docs(fiqh): the cash posture residual is recorded, not merely acknowl…

[eaitbrahim]

…edged (#691, part 2 of 2)

Closes #691. The last two acceptance boxes: keel brokers list and the docs/fiqh-basis.md open question.

THE PIN DID NOT FAIL WHEN IT SHOULD HAVE, AND THAT IS THE FINDING. test_the_unprovable_half_of_the_cash_posture_is_stated_not_hidden promised in its own docstring that "closing that needs a human attestation, not another adapter read -- and if one is ever built, this fails again". #691 built one. The pin passed, and the issue's own acceptance criterion predicted a failure that never came.

Nothing in the pin observed the attestation, so it repeated its FIRST failure mode exactly: that form pinned _sell_base_size's docstring as a proxy and held while the paragraph it guarded went false. A promise in a docstring is not a pin, and prose that matches is not prose that is true.

So this re-pointing reaches for the MECHANISM rather than for sentences. Four assertions that each go false if something real is removed:

• CashPostureState must carry no CONFIRMED -- adding one would mean keel believes something can AFFIRM a spot cash account, which is the claim the doc spends a section refuting.
• ATTESTATION_TTL_SEC > 0 -- without expiry, "the operator states it and keel records it" degrades to "keel remembers what someone said once".
• cash_posture must appear in guards.py -- with no rail reading the record, "an unattested posture vetoes live entries" is a sentence about nothing.
• the stale "a human attestation this repository has not yet built" must be GONE -- the specific prose regression, caught by string rather than hoped about.

THE DOC. Two passages were wrong on their facts, not merely dated: one said keel "has no cash-account posture check on Coinbase", which #666 added, and the other said the attestation was unbuilt. Both are corrected, and the section now states the three load-bearing properties (no confirmable state, a 90-day expiry, a claim bound to a credential) followed by the sentence to keep if only one survives: keel still cannot verify this, and neither can the venue. What changed is that the trust is now dated, revocable and written down, rather than assumed.

THE BLOCK. keel brokers list gains a THIRD block after declarations and readiness, which follows this codebase's own argument rather than a preference: venue_readiness renders separately because merging two questions "would re-blur exactly the distinction #233 exists to draw". Posture is a third question -- readiness asks whether this CREDENTIAL may trade, posture asks whether this ACCOUNT can borrow. It ends on its own honesty line, and a test forbids the words "verified", "confirmed", "checked" and "proven" anywhere in it: every other readiness surface reports something it checked, and this one cannot.

Read-only and best-effort, _readiness_rows' discipline -- a display command must not create a database, and a pre-v18 file renders an empty block rather than failing.

Tests written first: 9 on the block, plus the re-pointed fiqh pin.

Mutation-verified, 6 mutants. One SURVIVED: replacing sorted with reversed produced identical output because the fixture had only two venues in reverse alphabetical order. Three venues now, in an order where reversing is not sorting.

Closes #691

Claude-Session: https://claude.ai/code/session_01NzuKAe2RVrPt9acVAWjRyL

What & why

Tests-first evidence

• Tests written first, seen failing for the right reason

Gates (all must pass)

• uv run ruff check clean
• uv run mypy clean
• uv run pytest -q green

Scope check

• This PR touches a rail or a default classification — checked means it DOES;
  leave checked only if true, and if so: cite the source and open the discussion
  BEFORE review (CONTRIBUTING.md, "Governance: rulings vs. machinery").
• New dependency added (needs discussion first)