fix(broker): enforce operator broker truth boundary

trex_core/application/snapshot_scheduler.py

@@ -51,6 +51,7 @@ class SnapshotScheduler:
         warn_store: Optional[ReconcileWarningStore] = None,
         credential_fetch_enabled: bool = False,
         kis_reinit_callback: Optional[Callable[[BrokerCredentialPayload], None]] = None,
+        credential_refresh: Optional[Callable[[], object]] = None,
     ) -> None:
         self._read = read_port
         self._store = store
@@ -77,6 +78,8 @@ class SnapshotScheduler:
         # KISBroker with the fetched day-start credential. None = no reinit (paper
         # broker or credential_fetch_enabled=False). Set by daemon.py assembly.
         self._kis_reinit_callback: Optional[Callable[[BrokerCredentialPayload], None]] = kis_reinit_callback
+        # REQ-119: provider-owned refresh supersedes the legacy raw fetch hook.
+        self._credential_refresh = credential_refresh
         # REQ-113: detect break-glass at init time (env var set by operator).
         self._break_glass: bool = (
             os.environ.get("TREX_KIS_BROKER_BREAK_GLASS", "").lower()
@@ -250,7 +253,17 @@ class SnapshotScheduler:
         # Must run before portfolio snapshot so entry_allowed is set before
         # the first BuyIntent can arrive from the strategy daemon.
         if self._credential_fetch_enabled:
-            self._maybe_fetch_credential()
+            if self._credential_refresh is None:
+                self._maybe_fetch_credential()
+            else:
+                try:
+                    self._credential_refresh()
+                    self._entry_allowed = True
+                except Exception as exc:  # provider exposes only sanitized failure
+                    _log.error("DAY_START_LOAD_FAILED: broker credential refresh failed: %s (instance=%s)",
+                               exc.__class__.__name__, self._instance_key)
+                    self._entry_allowed = False
+                    self._emit_day_start_alarm(reason="broker_credential_unavailable")
 
         if self._daemon_id is None:
             try: