The shadow log, approved by the owner on 7 Oct: three candidate changes to the engine (a rating prior, a market prior and deep completions), each backtested on three past seasons, are priced beside every lock from GW6 by Payload v5.10.0 and written to the ledger beside the call. No price moves: the seventeen hashed engine functions are untouched, and no shadow feeds a price or counts as a call.

• Scoreboard · The market comparison gains Shadow · rating prior, Shadow · market prior and Shadow · deep completions, read from the ledger’s shadow_* columns and scored like every other row, each on the matches it shares with the desk with its own n. They appear once a settled desk call carries one; a round before that reads “logged from GW6”, never a dash. Only rows priced by the module version this page ships are pooled. The Summary’s “Does it beat the betting market?” panel keeps its six rows and shows no shadow.
• Model · A “Shadow models (GW6⁠–⁠10)” disclosure under the update rule: what each candidate changes, its setting as the module carries it, and its backtest as run on 7 Oct 2026 (none improved on the baseline out of sample), with how many ledger rows carry a shadow price.
• Data and How it’s built · Opta’s power rankings, ClubElo and Understat’s league data are marked as shadow model inputs, logged beside every lock and never in the prices; the ledger step says the same in one line, and the footer and the Model tab’s source hierarchy call them shadow-model inputs rather than trials.
• One module, two runtimes · site/js/shadow.js is the shadow’s only definition; the Apps Script copy is generated from it, and a test fails if the two differ.

Three outside reviews of a saved Summary tab (7 Oct), triaged by the lead and approved by the owner. Wording, rounding, navigation and the no-JavaScript copy; no price moves: the seventeen hashed engine functions are untouched.

• Percentages add up · Three shares of one distribution printed side by side are rounded by largest remainder (pct3), so a split never reads 99 or 101; rankings and single percentages stay on the raw values.
• Labels · A model pick is a “Model prediction”, never a call. A card’s score is “Most likely score” only when it is the mode of the whole scoreline grid; otherwise “Likeliest score in an Arsenal win”, with the model’s three percentages beside it so the 1X2 probability and the score read as two different things.
• Record · Beside the desk’s record one computed line gives the complete record: calls right of graded, how many settled fixtures the desk locked, and every fixture including model fallbacks and missed locks.
• Baseline · The ⅓-⅓-⅓ line is an uninformative probability forecast, not random picks; scoring above it on a small, upset-heavy sample does not mean worse than random.
• Navigation · Two tiers: six primary tabs and a Research control that opens Underlying, Model, Diagnostics, Data and How it’s built, pinned at the right on phones. The page title names the view; the clock and countdowns re-render once a minute while the tab is visible; link previews (Open Graph) for shared links.
• First paint and no JavaScript · The template loads as one bundle (views/_bundle.html); a static copy of every tab, regenerated twice a day by desk-gate, lives at /snapshot/, with robots.txt and a sitemap for readers and tools that do not run scripts.

A sitewide truth audit (owner, 6 Oct): sentences written for GW1–GW3 were still on the page as if current. No price moves: the seventeen hashed engine functions are untouched.

• Now and history are kept apart · A sentence about the present is computed from the payload; a sentence about the past is dated and frozen, and is never filled with today’s engine numbers. The GW3 cards grade the ledger’s 16:33 calls and keep the 4⁠–⁠5 Sep re-prices as dated history.
• Sources · The footer, the Model tab and How it’s built describe the pipeline as it runs: FPL, football-data.co.uk, FotMob and Understat read directly by the sheet’s scripts, Polymarket on the tick, Opta and Forebet lines logged into the ledger when found; Coupler, Solio and Premier Injuries retired.
• Season calls · Kept as made on 21 Aug and 4 Sep, frozen to be graded at the end of the season, with a computed line on where each call stands today.
• Market comparison · Summary and Scoreboard compare the desk with both model versions, Polymarket at lock, Opta’s supercomputer and Betfair close, each scored on the matches it shares with the desk.
• Layout · Running text runs to the edge of its column on every tab.

The Step 3 data contract, shared with Payload v5.6.0: the producer now locks the model’s call automatically when the desk has made none by kickoff − 45 min, marks the row call_source model_fallback, and publishes its fallback decisions, missed locks and lock refusals under gates. No price moves: the seventeen hashed engine functions are untouched.

• Fallback locks · A row with call_source model_fallback is not a desk call. It is kept out of the record strip, the forward ledger tile, the round log, the desk Brier and RPS rows and every check that counts desk calls, and is shown on a Model fallback record line of its own, with its n. A blank call_source, every row before v5.6.0, is a desk row.
• Scoring · The desk row scores the desk’s calls only. The model, market prior, Betfair close and Polymarket commit rows also score the fallback locks, which are real commits at that instant. The strip compares desk, model and Betfair on the desk’s fixtures alone, so its n stays equal.
• Cards · A fallback-locked fixture shows the model call with the status ‘Fallback lock (model)’ on a dashed pill, and its sub-line says the desk made no call by kickoff − 45 min. It is never a missed lock, and the round line reads ‘called k of n · fallback f · missed m’ once one exists.
• Gates · When the payload carries gates.missed_locks, it is a second opinion: a fixture is a missed lock when the producer lists it or the page derives it, so neither side can hide one. The Data tab prints the fallback mode with its recent decisions and the last seven days of lock refusals when the payload carries them, and nothing when it does not.
• L15 also fails when a fallback lock renders with any other status, or a desk call with the fallback’s. New L16 checks every fallback lock against the raw rows: out of the desk record, the called count and the desk Brier, and labelled as a fallback. It reports Blocked when the ledger has no fallback row.

The owner’s instruction after v3.6: fix every remaining failure that comes from a bug, a stale assumption or a typed literal, keep visible the ones that tell the truth about the model, and correct the in-file record where the payload contradicts it. No price moves: engine output is identical on all 380 pairings and the port hash is unchanged.

• K7 · Exempts and names the ledger rows committed before the earliest reference capture in the ledger, a cutoff read from the data; every later row is still held to the rule.
• W5 · Managerial reset is published as suspended at 0% effective (12% nominal) while both penalties are zero; W5 checks the realised share against the effective weight, and W1 reconciles nominal against effective plus suspended.
• X3 · Traces only cards whose prose is filled from the live engine; frozen cards are historical records and are counted as exempt.
• Missed locks · The card shows the model, market and Polymarket reference captures with their capture instant, or a red null row, never the live engine.
• Prose · The E6, E10 and P7 notes and every version-log sentence that named a check state are generated from the measurement and the live tally.
• In-file record · Three GW2 kickoffs typed an hour behind UK time are corrected to the payload’s, the GW1 and GW2 lists print the payload’s kickoff, and a test holds every in-file GW1–GW3 fixture to the payload’s results.
• Commentary · Three claims the data contradicted are corrected: GW1 above 55% went four from five, GW1 priced three matches as 1⁠–⁠1, and one of the three GW2 revisions landed. The GW1 set-piece figure is marked unverified.

The 4 October audit of the v3.5 page against the GW6 payload, fixed on the website that replaced Claude Design. No price moves: the seventeen hashed engine functions are untouched and the port hash still equals the payload’s. What changed is which rounds are scored, how ledger rows are joined, how a missed lock looks, and what two checks assert.

• SC1 · The forward record is read from the ledger for every round it covers, not from the in-file GW3 cards: the strip, the forward ledger tile, the round log and the scoring prose now count GW4 and GW5, with ‘of N’ wherever a round was not fully called.
• SC2 · H1, L3 and L5 compare against figures folded straight from locked_calls and results, so a renderer that drops a round fails them instead of agreeing with itself.
• SC4 · Each round gains a reference-family table over every fixture with a capture, each row with its own n, and a pooled forward table that L3 reconciles.
• SC6 · A round with no model or market split at lock shows a null row in red, never today’s engine re-run in-sample.
• LED-1 · Ledger rows join on FPL’s fixture code; fixture_id is a fallback only within 200 days of kickoff, so next season’s rows cannot overwrite this season’s.
• SC3 · A fixture that kicked off with no call shows ‘Missed lock’ in red, each round states ‘called k of n · missed m’, and L15 fails if a missed fixture renders as anything else.
• SC5 · K7 checks every ledger round, not only the target round, and reports the GW4 rows locked before the first reference capture.
• H3 · A Blocked row is data that has not arrived yet, not a printed invariant, so H3 no longer fails when data lands.
• LED-9 · Every UK time goes through one helper that names the UK zone from that instant’s own offset from UTC.
• LED-4/5/7 · Vocabulary chips colour only known values, and the Polymarket bar at lock carries its own capture time.

The integrity brief, applied in five runs — the first four against the v5.3 payload, the last against v5.4. No price moves, but the claim is narrower than it was: the text of solve, factorTerms, phaseStrengths and playedBy did change, for D4’s null handling, and the output is identical on all 380 pairings under both the pre-season and the market prior. ENGINE_VER stays v2.1 with one caveat — a club reporting zero played now prices at its prior instead of at the league count, which is a different number for that club and the correct one. What else changed is what the page reads, how it folds a ledger, what it is able to assert, and what it now admits it cannot.

• D1 · moved_after_capture is read as a non-blank string, never a boolean, and the chip prints the producer’s own sentence beside the flag.
• D2 · No render path dereferences an absent result: a missing score prints an em dash, and renderVals is wrapped so a throw in any presenter leaves the paste, clear and fetch controls standing.
• D3 · The harness self-tests. chk() refuses a typed Pass, so a Pass or Fail can only come from a measurement; every asserted row is re-run against its negated input and must flip; a row that does not flip is re-labelled Not asserted and counted against a declared PRINTED_INVARIANTS list. Seventeen rows rebuilt, eight added — C6, C6b, C7, L12, L13, S10, P7, P8 — E2b folded into E2, C3 split into a state row and C3b.
• D4 · Absence is null, and null is not zero. playedCount() returns null with no played block and the solve refuses rather than dividing by a literal two; the adapter returns a league count only when every club carries a finite figure, because Math.min over an absent value is NaN and a NaN divided into a season total propagates through the whole solve in silence; playedBy() carries null for a club with no entry and distinguishes it from a club that has played nothing, which now sits on its prior and is labelled prior only; a rest-day figure must be a finite number. strengthsSafe() degrades the page to the pure prior rather than taking it down, and every line that used to quote a substituted count says not reported instead.
• D5 · One scoring rule per row. The desk row is a distribution or it is unscored: no one-hot fallback, Brier and RPS print an em dash, and the direction hit prints beside them. Both non-called legs are capped, and the retrospective prints its K = 0.55 sensitivity.
• D6 · Every denominator is read. The Betfair baseline counts rs.length against the rounds[] fixture count and reports n of N priced; gradeSet returns null on an ungraded round instead of 0.000; the header Brier pair carries its n and H1 fails when the two differ; the forward ledger scores every row over one intersection per round and prints its size once; the pm_ref row completes the six-row promise.
• D7 · Nothing at lock is priced now. With no split in the ledger the desk row is titled direction only and carries no percentage; a result with no call reads Ungraded on a flat pill; a payload with no priced round renders the No priced round view with the producer’s clock authority and the forward list.
• D8 · The fold is order-independent and keeps history. Rows sort by their own stamps before the last-non-blank-wins pass and ties break on content; gw leaves the pair key; a bare-pair stub cannot displace an id-keyed snapshot; _rows keeps the rows themselves so L12 can audit them; L14 folds the reversed ledger and compares.
• D9 · Parity is a hash. The sha256 of the ported region is printed on the Diagnostics tab beside ENGINE_VER, with the region named method by method rather than counted — impliedGoals, playedPairs and resultsIndex were inside the port and outside the hash until the fifth run caught it, which a bare count could never have shown. L11 compares the hash to gates.engine_hash the moment the producer publishes one. New H4 asserts the version log leads with VER and descends strictly.
• D10 · The renderer has no clock. kickoffOf, RMONTH and RYEAR are deleted; every kickoff comes from results[], fixtures[] or forward[] joined on fixture_id, code or club pair; every label goes through one Europe/London formatter; C8 prints which array each card’s kickoff came from.
• D11 · Validate before you save, and the endpoint beats the paste. A pasted payload is stored only after it validates; load() tries the endpoint first and falls back to storage, printing which won and why; ingestClear walks one EXT_KEYS list.
• D12 · The unanchored flag is per leg. The sub-line daggers the thin leg, the fixture-level chip fires only on the favourite’s leg or a total under $5,000, and the Polymarket scored row excludes an unanchored draw and says how many.
• D13 · Small drops. review_gw is read from the payload and says when it had to be derived; R2 reports Blocked instead of vanishing; the harness declares its own size and asserts its ids are unique; G0 counts from rounds[] and forward[].
• Run-4 rulings · One row reports Fail on this payload — E10 — and its note on the Diagnostics tab says why. Two rows were re-scoped rather than tuned: C6 measured freshness from the page’s wall clock, which duplicated C1’s payload-age assertion and went red for every payload over two hours old whatever the producer had done — it now measures from the build stamp and reports producer health at build time — and E8 asserts on the payload instead of on card prose: no scorers[] entry marked available may appear in availability[] as out or suspended, and the in-file sentences it used to police are deleted. E6 was rebuilt to test whether the published factor sum is in the price; the row it replaces asserted only that the term was non-zero somewhere in a table. W5 was made two-sided on the same principle — a published weight that binds nothing is a defect, not a blocked assertion. K8 scans every round the ledger covers rather than the target round alone, and H3 and this tab’s header read one tally.

Triggered by the page at 400px. Eleven data tables squashed their columns to min-content rather than scrolling: .table is width 100%, so a table without a min-width has no width to overflow and the section padding does the rest.

• Eleven tables now scroll rather than squash. Each carries a min-width computed from its own columns — fixed widths plus 150px per auto column — inside an overflow-x wrapper: round locked ledger 410, underlying fixture table 780, A/B reconcile 530, availability split 370, GW3 forward ledger 390, strategy 460, fixture grade 410, per-gameweek log 660, club/manager/read 710, club table 600, diagnostics solved strengths 490. The wrapper alone does nothing; the min-width is what converts a squash into a scroll.
• Four tables are deliberately left bare because they fit inside the 336px content width of a 400px viewport and wrap better than they scroll: the round-graded table, the availability out-list, the FotMob model table and the diagnostics parameter table.

Triggered by one label carrying two facts. The header read a single version number for both the page and the pricing chain, so a layout change and an engine change were indistinguishable from the outside — and the sheet’s model_ver had nothing on this page it could be compared against.

• VER and ENGINE_VER are split. VER is this page; ENGINE_VER is the pricing chain of which the Apps Script port is a byte copy. The header reads both, and every prior-read label and scoreboard row tags the engine version it came from.
• New check L11. Every target-round ledger row that carries model_ver is asserted equal to ENGINE_VER, so a drifted port is caught by the page instead of by hand-diffing two files before a lock.

Triggered by two things the page was measuring against itself. K6 timed the capture window off the render clock rather than off the payload, and the prose overlay still carried a whitelist entry for a field the ledger had started writing.

• K6 runs on stamp_epoch. The capture-window check now measures from the payload’s own stamp rather than from the moment the page happened to render, so the result stops depending on when it is read.
• The duplicate whitelist entry is deleted. The overlay may only supply fields the payload has no column for; once the ledger writes one, the whitelist entry is a second source for the same fact.

Triggered by the reasoning behind a call being held in a column nobody rendered. The sheet writes why and risk with each locked row, and the card printed the call, the prices and the drift but not the sentence that explains them.

• Why and risk render in the card’s Notes region, ledger first and prose overlay second. Where the ledger carries the sentence, the ledger owns it.
• New check L10. Every why and risk the ledger carries is asserted to appear verbatim in its own card, so a note that exists and is not shown fails rather than passes quietly.

Triggered by the upstream layer dropping every calendar assumption the page was built on. The routine no longer decides the round by weekday, the ledger is 57 columns wide and captures each fixture twice, and a correction arrives as an appended row rather than an edit.

• v3.0 · the round stops being a unit of work. The page read a calendar it had assumed: ten fixtures, 38 rounds numbered 1 to 38, one kickoff per fixture, history in three in-file arrays. None of those are true of a Premier League season. Every count now comes from rounds[], the selector is built from the event ids that exist rather than from 1 to 38, any settled round draws itself from the payload, and a fixture with no date says so. The sheet now captures each fixture twice — unattended inside 24 hours of its own kickoff, and again at the moment the desk commits — and the card shows both, with the drift between them.
• The three in-file round arrays are demoted to a prose overlay on a built card. Structure comes from the payload on every round; the overlay may only supply fields the payload has no column for, on a whitelist. Where a round holds any ledger row at all, the ledger owns the call.
• ref_horizon_h is printed as measured. The 12 September dry run captured seven fixtures between 1.84 and 6.84 hours out because the trigger was installed on match day; the design intent of 24 hours is not what happened, so it is not what the card says.
• The payload and the page disagree on two club names by design — the payload carries FPL’s "Man Utd" and "Spurs" — and the page wins. PLIngest.NAMES stays the single spelling table and no name is ever read from the payload.
• Two checks were counting and not rendering. The Rounds and Calendar groups were missing from the diagnostics group list, so R1 and R2 contributed to the tally while appearing nowhere on the page — a number that exists and is not shown, which is the 11 September failure in miniature. Both groups are now in the list, and the new Calendar checks render with them.

Triggered by the first automated lock. At 16:30 the day before kickoff the sheet staged the model, market-prior and Polymarket columns for GW4 and the routine submitted the desk calls; the page parsed the ledger, L7 passed on engine parity, and the round view still priced the desk and market slots from the live engine. The ledger was right and the cards were not showing it. Six corrections, no new modelling.

• 1 · lockedCalls() keeps a row that carries no desk call. From sheet v4.7 a row exists from 16:30, before the desk locks it; the parser required pred and discarded every staged row.
• 2 · A graded card freezes only on a row that carries a desk call, so a staged-only row can never freeze one.
• 3 · The target round is rebuilt ledger-first through one builder: model and market-prior bars from model_split_* / mkt_split_* when staged, else the live engine labelled · now; the desk bar from desk_split_* or a one-hot at the lock split; Polymarket from pm_lock_* with volumes and the unanchored flag. The headline is the desk call once locked_at is set, with the engine printed beside it, never in place of it. Status reads Open → Staged → Locked. A fixture with no ledger row renders exactly as it did before.
• 4 · Two chips read the sheet’s v4.8 columns when present: the 09:00 → lock Polymarket move, and the raw overround.
• 5 · New check L8. Every target-round card with a ledger row is compared to that row bar by bar and headline by headline. L7 proved the ledger agreed with the engine; nothing proved the card showed the ledger. This is the check that would have caught 11 Sep.
• 6 · The header strip and round box report desk locked N of 10 with the lock time once the desk has locked; H1 still finds the deadline text inside the strip.

Triggered by the GW4 desk review, run in Node against the live engine on thirty results. Fourteen changes ship as one version under the structural-correction clause. All fourteen changes are in.

• 01 · Tempo calibrated to the league after the solve: every fixture scaled so the mean of λ + μ over all pairings equals a shrunk blend of goals and xG per match. The engine was pricing 3.49 goals a match against 2.83 actual and 3.10 xG, which is why it priced draws at 21% in a season running at 33%. New check E9 publishes the pre- and post-scale means; E10 holds the target round to 24⁠–⁠27% draws and 2.9⁠–⁠3.1 goals.
• 02 · Dixon-Coles ρ moved from a typed −0.045 to −0.10, stated as a prior; fitted at n ≥ 8 (change 13).
• 03 · Manager penalties set to zero, term still wired. It was 51% of the realised adjustment and moved Brier by 0.001. A2 is blocked until n ≥ 8.
• 04 · Congestion from the payload’s rest days, continuous: −0.03 × max(0, 3.5 − rest days). The european list is deleted — it was wrong and unread.
• 05 · Absences weighted by minutes and by the xGI / defensive-contribution share of the players missing, from the payload’s availability block, instead of a headcount.
• 06 · The solve fits on FotMob only; Football-Data is never averaged in. The spread between the two sets each fixture’s interval; the hand-typed per-card delta is gone. S7 is now an assertion.
• 07 · One ledger. Locked calls are rendered from the sheet’s locked_calls tab in the payload; lockedPrices() is deleted. The engine’s own price sits beside the desk call, labelled model at lock. GW3 grades on the desk call.
• 08 · A market-implied prior: every played fixture’s Betfair closing 1X2 inverted to implied goals and solved with the same opponent-adjusted machinery. The engine runs on both priors with the same evidence and the same w; the GW4 table shows three rows per fixture and the ledger scores both. Checks R1, R2.
• 09 · λ from open-play and set-piece components with τ 5 and 14, built on the payload’s situations block. Blocked until the routine emits it (E11); at n = 3 it would barely move a call.
• 10 · The game-state filter runs whenever the payload carries per-club score-state xG, with the multipliers published on the strengths table. The sample payload of the time carried none, so C4 was blocked on data rather than on a decision.
• 11 · Per-club match counts from the payload; ids are the join key in the adapter and every name is derived from one table. Result rows with unknown clubs are reported through S1 instead of dropped. Check S9.
• 12 · The season simulation samples each fixture’s outcome from its Dixon-Coles matrix rather than two independent Poissons. Check P6 asserts the sampled draw rate against the matrix.
• 13 · Home term, ρ and τ fitted by maximum likelihood on the played fixtures and published beside the typed values on the Diagnostics tab. Diagnostic only; adopted at n ≥ 8 (K1, K2).
• Sweep 3 · G2, G17 and G21 are derived from the payload’s producer gates and the live checks instead of describing a previous round; the return-date panel lists only cross-month conflicts.
• Sweep 2 · Captions under the payload-bound tables are derived from those tables (expected-points gaps, heaviest absence lists), the return-date conflict table requires two parsable dates, and the G0–G21 gate list is stamped with the gameweek and payload it attests plus the producer’s own gate summary and run log.
• Sweep · Every block the payload carries is read from the payload and its in-file copy is deleted: rates, played pairs, context, banked points, the live table, expected points, availability, suspensions, return-date splits, structural reads, GW1⁠–⁠2 results and the Betfair-favourite baseline. Without a payload the page renders only the Data tab. Check T1 asserts the Table and Expected-points panels against clubs[].
• Aesthetics · Five-size type scale (11 / 13 / 15 / 20 / 32), 11px floor, no caption under 70% ink. Semantic tokens for home / draw / away (green / blue / rust) and good / critical for hit and miss, all distinct from the accent, which now marks interactive and live only. One round view with a GW1⁠–⁠38 selector and a persistent strip (record, Brier v market, next lock from deadline_epoch). Cards lead with the call and stacked home / draw / away bars for model, desk and market on one scale; prose sits behind a disclosure. The nine-column joint table is retired — the bars carry it. Diagnostics unchanged.
• 14 · GW3 onward is scored on probabilities: desk call, model on each prior, Betfair closing and Polymarket at lock on multinomial Brier and RPS over the same fixtures. The Betfair-favourite baseline for GW1⁠–⁠2 is computed from the payload instead of typed. The literal nPlayed = 2 in the scoring path is gone. Check L6.

Triggered by a full diagnostics pass rather than by a round. Three findings, and the first is about the diagnostics themselves: the seventy-six QA rows this page published were typed string literals. A suite that cannot fail was attesting to a model that had shipped four defects in two days. The other two are engine defects — the number of matches played was hard-coded in three places, and every card was re-derived from the live engine on every render.

• The QA list is now an executed harness. 83 checks run at load against the live objects, each publishing the figure it measured; 1 fail, 8 are blocked on data that does not exist yet, and 3 are declared manual instead of claiming a pass. The action register on the Diagnostics tab is derived from the failures, so it cannot drift from them.
• Matches played is read from the payload. v1.9 divided season totals by four — two models and, hard-coded, two matches — and set the shrinkage weight from a literal 2. A GW4 payload would have halved every rate in the league and under-weighted the evidence at the same time, silently and in the same direction for all twenty clubs. New gate G19 asserts the declared count against the fixture list and against every club’s appearance count.
• Locked prices are stored. A fixture past its kickoff renders the price it carried at that moment; only an open fixture reads the engine. Every version to v1.9 re-derived all ten cards on every render, so each model change re-priced played matches while the page claimed its calls were immutable. New gate G20, and the live engine is still printed beside the snapshot so the gap is visible.
• The round clock is real. Kickoffs are computed from each card’s own day and time, so a round whose matches have been played and whose results have not arrived reports as closed and ungraded rather than as live. New gate G21 — which is what GW3 now trips.
• The season projection can carry banked points derived from a results block instead of the transcribed two-round table. It falls back to the table until the payload supplies results.
• The opponent adjustment is solved rather than approximated, and regularised rather than trusted. v1.7 ran three undamped Jacobi passes and called the result a fixed point; the harness measured the final pass still moving multipliers by 0.40. Solving it properly then exposed the real problem: on two matches per club the fixture graph is a union of cycles, the system is not identified, and the true fixed point is garbage — it made Bournemouth the best attack in the division because they had faced Manchester City, whose defence the same solve had driven to 0.16 because City had faced Bournemouth. The adjustment now carries a ridge keyed to the sample, 3 / matches played, so the schedule correction enters with exponent 0.40 at two matches and grows towards 0.86 by the end of the season. Opponents are averaged geometrically, which is what makes the system solvable at all, and the solved level is normalised so the goal mean is not quietly inflated — it was running 6.7% hot.
• Every club’s solved attack and defence is published on the Diagnostics tab, and any prose quoting a strength, a price or a clean-sheet line now fills from the object that produced it. Five of the eight standing reads were quoting multipliers the corrected solve no longer produces. A second prose check traces every percentage a card prints back to that card — the token scan can only see unresolved braces, and a stale hard-coded number looks exactly like a correct one.
• Scoreline grids size themselves to the fixture. A fixed 9×9 grid was discarding 1.1% of the probability mass on the highest-scoring fixture on the card and renormalising it onto the low scores.
• Convergence residual, pass count, grid mass, the Dixon-Coles mass shift, schedule-graph connectivity, strength centring and realised factor shares are measured and published rather than asserted in prose.

Triggered by a third audit pass. Two findings accepted, one declined. The accepted ones: the six factors bound in v1.8 were absolute rather than relative, so with fourteen of twenty clubs carrying a first-season manager the model was deflating league-wide goal expectancy and burning most of its adjustment budget on one term; and club names were an unchecked join key across seven separate tables.

• Factors split into relative and tempo terms. Managers, squads, injuries and congestion are zero-centred within the fixture — the home-away differential is preserved exactly, the goal total is not touched. Rule changes stay uncentred. Gate G16 moves from partial to pass.
• Club keys reconciled across the rates table, the fixture list and all five context maps at solve time, with orphans reported on the build tab. New gate G18.
• Game-state-neutral xG filter built and wired to a gameStateSplits payload field: 0.86 while two or more behind, 1.28 while ahead, normalised to a league mean of 1.00 so it redistributes attacking credit without moving the goal mean.
• Gate G17 stays unmet, and this is a decision rather than an omission. The filter would raise Newcastle’s adjusted attack and reverse the Bournemouth call — the audit puts the fixture back at Newcastle 2⁠–⁠1 and back in line with Opta. There are no score-state splits in the data layer. Reversing a published call on assumed inputs is the failure mode the gate exists to catch, so the call stands and the fix waits for real data.
• The payload can now supply the played-fixture list and the full context block as well as the rates table. Each falls back to the in-file copy independently, so a partial payload degrades one input rather than the page.

Triggered by an audit of the engine v1.7 had just shipped. Two findings, both structural: the home-advantage term was multiplying the home intensity and dividing the away one, squaring a 14% venue effect into a 30% goal ratio; and eleven of the thirteen published factor weights were never read by the simulation at all — they were display text beside a model running on shrunk xG rates.

• Home advantage applied once, to the home intensity only. The away side is no longer penalised for playing away twice. Every home price on the GW3 card falls, some by six points.
• The Hull call is withdrawn. It existed because of the double-counted venue term; corrected, Villa edge the fixture at 38% and the desk now agrees with Opta. Third revision of one fixture, caused by a defect the desk shipped and is recording rather than tidying.
• Six bypassed factors bound into log-intensity: managerial reset, fixture load, squad change, injuries, rule changes, market priors. A manager change or an injury list now moves λ.
• Every factor now publishes its measured share of this card’s total adjustment beside its nominal weight. Managerial reset is 12% by design and 65% of what actually moved — fourteen of twenty clubs have a first-season manager and nobody has played a European midweek yet. The divergence is printed, not smoothed.
• Dead-heat rule: outcomes are ranked on raw probabilities, never rounded percentages, and the margin to the runner-up is published. Inside three points the fixture is declared a dead heat. At the time of this version Fulham v Palace sat at 0.6 and Hull v Villa at 2.9; both figures move with the model, and the live ones are on the GW3 tab.
• The unconditional mode of each joint matrix is published beside the conditional one. It is 1⁠–⁠1 on six of the ten fixtures, and calling the conditional mode “modal” was overstating what the distribution says.
• Season projection replaced by Monte Carlo: 2,000 runs over every unplayed pairing, sampled from the same intensities the match cards use, reporting mean points, the 5th–95th band, and title, top-four and relegation probabilities.
• The engine will read pl-datalayer.json from the project if the weekly routine has written one, falling back to the transcribed table. The build tab reports which spine is live.

Triggered by a second audit pass, and by the defect v1.6 exposed rather than fixed: the scoreline and the win probability were produced by two separate paths, so nothing stopped a 2⁠–⁠0 sitting next to 49% confidence. The same decoupling is what forced a residual-expansion rule for scoring, and that rule was itself unsound — a draw published below 35.5% expanded into a vector whose largest element was the home win.

• One engine replaces the two tracks: a Dixon-Coles adjusted bivariate Poisson. Attack and defence multipliers give λ for each side, the joint matrix gives the 1X2 probabilities, the clean-sheet lines and the scoreline together, and all three are published per fixture.
• The scoreline on each card is the modal score inside the region the probabilities already favour, and the confidence is that region’s own probability. Neither is typed.
• Opponent adjustment added at 4%: every club’s xG and xGA are divided through by the strength of the opponents actually faced, solved to a fixed point. Brighton’s 5.17 xG becomes a 1.22 attack; Newcastle’s record loses its call.
• Draw prior retired. Draws now arrive when the distribution produces them, so the gate has nothing left to gate. Fulham v Palace splits 38 / 24 / 38 and the 1⁠–⁠1 is withdrawn.
• Phase-specific shrinkage: τ = 5 for open-play generation and the strength estimates, 6 for overperformance regression, 14 for set-piece conversion. A single τ was treating three different stabilisation rates as one.
• Residual expansion for retrospective scoring constrained so the stated call always keeps plurality. GW1 and GW2 Brier and RPS figures move slightly as a result.
• Two GW3 directions changed — Bournemouth at Newcastle and Hull over Villa — taking the disagreements with Opta from one to two. Seven calls re-priced without changing direction. Ipswich v Liverpool remains frozen.
• Runtime: the three round spines, the club rate table and the strength solve are memoised per instance, so a tab change re-runs the view mapping rather than the whole model. Tab state is bound to the URL fragment, so a view can be linked and survives a reload.

Triggered by an external audit of the desk rather than by a round: the v1.5 factor weights summed to 108%, the published Brier was a binary score on a three-outcome market, the new regression term was firing at full strength on two matches, and the Brighton card named a goalscorer the same data layer had listed as unavailable. Three of the four are defects in the model, which is the one thing that reopens a locked price.

• Weights normalised to 100% across thirteen factors. World Cup residue and unofficial transfer reporting retired; managerial reset, fixture load, squad change and market priors trimmed. No factor moved more than two points.
• Overperformance regression scaled by sample, n / (n + 6), so it applies 1.8% at two matches instead of 4%. It converges on the nominal weight rather than starting there.
• Scoring replaced: multinomial Brier and ranked probability score across home, draw and away, with the expansion rule from one call to three probabilities printed on the scoreboard. The old binary figure is kept beside the new one so the difference is visible.
• Named goalscorers now vetoed against the availability manifest before a card ships. Hinshelwood rejected on the Brighton card and replaced; gate G10 fails the build on any unavailable selection.
• Nine of the ten GW3 calls re-priced under the defect clause — four scorelines revised, no direction changed. Ipswich v Liverpool had kicked off and is frozen. Every original price stays printed on its card.
• Confidence intervals now scale with the two xG models’ disagreement per fixture: ±3 as a floor, ±7 on Arsenal v Chelsea and Fulham v Palace where the spread is 0.54 xG.
• The retrospective GW1–GW2 record and the forward-tested ledger from GW3 are reported as two records with two denominators, instead of one combined figure.

Triggered by the GW3 data layer v2: a second independent xG model beside the first, an expected-points table that corroborates three standing reads without having seen them, and an availability layer that meets the cross-source gate for all 20 clubs for the first time.

• New factor: overperformance regression at 4%, funded by trims to base rating, squad change and World Cup residue. It fires only where both models agree on the sign.
• Chance quality by phase raised 6% → 8% on the GW2 grade — the two calls reversed on the splits both landed, one exactly.
• GW2 graded: 7 of 10 on direction, 2 exact. The first round in which the desk beat the home-side baseline.
• Availability two-sourced for all 20 clubs, injuries and suspensions separated. Where FotMob and Premier Injuries disagree on a return date, both are carried.
• GW3 calls locked at 16:33 BST and not re-priced by the 19:03 refresh. The lock rule is now written into the update rule.
• Opta power rankings retired after a fourth failed retrieval. FotMob expected points ingested as a labelled external model, not as a replacement ranking.

Triggered by the GW3 data layer: 20-club situation splits (xG/Sh and xGA/Sh by open play, corner and set piece) — the first input that separates chance quality from finishing and locates both in a phase.

• New factor: chance quality by phase, at 6%, funded by trims to base rating and squad change.
• Three GW2 calls revised pre-kick-off on the splits — Liverpool to 2⁠–⁠0, Bournemouth–Everton to 1⁠–⁠2, Coventry–Hull reversed to the away side. One of the three landed, the Hull reversal, and exactly; Liverpool–Forest finished 2⁠–⁠2 and Bournemouth–Everton 1⁠–⁠1.
• Tottenham–Newcastle reversed with the reasoning corrected: the corner mismatch cancels, and the call rested on the open-play edge. It landed 0⁠–⁠2.
• Draw gate widened: also publishable when the benchmark simulation makes the fixture its most-drawn of the round, or on exact clean-sheet parity where no lines exist. It went 1 from 2.
• Solio Analytics adopted as the GW3 benchmark for clean sheets; Opta’s MD3 win probabilities returned for 9 of 10 fixtures.

Triggered by the complete GW1 grade: 4 from 5 at 55% or above, 0 from 5 below it. The problem was never the confident band.

• Hard draw gate: publishable only when the two win probabilities are within three points.
• Contrarian gate: a call against the external favourite needs a named mechanism in the card.
• Coventry v Hull reversed under that gate, then reversed again in v1.4 on the splits — where it landed.
• Set-piece and defensive-structure weight raised to 9% on the 27.4% league-wide share.
• Every card now carries a conviction flag so the weak band is visible before the result, not after.

Triggered by the nine settled matches and the Opta match reports.

• New factor: defensive structure and set pieces. Rates how a side concedes.
• Injuries keyed to dated return windows instead of a flat penalty.
• Manchester United cut ten projected points on structure, not on one result.
• Bottom-three and best-promoted calls switched: Hull out, Coventry in.

Triggered by the first six settled matches: one result correct, every draw call wrong.

• Draw prior 0.30 → 0.24. Home term 0.30 → 0.38 goals for rounds 1⁠–⁠6.
• New-manager penalty split by venue: 0.10 home, 0.28 away.
• Promoted-side home baseline +12%; away baseline unchanged.

Pre-season build. Three seasons of underlying numbers, no in-season evidence.

• Twelve factors, symmetric manager penalty, flat promoted-side conversion.
• Called four draws in ten and got one, in a match called 1⁠–⁠2. Retired after one round.