fix(ledger): dcy-015 outbox 영속 오류 분류 + 백오프/dead-letter (BAT-019)

portfolio-hub 404(미등록 포트폴리오)가 retryable 로 분류되어 백오프·상한 없이
초당 영구 재시도되던 버그(issue #13, 실측 930회) 정정.

거버넌스: 전부 change-req (신규 REQ 없음, dcy-015 OQ-3; 백오프 env 는 REQ-019 흡수).
- REQ-017: 404/400/422 → LedgerPermanentError 분류 (409 conflict / 408·429·5xx·
  network retryable 불변). LedgerPort 에 permanent 타입 추가
- REQ-019: 영속 → 터미널 delivery_failed 즉시(재시도 0). retryable 지수 백오프
  +jitter+next_retry_at, max_attempts 초과 시 dead-letter delivery_failed.
  list_pending 이 백오프 행 스킵(head-of-line 보호). 마이그레이션 007(status enum
  +next_retry_at). 백오프 env(base/cap/max-attempts)
- REQ-018: 터미널/dead-letter WARN + WriterStats.delivery_failed 카운터 가시화
- REQ-020: runtime-flows/data-model/interface-contract 정합

단일 터미널 delivery_failed(permanent/dead-letter, last_outcome 로 사유 구분) —
conflict_blocked 패턴과 동형. dead-letter 는 운영자 재처리 가능 상태.

검증: 단위 311 passed/34 skipped, 인프라 게이트(PG+RabbitMQ) 345 passed, ruff clean.
신규 test_ledger_outbox_backoff + adapter/PG 테스트, 기존 retryable 백오프 정합.
BAT-019 release-candidate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/application/test_execution_ledger.py

@@ -25,13 +25,16 @@ from trex_core.domain.slot.in_memory_repository import InMemorySlotRepository
 DAY = date(2026, 6, 4)
 
 
-def _wire(broker, *, ledger=None):
+def _wire(broker, *, ledger=None, clock=None):
     repo = InMemorySlotRepository()
     svc = SlotService(repo)
     intents = IntentService(svc, repo, InMemoryIntentStore())
-    outbox = InMemoryLedgerOutbox()
+    outbox = InMemoryLedgerOutbox(clock=clock) if clock else InMemoryLedgerOutbox()
     execution = ExecutionService(svc, repo, broker, ledger_outbox=outbox)
-    writer = LedgerWriter(outbox, ledger or InMemoryLedger())
+    writer = (
+        LedgerWriter(outbox, ledger or InMemoryLedger(), clock=clock)
+        if clock else LedgerWriter(outbox, ledger or InMemoryLedger())
+    )
     svc.preallocate_daily_slots(DAY, 5)
     return repo, svc, intents, execution, outbox, writer
 
@@ -134,17 +137,26 @@ def test_duplicate_execution_id_results_in_zero_duplicate_in_ledger():
 
 
 def test_retryable_failure_then_eventually_completes():
-    """REQ-019 AC-2: retry until completed; slot transition unaffected."""
+    """REQ-019 AC-2: retry until completed; slot transition unaffected.
+
+    dcy-015: retryable rows back off, so advance a shared clock past each
+    next_retry_at between writer passes.
+    """
+    from datetime import datetime, timedelta, timezone
+    now = {"t": datetime(2026, 6, 4, tzinfo=timezone.utc)}
     ledger = InMemoryLedger(fail_n_then_succeed=2)
-    repo, svc, intents, execution, outbox, writer = _wire(PaperBroker(fill_after_polls=0),
-                                                          ledger=ledger)
+    repo, svc, intents, execution, outbox, writer = _wire(
+        PaperBroker(fill_after_polls=0), ledger=ledger, clock=lambda: now["t"],
+    )
     sid = _buy(intents).slot_id
     execution.run_once()
     assert repo.fetch_slot(sid).status is SlotState.HOLDING  # slot already transitioned
     stats1 = writer.run_once()
     assert stats1.retryable == 1 and stats1.completed == 0 and ledger.count() == 0
+    now["t"] += timedelta(seconds=600)  # past backoff
     stats2 = writer.run_once()
     assert stats2.retryable == 1 and ledger.count() == 0
+    now["t"] += timedelta(seconds=600)  # past backoff again
     stats3 = writer.run_once()
     assert stats3.completed == 1 and ledger.count() == 1
     # outbox row terminal-completed