fix(broker): enforce operator broker truth boundary

tests/adapters/broker/test_kis.py

@@ -10,7 +10,7 @@ import os
 import pytest
 
 from trex_core.adapters.broker.kis import KISBroker
-from trex_core.application.broker_port import OrderRequest
+from trex_core.application.broker_port import BrokerBalanceError, OrderRequest
 
 _MOCK_URL = "https://openapivts.koreainvestment.com:29443"
 
@@ -75,3 +75,38 @@ def test_sandbox_token_and_submit():
         assert ack.broker_order_id
     else:
         assert ack.reason  # rejection carries a reason (e.g., 장 미개장/잔고부족)
+
+
+def test_get_balance_rejects_failure_instead_of_false_empty(monkeypatch):
+    """BAT-057: a rejected KIS response is not a successful empty balance."""
+    b = KISBroker("12345678-01", app_key="k", app_secret="s", base_url=_MOCK_URL)
+    monkeypatch.setattr(b, "_headers", lambda _tr: {})
+
+    class Response:
+        def raise_for_status(self): pass
+        def json(self): return {"rt_cd": "1", "output1": []}
+
+    monkeypatch.setattr("trex_core.adapters.broker.kis.httpx.get", lambda *a, **kw: Response())
+    with pytest.raises(BrokerBalanceError, match="broker_rejected"):
+        b.get_balance()
+
+
+def test_get_balance_accepts_validated_empty_balance(monkeypatch):
+    b = KISBroker("12345678-01", app_key="k", app_secret="s", base_url=_MOCK_URL)
+    monkeypatch.setattr(b, "_headers", lambda _tr: {})
+
+    class Response:
+        def raise_for_status(self): pass
+        def json(self): return {"rt_cd": "0", "output1": []}
+
+    monkeypatch.setattr("trex_core.adapters.broker.kis.httpx.get", lambda *a, **kw: Response())
+    assert b.get_balance() == []
+
+
+def test_get_balance_sanitizes_token_issuance_failure(monkeypatch):
+    b = KISBroker("12345678-01", app_key="k", app_secret="s", base_url=_MOCK_URL)
+    monkeypatch.setattr(b, "_headers", lambda _tr: (_ for _ in ()).throw(KeyError("access_token-secret")))
+    with pytest.raises(BrokerBalanceError) as raised:
+        b.get_balance()
+    assert raised.value.code == "token_issuance_failed"
+    assert "secret" not in str(raised.value)