fix: close broker uncertainty audit gaps

tests/application/test_execution_cancel.py

@@ -40,6 +40,7 @@ class ProgrammableBroker:
         )
         self.polls = 0
         self.balance = {"005930": 10}
+        self.cancel_calls = 0
 
     def name(self):
         return "stub"
@@ -53,6 +54,7 @@ class ProgrammableBroker:
         return self.responder(side)
 
     def cancel_order(self, broker_order_id, *, side, symbol, qty, venue="KRX"):
+        self.cancel_calls += 1
         return CancelOutcome(CancelState.REQUESTED)
 
     def get_balance(self):
@@ -159,3 +161,20 @@ def test_stale_watchdog_disabled_by_default():
     repo._slots[sid] = replace(s, updated_at=datetime.now(tz=timezone.utc) - timedelta(seconds=9999))
     r = execution.run_once()
     assert r.stale_pending == 0  # disabled => never warns
+
+
+def test_operator_cancel_is_sent_once_across_repeat_and_restart():
+    broker = ProgrammableBroker()
+    repo, svc, intents, execution, _, _ = _wire(broker)
+    sid = _buy_to_holding(intents, execution)
+    intents.submit_sell(SellIntent(intent_id="s1", slot_id=sid))
+    broker.responder = lambda side: FillStatus(state="accepted")
+    execution.run_once()
+
+    assert execution.cancel_pending_slot(sid) == "ok"
+    assert execution.cancel_pending_slot(sid) == "cancel_already_recorded"
+
+    restarted = ExecutionService(svc, repo, broker)
+    assert restarted.cancel_pending_slot(sid) == "cancel_already_recorded"
+    assert broker.cancel_calls == 1
+    assert repo.fetch_slot(sid).cancel_state == CancelState.REQUESTED.value

tests/application/test_intent_concurrency.py

@@ -49,13 +49,9 @@ def test_concurrent_buys_admit_at_most_m():
 
     admitted = [s for s in results if s == "admitted"]
     pending = [s for s in repo.list_slots(INST) if s.status is SlotState.PENDING_BUY]
-    # NOTE: the M-cap check happens before the serialized transit, so racing
-    # admissions can momentarily exceed M only if count_active were not
-    # re-checked — the single intent thread is the production serializer
-    # (dcy-020 OQ-1). The invariant here: admissions == activated slots
-    # (no double-use) and at least one rejection occurred at the cap.
+    # Capacity admission and transition share the same instance advisory lock.
     assert len(admitted) == len(pending)
-    assert len(admitted) >= 5
+    assert len(admitted) == 5
     assert len(results) == 20
 
 
@@ -95,3 +91,52 @@ def test_duplicate_intent_id_admits_once_under_concurrency():
     pending = [s for s in repo.list_slots(INST) if s.status is SlotState.PENDING_BUY]
     assert len(pending) == 1
     assert all(s in ("admitted", "processing") for s in statuses)
+
+
+def test_concurrent_cached_cash_reservations_are_atomic_with_transition():
+    repo = InMemorySlotRepository()
+    svc = SlotService(repo, instance_key=INST)
+    repo.reconcile_universe(INST, {"PF-0": "SYM", "PF-1": "SYM"})
+
+    def cash_guard(intent: BuyIntent):
+        reserved = sum(
+            float(slot.qty or 0) * float(slot.limit_price or 0)
+            for slot in repo.list_slots(INST, {"pending_buy"})
+        )
+        requested = float(intent.qty or 0) * float(intent.entry_price or 0)
+        return None if reserved + requested <= 100 else "insufficient_snapshot_cash"
+
+    intents = IntentService(
+        svc,
+        repo,
+        InMemoryIntentStore(),
+        resolve_symbol=lambda pid: f"SYM-{pid}",
+        instance_key=INST,
+        buy_guard_fn=cash_guard,
+    )
+    results = []
+    result_lock = threading.Lock()
+
+    def worker(index: int) -> None:
+        decision = intents.submit_buy(
+            BuyIntent(
+                intent_id=f"cash-{index}",
+                portfolio_id=f"PF-{index}",
+                qty=1,
+                entry_price=100,
+            )
+        )
+        with result_lock:
+            results.append(decision)
+
+    threads = [threading.Thread(target=worker, args=(index,)) for index in range(2)]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join()
+
+    assert [decision.status for decision in results].count("admitted") == 1
+    assert [decision.reason for decision in results].count(
+        "insufficient_snapshot_cash"
+    ) == 1
+    assert len(repo.list_slots(INST, {"pending_buy"})) == 1