fix(rails): exempt DCA buys from the total-exposure rail; rail 14 bounds DCA (#841)

[eaitbrahim]

Closes #841

The decision (the operator's, 2026-09-27, final)

DCA is bounded by the venue plan's cap (rail 14, the attested monthly buy cap), not by caps.max_exposure_usd.

• Exempt DCA BUYs from the total-exposure rail (total_exposure_cap) only.
• Per-asset concentration (per_asset_concentration_cap) still applies to DCA.
• Rail 14 (monthly_subscription_allowance) still applies to DCA, unchanged. It is now the binding DCA limit.
• Every other rail's treatment of DCA is unchanged.

The reason: the live account accumulates through 7 DCA rules. About $213 is held against the $400 max_exposure_usd cap, so rail 4 would veto the sleeve after about one buy on Oct 9.

Which rails bind DCA now

Rail	Rule-trading BUY	DCA BUY
4: total_exposure_cap	binds	exempt (this PR)
6: per_asset_concentration_cap	binds	binds
14: monthly_subscription_allowance	binds	binds. It is the limit that bounds DCA.
8: no averaging into losers	binds	exempt (unchanged)
11: drawdown breaker	binds	exempt (unchanged)
16: consecutive-loss breaker	binds	exempt (unchanged)
every other rail	binds	binds (unchanged)

• DCA holdings still count in the total exposure that a rule-trading entry sees, so a growing DCA sleeve shrinks the room left for rule trades.
• Rail 6's per-asset limit is still max_per_asset_pct × max_exposure_usd. max_exposure_usd still bounds DCA per asset, but no longer in total.
• SELLs are unaffected. Rail 4 never read a SELL.

What changed

• keel/execution/guards.py: rail 4 now gates on is_buy and not intent.is_dca. I updated the module docstring's "DCA exemptions" paragraph, rail 4's comment and rail 14's comment. The docstring now also names rail 16, which was already exempt but was missing from that paragraph.
• keel/sim/account.py: SimAccount.can_open applies the same exemption, so keel simulate models what live does. The sim's DCA path (portfolio_sim._process_dca_signals) goes through can_open, which vetoes and does not clamp. Before this PR it vetoed DCA over max_exposure_usd; now it does not. max_affordable_notional is unchanged because only the rule-slot path calls it.
• docs/rails/rail-4-total-exposure.md is new and holds the exemption table. docs/rails/rail-14-subscription-allowance.md now says rail 14 is what bounds DCA.
• The caps: comment in keel/templates/config.yaml and config.live.yaml says the same. The repo-root config.yaml is re-synced with its template, as test_the_template_stays_in_sync_with_the_repo_config requires.
• keel doctor has no text that lists rails or their DCA exemptions, so nothing changed there.
• executor.py is not touched.

This reaches live only after a release and deploy. Until then, the deployed rail 4 still vetoes DCA over max_exposure_usd.

Tests (written first; each was seen to fail for the stated reason, or is a pin)

Test	Before the fix
(a) test_rail4_dca_buy_over_max_exposure_is_not_vetoed_by_total_exposure	FAIL: total_exposure_cap: open exposure 960.0 + 45 = 1005.0 exceeds max_exposure_usd 1000
(b) test_rail4_the_same_buy_without_is_dca_is_still_vetoed_by_total_exposure	pass (regression pin; kills M3)
(c) test_rail6_dca_buy_over_the_per_asset_cap_is_still_vetoed_by_concentration	FAIL: extra total_exposure_cap beside per_asset_concentration_cap
(d) test_rail14_dca_buy_over_the_monthly_cap_is_still_vetoed_when_exposure_is_also_over	FAIL: extra total_exposure_cap beside monthly_subscription_allowance
(e) test_a_dca_buy_over_max_exposure_is_not_vetoed_by_the_exposure_cap (sim)	FAIL: total_exposure_cap … 1005 exceeds … 1000
(e) test_a_dca_buy_over_the_per_asset_cap_is_vetoed_by_concentration_only (sim)	FAIL: total_exposure_cap listed before per_asset_concentration_cap
(e) test_a_rule_buy_over_max_exposure_is_still_vetoed_by_the_exposure_cap (sim)	pass (regression pin; kills M6)
(e) test_parity_with_guards_check_when_total_exposure_is_the_tightest_cap	FAIL: sim vetoed a 100 DCA buy that the fixed guards allow
(f) test_rail4_never_gates_a_sell_whatever_the_order_class[False/True]	pass (pin)

Two existing sim tests, test_exposure_cap_rejects_over_cap and test_close_frees_up_exposure_for_a_subsequent_open, probed the exposure cap with the sim helper's default is_dca=True intent. They now probe with a rule-trading intent, which is what they test.

Mutants (each proven applied: the source differed from the saved copy; restored from that copy, never git checkout)

Mutant	Result
M1: drop the guards exemption	killed by (a), (c), (d) and the parity test
M2: exempt DCA from rail 6 instead of rail 4	killed by (a), (c), (d) and the parity test
M3: exempt non-DCA buys too (guards)	killed by (b), test_rail4_total_exposure_cap_rejects_over_cap and test_a_malformed_history_row_still_counts_toward_the_exposure_cap
M4: remove the sim exemption	killed by both (e) DCA tests and the parity test
M5: sim exempts DCA from concentration instead	killed by 5 sim tests
M6: sim exempts rule entries too	killed by the (e) rule pin and 2 existing sim exposure tests

Checks

• uv run pytest -q: 6850 passed, 3 skipped, exit 0
• uv run ruff check keel tests: exit 0
• uv run ruff format --check keel tests: exit 0
• uv run mypy: no issues in 473 files, exit 0

🤖 Generated with Claude Code