feat: add bounded KIS account read recovery

tests/application/test_asset_centric_admission.py

@@ -99,3 +99,52 @@ def test_no_cap_admits_without_capacity_check():
         d = intents.submit_buy(BuyIntent(intent_id=f"b{i}", portfolio_id=pid))
         assert d.status == "admitted"
     assert repo.count_active(INST) == 3
+
+
+def test_buy_guard_rejection_is_fail_closed_and_sell_path_is_unaffected():
+    repo = InMemorySlotRepository()
+    svc = SlotService(repo, instance_key=INST)
+    repo.reconcile_universe(INST, {"pf-a": "SYM"})
+    intents = IntentService(
+        svc,
+        repo,
+        InMemoryIntentStore(),
+        resolve_symbol=lambda pid: _SYMS.get(pid),
+        instance_key=INST,
+        buy_guard_fn=lambda _intent: "insufficient_snapshot_cash",
+    )
+
+    decision = intents.submit_buy(
+        BuyIntent(
+            intent_id="guarded",
+            portfolio_id="pf-a",
+            qty=1,
+            entry_price=1000,
+        )
+    )
+    assert decision.status == "rejected"
+    assert decision.reason == "insufficient_snapshot_cash"
+    assert repo.find_slot_by_portfolio(INST, "pf-a").status is SlotState.INACTIVE
+
+
+def test_buy_guard_exception_rejects_without_slot_transition():
+    repo = InMemorySlotRepository()
+    svc = SlotService(repo, instance_key=INST)
+    repo.reconcile_universe(INST, {"pf-a": "SYM"})
+
+    def broken_guard(_intent):
+        raise RuntimeError("unavailable")
+
+    intents = IntentService(
+        svc,
+        repo,
+        InMemoryIntentStore(),
+        resolve_symbol=lambda pid: _SYMS.get(pid),
+        instance_key=INST,
+        buy_guard_fn=broken_guard,
+    )
+    decision = intents.submit_buy(
+        BuyIntent(intent_id="broken", portfolio_id="pf-a", qty=1, entry_price=1000)
+    )
+    assert decision.reason == "account_snapshot_unavailable"
+    assert repo.find_slot_by_portfolio(INST, "pf-a").status is SlotState.INACTIVE