fix(trading): share strict paper URL normalization across credential gates - #1080

Scope

Lane A's credential gate refused the inventory's valid paper /v2 URL before
preflight could make a request. Reuse one strict paper-URL normalizer across
credential-source gates and the capacity env reader, accepting the canonical
HTTPS paper authority with no explicit port and paths empty, /, /v2 or /v2/.
Every request still uses its existing pinned paper destination.

• Base commit: ba6afd8.
• Lane: lane:trading.
• Owned paths: credential_source.py, capacity.py, their two test modules,
  the README, credential decision/correction, and owner-derived source/evidence bindings.
• One concern; the original commit and two review-fix commits. No live key/store, account state or operating unit
  is changed by the code PR.

SOTA sources

• alpacahq/alpaca-py v0.44.0,
  verified mirror pin cc4cb3b7ba50ae250e621983c2779047fb16bb28:
  common/enums.py:9
  pins TRADING_PAPER; common/rest.py:36,64,107-109
  stores and appends API version v2 separately. Env spelling never becomes
  the request destination.

• Merged #1069 capacity correction,
  reference commit 3acbb95: strict component
  parsing and raw control/delimiter refusal. Its parser is replaced by the
  shared helper; internal CapacityConfig remains canonical-only.

• Existing credential-source design
  and this correction:
  fixed reasons, explicit source selection, env-key removal and ownership/
  storage gates remain enforced.

• RFC 3986 section 3.2.2: hosts are case-insensitive; this authority gate deliberately requires exact lowercase canonical spelling, and refuses every explicit port under the CC ruling. Capacity is now stricter than fix(trading): accept paper host version paths in capacity env URLs #1069's optional-443 rule.

Evidence-class table

Local commands run

Bounded run used the engine Python 3.12.3 venv and idle scope. Portable command
spelling below; the private lane report retains the absolute interpreter argv.

TMPDIR=/var/tmp systemd-run --user --scope -p CPUWeight=idle python -B -m unittest tests.test_adaptive_paper_credential_source tests.test_order_throughput tests.test_adaptive_market_research tests.test_adaptive_paper_runner.MainCommandGateWiring tests.test_adaptive_paper_source_hashes_manifest tests.test_evidence_manifest
rc 0: 202 tests in 14.476 seconds, OK (CC review-fix tree)

TMPDIR=/var/tmp python -B scripts/validate.py
rc 0: 71 components, 11886 hashed files, 4 profiles, 240 receipts

TMPDIR=/var/tmp scripts/git-hooks/pre-commit
rc 0: native staged secret scan passed

git diff --cached --check
rc 0

New tests use fake credential values only, outside Git. Initial diagnostic and
operating handoff evidence remain private; no provider text, account identifier
or private home path is copied into the PR. No new dependency is added.

CC review correction

Every explicit port, including :443, is now refused. Empty path, /, /v2 and /v2/ remain accepted; /v2// is refused. The README and decision records state the exact policy, and both displaced test-class docstrings are restored.

The final refusal regressions fail on unchanged 3b6279f production bytes for all four default-port paths across the shared normalizer/reason gate, both real guarded file loaders and capacity. Additional case, foreign-host userinfo and Unicode cases already refused at that head; their tests pin existing behavior. Unicode credential-file inputs hit the existing encoding refusal before capacity parsing. These are synthetic checks, with no broker calls.

Round 2 corrects the remaining contradictory sentence in the credential
decision's earlier dated correction: it now says NO explicit port and paths
empty, /, /v2 or /v2/, matching the implementation and later paragraph.
Only that document and its evidence hash/bytes changed. The reason-gate and
manifest checks passed (13 tests), and validate.py passed; no parser or test
behavior changed in this documentation round.

Decision record

docs/decisions/2026-10-13-strict-paper-url-gates.md.

The same PR supplies override-free replacement ExecStart forms for preflight,
paper and recover: native credential runner directly starts keychain-env with
the inventory's original value. The temporary child env utility/URL assignment
is absent from all three replacements. Co-op materializes their exact ids,
paths and properties in a NEW sealed operating record at a merged pin;
this builder does not edit the sealed old-pin records or active units.

Follow-ups

• Add the missing paper_only base-URL gate to mover paper/recover credential reads (mover_runner.py:705,936 at 3b6279f) in a separate PR.
• The separately recorded mover config-snapshot race remains a different PR.
• New-pin/unit activation and account readiness remain observed operator
  inputs; synthetic URL tests do not claim a ready broker preflight.
• Rebuild reader packets with all cited pinned source blobs and a hashed RFC
  3986 capture/provenance; verify the fix(trading): accept paper host version paths in capacity env URLs #1069 hyperlink in the offline packet.
• If the restored class docstrings are claimed as a separate regression,
  retain their fail-before assertions and pinned Python docstring citation.
• Preserve sealed historical records; any deliberate historical hygiene
  republication uses generic host labels without changing its evidence meaning.

Host evidence

Not applicable; no evidence/hosts changes.

Checklist

• Shared strict parser, existing request destinations and fixed reasons.
• Fail-before tests, capacity dependency receipt, source/evidence bindings.
• Override-free replacement unit forms included with preserved state/budgets.
• No credential values, account identifiers or private paths published.
• No paid service, workflow permission or dependency change.
• Peer-owned files, sealed operating records and running units preserved.
• Both families' delta reads on the CC review-fix head.