fix(broker): dcy-013 KIS 외부 취소 감지 + 부분 체결 회계 + stale 워치독 (BAT-017)

KIS 계좌에서 직접 매도 주문을 취소하면 poll_fill 이 cncl_yn 을 파싱하지 않아
슬롯이 pending_sell 에 영구히 갇히고 죽은 주문을 무한 폴링하던 버그(issue #9)
정정.

거버넌스: 전부 change-req (신규 REQ 없음, dcy-013 OQ-3).
- REQ-012: KIS poll_fill cncl_yn 파싱 → 외부 취소 감지. FillStatus.cancelled
  /is_partial_cancel 추가. 체결 0 취소→cancelled, 부분 체결 후 취소→partial+cancelled
- REQ-013: 집행 _on_partial_cancel — 체결분 원장 1회 + qty 차감(매도 잔여/매수 체결분)
  + holding 복귀 (OQ-1 A안). 전량 취소는 기존 롤백 경로 재사용
- REQ-018: 부분 체결분 원장 1회 기록 (_record_ledger 재사용)
- REQ-031: 잔여 포지션 정합 연계 (slot.qty ↔ 실 잔고, 과매도 방지)
- REQ-014: pending stale 워치독 Alert-only (TREX_PENDING_STALE_THRESHOLD,
  WARN+카운터, 상태 미변경) — 취소 감지 누락 backstop
- REQ-015: interface-contract/runtime-flows 정합

전량 취소는 holding 자동 복구(limit_price clear→재매도 시장가, dcy-012 연계).
KIS cncl_yn 실 규약은 운영 검증(미지 값 보수 처리 + 워치독 backstop).

검증: 단위 294 passed/32 skipped, 인프라 게이트(PG+RabbitMQ) 326 passed, ruff clean.
신규 test_kis_cancel(httpx stub) + test_execution_cancel(programmable broker).
BAT-017 release-candidate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

trex_core/application/broker_port.py

@@ -53,6 +53,12 @@ class FillStatus:
     execution_id: Optional[str] = None
     fee: float = 0.0
     tax: float = 0.0
+    # dcy-013 / REQ-012 (issue #9): an external cancel was detected. When the
+    # order had a partial fill before the cancel, state stays "partially_filled"
+    # and this flag is set so execution records the filled portion and returns
+    # the remainder to holding (is_partial_cancel). A zero-fill external cancel
+    # is mapped to state="cancelled" (is_terminal_reject) instead.
+    cancelled: bool = False
     raw: dict[str, Any] = field(default_factory=dict)
 
     @property
@@ -63,6 +69,11 @@ class FillStatus:
     def is_terminal_reject(self) -> bool:
         return self.state in {"rejected", "cancelled"}
 
+    @property
+    def is_partial_cancel(self) -> bool:
+        """A partial fill that was then externally cancelled (dcy-013 FR-2)."""
+        return self.cancelled and self.filled_qty > 0
+
 
 class BrokerPort(Protocol):
     """Single broker session boundary (invariant B)."""

trex_core/application/execution.py

@@ -46,6 +46,7 @@ class ExecutionResult:
     rolled_back: int = 0
     ledger_enqueued: int = 0     # REQ-019: ledger work items appended this tick
     ledger_skipped: int = 0      # REQ-018 AC-4: fills without portfolio_id
+    stale_pending: int = 0       # dcy-013 / REQ-014 FR-3: pending orders over threshold
 
 
 class ExecutionService:
@@ -56,12 +57,22 @@ class ExecutionService:
         broker: BrokerPort,
         ledger_outbox: Optional[LedgerOutbox] = None,
         event_emitter: Optional[SlotEventEmitter] = None,
+        stale_pending_threshold_sec: Optional[int] = None,
     ) -> None:
         self._svc = slot_service
         self._repo = repo
         self._broker = broker
         self._ledger_outbox = ledger_outbox
         self._event_emitter = event_emitter
+        # dcy-013 / REQ-014 (issue #9): Alert-only pending-order stale watchdog.
+        # <=0 or None disables it. When set, a dispatched-pending slot whose
+        # last update is older than the threshold is surfaced (WARN + counter)
+        # without changing its state — the backstop for a cancel-detection miss.
+        self._stale_threshold_sec = (
+            stale_pending_threshold_sec
+            if stale_pending_threshold_sec and stale_pending_threshold_sec > 0
+            else None
+        )
 
     # ------------------------------------------------------------
     def run_once(self) -> ExecutionResult:
@@ -111,16 +122,25 @@ class ExecutionService:
                 r.rolled_back += 1
 
     def _poll(self, r: ExecutionResult) -> None:
+        now = datetime.now(tz=timezone.utc)
         for slot in self._repo.list_dispatched_pending():
             side = "buy" if slot.status is SlotState.PENDING_BUY else "sell"
             fs = self._broker.poll_fill(slot.broker_order_id, side=side, symbol=slot.symbol or "")
             if fs.is_filled:
                 self._on_filled(slot, fs, side, r)
                 r.filled += 1
+            elif fs.is_partial_cancel:
+                # dcy-013 / REQ-013 FR-2: partial fill then external cancel.
+                self._on_partial_cancel(slot, fs, side, r)
+                r.filled += 1
             elif fs.is_terminal_reject:
+                # rejected or full external cancel (dcy-013 FR-1) -> rollback.
                 self._rollback(slot, reason=f"order_{fs.state}")
                 r.rolled_back += 1
-            # accepted / partially_filled -> leave for next tick
+            else:
+                # accepted / partially_filled (not cancelled) -> leave for next
+                # tick, but surface if it has been stuck too long (FR-3).
+                self._check_stale_pending(slot, now, r)
 
     # ------------------------------------------------------------
     def _on_filled(self, slot, fs, side: str, r: ExecutionResult) -> None:
@@ -149,6 +169,58 @@ class ExecutionService:
         self._emit_event(event_type, updated)
         self._repo.clear_dispatch(slot.slot_id)  # done with this order
 
+    def _on_partial_cancel(self, slot, fs, side: str, r: ExecutionResult) -> None:
+        """Partial fill then external cancel (dcy-013 / REQ-013 FR-2, OQ-1 A).
+
+        Record the filled portion to the ledger ONCE, decrement the held qty,
+        and return the slot to holding with the remainder — so the remaining
+        position can be re-sold and no over-sell / double-record occurs (NFR-3).
+        avg_price (cost basis) is preserved on a sell; a buy keeps only the
+        portion that actually filled.
+        """
+        broker_order_id = slot.broker_order_id  # captured BEFORE clear_dispatch
+        filled = float(fs.filled_qty)
+        try:
+            if slot.status is SlotState.PENDING_BUY:
+                # Only the filled portion is held; avg_price = fill price.
+                updated = self._svc.transit_slot(
+                    slot.slot_id, SlotState.PENDING_BUY, SlotState.HOLDING,
+                    reason="buy_partial_cancel", actor="execution_loop",
+                    avg_price=fs.avg_price, qty=filled,
+                )
+                event_type = "slot_filled_buy"
+            else:  # PENDING_SELL: remainder stays held, cost basis unchanged.
+                remaining = max(0.0, float(slot.qty or 0) - filled)
+                updated = self._svc.transit_slot(
+                    slot.slot_id, SlotState.PENDING_SELL, SlotState.HOLDING,
+                    reason="sell_partial_cancel", actor="execution_loop",
+                    qty=remaining,
+                )
+                event_type = "slot_filled_sell"
+        except SlotStateMismatchError:
+            return  # slot moved concurrently; next tick reconciles
+        self._record_ledger(slot, fs, side, broker_order_id, r)
+        self._emit_event(event_type, updated)
+        self._repo.clear_dispatch(slot.slot_id)
+
+    def _check_stale_pending(self, slot, now: datetime, r: ExecutionResult) -> None:
+        """Alert-only: surface a dispatched-pending slot stuck past the threshold.
+
+        dcy-013 / REQ-014 FR-3 — state is NOT changed (auto-remediation is a
+        follow-up). This is the backstop for a cancel-detection miss (R-1).
+        """
+        if self._stale_threshold_sec is None or slot.updated_at is None:
+            return
+        age = (now - slot.updated_at).total_seconds()
+        if age >= self._stale_threshold_sec:
+            r.stale_pending += 1
+            _log.warning(
+                "pending order stale: slot=%s status=%s broker_order_id=%s "
+                "age_sec=%.0f threshold_sec=%d (no state change — ops attention)",
+                slot.slot_id, slot.status.value, slot.broker_order_id,
+                age, self._stale_threshold_sec,
+            )
+
     def _emit_event(self, event_type: str, slot) -> None:
         if self._event_emitter is None:
             return