fix(broker): enforce operator broker truth boundary

trex_core/domain/slot/in_memory_repository.py

@@ -89,6 +89,19 @@ class InMemorySlotRepository:
             if s.instance_key == instance_key and s.status is SlotState.HOLDING
         ]
 
+    def find_managed_slot_by_symbol(self, instance_key: str, symbol: str) -> Optional[Slot]:
+        candidates = [
+            s for s in self._slots.values()
+            if s.instance_key == instance_key and s.symbol == symbol
+        ]
+        # PostgreSQL parity: updated_at DESC NULLS LAST, slot_id ASC.
+        candidates.sort(key=lambda s: (
+            s.updated_at is None,
+            -s.updated_at.timestamp() if s.updated_at is not None else 0,
+            str(s.slot_id),
+        ))
+        return candidates[0] if candidates else None
+
     def reconcile_universe(
         self, instance_key: str, universe: dict[str, str],
         *, allow_retire: bool = True,

trex_core/domain/slot/repository.py

@@ -72,6 +72,13 @@ class SlotRepository(Protocol):
         reconcile; safety-sell / kill-switch sweeps)."""
         ...
 
+    def find_managed_slot_by_symbol(self, instance_key: str, symbol: str) -> Optional[Slot]:
+        """Return one deterministic managed slot for exact instance+symbol.
+
+        Read-only reconciliation triage; this must not imply remediation.
+        """
+        ...
+
     def reconcile_universe(
         self, instance_key: str, universe: dict[str, str],
         *, allow_retire: bool = True,