docs(fiqh): long-only is bay' ma la yamlik, and it is not closed at the venue boundary

[eaitbrahim]

docs/fiqh-basis.md had no section on long-only at all. The rails table covered the prudential rails, rails 18/19 covered the spot-only charter, and the one ruling that is neither — keel never sells what it does not hold — was left implicit in four places that enforce it and named in none.

What the section says

Long-only is a fiqh-derivation, not a charter, and it descends from Ayub Ch 5.4.2 (§65.11) and Ch 6.5.1 (§65.4): bay' ma la yamlik. That anchor is more direct than riba for this class of failure, and the difference is load-bearing — a sale of what the seller does not hold is impermissible with no interest anywhere in the transaction, so a riba-framed defence does not reach it.

The four enforcement points are named with the source text that carries them: direction: Literal["long"] plus its __post_init__ runtime check (#447), side=Side.BUY unconditional in the engine, rail 10, rails 18/19.

One qualification, stated because §65.4 is invoked here for nearly the opposite of what it was read for. §65.4's own point is that possession is CONSTRUCTIVE — "what is meant by possession here is the inability to deliver the goods" — which is exactly how exchange-held balances qualify as valid qabd. That lenient reading does not weaken the long-only claim; it sharpens it. In every failure mode below the asset is not there at all, so selling it fails the prohibition on the lenient reading, not merely the strict one.

The hadith is recorded honestly. Hakim ibn Hizam — "Do not sell what is not with you", Sunan an-Nasa'i 4613 / Abu Dawud 3503 — is marked as not extracted in this repository's knowledge base. It carries no §N.x row and is not disguised as one. A test pins the disclaimer and its truth: if a source file ever extracts the hadith, the disclaimer has become false and the test says so.

The new open question

The ruling is sound where keel decides and open where it settles:

• A SELL is never clamped to the account's available base — fee dust, an unrecorded partial fill (filled_quantity is NULL on every filled live order), or an out-of-band transfer can send an order for more than is held (A SELL is never clamped to the venue's available base — fee dust, partial fills and out-of-band drift all oversell #667).
• A resting stop leg can outlive the position that justified it; no sweep cancels a SELL whose position is gone (No sweep for a resting SELL whose position is gone — a filled target leaves the stop live #668).
• On a cash account each is a rejection. On a margin-enabled account the venue fills the difference as a short — and there is no cash-account posture check on Coinbase; verify_cash_account exists only on the Alpaca adapter (Coinbase has no cash-account posture check — a margin-enabled account can turn a spot SELL into a short #666).

Named in the doc rather than left for a reader to discover.

Pins

Four tests, all two-sided, 12 mutants and 12 killed.

The base.py pin matches the field line by regex rather than the file, because __post_init__'s docstring quotes the annotation too and a prose mention is not a contract — an earlier version of this pin passed against direction: str. It also pins the runtime check separately, since the annotation is a promise to mypy and a foreign rule never runs mypy.

The venue-boundary pin is anchored to _sell_base_size's own stated contract, so when #667 lands this test fails — the doc gets updated with the code, not after it.

Full suite: 5059 passed, 3 skipped. ruff and mypy clean; no new ruff format deltas.

Closes nothing — it records what #666/#667/#668 are for.