docs(setup): a refused promotion is the gate working, and the checklist should say so

[eaitbrahim]

Refs #437 (D4). No behaviour change — wording plus two pins.

Found while verifying D4's acceptance end to end on a real deployment.

What happened

A freshly-seeded turtle_breakout, promoted from the browser against 74,714 real candles:

rule 25 (turtle_breakout): overfitting check = not_run
  - n_trades 12 < min_trades 100
  - win_rate 0.5 < min_win_rate 0.55
  - G4 / PBO-CSCV NOT RUN: no trial matrix was supplied, so the probability that this
    rule's parameters were selected by overfitting is UNKNOWN — which is not the same
    as low, and is not a pass.
rule 25: status -> candidate

That is exactly right. It is also the single most likely thing a first-run user will see on this step — and left unexplained it reads as a broken button on a checklist that has gone green everywhere else.

What changed

The step now says a refusal is the gate doing its job, that this item can stay outstanding for a long time, and that the deliberate bypass is keel rules promote --force — at a terminal, on the record.

ready_for(PAPER)'s docstring gains the same correction: "set up" and "has a rule worth running" are different states. It reports the second, and a fresh install does not reach it quickly.

The website already says this about keel simulate — "it will very likely tell you TRAIN MORE and name the gates that fail — that is the engine working, not broken; the honesty is the feature" — and the setup checklist was the one surface still missing it.

4094 passed, 3 skipped (2 new). ruff check clean repo-wide.

The open question this surfaces

D4's acceptance reads "a user with no prior state reaches a working paper deployment without typing a command." Every mechanical and operator-input step now gets there. rule_promoted does not, and cannot, because a fresh rule legitimately fails the gate.

Two ways to close that, and I would not pick the first:

1. Expose --force in the browser. No — it is one of the eleven, and attempt_promotion states that force carries no gate at the service level, so the front-end is the gate. A browser cannot keep that contract.
2. Read the acceptance as "set up and ready for you to promote a rule when one earns it." That is what the product actually is, and what the honest wording above now describes.

🤖 Generated with Claude Code