[eaitbrahim]

Version bump only: every workspace pyproject.toml 0.21.0 -> 0.22.0 (and the == sibling pins) plus the refreshed uv.lock, the same nine files every bump moves (tests/test_packaging.py and tests/test_version.py green locally). Merge this, then run the Release workflow with 0.22.0.

MINOR: rail 17 changes its input and DCA gains catch-up. Schema unchanged (22); no migration.

What lands since 0.21.0:

• Rail 17 reads Coinbase; skipped DCA buys retry until the next window and alert on macOS (#1010) #1016 (supersedes Rail 17: warn when the attestation expires before a DCA window, and retry a vetoed window (#1010) #1013, closes Rail 17's 7-day attestation TTL cannot cover a 14-day DCA cadence; vetoed windows are never retried #1010): rail 17 reads Coinbase allow_withdrawals on every live BUY instead of a 7-day attestation; keel withdrawals attest --suspended/--enabled becomes a manual brake with no expiry; a skipped DCA buy retries daily until the rule's next window (one fill per window, the orders ledger decides); every skipped live DCA buy posts a macOS notification; a local-only keel orders cancel for a stuck pending order with no venue id.
• Bump certifi to 2026.10.23 for PYSEC-2026-4320 (#1011) #1012: certifi 2026.10.19 for PYSEC-2026-4320.
• Clear the open CodeQL alerts (#1, #2, #3, #5, #7, #8) #1009: the open CodeQL alerts cleared.
• Console rework (Task 4: Levels support/resistance (Closes #4) #13 PR1-4: console: Pulse home view with HALT; Status, Activity and Gates views retired (#13 PR1) #956, console: Holdings view replaces Positions and Orders (#13 PR2) #959, console: Rules view absorbs Insights and Research; charts and journal retired (#13 PR3) #963, console: Audit & Setup view; Timeline, Setup, Venues, Balances and Plans retired -- four views (#13 PR4) #966) and its hardening: console: HALT gets its own token; the release token is served nowhere (#968, #969) #970, console: Holdings per rule row; DCA tranches read "no stop by design" (#960, #961) #972, insights: one track record per rule; empty side reads unknown (#962, #965) #975, Halt and keel serve hardening: drain every POST, HALT on a failed Pulse, serve keeps --external-host (#955, #958, #971) #977, Test log isolation, stale references, DCA stop distance, manifest name refusal (#964 #967 #973 #974) #978, tests: read the write guards from _post (main red after #977 + #978) #984, insights+promotion: an empty sample side reads as empty, not as Infinity or zero (#979, #980) #986, keel serve: socket timeout, GET drain, halt never creates a DB, halt outlives the remote lifetime; stale citations (#981 #982 #983) #987, fix(web): refuse HTTP/0.9 before dispatch with a framed 505 (#989) #999, Console: a reloaded console keeps its HALT after the remote lifetime (#985) #1001, docs: remote-access names the two stop exceptions to the session lifetime (#1002) #1005, Console: serve the static shell past the remote lifetime to its own session (#1006) #1008.
• Report wording for empty sample sides: rules backtest: word an empty-side profit factor as insights does (#988) #998, sim report: word an empty-side R profit factor as insights does (#1000) #1003, sim report: word an empty-side Avg win/loss (R) by counting the R sample (#1004) #1007.
• Dependencies: fix(deps): bump pyjwt and urllib3 to clear pip-audit #957 (pyjwt 2.15.1, urllib3 2.8.0), uv-build chore(deps-dev): update uv-build requirement from <0.13.0,>=0.10.4 to >=0.10.4,<0.14.0 in /packages/keel-broker-kraken in the python-dependencies group #990-chore(deps-dev): update uv-build requirement from <0.13.0,>=0.10.4 to >=0.10.4,<0.14.0 in /packages/keel-broker-fake in the python-dependencies group #997.

Live impact:

• The first live cycle after deploy retries every DCA rule whose current window is unfilled. With the windows that opened on the 2026-11-05 bar, that is all seven live rules once (about $150), subject to rails 13 and 14; the next day buys nothing extra.
• Rail 17 now vetoes a live BUY when Coinbase cannot be read. Coinbase is the only adapter that answers.
• The live DB has no resting live BUY rows that would block a rule (checked 2026-11-06).

Deploy note: install the five release wheels by path into ~/keel and confirm keel versions prints [release]; restart the four com.keel.serve.* daemons so the console runs the new build.

🤖 Generated with Claude Code