentMlbFeatures({gameId, batterName, batterId, pitcherId, pitcherName, ymd}) reads tank01:mlb:bvp:{batterId}:{pitcherId} and surfaces BvP signals (t01_bvp_pa/ab/h/hr/so + derived t01_bvp_so_rate). Best-effort fallbacks: name-only markers when IDs are absent (future ID resolution), daily-scoreboard presence marker when pitcher is unknown.
• computeFeatures.js calls both augmentors after safeGetFeatures and merges the result with Object.assign. Wrapped in try/catch so a Redis hiccup never poisons a grade.
• Tests: 13 new in tests/unit/tank01Augment.test.js. Existing computeFeatures + soccerBranch suites still green (no regressions).

Phase 4 — WNBA + MLB odds proxies

• oddsService.SPORT_KEYS — added wnba: 'basketball_wnba' and mlb: 'baseball_mlb'. Off-season odds-api responses return empty arrays which the Slate handles cleanly.
• src/routes/odds.js — new buildSportRoute() factory drives /api/odds/wnba and /api/odds/mlb (clones of the existing /api/odds/nba handler).
• Next.js proxies: web/src/app/api/odds/{nba,wnba,mlb}/route.ts (the NBA one was also missing — Slate had been pointing at a non-existent route).
• Slate.tsx FETCH_URLS — WNBA + MLB no longer flagged as unsupported. ALL tab fans out to all four sports via Promise.allSettled.

Phase 5 — UX polish

• web/src/components/OAuthIcons.tsx — inline SVGs for Google G, Apple silhouette, X glyph. ~1 KB each, no icon library import.
• Login + signup pages wire icons into the OAuth buttons with a shared layout helper.
• Slate loading state — bare "Loading the slate…" text replaced with three shimmer-skeleton placeholder cards approximating GameCard dimensions. @keyframes vyndr-shimmer added to globals.css so other loading surfaces can reuse the animation.
• Empty state messaging — the Slate's empty-result case already shows a "Scan it manually →" CTA from Session 13; Session 14 preserves that path.
• Mobile nav — added a subtle "Scan manually →" tertiary link in the mobile hamburger panel. The desktop nav stays clean (the Slate IS the scan surface there).

Tests added (Session 14)

Suite	Tests
tests/unit/tank01Augment.test.js	13
tests/integration/stripe.test.js extended (Africa checkout)	+3
tests/unit/stripeService.test.js extended (Africa getPriceId)	+3
Session 14 total	19

Quality gates

• npm test: 1330 / 1330 passing (1311 + 19), 103 suites, 0 regressions
• web/npm run build: clean — all four odds proxies prerender
• License audit: third-party deps remain permissive

Honest gaps

• Tank01 cache keys are not yet populated by any prefetch — the augmentor wiring is in place but reads will miss until a daily prefetch script lands. The augmentor returns {} on miss, so grades work exactly as before until the keys populate.
• Africa-tier writes to users.tier will still 23514 (CHECK violation) post-checkout. The DB constraint migration remains a manual SQL step from Session 12.
• STRIPE_PRICE_AFRICA env var is not set in Coolify yet. Until it is, /api/stripe/checkout returns 503 with code: 'tier_unconfigured' for tier:'africa'.
• WNBA odds: odds-api may not always carry props during off-season. Slate degrades cleanly (empty props array + empty state UX).
• OAuth: Google works (if Supabase Site URL + Redirect URLs are configured). Apple + X buttons render with their icons but the redirect won't succeed until provider configuration lands in the Supabase dashboard (Apple Developer Service ID + key; X OAuth 2.0 client).

Coolify env (Session 14 additions)

# New, required to unblock Africa checkout end-to-end:
STRIPE_PRICE_AFRICA=price_...   # After creating the product in Stripe dashboard

---

Session 13 (2026-06-11) — SHIPPED

Phase 1 — Africa geo-restriction via CF-IPCountry

The Session 12 Africa tier was visible to anyone on a Swahili locale (too narrow: most African users browse in English/French; too broad: Swahili speakers anywhere got the discount). Session 13 swaps the locale proxy for real Cloudflare IP geolocation.

• web/middleware.ts — reads cf-ipcountry (uppercase), stamps x-vyndr-country on the request alongside the locale header. Empty string when traffic bypasses Cloudflare (local dev).
• web/src/lib/locales.ts — AFRICAN_COUNTRIES set covering all 54 sovereign African nations (NG/KE/ZA/GH + sub-Saharan + MENA overlap). isAfricanCountry(code) is case-insensitive and degrades closed on empty/null inputs.
• LocaleContext — extended with country/inAfrica fields; new useRegion() hook for components that gate by geography.
• Pricing.tsx — inAfrica === false filters the Africa tier out of the render entirely. inAfrica === true puts it first. Locale-based reorder removed.
• Pricing grid CSS — desktop column count now tracks the visible tier count via a --pricing-cols CSS custom property on the grid root (3 outside Africa, 4 inside). Sidesteps a styled-jsx limitation with attribute selectors inside :global().

Phase 2 — OAuth: Google + Apple + X

• AuthContext — added generic signInWithProvider(provider) alongside the legacy signInWithGoogle() (kept as an alias so existing callers don't break). Translates Supabase OAuth errors into a flat { error: string } so the UI can surface a friendly inline message when a provider isn't configured.
• login/page.tsx + signup/page.tsx — both pages now render three OAuth buttons (Google, Apple, X). The handleOAuth helper routes to signInWithProvider and shows an inline error when the provider isn't configured ("apple login isn't available yet. Use email or another method.").
• External configuration required (operator action, not code):
  • Supabase Auth → Providers → Apple: needs an Apple Developer Service ID + private key
  • Supabase Auth → Providers → Twitter: needs an X Developer OAuth 2.0 client
  • Google should already work — if it doesn't, verify Supabase Auth → URL Configuration → Site URL = https://vyndr.app and Redirect URLs include https://vyndr.app/**, and that the Google Cloud Console OAuth consent screen has the Supabase callback URL in Authorized redirect URIs.

Phase 3 — The Slate (browse-first dashboard)

Generalizes the Session 8 /soccer page pattern across every sport.

• web/src/components/PropRow.tsx — single-prop UI with three states (ungraded/grading/graded). Pure presentational — parent owns the API call so there's one shared rate-limited grading queue. Free-tier expansion shows blurred reasoning + Unlock CTA; paid tier shows full reasoning + kill conditions. Exports propRowKey() for stable Map keys.
• web/src/components/GameCard.tsx — game header + expandable prop list. Sport emoji prefix (🏀 NBA/WNBA, ⚾ MLB, ⚽ soccer), sport-accented left border, formatted local game time, + N more expander when props > defaultVisible.
• web/src/components/Slate.tsx — the orchestrator. Sport tabs (ALL / NBA / WNBA / MLB / Soccer), sticky search input, group-by-game pipeline, gradedProps Map, single-flight grading queue (gradingKey). Promise.allSettled fan-out for the ALL tab so a single sport failing doesn't blank the slate. FETCH_URLS is null-aware — sports without an odds proxy yet (WNBA, MLB) render a bottom-of-page "endpoint not configured yet" note rather than spamming 404s.
• Search filter + manual-scan fallback — sticky search filters game cards by team name and prop rows by player/stat. Empty result shows a CTA linking to /scan?q=<query> so users land on a partially-filled scan form.
• /dashboard — <Slate /> mounted as the lead surface above the existing Top Graded / Most Parlayed / Recent Reads sections. Those sections stay as supplementary intelligence layers — not removed.
• Nav.tsx — "Scan" link removed from primary nav. The Slate is the scan surface; /scan stays reachable from the slate's empty-state CTA.

Tests added

Suite	Tests
tests/unit/africaCountries.test.js	6
Session 13 total	6

Quality gates

• npm test: 1311 / 1311 passing (1305 + 6 new), 102 suites, 0 regressions
• web/npm run build: clean — Slate page + components prerender
• License audit: third-party deps remain permissive

Honest gaps (documented, not bugs)

• I could not visually verify The Slate in a browser. Build/type correctness is confirmed; "renders correctly with live odds data" needs a deploy smoke test.
• Google/Apple/X OAuth: button wiring is complete. Whether the buttons actually authenticate depends on external dashboard configuration (Supabase + Google Cloud Console + Apple Developer + X Developer Portal). Apple and X are guaranteed to show the "isn't available yet" inline error until configured.
• WNBA + MLB don't have /api/odds/* proxies on the Next.js side yet. The Slate degrades cleanly (footer note), but those tabs return empty until the proxies exist. Session-14 work.
• Africa tier still can't be SOLD even when geo gates open it — the Stripe price + the DB CHECK migration remain outstanding from Session 12.

Coolify env (Session 13 additions)

None. CF-IPCountry is set by Cloudflare automatically; no env-var change required.

---

Session 12 (2026-06-11) — SHIPPED

FIX 1 — i18n infrastructure (10 languages, cookie-based)

Honest scope decision: skipped the full [locale]/ URL-prefix refactor (would have touched all 24+ pages). Went cookie-based + header-stamping middleware instead — same UX, much smaller blast radius. URL-prefix routing can layer on later without breaking anything.

• web/src/lib/locales.ts — locale registry. 10 locales: en (source), es, fr, pt, ar (RTL), sw, hi, ja, ko, zh. LOCALE_META carries native names + dir + region. AFRICA_LOCALES = {sw} used by the pricing reorder logic.
• web/src/middleware.ts — locale resolver. Priority: URL prefix → NEXT_LOCALE cookie → Accept-Language parsing → default 'en'. Stamps x-vyndr-locale on the request so server components can read it via next/headers.
• web/src/locales/{en,es,fr,pt,ar,sw,hi,ja,ko,zh}.json — 10 translation dictionaries, each ~17 keys covering nav, slate, grade, pricing, sports, auth, common, cookie. Every file declares its _meta.review_status: en is source, the other 9 are translated_unreviewed. Sports terminology is locale-correct (Fútbol/Football/サッカー/كرة القدم/Soka, etc.).
• web/src/lib/i18n.ts — synchronous server-side loader (getTranslations(locale) → {t, locale, dir}) plus getServerTranslations() which reads the middleware-stamped header. English fallback per key, falls to the key string itself when missing on both. {name} interpolation supported.
• web/src/contexts/LocaleContext.tsx — client provider + useT() / useLocale() hooks. Mounted in the root layout above every other provider.
• RTL — <html dir="rtl"> set in root layout when locale is Arabic. globals.css flips nav direction and isolates monospace blocks (numbers stay LTR — financial data convention).
• LocaleSwitcher.tsx — compact mono dropdown with native language names. Sets the cookie, reloads the page. Mounted in Nav for both authenticated and anonymous states.
• Wired into: Nav (5 links + login button), CookieConsent (message + accept + privacy link), Pricing (CTAs translate per tier). High-impact components first; longer-tail strings remain English with t('key') calls scheduled for a follow-up.

FIX 2 — Africa tier ($4.99/mo)

• src/config/tiers.js — adds the africa tier between free and analyst: 10 scans/day, reasoning_visible:true, kill_conditions_detail:true, alerts:false, api_access:false. Frozen.
• Scan-limit middleware — no change needed. scanLimit() reads via getScanLimit(), which now resolves 'africa' to 10.
• web/src/components/Pricing.tsx — adds the VYNDR Africa card. The pricing-grid CSS unfolds from 2-up (tablet) to 4-up (≥1100px desktop). When the user's locale is Swahili (a proxy for African markets — IP-based geolocation deferred to a future session), the Africa tier renders FIRST.
• Honest UX gap: Africa-tier checkout short-circuits to an inline "coming soon" message instead of triggering Stripe. Two reasons: (a) the backend /api/stripe/checkout route validates tier against ['analyst','desk'] and the spec forbids backend edits this session; (b) STRIPE_PRICE_AFRICA is unset and the Stripe product hasn't been created in the dashboard yet.
• DB CHECK constraint blocker: migrations 001 + 011 declare tier IN ('free','analyst','desk'). The webhook will 23514 (check_violation) if it tries to write africa until the constraint is extended. Documented in tiers.js header + in SYSTEM-MANIFEST. Out of scope this session per the no-migration rule.
• .env.example — STRIPE_PRICE_AFRICA=price_... placeholder with explanatory comment.

Tests added (Session 12)

Suite	Tests
tests/unit/i18n.test.js	14
tests/unit/tiers.test.js (extended)	+5
Total new	19

Quality gates

• npm test: 1305 / 1305 passing (1286 + 19), 101 suites, 0 regressions
• web/npm run build: clean. NOTE — every page is now ƒ Dynamic rather than ○ Static because the root layout reads request headers (next/headers) for locale resolution. This is the expected cost of SSR i18n. If FCP regresses, the fallback is client-side cookie reads (brief English flash on first paint, but static prerender returns).
• License audit: third-party deps remain permissive (no new licenses introduced — translation files are JSON in our own repo).

Open items / follow-ups

1. DB CHECK constraint must be updated before the Africa tier can actually be assigned to users. Manual SQL:

   ALTER TABLE users DROP CONSTRAINT users_tier_check;
   ALTER TABLE users ADD CONSTRAINT users_tier_check
     CHECK (tier IN ('free','africa','analyst','desk'));
   -- same for user_profiles
   

2. Stripe product for VYNDR Africa not created. Manual step: create the product + price in the Stripe dashboard, set STRIPE_PRICE_AFRICA in Coolify, then extend the backend checkout route's validation list.
3. Translation review — only en is source quality. The other 9 locales are translated_unreviewed. Native-speaker review recommended for Arabic, Chinese, Korean, Japanese, Hindi before public launch.
4. Browser geolocation — Africa tier currently sorts first only for Swahili-locale users. IP-based detection (NG/KE/ZA/GH/etc.) would catch English-speaking African users; deferred to a session with proper geo middleware (Cloudflare headers, etc.).
5. Per-page meta translations — page <title> and OG tags are still English. Adding per-locale metadata requires the [locale]/ segment refactor, deferred.

Coolify env (Session 12 additions)

# Already required:
NEXT_LOCALE         # No env — set as a per-user cookie by the switcher.

# New, optional:
STRIPE_PRICE_AFRICA=price_...   # Once you create the Stripe product

---

Session 10 (2026-06-10) — SHIPPED

FIX 1 — Internal auth refactor + /pipeline off-host support

Pre-audit revealed the spec's premise was wrong: /api/grading/pipeline and /api/grading/resolve ALREADY EXISTED with requireInternal middleware inline in each route file. The actual n8n bug was a header- name mismatch (n8n sends x-internal-key, code read X-VYNDR-Internal-Key) PLUS a hard loopback-IP check that blocks any caller from a separate container.

• src/middleware/internalAuth.js (new) — centralized middleware. Accepts BOTH x-internal-key (Session 10 short form, n8n) AND X-VYNDR-Internal-Key (legacy, poller + existing tests). Timing-safe string compare. loopbackOnly is now an OPT-IN flag (default off).
• src/routes/grading.js — replaced inline requireInternal with the centralized middleware. /resolve uses {loopbackOnly: true} (poller from localhost). /pipeline uses the off-host variant (n8n from a separate container). __helpers.requireInternal kept exported for the existing test suite — backwards compatible.
• src/routes/corrections.js — same refactor; /correct stays loopback-only (morning sweep is co-located).
• /api/grading/pipeline body shape — empty body now iterates nba/wnba/mlb (n8n's "Morning Ops" workflow case). Single-sport body still works and returns the legacy summary object so existing per-sport tests continue to pass.

FIX 2 — Soccer prefetch cascade keys

Session 9's adapters write to apifootball:* and footapi:* cache keys; the daily prefetch was still only writing soccer:* (the tertiary fallback). The cascade in soccerFeatureExtractor never hit PRIMARY because nothing populated those keys.

• scripts/soccer-data-prefetch.js — new enrichFromApiFootball() walks finished WC fixtures via apiFootballAdapter.getFixtures + getFixturePlayerStats, aggregates per-player season stats across matches (minutes, goals, assists, shots, tackles, cards, rating), collapses to per-90 rates, and writes apifootball:player_by_name:{normalizedName} (24h TTL). Hard-capped at --max-players=80 per run.
• CLI flags added — --source=api-football|footapi|football-data|all (default all), --max-players=N, --season=N. Existing --leagues and --dry-run flags unchanged.
• enrichRefereesFromFootApi() — best-effort referee enrichment. Writes footapi:referee_by_name:{name} (7d TTL).
• Behavior preserved — legacy soccer:player:* writes still happen when football-data source is selected (and it's the default in all mode). The cascade resolves at PRIMARY when api-football data is available, TERTIARY otherwise.
• Boot guard relaxed — previously bailed when FOOTBALL_DATA_API_KEY was unset; now bails only when EVERY source is unavailable. The script can run on api-football alone.

FIX 3 — Sentry error tracking

• src/utils/sentry.js (new) — graceful no-op when SENTRY_DSN is unset (every Sentry surface becomes a noop). Initialized at the top of src/app.js BEFORE express is required.
• Sentry.setupExpressErrorHandler(app) mounted AFTER all routes in app.js — catches uncaught route errors automatically.
• PII scrubbing — beforeSend strips user.ip_address, user.email, request.cookies, request.headers.authorization, request.headers.cookie, and BOTH internal-key headers. Bearer tokens never reach Sentry.
• Sampling — 10% traces, 100% errors. Free-tier friendly.
• Frontend — manual init via web/src/components/SentryInit.tsx (client component, mounted in root layout). Lazy import('@sentry/nextjs') fires on mount only if NEXT_PUBLIC_SENTRY_DSN is set. Avoids the withSentryConfig plugin which conflicts with standalone output mode (per Session 10 spec note).

FIX 4 — Welcome email on signup

The sendWelcomeEmail function in web/src/services/email.ts already existed; nobody called it.

• Copy updated — 5/month → 3/day, NexaPay → Stripe founder pricing ($14.99/mo locked for life), added the soccer/World Cup mention per Session 10 spec. Both HTML and plain-text variants.
• web/src/app/api/welcome-email/route.ts (new) — POST endpoint, bearer-auth required. Reads Supabase user_metadata via the service-role admin client, checks welcome_email_sent, sends if absent, sets the flag. Idempotent — re-trigger is a cheap noop. No migration needed — user_metadata is the Supabase auth user's existing JSONB scratchpad.
• Trigger — web/src/app/welcome/page.tsx fires the POST once on mount via useRef guard. Server-side idempotency keeps it safe across refreshes too.
• Graceful failure — if RESEND_API_KEY is unset, send returns { ok: false } but the flag is still set (manual operator override if a batch needs re-sending).

Tests added

Suite	Tests
tests/unit/internalAuth.test.js	15
tests/unit/soccerDataPrefetchCascade.test.js	20
tests/unit/sentry.test.js	10
Existing suites (pipeline, resolution, prefetch) re-verified	0 new
Session 10 total	45+

Quality gates

• npm test: 1286 / 1286 passing (1240 + 46 new), 100 suites, 0 regressions
• web/npm run build: clean — Sentry mount + /api/welcome-email prerender
• License audit: only permissive licenses (Sentry adds nothing exotic)

Env vars to set in Coolify

# Already required from prior sessions:
VYNDR_INTERNAL_KEY=<existing — header is now x-internal-key OR X-VYNDR-Internal-Key>
RESEND_API_KEY=<existing>
RESEND_FROM_EMAIL=<existing, defaults to "VYNDR <grades@vyndr.app>">

# New in Session 10 (all optional — wrappers degrade gracefully):
SENTRY_DSN=<from sentry.io project settings>
NEXT_PUBLIC_SENTRY_DSN=<same DSN — needs the NEXT_PUBLIC_ prefix to reach browser bundle>

Open items

• Soccer prefetch hasn't run against live api-football yet — first cron tick after deploy will populate the cascade. Until then, the feature extractor resolves at tertiary (football-data).
• Sentry's frontend manual-init pattern means errors before the React tree mounts (e.g. SSR errors) bypass Sentry. The backend handler catches Express-side errors; for browser-side SSR errors we'd need instrumentation.ts, deferred.
• Welcome email idempotency relies on Supabase user_metadata. If a user signs in via SSO and never lands on /welcome, they don't get the email. Acceptable Day-1 — track via PostHog if it becomes a real conversion gap.

---

Session 9 (2026-06-10) — SHIPPED

World Cup opens tomorrow. This session closed three live-site emergencies (404, OOM cycle, slow FCP), added three new soccer data sources with a priority cascade, two new RapidAPI sports adapters, a real grace-period downgrade middleware, and updated the legal pages.

Phase 0 — critical fixes

• /pricing 404 → fixed. web/src/app/pricing/page.tsx created; wraps the existing Pricing component on a standalone route so email renewal CTAs (which link to /pricing via web/src/services/email.ts:204) no longer land on 404. Metadata block ships with OG + Twitter tags.
• Web container OOM cycle → cause identified, fix documented. docker logs on the live host (z2zyki…-032334469519, 44 restarts and climbing) returned FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory. Docker mem limit is unlimited (0) — this is Node's own ~2 GB V8 default. Fix is a Coolify env-var change: NODE_OPTIONS=--max-old-space-size=4096 on the web container. Cannot be applied from this session — listed under the Coolify env requirements at the end of this entry.
• 7.5s FCP → root cause traced to the OOM cycle. All page routes are static-prerendered; root layout makes no blocking calls. The FCP measurement is dominated by cold-start latency hit during each restart. The NODE_OPTIONS fix is the primary FCP fix too — re-measure after deploy.

Phase 1 — soccer source upgrade

New adapter cascade for soccer (priority order):

1. api-football.com (PRIMARY) — src/services/adapters/apiFootballAdapter.js. 100 req/day soft limit (90, with 10-req safety margin). 6 endpoints: getFixtures, getFixtureLineups, getFixturePlayerStats, getFixtureEvents, getPlayerSeasonStats, getStandings. Auth via x-apisports-key header (NOT RapidAPI). Per-endpoint TTLs match data volatility (fixtures 6h, lineups/playerstats 24h, events 12h).
2. FootApi via RapidAPI (BACKUP) — src/services/adapters/footApiAdapter.js. 50 req/day (soft 45). 4 endpoints: getMatchLineups (28 stat keys), getMatchIncidents (minute + addedTime), getRefereeStatistics (yellow/red per game), getWorldCupSchedule (tournament ID 16).
3. football-data.org (TERTIARY) — existing Session 7j adapter unchanged.

The soccerFeatureExtractor now cascades through these via a new loadFromCascade() helper. Each load returns a _source tag so debugging is straightforward; meta.sources exposes the attribution per lookup (player, nextMatch, lastFixture, referee). Existing 17 soccer-extractor tests still pass; 7 new cascade tests prove the priority order.

Phase 1 — Tank01 RapidAPI adapters

• tank01NbaAdapter.js — live NBA box scores, schedule, betting odds. Status-aware TTL: 5-min cache while a game is in-progress, 24-hour cache once it reports Final. Free tier 1,000 req/mo; TTL-bound rather than counter-bound.
• tank01MlbAdapter.js — live MLB box scores, daily scoreboard, and batter-vs-pitcher (the headline new MLB signal — a batter's historical PA/AB/H/HR/SO line against a specific pitcher). Same status-aware TTL pattern as NBA.

Both Tank01 adapters use the shared RAPID_API_KEY (also used by FootApi). Host overridable via TANK01_NBA_HOST / TANK01_MLB_HOST.

Phase 2 — production readiness

• Grace-period downgrade middleware — src/middleware/gracePeriod.js. Fires at request time on tier-gated routes (/api/scan/parlay, /api/alerts, /api/props/joint-history). Reads req.user.grace_period_until (now selected by requireAuth in src/middleware/auth.js), and on expiry atomically downgrades users.tier and user_profiles.tier to 'free', clears the timestamp, sets subscription_status='expired' on the profile mirror, and rewrites req.user so the route immediately sees the downgrade. Closes the long-standing "cancelled users keep paid access forever" gap. Ordering matters: grace must run AFTER requireAuth and BEFORE scanLimit, because scanLimit reads tier off req.user — a just-expired Desk user would otherwise burn one final unlimited-quota request.
• TOS update — web/src/app/terms/page.tsx Subscription Terms switched from NexaPay to Stripe; Acceptable Use now explicitly states "VYNDR does NOT offer API access at any tier" — closes the Session 7h immutable.
• Privacy update — web/src/app/privacy/page.tsx Payment Data section switched from NexaPay to Stripe with specifics on what Stripe receives. New "Sub-processors" section explicitly lists Stripe, Supabase, PostHog, Resend.
• Cookie consent banner — web/src/components/CookieConsent.tsx, mounted in root layout. Thin bottom bar, SSR-safe (renders nothing until client mount checks localStorage), single-button accept, links to Privacy Policy.
• Root layout metadata — keywords + description extended to include soccer and World Cup 2026 intelligence terms. OG + Twitter cards already comprehensive from prior sessions. Per-page metadata for /soccer + /scan deferred (those pages are 'use client'; would need server-component wrappers — cosmetic).

Tests added

Suite	Tests
tests/unit/apiFootballAdapter.test.js	16
tests/unit/footApiAdapter.test.js	13
tests/unit/soccerFeatureExtractorCascade.test.js	7
tests/unit/tank01NbaAdapter.test.js	12
tests/unit/tank01MlbAdapter.test.js	12
tests/unit/gracePeriod.test.js	7
Session 9 total	67

Quality gates

• npm test: 1240 / 1240 passing (1173 baseline + 67 new), 97 suites, 0 regressions
• web/npm run build: clean — /pricing + everything else prerenders, no type errors
• License audit: only permissive licenses

Coolify env vars (apply on the web container — keys not in repo)

NODE_OPTIONS=--max-old-space-size=4096        # fixes the OOM cycle
API_FOOTBALL_KEY=<from api-sports.io>          # PRIMARY soccer source
FOOTBALL_DATA_API_KEY=<from football-data.org> # TERTIARY soccer source
RAPID_API_KEY=<from RapidAPI marketplace>      # FootApi + Tank01 NBA + Tank01 MLB
FOOTAPI_HOST=footapi7.p.rapidapi.com           # default — override only for mirrors
TANK01_NBA_HOST=tank01-fantasy-stats.p.rapidapi.com
TANK01_MLB_HOST=tank01-mlb-live-in-game-real-time-statistics.p.rapidapi.com

Open items

• NODE_OPTIONS must be set in Coolify before the next deploy; until then, the web container will keep OOM-looping. This is the single most important production action item.
• The 2 GB+ heap usage that triggered the OOM suggests a memory leak in the Next.js standalone server. Heap-snapshot investigation deferred — the env-var bump buys headroom but doesn't fix the leak root cause.
• Per-page OG metadata on /soccer and /scan requires those pages to be refactored to a server-component wrapper pattern. Not blocking.
• The new adapter cascade improves data quality WHEN API_FOOTBALL_KEY / RAPID_API_KEY are populated and a daily prefetch has run against them. Until then, the cascade silently falls through to football-data.org and static reference data. Updating scripts/soccer-data-prefetch.js to write the new apifootball:* / footapi:* cache keys is a follow-up.

---

Session 8 (2026-06-10) — SHIPPED

Frontend layer that connects users to the Session 7h–7j backend. NexaPay → Stripe cutover on the pricing flow + a /soccer page that exposes the soccer intelligence pipeline.

Files created (frontend)

• web/src/app/api/odds/soccer/[league]/route.ts — Next.js proxy → Express GET /api/odds/soccer/:league. Validates league against the 9 accepted codes upstream so a typo bounces at the Next boundary.
• web/src/app/soccer/page.tsx — live soccer odds feed. Hosts SportSelector, fetches /api/odds/soccer/:league, groups props by match → stat type. "Grade" button triggers inline scan via /api/scan (sport: Soccer) and renders the result through SoccerGradeResult. Soccer-only page; switching the selector to another sport bounces to /scan.
• web/src/app/upgrade/success/page.tsx — Stripe success landing. Reads session_id, refreshes AuthContext so the new tier flips immediately. Does NOT verify against Stripe from the client (no secret key on the browser) — the webhook is the source of truth.
• web/src/app/upgrade/cancel/page.tsx — Stripe cancel landing.
• web/src/components/SportSelector.tsx — pill tabs (NBA/WNBA/MLB/ Soccer); Soccer reveals a sub-row of the 9 league codes matching Express's SOCCER_SPORT_KEYS. Emits { sport, league? } via onChange — pure UI, no fetches.
• web/src/components/SoccerGradeResult.tsx — soccer-themed result card. Parses the engine's reasoning summary into visual chips (⚽ goals/90, 📊 xG, 🎯 penalty taker, 🏹 free-kick taker, ⛳ corner taker, 🏔️ altitude, 🟨 referee, ⏱️ minutes discount, 🛡️ opponent defense, 🏆 tournament pedigree). Color-coded by tone (positive / caution / warning / neutral). Free-tier responses (carrying tier_gated: true) render the chip row blurred under an upgrade CTA; the structured grade + confidence + edge stay visible. Kept separate from GradeCard so the NBA/MLB/WNBA path is untouched.

Files modified (frontend)

• web/src/app/api/checkout/route.ts — full rewrite. Was a NexaPay payment-link creator; is now a thin proxy that forwards { tier, founder_code? } + bearer to Express /api/stripe/checkout. Response remap: checkout_url → url for callsite compat; both fields shipped so either reads cleanly.
• web/src/app/api/scan/route.ts — accepts Soccer sport in addition to NBA/MLB/WNBA. Soccer stat-type allowlist mirrors the backend VALID_STAT_TYPES (goals, shots_on_target, shots, tackles, cards, corners, saves, goals_conceded, passes, clean_sheet, assists).
• web/src/components/Pricing.tsx — CTAs converted from <a href> to onClick handlers. Uses useAuth() for the bearer token, POSTs to /api/checkout, window.location.assign to the returned Stripe URL. Loading state on the active tier, inline error banner. Anonymous visitors bounce to /signup?return=/%23pricing. Footnote rewritten from "NexaPay" to "Stripe (test mode while we onboard founders)".
• web/src/components/Nav.tsx — small BETA tag next to the wordmark. Glitch-styled, monospace, low-opacity green border. Renders on every page that mounts Nav.

Files modified (backend — ONE allowed change)

• src/services/stripeService.js — success_url / cancel_url point at the frontend (NEXT_PUBLIC_SITE_URL with BASE_URL fallback, default http://localhost:3000). Previously the routes pointed at the Express origin which would have 404'd the redirect. New URLs:
  • ${frontendUrl}/upgrade/success?session_id={CHECKOUT_SESSION_ID}
  • ${frontendUrl}/upgrade/cancel All 23 Stripe tests still pass (none asserted on the URL strings).

Files modified (docs)

• docs/SYSTEM-MANIFEST.md — /api/odds/soccer/[league] row in Next.js routes, new section listing the three new Next.js pages, the Session 7h "dual-provider divergence" callout flipped from open-work to ✅ complete.
• BUILD-STATE.md — Session 8 entry.

Honest verification status

Build-verified (passed web/npm run build after every component):

• All TypeScript types resolve
• All routes prerender / build correctly (24 pages, 30+ API routes)
• No ESLint errors

NOT runtime-verified in this session (I have no browser to click through):

• Actual Stripe checkout redirect end-to-end (test mode card flow)
• Soccer odds rendering with live data (depends on FOOTBALL_DATA_API_KEY being set in prod and the daily prefetch having run)
• SoccerGradeResult signal parsing against a real engine response (signal-chip regex tested against the exact phrasing buildSoccerReasoningLines emits in analyzeViaEngine1.js, but not against live engine output)
• AuthContext.refresh() actually triggering a profile re-read after the Stripe redirect

These are the expected next-session sanity checks once Coolify deploys this build.

Quality gates

• npm test (backend): 1173 / 1173 passing, 91 suites, 0 regressions from Session 7j baseline
• web/npm run build: clean — all new routes prerendered, no type errors
• License audit: only permissive licenses

---

Session 7j (2026-06-10) — SHIPPED

Permanent soccer sport vertical, launching with FIFA World Cup 2026 (opens June 11). League-agnostic architecture supports WC, EPL, La Liga, Bundesliga, Serie A, Ligue 1, UCL, MLS, Liga MX from the same code paths.

Files created

• src/data/worldcup2026.js — 16 venues + altitudes + climate, CONCACAF
  • CONMEBOL teams, penalty/corner/free-kick takers (top 25 teams), tournament players (≥3 career WC goals). All frozen. Helpers: isPenaltyTaker, isCornerTaker, isFreeKickTaker, getTournamentHistory, isHomeContinent, getVenue, altitudeImpact.
• src/services/adapters/footballDataAdapter.js — football-data.org v4 REST adapter. 8/min token bucket (2-req safety margin vs the 10/min upstream cap). Tier-matched Redis TTLs (fixtures 6h, standings 12h, squads 24h, scorers 6h). Stale-while-revalidate fallback when the bucket is drained or the API 5xx's. Returns null when no API key — callers degrade gracefully.
• src/services/intelligence/soccerFeatureExtractor.js — reads from prefetch-populated Redis cache (NEVER hits external APIs on the user request path). Builds the engine1 feature vector + a soccer overlay (goals_per_90, xG, penalty/corner/FK role, altitude, referee, tournament history, rest_days).
• poller/soccer.js — league-agnostic fixture poller. WC pulls from the rezarahiminia/worldcup2026 OSS API (no rate limit) and falls back to football-data.org. Other leagues use the adapter directly. Writes soccer:nextmatch:{team} (24h TTL) + soccer:lastfixture:{team} (7d TTL) per fixture. Self-rescheduling: 5-min ticks during live matches, 30-min otherwise. PM2-managed.
• scripts/soccer-data-prefetch.js — daily batch job. Pulls standings
  • scorers per configured league, computes per-team defensive aggregate (goals_conceded_per_game, defensive_rank_norm on a 0..1 scale that slots into engine1's opp_rank_stat) and per-player per-90 rates. Writes soccer:teamdefense:{league}:{team} and soccer:player:{normalizedName}. --leagues=WC,PL --dry-run flags supported. xG fields left null on Day 1 (soccerdata-Python bridge is a follow-up; engine handles nulls gracefully).
• tests/unit/worldcup2026.test.js (20 tests)
• tests/unit/footballDataAdapter.test.js (15 tests)
• tests/unit/soccerFeatureExtractor.test.js (17 tests)
• tests/unit/trapDetectionSoccer.test.js (21 tests)
• tests/unit/computeFeaturesSoccerBranch.test.js (4 tests)
• tests/unit/analyzeViaEngine1Soccer.test.js (8 tests)
• tests/unit/soccerPoller.test.js (22 tests)
• tests/unit/soccerDataPrefetch.test.js (14 tests)
• tests/integration/oddsSoccer.test.js (6 tests)

Files modified

• src/utils/oddsNormalizer.js — MARKET_MAP gains 10 soccer market keys (player_goals, player_shots_on_target, etc → goals, shots_on_target, etc). Existing NBA mappings untouched.
• src/routes/analyze.js, src/routes/scan.js — VALID_STAT_TYPES set extended with 10 soccer stat types. 'assists' is shared with NBA; sport field discriminates downstream.
• src/routes/odds.js — new GET /api/odds/soccer/:league route. Validates league against SOCCER_SPORT_KEYS (9 leagues), surfaces 405 valid-list hint on miss.
• src/services/oddsService.js — SPORT_KEYS gains 9 soccer entries mapping soccer_wc → soccer_fifa_world_cup, soccer_epl → soccer_epl, etc. SOCCER_SPORT_KEYS exported as a frozen list.
• src/services/intelligence/computeFeatures.js — sport ∈ {'soccer','football'} dispatches to extractSoccerFeatures. NBA path unchanged.
• src/services/intelligence/trapDetection.js — six soccer signals (xg_regression, altitude_risk, rotation_risk, minute_discount, referee_card_bias [positive — excluded from composite], strong_defense). getTrapScore branches on input.sport.
• src/services/intelligence/analyzeViaEngine1.js — soccer reasoning branch (buildSoccerReasoningLines). Uses "matches" not "games", surfaces xG / penalty taker / altitude / referee / minutes / WC pedigree. NBA-specific sentences (back-to-back, injury report) guarded by !isSoccer.
• poller/ecosystem.config.js — poller-soccer PM2 app added. Same restart policy as box-score pollers; SOCCER_LEAGUES env wired.
• .env.example — soccer block (FOOTBALL_DATA_API_KEY, SOCCER_LEAGUES, WORLDCUP_API_URL, RAPID_API_KEY).
• docs/SYSTEM-MANIFEST.md — /api/odds/soccer/:league row in §2, Soccer env block in §3, soccer poller in poller-set, four new external API rows in §6, [ARCH-3] soccer-pipeline note in §8.

Quality gates (all green)

• npm test: 1173 / 1173 passing (1042 baseline + 131 new soccer tests across 9 new suites), 91 suites, 0 failures
• web/npm run build: clean
• License audit: only permissive third-party licenses

---

Session 7i (2026-06-10) — SHIPPED

Stripe checkout + webhook (no new routes — gap-fill on existing)

Pre-audit revealed Session 3.4 already shipped a fuller Stripe integration than this session's spec asked for: route, sig verify, all 4 event handlers with 48h grace, customer create + persist, portal + status endpoints, founder-code system, and users ↔ user_profiles dual writes. Raw-body middleware was already correctly positioned at src/app.js:52 (before global express.json()).

What this session added on top:

• tests/integration/stripe.test.js — refactored stripe mock to a singleton handle, then added two route-level tests:
  1. constructEvent throws → route returns 400 with { error: /signature/i }
  2. valid signature → route dispatches to handleWebhookEvent and returns { received: true }
• tests/unit/stripeService.test.js — added customer.subscription.updated test covering portal-driven plan-change: maps items.data[0].price.id back to a tier via PRICE_MAP, writes to both users + user_profiles, clears grace.
• docs/SYSTEM-MANIFEST.md — appended a Payments: dual-provider divergence subsection under § 8 Findings → Frontend ↔ Backend contract, documenting that the Next.js /api/checkout still routes to NexaPay while Express Stripe is wired but uncalled by the frontend, with a 4-step cutover punch list for a follow-up session.

Quality gates (all green)

• npm test: 1042 / 1042 passing (delta +3 from 1039 baseline, 0 regressions)
• web/npm run build: clean
• License audit: third-party deps only permissive (MIT/Apache-2.0/BSD/ISC/MPL/BlueOak/CC-BY/0BSD)
• curl https://api.vyndr.app/api/health → {"status":"healthy"}

---

Session 7h (2026-06-10) — SHIPPED

Stripe (test mode)

Resources created against sk_test_* via direct REST API (Stripe MCP plugin OAuth flow was non-functional in this environment; bypassed by hitting https://api.stripe.com/v1 with the secret key in a single shell subprocess, then shredding the on-disk key file).

• prod_UgBel9RYTROCxr — VYNDR (metadata.tier=analyst)
  • price_1TgpGxIp1Mec3r2E6Wh6oeaP — $14.99/mo recurring (metadata.tier=analyst)
• prod_UgBeSBYw2j9oXL — VYNDR Desk (metadata.tier=desk)
  • price_1TgpGyIp1Mec3r2EQq50KKhF — $44.99/mo recurring (metadata.tier=desk)
• we_1TgpGzIp1Mec3r2ERtDIF2n2 — webhook → https://api.vyndr.app/api/stripe/webhook
  • Subscribed events: checkout.session.completed, customer.subscription.updated, customer.subscription.deleted, invoice.payment_failed
  • Signing secret saved to ~/.stripe-webhook-secret (chmod 600) — read once, paste into Coolify, then shred -u.

Tier infrastructure

• src/config/tiers.js — frozen access matrix (free / analyst / desk); api_access:false on every tier (non-negotiable consumer-product invariant)
• src/middleware/scanLimit.js — 24h rolling per-user/IP quota (free=3, analyst=15, desk=∞); 429 + Retry-After + X-Scans-Used/Limit headers on overflow; in-memory LRU with MAX_TRACKED=50_000
• src/utils/tierGating.js — pure response gating; free tier keeps grade/confidence/edge_pct, redacts reasoning + kill_conditions_triggered; paid tiers pass through
• Wired into src/routes/scan.js (/parlay after requireAuth) and src/routes/analyze.js (/prop + /batch, gating applied per-result)

SQL (run manually in Supabase SQL Editor)

• docs/sql/pricing_slots.sql — creates pricing_slots table + RLS + price IDs seeded. Not added to the migrations chain per session policy.

Tests

• tests/unit/tiers.test.js (10 tests) — frozen matrix, api_access=false invariant, fallback behavior
• tests/unit/tierGating.test.js (9 tests) — free-tier redaction, paid passthrough, no input mutation
• tests/unit/scanLimit.test.js (10 tests) — per-tier limits, anonymous IP fallback, independent quotas, desk skip
• Existing suites adapted for the new middleware: tests/unit/analyzeCache.test.js, tests/integration/analyze.test.js, tests/integration/scan.test.js reset the scan-limit map in beforeEach; the integration suite for /api/analyze mocks applyTierGating as pass-through so engine-shape assertions stay focused on the engine contract (gating has its own suite).

Quality gates (all green)

• npm test: 1039 / 1039 passing, 82 suites, 0 failures
• web/npm run build: production build clean, all 24 routes prerendered
• License audit: only permissive third-party licenses (MIT/Apache-2.0/BSD/ISC/etc.); single UNLICENSED entry is our own vyndr-web workspace

Web Tier v6 (2026-05-18) — SHIPPED

Complete frontend overhaul. 18 pages, 22 API routes. npm run build passes with zero errors.

New pages

• /dashboard — post-login slate (sport tabs, top grades, tonight's games, most parlayed, recent scans, first-time onboarding)
• /game/[id] — game preview with spread/total/ML, starting lineups with injury flags, expandable prop list, add-to-parlay
• /profile — tier status, subscription state, founder badge, cancel-at-period-end flow
• /intelligence — Desk-tier timeline of evolution/coaching/cascade/ABS/line-movement signals (blurred for non-Desk)
• /terms, /privacy, /responsible-gambling — branded legal pages with brand voice
• /scan — full rebuild (sport tabs, real /api/scan with tier gating, parlay tray hook)
• /login, /signup — wired to Supabase Auth via AuthContext (Google OAuth + email/password + age check)
• /marketplace — coming-soon waitlist (API access, custom alerts, capsule drop)
• /ledger, /tracker — design system refresh, accuracy buckets, miss autopsy, quick-slip
• / — auth-aware: logged-in users redirect to /dashboard; anonymous see marketing

New API routes

• /api/games/tonight, /api/games/[id], /api/games/[id]/props
• /api/props/top-graded, /api/props/most-parlayed
• /api/players/search
• /api/user/recent-scans
• /api/intelligence/feed
• /api/parlay/add-leg, /api/parlay/grade
• /api/ledger, /api/ledger/accuracy
• All cached via Supabase odds_cache table (5-min TTL) — never hit Odds API directly

Services + middleware

• services/odds-cache.ts — Supabase-backed TTL cache for upstream calls (loader + stale-fallback)
• services/email.ts — Resend wrapper: sendWelcomeEmail, sendPaymentReceipt, sendRenewalReminder
• middleware/rateLimit.ts — per-tier per-minute scan throttle (5/30/60 free/analyst/desk)
• services/nexapay.ts — already shipped (createPaymentLink + HMAC webhook verify), now wired to email receipts

Components

• GradeCard.tsx — premium grade card with tier-gated blur (factors locked for free; alt-lines locked for non-Desk)
• ParlayContext.tsx + ParlayTray.tsx — cross-page parlay state, slide-up tray, /api/parlay/grade integration
• BottomTabBar.tsx — mobile-only 5-tab navigation (Home/Scan/Parlay/Ledger/Profile) with parlay badge
• ShareCard.tsx — canvas-rendered 1200x630 OG share image with grade letter; download + copy-to-clipboard
• Nav.tsx, Hero.tsx, LivePropsStrip.tsx, Features.tsx, Pricing.tsx, HowItWorks.tsx, FAQ.tsx, Footer.tsx — design system refresh already shipped

PWA + meta

• public/manifest.json (192/512/maskable icons)
• public/icons/icon-{192,512,maskable-512}.png, apple-touch-icon.png, favicon.ico, favicon.png
• public/og-image.png — 1200x630 social share card
• appleWebApp + manifest + theme-color wired in layout.tsx

Supabase migrations

• 011_user_profiles_web.sql (already deployed): user_profiles (+RLS+trigger), parlay_leg_frequency (+RPC), scan_history
• 012_web_caching_waitlist.sql (NEW): odds_cache (TTL cache), waitlist_signups, founder_pricing_seats view, prune_expired_odds_cache() helper

Backend

• src/app.js — CORS middleware added (localhost dev + vyndr.app + *.vercel.app + FRONTEND_ORIGINS env var)
• package.json — added cors@2.8.5

Bug fixes

• Scan page sibling-div JSX bug fixed (rewritten from scratch)
• Lockfile warning silenced via next.config.ts turbopack.root (already in place)
• Auth callback rewritten to use Supabase JS session API instead of raw localStorage parse

Environment variables (set in Vercel + Railway)

Vercel (Next.js)

• NEXT_PUBLIC_SUPABASE_URL — Supabase project URL
• NEXT_PUBLIC_SUPABASE_ANON_KEY — Supabase anon key
• SUPABASE_SERVICE_ROLE_KEY — service role (server-only, NEVER expose to client)
• NEXT_PUBLIC_SITE_URL — https://vyndr.app
• BACKEND_URL — Railway URL of Express grading engine
• NEXT_PUBLIC_API_URL — same as BACKEND_URL (for legacy client fetches)
• NEXT_PUBLIC_NBA_SERVICE_URL — FastAPI nba_api wrapper URL
• NEXAPAY_API_KEY — bearer token from NexaPay dashboard
• NEXAPAY_WEBHOOK_SECRET — HMAC secret from NexaPay dashboard
• NEXAPAY_API_URL — defaults to https://api.nexapay.one/v1
• RESEND_API_KEY — from resend.com
• RESEND_FROM_EMAIL — defaults to VYNDR <grades@vyndr.app>
• NEXT_PUBLIC_POSTHOG_KEY — PostHog project key (optional)
• NEXT_PUBLIC_POSTHOG_HOST — defaults to https://us.i.posthog.com

Railway (Express backend)

• All existing engine vars (Odds API key, Supabase, etc.)
• FRONTEND_ORIGINS — comma-separated additional CORS origins (optional; defaults cover localhost + vyndr.app + *.vercel.app)

Vercel deployment

1. Repo root → /home/kev/mastermind/vyndr
2. Root Directory in Vercel project settings: web
3. Framework Preset: Next.js (auto-detected)
4. Build Command: npm run build (default)
5. Install Command: npm install (default)
6. Output Directory: .next (default; we use output: 'standalone')
7. Node version: 20.x or 22.x
8. Add all env vars from the list above

Railway deployment (backend)

1. railway.toml already configured in repo root
2. Connect GitHub → Deploy from main
3. Set env vars (same as Vercel backend list)
4. Get URL → set BACKEND_URL in Vercel

NexaPay configuration

1. Create NexaPay account → get API key + webhook secret
2. Webhook URL: https://vyndr.app/api/webhook/nexapay
3. Webhook events to enable: payment.succeeded, payment.failed, payment.refunded, subscription.canceled
4. Settlement wallet: USDC on Polygon (or your preferred chain)
5. Set NEXAPAY_* env vars in Vercel

Resend configuration

1. Create Resend account → verify vyndr.app domain
2. Add DNS records (SPF, DKIM, DMARC) from Resend dashboard
3. Create API key → set RESEND_API_KEY in Vercel
4. Test: trigger a signup, check the welcome email arrives

Supabase Auth setup

1. Run migrations 011_user_profiles_web.sql and 012_web_caching_waitlist.sql (Supabase SQL editor or CLI)
2. Auth → Providers → enable Email/Password (default)
3. Auth → Providers → enable Google: paste client ID/secret from Google Cloud Console
4. Auth → URL Configuration → Site URL: https://vyndr.app
5. Auth → URL Configuration → Redirect URLs: https://vyndr.app/auth/callback, http://localhost:3001/auth/callback

---

What Has Shipped (Backend — Already Live)

Phase 1 — Foundation (COMPLETE)

• Feature 1.1 — Odds API Integration
• Feature 1.2 — NBA_API Stats Wrapper (FastAPI microservice)
• Feature 1.3 — Prop Analysis Engine (6-step grading pipeline)
• Feature 1.4 — Database Schema (9 tables, RLS, triggers)
• Feature 1.5 — Bet Submission (3 methods + performance tracking)

Phase 2 — Core Product (COMPLETE)

• Feature 2.1 — Parlay Scan (correlation detection, monetization)
• Feature 2.2 — Line Movement + Cascade Detection

Phase 3 — Web MVP (COMPLETE)

• Feature 3.1 — Landing Page + Blog (Next.js, MDX, VYNDR voice, SEO)
• Feature 3.2 — Scan UI (leg builder, grade results, upgrade pitch)
• Feature 3.3 — Bet Tracker (performance dashboard, quick slip, settle flow)
• Feature 3.4 — Stripe Integration (checkout, webhooks, portal, founder codes)

Also Shipped (Separate Repo)

Mastermind Agency Site

• /home/kev/mastermind/agency-site/
• Glitch aesthetic, scan lines, CRT flicker, JetBrains Mono
• Home, VYNDR case study, Contact pages

Phase 1 Additions — Intelligence Engine (COMPLETE)

• Addition 1 — Stats endpoints (parlays-graded, public, live props)
• Addition 2 — Dynamic role profile system (8 roles, Shannon entropy, conditional profiles)
• Addition 3 — Player selector (placeholder — Cowork handles design)
• Addition 4 — Parlay probability (phi coefficient, juice-adjusted EV, correlation math)
• Addition 5 — MLB prop grading (14 stat types, 10 kill conditions, 30 parks, weather API)
• Addition 6 — Intelligence engine (similarity, evolution/PELT, line discrepancy, alt line, Bayesian, model trainer)
• Addition 7 — Lineup watch speed (role activation detection framework)
• Addition 8 — Database additions (7 new tables, migration 003, indexes, RLS)
• Addition 9 — Design system update (forest green, Hero tagline, live props strip, DemoScan result card)
• Addition 10 — Accuracy ledger page (/ledger)
• Addition 11 — Marketplace page (/marketplace, waitlist, honeypot)
• Addition 12 — ARCHITECTURE.md v1.0
• Permanent: FOUNDER_NOTE constant (immutable, tested for integrity)
• Permanent: X-VYNDR-Mission header on all API responses

Also Shipped (Separate Repo)

Mastermind Agency Site

• /home/kev/mastermind/agency-site/
• Glitch aesthetic, scan lines, CRT flicker, JetBrains Mono
• Home, VYNDR case study, Contact pages

Test Summary

• Node.js: 662 tests passing (unit + integration) — 357 original + 187 ship + 65 supplement + 35 patch + 45 security
• Python: 27 tests passing
• Total: 689 tests, all green
• 8 new test files: shipInfrastructure, shipGradingEngine, shipDataSources, shipResolution, shipSchemeClassifier, supplementSystems, patchIntegration, securityAudit
• Next.js project builds (pending Vercel deploy)

Active Blockers

• BLOCKER-003: WSL2 DNS cannot resolve *.supabase.co
• Migrations 003-010 need manual apply via Supabase SQL Editor

Phase 1 Additions Part 2 (COMPLETE)

• Addition 13 — Simplified scan selector (sport toggle NBA/MLB, player search, stat dropdown, line pre-fill from Odds API)
• Addition 14 — PostHog analytics integration (5 events: scan_completed, grade_viewed, upgrade_cta_clicked, prop_shared, alt_line_viewed)
• Addition 15 — Affiliate database (Migration 004: referral_codes, referral_conversions, affiliate_payouts, wallet_addresses, RLS on all)
• Addition 16 — Scheme intelligence data layer (schemeClassifier.js: PnR coverage classification DROP/SWITCH/HEDGE/MIXED/UNKNOWN, 8-possession min, 6hr cache, graceful degradation, silent logging to model_predictions_extended)
  • Scheme intelligence: data layer active, user activation pending Day 31

Phase 2 Pending

• Model learning loop (Feature 4.1 spec exists)
• Player selector UI completion (Cowork handles design)
• Full parlay probability UI integration
• Real-time lineup watch CRON implementation
• Evolution watch UI on ledger page
• Pre-registered predictions system activation
• Physical ledger fulfillment
• Education library content

Manual Actions Required

1. Paste SQL migrations 003-010 in Supabase SQL Editor (in order)
2. Run node scripts/seedRoleProfiles.js after NBA API access configured
3. Set Stripe env vars (STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, price IDs)
4. Set NEXT_PUBLIC_POSTHOG_KEY env var for PostHog analytics
5. Set ODDS_API_KEY env var for Odds API
6. Set SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY for Python service
7. Deploy Next.js frontend to Vercel
8. Start Python service: cd src/services/python && pip install -r requirements.txt && python3 app.py
9. Set up GitHub Actions crons: lineup monitoring (15min), morning odds (10am ET), pre-game odds (90min), weather (30min), nightly resolution (2am ET)
10. Run cold_start_boot() on first launch (seeds reporters, loads data files)
11. SHADOW_MODE=True for first 2 weeks — grades logged but not published to capper

Session Log

Sessions 1-6 — 2026-03-21/22

• Built all backend: Phase 1 + Phase 2 + Feature 1.5
• 221 backend tests passing

Session 7 — 2026-03-22

• Built Feature 3.1: Landing page + blog (Hero, Pricing, Blog/MDX, Auth pages)
• Built Mastermind Agency Site (glitch aesthetic, 5 pages)
• Built Features 3.2 + 3.3: Scan UI + Bet Tracker
• Built Feature 3.4: Stripe Integration (checkout, webhooks, portal, founder codes)
• ALL FEATURES COMPLETE
• Total: 237 tests (210 Node.js + 27 Python), all green

Session 8 — 2026-03-28

• Built all 12 Phase 1 additions in single session
• 68 new tests (305 total), all green
• New services: roleProfileEngine, roleStabilityEngine, similarityEngine, evolutionEngine, lineDiscrepancyDetector, altLineScanner, bayesianEngine, modelTrainer, correlationMath, mlbGrader, mlbKillConditions, mlbStatsClient
• New routes: stats, props, waitlist
• New frontend: LivePropsStrip, ledger page, marketplace page
• New constants: founderNote, mlbParks
• New middleware: mission header
• Migration 003: 7 new tables with indexes and RLS
• Python microservice: evolutionEngine.py (Flask/PELT on port 5001)
• ARCHITECTURE.md v1.0 created

Session 9 — 2026-04-12

• Built 4 Phase 1 Part 2 additions
• 52 new tests (357 total), all green
• New component: SimplifiedSelector (sport toggle, player search, stat dropdown, line pre-fill)
• PostHog analytics: 5 tracked events, initialized in layout.tsx
• Migration 004: 4 affiliate tables (referral_codes, referral_conversions, affiliate_payouts, wallet_addresses)
• New service: schemeClassifier.js (PnR coverage classification, 6hr cache, graceful degradation)
• Scheme intelligence: data layer active, user activation pending Day 31

Session 10 — 2026-04-13 (SHIP BUILD v5.1)

• Built complete dual-sport grading engine from vyndr-SHIP.md spec
• 187 new tests (544 total), all green across 38 test suites
• Phase 1 — Infrastructure:
  • Flask app.py with blueprints, health check, rate limiting (60/min default, 20/min grade), flask-cors, /api/docs
  • evolutionEngine.py moved to blueprints/evolution.py (structural only — logic unchanged)
  • utils: retry.py, data_warehouse.py (game-day TTL), bayesian.py (per-stat-type weights, skewness, data sufficiency curve), edge_calculator.py (real edge + quarter-Kelly), context_aggregator.py (15 factors), similarity.py (min 0.7), regime_detector.py (disabled <20 games), blind_spot_detector.py (worst 5%), supabase_client.py
  • Data files: park_factors.json (30 parks, lat/lng, roof_status), reporter_database.json (80+ handles), timezone_map.json (30 arenas), grade_thresholds.json, odds_api_config.json
  • requirements.txt with all 15 dependencies
  • Cold start boot sequence with reporter seeding
• Phase 2 — Data Sources:
  • blueprints/synergy.py (team play types, matchup, tracking, defensive scheme)
  • blueprints/nba_context.py (teammate impact, game script, home/road, rest/travel, matchup pace, foul trouble, B2B stat-specific, positional defense, usage-efficiency, playoff modifiers, NBA sub-scores endpoint)
  • blueprints/lineup_intelligence.py (3-source architecture, reporter trust tiers, tweet parsing, two-stage grading, reporter-line correlation)
  • blueprints/odds_scanner.py (free tier 2 pulls/day, odds warehouse, line movement detection, slate scanner)
  • utils/weather.py (Open-Meteo, continuous 30min, dome detection, regrade triggers)
  • utils/archetypes.py (5 pitcher dimensions, 5 batter dimensions, 6 NBA dimensions — ALL with weight_profiles, batting order, batter approach, pitcher identity, weight blending)
  • schemeClassifier.js enhanced: Synergy-first with regex fallback, backward compatible
• Phase 3 — Grading Engines:
  • blueprints/mlb.py (14-step pipeline, pitcher/batter profiles, ABS challenge system with player-specific discipline score, TTO decay, platoon-specific opponent quality, lineup protection, day/night, bullpen state, catcher framing)
  • blueprints/image_grade.py (OCR pipeline with low-confidence confirmation)
  • utils/sportsbooks.py (10 books, parlay grading with correlation check, phi coefficient)
  • utils/capper.py (pick numbers, breaking alerts, daily recap, miss autopsy)
• Phase 4 — Self-Improving Loop:
  • blueprints/resolution.py (nightly job: actuals from nba_api/MLB-StatsAPI, hit/miss, CLV, alignment, joint outcomes, calibration triggers)
  • blueprints/calibration.py (point-biserial weights, global offset, Brier score, blind spots, CLV/alignment reports)
• Phase 5 — Database + Tests:
  • Migration 005: lineup_scheme_data
  • Migration 006: nba_data_cache, mlb_data_cache, grade_outcomes (ALL ship columns incl discipline_score, CLV, alignment), player_calibrated_weights
  • Migration 007: lineup_updates, reporter_trust (with source_type + starting_trust), odds_warehouse, ship_line_movements, reporter_line_correlation, api_health_log, global_calibration, ship_joint_outcomes
  • 5 new test files covering infrastructure, grading engine, data sources, resolution pipeline, scheme classifier enhancement
• Key Spec Compliance:
  • Grade thresholds LOCKED (A+ through F)
  • SHADOW_MODE = True (first 2 weeks)
  • Bayesian weights are INITIAL ESTIMATES (marked as such)
  • Abstention check BEFORE data cap
  • Point-biserial bounds 0.05-0.50, global offset ±0.15
  • Real edge with vig + quarter-Kelly
  • Brier + CLV from day one
  • Capper A- and above ONLY
  • ABS is CHALLENGE system (successful challenges don't deplete)
  • Foul trouble widens std, not mean
  • Stat-specific B2B adjustments
  • Matchup-specific pace (home 60/40)
  • Positional defense (tracking > roster position)
  • Usage-efficiency tradeoff (-1.5% TS per +5% usage)
  • Tier limits documented but NOT enforced (gate manually later)
  • Node.js stays Node.js, Python is data/utility layer via HTTP

Session 10c — 2026-04-13 (FINAL INTEGRATION PATCH)

• Applied 15-item integration patch — wiring + features + infrastructure
• 35 new tests (644 total), all green across 40 test suites
• Wiring (items 1-5):
  • Scratch → redistribution → re-grade → alt line scan → alert chain in lineup_intelligence.py
  • Slate scan → alt line auto-scan for A-grades in odds_scanner.py
  • Nightly resolution steps 14-18: coaching update, player-out history, evolution scan, unconventional data collection, monthly validation
  • Migration 009: supplement columns on grade_outcomes (coaching_context, redistribution_context, evolution_flag, alt_line_opportunity, unconventional_factors) + unconventional_factor_data table
  • API docs updated with 7 supplement endpoints
• Features (items 6-10):
  • MLB lineup shift logic (PA multiplier changes when player scratched)
  • high_leverage_hook_tendency added to MLB coaching schema
  • Evolution persistence check (3 games before public promotion, false positive detection)
  • Unconventional daily data collection + monthly validation functions
  • Alt line ladder mode (ALT_LINE_MODE env var — 'manual' generates probability ladder)
• Infrastructure (items 11-15):
  • 5 GitHub Actions YAML files: nightly (2am ET), morning odds (10am ET), pre-game (3pm/5pm/6:30pm ET), reporter poll (every 15min), weather (every 30min)
  • scripts/seed_historical.py — one-time historical data seeder (NBA 2024-25 + MLB 2024)
  • railway.toml (Flask service, port 5001, health check)
  • web/vercel.json (Next.js deployment)
  • MLB coaching helper functions for historical seeding
• Product is DEPLOYMENT-READY

Session 10d — 2026-04-13 (SECURITY AUDIT)

• Applied 19-item security hardening pass — Ryan Montgomery panel reviewed
• 45 new tests (689 total), all green across 41 test suites
• Authentication (items 1, 8, 11):
  • utils/auth.py: require_auth (JWT with issuer check) + require_service_role (BETONBLK_INTERNAL_KEY)
  • PyJWT added to requirements.txt
  • BETONBLK_INTERNAL_KEY separates cron auth from service key — service key never leaves Railway
• Input Security (items 3, 10, 13):
  • utils/validation.py: whitelist stat types, sanitize strings (strip SQL/HTML), validate line 0-500, image upload (magic bytes, 10MB max, PNG/JPEG/GIF), parlay legs 2-12
  • OCR rate limit 3/min, max 2 concurrent
  • MAX_CONTENT_LENGTH 1MB globally, 413 JSON response
• Network Security (items 2, 12):
  • CORS locked to ALLOWED_ORIGINS env var (no more wildcard)
  • Real IP from X-Forwarded-For for rate limiter and security logger
• Error Handling (item 9):
  • Production returns generic "Internal server error" — no stack traces
  • 404, 405, 413, 429 all return JSON
• Monitoring (items 4, 5, 6, 15, 17, 18):
  • Security headers: X-Frame-Options DENY, HSTS, CSP, nosniff, XSS protection, Server removed
  • utils/security_logger.py: request logging, rate tracking, SQL injection detection, security_events table
  • utils/env_check.py: startup validation, exits on missing required vars, never logs secrets
  • security-scan.yml: weekly pip-audit + npm audit
  • security.txt: /.well-known/security.txt with contact
  • 90-day security event retention cleanup + weekly security digest (50+ events per IP = action required)
• Infrastructure (items 7, 14, 16, 19):
  • Migration 010: security_events table with RLS
  • Supabase client timeout guidance, retry with 30s default timeout
  • Source code secret scan test (sk_live_, eyJhbGci, sbp_)
  • .gitignore: .env, .env.local, .env.production, *.pem, *.key, .vercel/

Session 10b — 2026-04-13 (SUPPLEMENT BUILD)

• Built 5 intelligence supplement systems — ADDITIVE, no existing code modified
• 65 new tests (609 total), all green across 39 test suites
• System 1 — Coaching Tendency Database:
  • blueprints/coaching.py (NEW) — per-coach NBA + MLB tendencies, nightly update from game logs, shift detection (15%+ threshold on last 15 vs season baseline)
  • 12 NBA fields (pace, 3PT rate, ISO freq, PnR usage, rotation depth, late-game player, score-state lineups, second-unit patterns, redistribution profile, shot location, timeout tendency)
  • 10 MLB fields (starter hook, quick hook, bullpen philosophy, IBB rate, PH freq, bunts, closer-only, platoon, lineup consistency, challenge aggressiveness)
• System 2 — Usage Redistribution Engine:
  • blueprints/redistribution.py (NEW) — two-layer calculation (Layer A: minutes redistribution from historical player-out data + coaching rotation depth; Layer B: offensive system change from archetype shifts)
  • Uses coaching database, applies usage-efficiency tradeoff (-1.5% TS per +5% usage)
  • Three tiers: primary (>=0.20 boost, >=0.75 confidence), secondary (>=0.10, >=0.60), tertiary (>=0.05)
  • Auto-grades at 15%+ boost / 0.65+ confidence, formats 60-second absorption alerts
• System 3 — Alt Line Scanner:
  • Added to existing odds_scanner.py — auto-runs on A-grade props after slate scan
  • Pulls alt lines from odds_warehouse, calculates model probability via Bayesian norm_cdf
  • Real edge with vig on each alt, finds optimal (best EV/dollar)
  • Only recommends if alt edge exceeds standard by 3%+
• System 4 — Unconventional Data Pipeline:
  • blueprints/unconventional.py (NEW) — validation gate for non-traditional correlates
  • 500 instance minimum, Pearson r > 0.15, Bonferroni-corrected p-value
  • 5 tracked factors: altitude, contract year, referee crew history, travel distance (pre-validated), arena altitude
  • Factors only enter grading engine AFTER passing validation
• System 5 — Player Evolution Alerting:
  • Added to existing evolution.py — daily scan across multiple metrics simultaneously
  • NBA: usage_rate, assist_rate, three_pa_rate, fg_pct, minutes
  • MLB: k_rate, bb_rate, exit_velocity, hard_hit_pct, fb_velo
  • PLAYER_EVOLUTION_DETECTED when 2+ metrics show concurrent inflection (10%+ change, 15 game minimum)
  • Timestamped records in evolution_detections table, Evolution Watch content formatter
• Migration 008: coaching_tendencies, player_out_history, evolution_detections, unconventional_validations (all with indexes + RLS)
• Integration: 3 new blueprints registered in app.py (coaching_bp, redistribution_bp, unconventional_bp), evolution + odds_scanner extended with new endpoints

---

Session — Under-querying vs out of data (2026-08-05)

Shipped

• scripts/backfill-context.js — platoon splits backfilled to all 380 settled hitters (was 298; ingest had only ever seen tonight's lineups).
• scripts/reconstruct-game-environment.js — joins the ledger's game slug to statsapi, writes game_context on the LEDGER's key, pulls actual archived Open-Meteo weather. 96/101 settled games now carry real weather; park dimensions 15 -> 30 venues.
• src/services/model/parkWeather.js (+ tests) — park geometry + air read onto HIT TYPE, not P(hit). Wind refused (no park orientation).
• factorGate — cluster-aware bootstrap + effective_n. Unclustered rows keep the original path byte-for-byte.
• specs/under-querying-vs-out-of-data.md — the full record.

Decided

• pitcher_contact_profile DEMOTED: point estimate halved on 2x sample, interval now spans zero.
• platoon / platoon_severity clear the bar but are NOT promoted — 4.5% median contamination (season-to-date splits contain the games they predict) on a -0.0001 bound.
• Park+weather on total_bases: 47 clusters < 500, point estimate WORSE (+0.0011).

Next

• Weather is reachable: ~57 days at 7 games/settled-day.
• Park geometry is NOT — 30 ballparks exist, so a venue-constant factor can never reach 500 independent units. Needs a hierarchical fixed-effect treatment or it stays unvalidatable.
• Point-in-time platoon splits would settle the two held passes.
• Park orientation is the one column that would unlock wind.

Blocker

• git push has no credentials in this environment; commit 7b85934 is local.