feat(tui): reach the asset-admission gate from the dashboard (screen / propose / discover)

[eaitbrahim]

The allowlist-admission workflow — the halal asset gate — was CLI-only. This puts it on the operator dashboard: three new overlays, s screen, p propose, d discover, alongside the existing i insights.

Nothing here admits, attests, or trades. keel assets attest stays deliberately CLI-only: it is the one step in this gate that rests on human judgment rather than code, and it must not be a keystroke.

The overlays

• s screen — the current allowlist's admission verdicts, with the reason for each. OFFLINE, DB reads only.
• p propose — screens the newest *.json shortlist in config.proposals_dir (new setting, default ~/keel/proposals, ~ expanded at use rather than baked into a Config). OFFLINE. A missing directory, absent shortlist, unreadable file, bad JSON or malformed proposal each render as a calm, actionable explanation — never an error that takes the dashboard down. Invalid candidate entries are reported as INVALID, never dropped.
• d discover — proposes NEW candidates from the venue's own product list.

Each reuses keel/proposer.py and the existing _screen_product gate verbatim rather than growing a second rendering or admission path.

d is gated harder than f is

Discover is the second deliberate network exception in a dashboard whose contract is read-only and offline. Pressing d makes no call at all — it opens ARMED, rendering an explanation of what running it will do and that it is a live venue call. Only Enter, pressed inside the overlay, makes the one list_products request. The result is then HELD: later polls repaint it without re-fetching, and closing discards it so reopening is armed again. It is bounded by a timeout, because the operator is blocked on it with the screen frozen — a hung venue becomes a retryable discover failed: line, not a dashboard whose only exit is Ctrl-C.

Two tests pin this by driving the real loop: zero list_products calls across d + several polls + close, and exactly one per Enter with no re-fetch on subsequent polls.

The correctness fix this uncovered

DATA_DERIVED_FAILURES claimed to hold every failure class "DOWNSTREAM of having no cached history" but omitted history itself. So a product with zero cached candles was reported as history: 0 daily bars, need 1460 — which reads as "this asset is too young" when the truth is "we have never fetched it". A candidate never fetched was indistinguishable, by its failure list alone, from one that genuinely is too young. Since screening an unfetched asset is the normal first step of admitting one, this was the common case, not the edge case.

The split and its explanation now live once, in screen.py beside the tag set that decides them:

split_failures(facts, result) -> (about_the_asset, about_our_cache)
missing_history_lines(product_id, not_assessable) -> list[str]

assets holdings --screen, assets propose, assets screen and the new TUI overlay all route through them, replacing three independent copies of the same logic. A zero-bar product now says "no local history — run keel fetch --products X first" and names what is unassessable until then, instead of asserting something false about the asset.

The suppression fires at exactly zero bars, so an asset with some history that still falls short is still reported as genuinely too young — pinned by counterpart tests on every surface, so the fix cannot decay into a blanket silencer.

keel assets screen was initially left out of that migration and a review caught it. It is the sibling of the new s overlay — both screen the same product set through the same gate — so leaving only one able to explain an empty cache would have handed an operator two different stories about the same allowlist depending on which surface they looked at.

Also

• tui_cmd's docstring claimed the TUI "never touches the network except when explicitly asked (f)", while run_live has all along made an automatic ~30s get_accounts balance read — which run_live's own docstring acknowledged. The two contradicted each other before this branch. The docstring now enumerates all three network touches honestly.
• run_live's help and insights branches each hand-rolled an identical scroll chain. Rather than copy it three more times, both now share one pure _scroll_offset, behaviour unchanged.

Verification

ruff clean, mypy clean, 2062 tests passing (1976 on main, +86).

Beyond running the suite, the two constraints that carry the safety weight were mutation-tested: removing history from the tag set fails 5 tests, and making discover fetch on open or on poll fails 4. Both were confirmed to fail for the right reason before the fix existed.