@@ -18,7 +18,7 @@ published. Every architectural decision below is tested against that constitutio
 It ships today in three shapes, all from one artifact set:
 
 - **CLI** — `keel` commands over a local database (the operator's terminal).
-- **Local web console** — `keel serve`, loopback-only, zero-dependency static UI.
+- **Local web console** — `keel serve`, loopback-only, zero-dependency static UI: four engine views (Pulse, Holdings, Rules, Audit & Setup).
 - **Desktop distribution** — unsigned installers plus the `keel update` self-updater.
 
 ## 2. Package and module architecture
 
@@ -250,6 +250,8 @@ itself is a moat, because every competitor's UI depends on hiding what keel show
 - Feature-gating inside the engine. The Plans page ships **inverted** (#706): a
   transparency artifact stating what is free forever and why — not a paywall matrix.
 
+> **Correction (2026-10-11).** The console is now four views (Pulse, Holdings, Rules, Audit & Setup). The Venues and Plans views named above are retired: venue readiness lives on Audit & Setup, and the declared capabilities stay with `keel brokers list`. Holdings has no cancel control (cancelling stays `keel orders cancel`), so "one-click even from the web" below describes the 2026-08 design, not the present console. The console's one-tap action is HALT, on Pulse.
+
 ### What keel does beyond parity
 
 - **The cancel asymmetry** (#707): cancelling an entry is refusing risk — frictionless,
 
@@ -28,8 +28,9 @@ lists, observed rather than assumed, in three kinds:
   are **never** reported as done, because a green check that verifies nothing turns an open risk
   into a false assurance.
 
-The same checklist is the Setup page in `keel serve`, and it is what a brand-new machine's
-landing page shows instead of an empty dashboard.
+The same checklist is the Setup section of the Audit & Setup view in `keel serve`, and it is
+where a brand-new machine's "Set keel up on this machine" link lands instead of an empty
+dashboard.
 
 ## 0. Before you start
 
 
@@ -421,15 +421,19 @@ It prints a URL carrying a one-time token for that run and opens your browser (`
 skip). The `--config`/`--db` pair still decides which account you are looking at, and still bites
 the same way.
 
-It is **read-only**, and structurally so: the server answers `GET` and `HEAD` and implements no
-other verb, so there is no request it can answer that changes anything. Attesting, promoting a
-rule, recording a flow and arming autonomy stay CLI commands behind the interactive-terminal gate.
+It **reads with `GET` and `HEAD`, and its writes are a closed set of `POST`s** under `/api/`:
+`/api/gates/halt` engages the kill-switch (a gate token, nothing more — stopping must never be
+slower than starting); `/api/gates/resume` and `/api/gates/resume-entries` release a halt only
+from a loopback session on a loopback bind, with a gate token and a typed phrase (the console
+offers neither — release a halt with `keel resume` at a terminal); and `/api/setup/<step>` runs
+one of `keel setup`'s idempotent mechanical steps. Attesting, promoting a rule, recording a flow
+and arming autonomy stay CLI commands behind the interactive-terminal gate.
 
 Four things stand between that page and the rest of the machine: it binds `127.0.0.1`; it checks
 the `Host:` header, so a hostname rebound to loopback is refused even though its packets arrive
 on loopback; it requires the session token, which is minted per run and never written to disk; and
-it serves no write verb. `--host` will bind anywhere you ask, and says plainly what that costs —
-on a non-loopback address your positions, equity and full trade history are readable by anyone who
+every write also needs the console's own request headers and a token derived from that session.
+`--host` will bind anywhere you ask, and says plainly what that costs — on a non-loopback address your positions, equity and full trade history are readable by anyone who
 can reach the port, with a cleartext token as the only obstacle.
 
 **Placing an order is gated differently.** Paper places freely against synthetic cash — nothing is
@@ -836,12 +840,11 @@ Rewards item: account settings no rail can see, re-checked after any account cha
 
 ## The operator console, in a browser
 
-`keel serve` opens keel's **operator console**: a local web page showing Pulse (the home view),
-Setup, Holdings, Balances, Timeline, Rules, Venues and Plans, over the same `keel/commands/*`
-service layer the CLI commands call. It is being slimmed to four engine
-views -- Pulse, Holdings, Rules, Audit & Setup; see
-`docs/superpowers/plans/2026-10-10-console-four-views.md`. An architectural test (`tests/commands/test_console_thinness.py`) pins that thinness -- the
-front-end renders and dispatches, and every behaviour comes from the services.
+`keel serve` opens keel's **operator console**: a local web page with four engine views -- Pulse
+(the home view), Holdings, Rules and Audit & Setup -- plus a link to the documentation, over the
+same `keel/commands/*` service layer the CLI commands call. An architectural test
+(`tests/commands/test_console_thinness.py`) pins that thinness -- the front-end renders and
+dispatches, and every behaviour comes from the services.
 
 ```bash
 keel --config config.live-sandbox.yaml --db keel-live.db serve
@@ -850,6 +853,11 @@ keel --config config.live-sandbox.yaml --db keel-live.db serve
 It binds loopback and prints a URL carrying a one-time token for that run. Stopping the server
 invalidates it: the token is new every run.
 
+**Pulse.** The glance page: the kill switch, autonomy and its lapse, today's cycle counts
+(signals, entered, blocked, errors), why keel did not trade, the last cycle's time, the next DCA
+buy due per live DCA rule, data freshness and the market session, and any tranche missing its
+bracket. It carries the HALT button (below).
+
 **Holdings.** One table of open tranches per rule: per-tranche cost (what the tranche paid to
 open, entry fee included), the entry-gate verdict, the asset attestation, the bracket, the stop
 only when a tranche carries one, and the entry order's placement and expected-vs-actual fill. The
@@ -867,10 +875,22 @@ command it shows, at a terminal), then the research record: every trial, the evi
 gauntlet and the slippage assumptions. Track records, promotion-gate distances and the research
 record used to be the Insights and Research views. The equity charts and the closed-trade table
 left the console: the closed-trade journal is `keel insights journal`, your own journal is `keel
-journal list`, and in the browser every fill is still a Timeline `trade` row and every journal
-entry a Timeline `attestation` row. A live rule's track record is `keel insights summary --mode
+journal list`, and in the browser every fill is still a `trade` row on the Audit & Setup timeline and every
+journal entry an `attestation` row there. A live rule's track record is `keel insights summary --mode
 live`.
 
+**Audit & Setup.** The tamper-evident timeline, the setup checklist and venue readiness, on one
+page. The timeline opens on keel's own record -- `kind=keel`, the engine's cycle rows (each with
+its signals, blocked, entered, exited and error counts) and the attestations -- and the `trade`
+and `flow` chips (or `all`) bring back fills and cash flows; the Export CSV link carries the same
+scope and kind, so the file holds what the screen shows, with each row's hash and chain status.
+Below it is Setup: the runbook stages as tabs, each mechanical step a button, and the job panel
+reporting a running step such as the market-data fetch. Last is venue readiness: whether a live
+entry can be placed on this deployment now, and the fix when it cannot. The adapters' declared
+capabilities are `keel brokers list`. This page is where "Set keel up on this machine" lands
+when no deployment exists yet, and the old `/setup`, `/timeline` and `/venues` addresses open it.
+The Balances and Plans views are gone; their old addresses open Pulse.
+
 **Halting from the browser.** Pulse carries a HALT button. It engages the kill switch through the
 same operation `keel kill` performs (`POST /api/gates/halt`), after one confirm dialog and nothing
 else: stopping must never be slower than starting. It needs the console session and the gate token
@@ -998,10 +1018,15 @@ covers the rest from a plain shell.
 
 **What the browser cannot do, and that is deliberate.** Every capability-increasing action --
 arming autonomy, releasing the kill-switch, clearing a consecutive-loss halt, re-seeding the
-drawdown high-water mark, declaring a deposit or withdrawal, attesting withdrawal capability, and
-replacing the binary -- is a CLI command behind a typed confirmation at an interactive terminal.
-`keel capabilities` lists all seven with the gate covering each. The server implements no verb
-that would reach one, so this is a property of the server rather than of what the page draws.
+drawdown high-water mark, declaring a deposit or withdrawal, attesting withdrawal capability, scope
+or posture, declaring an out-of-band close, and replacing the binary -- is a CLI command behind a
+typed confirmation at an interactive terminal. `keel capabilities` lists all ten with the gate
+covering each. The one exception is the console's
+HALT button, which engages the kill-switch (stopping is never gated). The server's gated routes
+under `/api/gates/` can also release the kill-switch and clear the consecutive-loss halt, but only
+for a loopback session on a loopback bind with the typed phrase, and the page draws no control for
+either: releasing remains a terminal act in practice. Everything else in the list has no route
+at all, so that is a property of the server rather than of what the page draws.
 
 ## How much money moves
 
 
@@ -80,6 +80,8 @@ packages/                  the uv workspace                          (7,190)
 └── keel-broker-fake/      ⭐ adapter existing ONLY to exert design pressure on the port
 ```
 
+*Note (2026-10-11): `web/` is no longer purely read-only. The console halts the engine (the HALT button on Pulse) and runs idempotent setup steps; releasing a halt and every other capability-increasing action stays at the terminal.*
+
 **Two things to notice before we go further.**
 
 `commands/` is 23,188 lines — larger than the engine it drives. That is deliberate rather than
 
@@ -55,7 +55,7 @@ Stated plainly, because "it's encrypted" is not a threat model.
 
 The third row is the one that needs saying out loud. Cloudflare terminates TLS. In that mode
 the operator is not merely trusting Cloudflare to route traffic; they are handing it the
-readable contents of a console that displays positions, balances and attestations. That may be
+readable contents of a console that displays holdings, the timeline and attestations. That may be
 an acceptable trade for convenience. It is not a neutral one, and a document that let someone
 discover it later would have failed.
 
@@ -87,10 +87,13 @@ gesture in both postures.
 
 ## Capability-increasing actions are refused unless the bind is loopback
 
-`keel serve` serves a read surface. Three of the nine capability-increasing actions in
-`keel/capabilities.py` are being admitted to it behind a second gate (#781) -- releasing the
-kill-switch halt, clearing rail 16's consecutive-loss halt, and re-seeding rail 11's drawdown
-breaker. `keel.web.security.gated_action_permitted` decides, and it requires **three** things:
+`keel serve` serves a read surface plus a small write surface: the setup steps, the HALT button
+(`/api/gates/halt`, which engages the kill switch and is deliberately allowed from a tunnel -- a
+stop must never be slower than a start), and two gated releases behind a second gate (#781) --
+releasing the kill-switch halt and clearing rail 16's consecutive-loss halt. The other
+capability-increasing actions in `keel/capabilities.py` have no route at all.
+`keel.web.security.gated_action_permitted` decides the two releases, and it requires **three**
+things:
 a loopback peer, no `--external-host`, and a **loopback bind**.
 
 The third exists because the second is a declaration and two ordinary deployments never make it:
@@ -104,8 +107,9 @@ The third exists because the second is a declaration and two ordinary deployment
 
 A bind is observable where a declaration is not: a server reachable from off-box is one an
 operator had to bind off-box. So a tunnelled, proxied or LAN-bound deployment serves every read
-and refuses every gated action -- and says so on the page, rather than presenting a button that
-returns 403.
+and the halt, and refuses every gated release with a 403. The console draws no release control at
+all -- releasing is done at the terminal -- so there is no button on the page that returns 403;
+the refusal is what a direct request to `/api/gates/resume` gets.
 
 **`ssh -L 8765:127.0.0.1:8765` is not closed by this, and that is deliberate.** The peer is
 genuinely loopback and the bind is loopback, so the gate opens for a remote human. Ordinarily
 
@@ -1,5 +1,11 @@
 # Console — four engine views (Pulse · Holdings · Rules · Audit & Setup) — Implementation Plan
 
+> **As built (correction note, 2026-10-11).** This plan is kept as written; where it differs from what shipped:
+> - **PR2 (Holdings):** the entry order is matched by product, BUY, `placed <= opened_at` and the exact fill price (nearest earlier wins), NOT by the `created_at == opened_at` timestamp join -- paper stamps orders with bar time and tranches with cycle time, so the join missed every paper tranche.
+> - **PR3 (Rules):** `rules_payload(records=...)` is a required keyword, not `None` falling back to `count(0)` (a zero nobody passed is unknown-as-zero); the CSV export link gets no class, not `.linkaction`.
+> - **PR4 (Audit & Setup):** `keel/commands/balances.py` was deleted, not kept (no `keel balances` CLI exists; the web reader was its only caller). The Audit sections are exported builders (`setupSection`, `timelineSection`, `readinessSection`), so the key-parity scan runs per section against its own endpoint rather than `_view_keys("auditView", "setup")`. `timelineSection` takes the read error as an argument: no database reads "No timeline yet: there is no database on this machine. Setup creates one.", a failed read reads "The timeline could not be read: <detail>" (not "keel isn't running here yet"). The timeline wire also carries `engine_log`, and the page says when the engine log is missing or unreadable.
+
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. Never ask the user anything; every open question in this initiative is settled in a "Rulings" list below.
 
 **Goal:** Replace the console's thirteen screens with four engine views -- PULSE (home, with the HALT button), HOLDINGS, RULES, AUDIT & SETUP -- shipped as four sequential PRs, each leaving the console fully working and the suite green. The ledger's "Done means" (`.superpowers/orchestrate/2026-10-10-console-four-views/ledger.md`) is the acceptance list; the screen inventory with line numbers is `inventory.md` beside it. Line numbers below are at BASE_SHA `9b1db8755cf7ac6a65cb118c615dc8e630998143`.
 
@@ -3,6 +3,12 @@
 **Date:** 2026-08-23 · **Status:** shipped. Every step of §"Build order" landed (#533–#541, v0.12.0);
 kept unrewritten as the design record.
 
+**Note (2026-10-11):** the console is now four views -- Pulse, Holdings,
+Rules, Audit & Setup -- and its write surface also includes a gates POST surface (`/api/gates/*`,
+#781; the console's HALT button uses `halt`). Where this document names the earlier views
+(Status, Activity, Gates, Timeline, Setup, Venues, Balances, Plans) or says the write surface is
+only `setup.ACTIONS`, read it as the 2026-08 design, not the present.
+
 This document describes the browser interface keel serves from the operator's own machine: what the
 server does, what the client does, and why each decision was made the way it was. It follows the
 shape of [youperiod.app's SPECS.md](https://github.com/getify/youperiod.app/blob/main/SPECS.md) and
@@ -137,8 +143,9 @@ Subresource Integrity authorises any inline `<script>` or `<style>` block, as in
 3. **A session token**, minted per run, never written to disk, exchanged on first load for a
    `SameSite=Strict`, `HttpOnly` cookie. `Strict` rather than `Lax` is deliberate: `Lax` attaches the
    cookie to top-level navigations, so a link on a hostile page would arrive authenticated.
-4. **A closed action set.** The entire write surface routes through `keel.commands.setup.ACTIONS`,
-   every member declared `MECHANICAL`, idempotent and non-destructive, and **a test asserts that set
+4. **A closed action set.** The setup write surface (`/api/setup/*`) routes through
+   `keel.commands.setup.ACTIONS` (as of 2026-10 the gated `/api/gates/*` routes are a second,
+   separately gated surface -- see the note in the header), every member declared `MECHANICAL`, idempotent and non-destructive, and **a test asserts that set
    is disjoint from the eleven capability-increasing actions in `keel/capabilities.py`.**
 5. **A CSRF token on every write**, derived from the session token by HMAC rather than stored — "the
    layer that does not depend on the browser being current." Comparisons use
 
@@ -244,7 +244,9 @@ def key(self) -> tuple[str, str]:
         module="keel.web.gates",
         function="run_gated_action",
         surface="web",
-        invocation="the Resume trading button, with its typed phrase",
+        invocation=(
+            "POST /api/gates/resume with its typed phrase (loopback; the console draws no control)"
+        ),
         increases=(
             "trading resumes after the kill-switch halted it -- the same increase `keel resume` "
             "grants, reached from a browser on a loopback session instead of from a terminal"
@@ -256,7 +258,10 @@ def key(self) -> tuple[str, str]:
         module="keel.web.gates",
         function="run_gated_action",
         surface="web",
-        invocation="the Clear streak halt button, with its typed phrase",
+        invocation=(
+            "POST /api/gates/resume-entries with its typed phrase (loopback; the console draws "
+            "no control)"
+        ),
         increases=(
             "new entries resume after rail 16's consecutive-loss halt -- the same increase "
             "`keel resume-entries` grants, reached from a browser on a loopback session"