feat(web): the Positions view -- marked at the rails' own price (#701… - #717

…, items 1-4)

keel status showed a tranche's id, product, rule, qty, entry price and bracket, and web/payload.py::_position_payload explained in its own docstring why it showed no P&L: "OpenPositionStatus carries neither, so emitting one would mean this layer multiplied qty by entry_price... the fix, if it is wanted, is upstream." This is that fix, upstream, plus the endpoint and view that read it.

THE MARK IS THE RAILS' MARK, AND THAT IS THE WHOLE POINT. agent._mark_to_market_parts values a holding at repo.get_candles(product, finest)[-1].close; gather_positions makes the same read through the same _finest_granularity. A positions page quoting a different current price would be a second answer to "what is this worth", and since the first answer moved rail 11's drawdown scalars, the page would be the wrong one.

That is asserted across the module boundary rather than claimed. The two readers do NOT share a source for QUANTITY: the agent counts inventory from the filled-orders log -- never from positions, deliberately, after the phantom-drawdown bug that taught it -- and this report reads the tranche ledger. They share only the mark. So the reconciliation test is what says the two ledgers agree about what is held, and it fails the day they drift.

WHAT IS ABSENT STAYS ABSENT. No cached candle means no mark, and no mark means no market value, no unrealized and no stop distance -- never zero. A zero market value renders a held position as a total loss, which is the most alarming thing this page could say and it would be saying it about missing data. initial_stop NULL is "not on this row" (a DCA leg, a pre-v12 tranche), so its distance is absent too: measured against a substituted zero it would read as a position comfortably clear of a stop it does not have.

Signed where the sign means something, and nowhere else. unrealized and stop_distance carry verdicts; a market value does not, because an account is not good for being worth something and a glyph on every balance hides the one figure that matters. A negative stop distance means the tranche is trading THROUGH its protection -- keel is cash-spot and long-only, so a stop always sits below the mark and the sign has one meaning. stop_distance_pct crosses as a raw fraction with no %, the posture ratio already documents for the drawdown scalars.

THE FRESHNESS CHIP IS THE ENTRY GATE'S VERDICT, not a data age. missing/behind/ unconfirmed are entry_bar_ready's own words for why the agent would refuse to open here. freshness.assess tolerates the normal forming-bar lag; entry_bar_ready refuses a one-bar-late finer series because that lag is exactly what produces a duplicate real-money order. Showing the softer number would tell a reader the feed is fine while the engine's own gate is refusing it -- and this chip is the most common answer to "why has nothing happened", which is why it sits beside the money rather than under a disclosure.

NO CLOSE ACTION, EVER. #701's own refusal, pinned on the source rather than trusted: an exit goes through the typed-phrase friction of the terminal path, because a panic tap on a table row must not be the last line of defence. The test fails the build the day the affordance arrives looking like an obvious convenience.

A GUARD FOR A BUG THAT SHIPPED SILENTLY IN THE WRITING OF THIS. The view was first written calling sorting(sort, onSort) -- sorting is a TYPEDEF and a parameter name in render.js, never a function -- and every gate stayed green, because mypy does not read JavaScript, ruff does not either, and the view tests assert over source text rather than executing it. The page would have thrown ReferenceError on first render. test_every_call_resolves_to_something_the_module_has now scans both derivation-free modules for calls that are not in scope where they are made.

Scoped PER FUNCTION, which is the part that took two attempts: the first version pooled every function's parameters into one module-wide set, so sorting -- a parameter of table and headerCell -- counted as defined inside positionsView, and the scan passed when the original bug was reinstated. It only came out because the guard was itself mutation-tested against the bug it was written for.

Not in this commit, and split rather than faked: #701's attestation chip wants a quarterly expiry that neither asset_attestations nor instrument_attestations records (every other attestation table in the schema carries attest_due_ts; these two do not), and a "Purif: 0.38%" ratio whose denominator nothing holds -- owed_by_asset gives dollars, and what they are a percentage OF is a judgement.

What & why

Tests-first evidence

• Tests written first, seen failing for the right reason

Gates (all must pass)

• uv run ruff check clean
• uv run mypy clean
• uv run pytest -q green

Scope check

• This PR touches a rail or a default classification — checked means it DOES;
  leave checked only if true, and if so: cite the source and open the discussion
  BEFORE review (CONTRIBUTING.md, "Governance: rulings vs. machinery").
• New dependency added (needs discussion first)