fix(ledger): dcy-015 outbox 영속 오류 분류 + 백오프/dead-letter (BAT-019)

portfolio-hub 404(미등록 포트폴리오)가 retryable 로 분류되어 백오프·상한 없이
초당 영구 재시도되던 버그(issue #13, 실측 930회) 정정.

거버넌스: 전부 change-req (신규 REQ 없음, dcy-015 OQ-3; 백오프 env 는 REQ-019 흡수).
- REQ-017: 404/400/422 → LedgerPermanentError 분류 (409 conflict / 408·429·5xx·
  network retryable 불변). LedgerPort 에 permanent 타입 추가
- REQ-019: 영속 → 터미널 delivery_failed 즉시(재시도 0). retryable 지수 백오프
  +jitter+next_retry_at, max_attempts 초과 시 dead-letter delivery_failed.
  list_pending 이 백오프 행 스킵(head-of-line 보호). 마이그레이션 007(status enum
  +next_retry_at). 백오프 env(base/cap/max-attempts)
- REQ-018: 터미널/dead-letter WARN + WriterStats.delivery_failed 카운터 가시화
- REQ-020: runtime-flows/data-model/interface-contract 정합

단일 터미널 delivery_failed(permanent/dead-letter, last_outcome 로 사유 구분) —
conflict_blocked 패턴과 동형. dead-letter 는 운영자 재처리 가능 상태.

검증: 단위 311 passed/34 skipped, 인프라 게이트(PG+RabbitMQ) 345 passed, ruff clean.
신규 test_ledger_outbox_backoff + adapter/PG 테스트, 기존 retryable 백오프 정합.
BAT-019 release-candidate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

trex_core/adapters/ledger/in_memory.py

@@ -5,6 +5,7 @@ import threading
 
 from trex_core.application.ledger_port import (
     LedgerConflictError,
+    LedgerPermanentError,
     LedgerRetryableError,
     LedgerTrade,
     LedgerWriteResult,
@@ -21,6 +22,8 @@ class InMemoryLedger:
                                then accept.
         conflict_executions -- execution_ids that raise LedgerConflictError
                                (simulates portfolio-hub 409).
+        permanent_executions -- execution_ids that raise LedgerPermanentError
+                               (simulates portfolio-hub 404/400/422, dcy-015).
     """
 
     def __init__(
@@ -28,12 +31,14 @@ class InMemoryLedger:
         *,
         fail_n_then_succeed: int = 0,
         conflict_executions: set[str] | None = None,
+        permanent_executions: set[str] | None = None,
     ) -> None:
         self._trades: dict[str, LedgerTrade] = {}
         self._order: list[LedgerTrade] = []
         self._lock = threading.Lock()
         self._fail_remaining = fail_n_then_succeed
         self._conflicts = set(conflict_executions or set())
+        self._permanent = set(permanent_executions or set())
 
     def record_trade(self, trade: LedgerTrade) -> LedgerWriteResult:
         with self._lock:
@@ -41,6 +46,10 @@ class InMemoryLedger:
                 raise LedgerConflictError(
                     f"ledger conflict for execution_id={trade.execution_id}"
                 )
+            if trade.execution_id in self._permanent:
+                raise LedgerPermanentError(
+                    f"ledger permanent error for execution_id={trade.execution_id}"
+                )
             if self._fail_remaining > 0:
                 self._fail_remaining -= 1
                 raise LedgerRetryableError("simulated transient failure")

trex_core/adapters/ledger/portfolio_hub.py

@@ -6,7 +6,9 @@ Live portfolio-hub contract (verified against openapi, REQ-017 CHG-04):
              execution_id, order_id
   - 2xx (201)        => recorded (or duplicate accepted idempotently)
   - 409              => LedgerConflictError (operator resolution)
-  - 4xx (other)/5xx  => LedgerRetryableError (outbox retries)
+  - 404/400/422      => LedgerPermanentError (dcy-015/REQ-017 — retry can't fix:
+                        portfolio not registered / malformed trade)
+  - 4xx (other)/5xx  => LedgerRetryableError (outbox backoff retries)
   - httpx error      => LedgerRetryableError
 
 `asset_id` on LedgerTrade carries the portfolio_id value (REQ-018:
@@ -21,11 +23,15 @@ import httpx
 
 from trex_core.application.ledger_port import (
     LedgerConflictError,
+    LedgerPermanentError,
     LedgerRetryableError,
     LedgerTrade,
     LedgerWriteResult,
 )
 
+# dcy-015 / REQ-017: client errors that retrying cannot resolve.
+_PERMANENT_STATUS = frozenset({400, 404, 422})
+
 
 class PortfolioHubLedger:
     """portfolio-hub ledger adapter (single endpoint, single responsibility)."""
@@ -91,6 +97,14 @@ class PortfolioHubLedger:
                 f"portfolio-hub 409 conflict for execution_id={trade.execution_id}: "
                 f"{resp.text[:200]}"
             )
+        if resp.status_code in _PERMANENT_STATUS:
+            # dcy-015 / REQ-017 (issue #13): 404/400/422 won't be fixed by
+            # retrying — surface as permanent so the outbox terminates the row.
+            raise LedgerPermanentError(
+                f"portfolio-hub {resp.status_code} permanent error for "
+                f"asset_id={trade.asset_id} execution_id={trade.execution_id}: "
+                f"{resp.text[:200]}"
+            )
         raise LedgerRetryableError(
             f"portfolio-hub {resp.status_code} response: {resp.text[:200]}"
         )