feat(compliance): rail 22 — the cash posture no venue will affirm (#6…

[eaitbrahim]

…91, part 1 of 2)

Stage 2 of #666. Schema v18.

WHAT STAGE 1 ESTABLISHED, AND WHY IT CANNOT BE FIXED WITH ANOTHER READ. Coinbase exposes no cash-versus-margin field for spot. The 2026-09-02 probe found margin_rate present in every account's response schema and carrying null -- so a check keyed on its presence would refuse every deployment -- and portfolios DEFAULT/CONSUMER with no INTX. Every margin, borrow, leverage and liquidation field in the SDK lives in the futures or perpetuals types. The adapter check therefore REFUTES and never issues: an INTX portfolio proves derivatives are available, its absence proves nothing.

That residual is the same shape as rail 17's qabd. Silence is not evidence of possession, and silence is not evidence of a cash account. What closes it is a human who knows their own account saying so, on the record, with the venue able to contradict them.

TWO DESIGN CHOICES DIFFER FROM VenueTradeScope, AND BOTH FOLLOW FROM THAT:

• No CONFIRMED state, and a test pins its absence. Trade scope earns one because the venue re-proves it on every accepted placement. NOTHING can ever prove a spot account is cash-only, so CONFIRMED would be a state nothing is entitled to write -- and an unreachable state is one a later reader eventually writes anyway.
• A TTL, where trade scope has none. Trade scope needs no clock precisely because the venue re-confirms it continuously. This record has NO observation channel, which is VenueSubscription's situation, and there a due date is the only thing between a lapsed claim and a live spend. 90 days, not rail 17's 7: an account does not silently acquire margin, and a prompt that fires weekly gets automated, which is how an attestation stops meaning anything. The due date is STORED, not derived, so changing the TTL cannot retroactively expire a claim a human made under the window in force when they made it.

Rail 22 vetoes new ENTRIES and nothing else -- exits, stop rolls, cancels and DCA exits are untouched, because a rail that blocked an exit over a fact about the ACCOUNT would strand a position that wanted out. It is in LIVE_STATE_RAILS, so paper skips it AND reports the skip.

FOUR distinct veto messages, because there is no venue read to fall back on and the message IS the interface: never-attested, expired, attested-margin (which calls for a change to the ACCOUNT, not a re-run of the command), and a DIFFERENT credential -- never described as "never attested", which is #624's exact mistake.

keel posture attest --spot-cash is TTY-gated and declared in keel/capabilities.py; --margin-enabled is ungated, because it only ever reduces capability -- keel autonomy's asymmetry. Recording margin is better than refusing to write: absent reads as "nobody has attested", which is a less useful fact and invites the same person to be asked again next week.

refute_posture is deliberately not symmetric: a human issues a claim, only the venue withdraws one. With no record it writes nothing rather than inventing a history, and refuted_ts marks the FIRST contradiction of a claim rather than advancing every build.

Tests written first, red before green: 42 across four files (16 core, 10 storage, 9 rail, 11 CLI, 6 refutation).

Mutation-verified, 9 mutants, all killed: the entries-only gate removed; the paper skip removed; a missing record failing open; the TTL ignored; a margin attestation permitting; due-at off by one; refutation inventing a record; attest not stamping a due date; a refuted record permitting. A tenth was written and discarded as ineffective -- del is_buy after the branch changes nothing, and counting it would have inflated the run.

The rail-count pin did its job and exposed two bugs IN ITSELF along the way: it read "the 20% rail" (rail 11's drawdown threshold) as a count claim, and \btwenty\b matched inside "twenty-one" because a hyphen is a word boundary, so every line it had just corrected still read as stale. Both are fixed with the reasoning inline.

Refs #691

Claude-Session: https://claude.ai/code/session_01NzuKAe2RVrPt9acVAWjRyL

What & why

Tests-first evidence

• Tests written first, seen failing for the right reason

Gates (all must pass)

• uv run ruff check clean
• uv run mypy clean
• uv run pytest -q green

Scope check

• This PR touches a rail or a default classification — checked means it DOES;
  leave checked only if true, and if so: cite the source and open the discussion
  BEFORE review (CONTRIBUTING.md, "Governance: rulings vs. machinery").
• New dependency added (needs discussion first)