feat(web): close #701 and #702 — the mark reconciliation pinned, the attestation chip, and a staleness verdict

[eaitbrahim]

Closes #701. Closes #702.

The three gaps the acceptance audit found. Each was a criterion nothing in the suite could fail on.

#701 — the reconciliation was documented and unpinned

commands/positions.py has claimed since it shipped that "THE MARK IS THE RAILS' MARK, AND THAT IS THE POINT", and nothing asserted it. Both real paths now run against one seeded book and the numbers are compared.

Writing it found why it needed writing: the two sides read different tables. agent._held_position derives the holding from filled live orders — the audit log, the same source guards.py uses — while the page reads the positions table's tranches. A real cycle writes both. My first cut seeded only the tranche, so the rails saw an empty order log and reported unrealized as zero — a true statement about nothing.

A coarser series is seeded alongside the finest and holds a different close, so the test is about the granularity choice rather than about there being one candle in the database. The absent case is pinned too, because that's where two implementations of one idea usually part company.

#701 — the attestation chip, on #718's window

The page had a freshness chip and no attestation chip; the issue asked for both. #718 recorded attest_due_ts and keel doctor reads it — the page didn't.

Four states, not a boolean, because the middle two are different facts: unattested (which screen_asset already rejects, so a quiet blank would say the opposite of the gate governing the holding), expired, due, and attested — which covers both "in date" and "no window recorded", a legitimate state #718 made deliberately.

The threshold is imported from doctor, not restated: a page warning at one horizon beside a keel doctor warning at another would have an operator believing whichever they read last. Every state is WARN or UNKNOWN, never BAD — doctor's own choice for this column, because an expired window vetoes nothing and a red chip would say otherwise.

Beside the entry gate, never merged with it: one is a claim about the world, the other about data, they disagree in both directions, and a flagged row must say which.

#702 — a staleness verdict that doesn't cry wolf on this deployment

Every stamp crossed as moment(...), unconditionally NEUTRAL. A reading from last week rendered exactly like one from a minute ago — the page told you when and left you to do the subtraction, which Rule 2 says is Python's job.

The obvious threshold is wrong here, and this deployment proves it. The config ships interval_sec: 900; the live profile is driven by a wrapper that runs the agent once per UTC day — the scheduler fires more often and the wrapper decides. A window scaled off the config value alone would mark that deployment stale for ~23½ hours out of every 24, while it worked perfectly. agent._finest_granularity records the identical hazard for the identical reason: a slow series "would spuriously flag a perfectly healthy feed as stale."

So the window is three intervals of the larger of the configured cadence and the deployment's own observed one — the median gap between recent readings, because a mean would let one week-long outage widen the window permanently. Three rather than two: a single missed cycle is a restart, not a stop.

Fewer than two readings is None, not "fast" — one reading is no cadence. A deployment that has never cycled is UNKNOWN, never stale: a reading that does not exist is not an old one. And current is NEUTRAL, never GOOD — a fresh reading is the ordinary state, and grading it green would make the absence of green read as a fault on every page that has just started.

Gates

• 6,243 passed / 3 skipped; mypy clean on 444 files; ruff clean (the one E501 is pre-existing in docs/experiments/)
• 12 mutants killed: the page marking at a coarser series than the rails · an expired window reading as attested · an absent attestation reading as attested · a NULL window treated as expired · the page inventing its own approaching threshold · the attestation read going per row · an expired attestation graded bad · the stale window ignoring the observed cadence · the cadence using a mean · a never-cycled deployment called stale · a fresh reading graded good · the badge dropping the age

🤖 Generated with Claude Code

https://claude.ai/code/session_01KZZxmspQXe5qJ9FAsG13s6