fix(broker): enforce operator broker truth boundary

tests/application/test_holding_divergence.py

@@ -1,7 +1,10 @@
 """dcy-020 / REQ-062 (BAT-029): core holding ↔ broker divergence reconcile."""
 from __future__ import annotations
 
+from dataclasses import replace
+
 from trex_core.application.broker_port import BalanceItem
+from trex_core.application.portfolio import InMemoryReconcileWarningStore
 from trex_core.application.reconciliation import reconcile_core_holdings
 from trex_core.domain.slot import SlotService, SlotState
 from trex_core.domain.slot.in_memory_repository import InMemorySlotRepository
@@ -36,6 +39,18 @@ def _wire():
     return repo, SlotService(repo, instance_key=INST)
 
 
+class TrackingRepository(InMemorySlotRepository):
+    """Records writes so reconciliation-only classification stays read-only."""
+
+    def __init__(self):
+        super().__init__()
+        self.update_calls = 0
+
+    def update_slot(self, slot):
+        self.update_calls += 1
+        return super().update_slot(slot)
+
+
 def test_A_core_holding_broker_flat_goes_error():
     repo, svc = _wire()
     slot = _hold(repo, svc, "pf-a", "005930", 10)
@@ -66,4 +81,71 @@ def test_B_broker_holds_unmanaged_warns():
     repo, svc = _wire()
     broker = FakeBroker([BalanceItem(symbol="000660", hldg_qty=5)])  # core has none
     d = reconcile_core_holdings(slot_repo=repo, slot_service=svc, broker=broker, instance_key=INST)
-    assert d["broker:000660"] == "unmanaged_warning"
+    assert d["broker:000660"] == "unmanaged_position"
+
+
+def test_broker_held_symbol_with_same_instance_non_holding_slot_is_read_only_divergence():
+    repo = TrackingRepository()
+    svc = SlotService(repo, instance_key=INST)
+    warn_store = InMemoryReconcileWarningStore()
+    repo.reconcile_universe(INST, {"pf-a": "000660"})
+    slot = repo.find_slot_by_portfolio(INST, "pf-a")
+    assert slot is not None
+    writes_before = repo.update_calls
+
+    decisions = reconcile_core_holdings(
+        slot_repo=repo, slot_service=svc,
+        broker=FakeBroker([BalanceItem(symbol="000660", hldg_qty=5)]),
+        instance_key=INST, warn_store=warn_store,
+    )
+
+    assert decisions == {"broker:000660": "managed_non_holding_divergence"}
+    assert repo.fetch_slot(slot.slot_id) == slot
+    assert repo.update_calls == writes_before
+    assert warn_store.list_warned() == set()
+    assert repo.list_slots(INST) == [slot]
+
+
+def test_broker_held_symbol_with_same_instance_error_slot_is_read_only_divergence():
+    repo = TrackingRepository()
+    svc = SlotService(repo, instance_key=INST)
+    warn_store = InMemoryReconcileWarningStore()
+    repo.reconcile_universe(INST, {"pf-a": "000660"})
+    inactive = repo.find_slot_by_portfolio(INST, "pf-a")
+    assert inactive is not None
+    error = replace(inactive, status=SlotState.ERROR)
+    repo.update_slot(error)
+    writes_before = repo.update_calls
+
+    decisions = reconcile_core_holdings(
+        slot_repo=repo, slot_service=svc,
+        broker=FakeBroker([BalanceItem(symbol="000660", hldg_qty=5)]),
+        instance_key=INST, warn_store=warn_store,
+    )
+
+    assert decisions == {"broker:000660": "managed_non_holding_divergence"}
+    assert repo.fetch_slot(error.slot_id) == error
+    assert repo.update_calls == writes_before
+    assert warn_store.list_warned() == set()
+
+
+def test_other_instance_only_managed_slot_remains_unmanaged_position_without_writes():
+    repo = TrackingRepository()
+    svc = SlotService(repo, instance_key=INST)
+    warn_store = InMemoryReconcileWarningStore()
+    repo.reconcile_universe("other-instance", {"pf-a": "000660"})
+    other = repo.find_slot_by_portfolio("other-instance", "pf-a")
+    assert other is not None
+    writes_before = repo.update_calls
+
+    decisions = reconcile_core_holdings(
+        slot_repo=repo, slot_service=svc,
+        broker=FakeBroker([BalanceItem(symbol="000660", hldg_qty=5)]),
+        instance_key=INST, warn_store=warn_store,
+    )
+
+    assert decisions == {"broker:000660": "unmanaged_position"}
+    assert repo.fetch_slot(other.slot_id) == other
+    assert repo.update_calls == writes_before
+    assert warn_store.list_warned() == set()
+    assert repo.list_slots(INST) == []

tests/application/test_reconcile_warning_blocking.py

@@ -130,7 +130,7 @@ def test_reconcile_core_holdings_matching_qty_no_warn(caplog):
         instance_key="default", warn_store=warn_store,
     )
     assert warn_store.list_warned() == set()  # S-4: no false positive
-    assert all(v == "ok" for v in decisions.values() if v != "unmanaged_warning")
+    assert all(v == "ok" for v in decisions.values() if v != "unmanaged_position")
 
 
 # REQ-103 AC-4: A case (broker 0) => ERROR transition, NOT warn_store