feat(tui): the console shell — menu navigation, guarded profiles, the session banner (#388 C2)

[eaitbrahim]

What

C2 of the TUI-operator-console PRD (issue #388): the console shell around the existing dashboard, profile switching across the four deployments, and the session banner on every screen. The dashboard stays the landing screen; nothing working was rewritten.

The shell's structure

• keel/commands/console.py (new) holds the pure model: the menu tree, the profile convention, the switch/guard logic, and the banner builders — directly unit-testable without curses, mirroring tui.py's pure-model/thin-loop split.
• run_live gains three modes — menu (the PRD §3 tree, cursor + 1-9 ordinals), profile (the deployment menu), placeholder (a future slice's notice) — and m in normal mode opens the menu. Every screen, all ten modes, is prepended the two-line session banner (fail-soft read).
• run_live takes the shell as an optional console_binding: a caller that passes none gets the pre-C2 dashboard byte-for-byte — which is what keeps every pre-existing test unchanged. --once heads its frame with the same banner.
• Only Dashboard / Profile / Help act in this slice; Trading, Rules, Compliance, Data, Research, Account render a "lands in C3/C4/C5 — navigation only" notice (owners per the PRD §5 phasing; Account rides with C5, commented as such).

The profile convention (O4)

The four deployments are discovered from the tracked config files present in the working directory — the same place the CLI resolves its relative --config/--db paths. The pairs are what the wrappers (keel-paper, keel-live, keel-paperhourly, keel-equities) and the runbook's deployment table pin:

profile	config	db	guarded
paper-forward	config.paperforward.yaml	keel.db	no
live	config.live-sandbox.yaml	keel-live.db	yes
paper-hourly	config.paper-hourly.yaml	keel-paperhourly.db	no
paper-equities	config.paper-equities.yaml	keel-equities.db	no

The convention is stated as a comment in console.py; no new registry file. A switch rebinds config and db together through the same _load_cfg/_open_repo loaders every CLI command uses (ConsoleBinding.open_state), so one action rebinds every screen; a pair not in the registry — a config on another deployment's db — is refused outright. Selecting LIVE asks an explicit y/N at the terminal (a confirm step, deliberately not O3's typed contract: it changes what the operator is looking at, not what the engine does) and, once active, the header marks it unmistakably (LIVE (REAL MONEY), alert style). No secrets anywhere in the header or profile display — file names and venue declarations only.

The port schedule extension

market_clock() is untouched. Broker.market_schedule() is added, returning a frozen MarketSchedule(state, next_open_ts, next_close_ts):

• the default implementation ships as default_market_schedule(broker) on the port (a protocol cannot carry a method body to structural implementors) — the broker's own clock answer with no timestamps claimed;
• the 24/7 trio (coinbase, fake, robinhood) ship exactly that default: OPEN with nulls, no transport call;
• Alpaca overrides it: the same /v2/clock, with next_open/next_close crossed as epoch ints — fail-soft on an unparseable timestamp (the state stands, the unusable field is dropped), fail-closed on an unreadable clock (CLOCK_UNAVAILABLE with nulls);
• the conformance suite gains three checks: the port type, state agreement with market_clock(), and no-times-for-24/7.

The recorded banner (O9)

record_market_session now also records next_open/next_close under the same venue-namespaced keys and trust window — writing explicit nulls when the clock is unreadable so a previous cycle's next_open can never linger as fact, and deriving nulls for a pre-#388 third-party adapter that only implements market_clock(). latest_recorded_session(repo, config, now) is the one broker-free read: newest-stamped venue, with fresh (the same window recorded_market_closed uses) and defused flags. The banner composes from it:

• 24/7 venue (from the adapter's offline session_bound declaration — capability display, no broker handle) → market: 24/7 (always open), muted;
• session-bound, fresh record → OPEN/CLOSED with the recorded next open/close (local time), styled per B1's session-line conventions;
• absent or stale record → CLOCK UNAVAILABLE, fail-loud, warn — same semantics as fetch --check, no TUI-side calendar.

TDD / gates

Red first for: the menu navigation contract, profile rebinding (switch → binding/header/config/repo all reflect it; live-guard confirm required and decline keeps the binding; wrong-pair refused), the port schedule read (default derivation, alpaca parse incl. malformed next_open, clock-failure → CLOCK_UNAVAILABLE with nulls, conformance), the recorded next_open/next_close round-trip (including the null-clearing and pre-port fallback), and banner rendering for all four states. Every pre-existing TUI/dashboard test passes unchanged where behavior is unchanged (the only edited legacy assertions are none — the help "which account" section text changed under its existing assertions, which still hold).

• uv run pytest -q — 3329 passed, 3 skipped
• uv run ruff check keel tests packages — clean
• uv run mypy — no issues in 262 files

Fixes #388