fix(broker): enforce operator broker truth boundary

trex_core/runtime/daemon.py

@@ -74,6 +74,7 @@ _log = logging.getLogger(__name__)
 
 
 def _build_broker(config: DaemonConfig) -> BrokerPort:
+    """Backward-compatible env-only factory; new callers use broker_provider."""
     if config.broker == "kis":
         from trex_core.adapters.broker.kis import KISBroker
 
@@ -180,7 +181,7 @@ class Daemon:
             instance_key=config.instance_key,
             strategy_state_store=self.strategy_state_store,
         )
-        self.broker = _build_broker(config)
+
         self.outbox = PostgreSQLLedgerOutbox(config.dsn)
         # BAT-008: portfolio-hub read + snapshot store + durable pause + scheduler.
         # (Created before the ledger writer so option-D write-back can target it.)
@@ -193,6 +194,11 @@ class Daemon:
         # BAT-012: day-scoped kill-switch exclusion store + service.
         self.killswitch_store = PostgreSQLKillSwitchStore(config.dsn)
         self.portfolio_read = _build_portfolio_read(config)
+        # REQ-119: one provider owns source resolution and the long-lived broker.
+        # Fetched mode never starts from an implicit env broker.
+        from trex_core.runtime.broker_provider import build_broker_provider
+        self.broker_provider = build_broker_provider(config, read_port=self.portfolio_read)
+        self.broker, self.broker_source = self.broker_provider.get_broker_for_read()
 
         # Event publisher transport — one dedicated instance for the
         # execution-loop thread (pika is not thread-safe).
@@ -237,6 +243,7 @@ class Daemon:
             alarm_emitter=self.alarm_emitter,  # dcy-033 / REQ-100
             warn_store=self.warn_store,  # BAT-050 / REQ-103: durable reconcile-warning
             credential_fetch_enabled=config.credential_fetch_enabled,  # dcy-036 / REQ-113
+            credential_refresh=self.broker_provider.refresh_day_start_credential,
             # dcy-036 / REQ-113 AC-2 / REQ-115 AC-1: KISBroker reinit callback.
             # None when broker!=kis or credential_fetch_enabled=False (backward compat).
             kis_reinit_callback=_build_kis_reinit_callback(config, self.broker),