# AEG-VS-29 — Reconciliation replay-safety boundary

## Source / Assumption / Unknown / Decision Required

- Source: `PortfolioReconciliation/Endpoints.cs`, `ReconcileTradeHandler.cs`, v60 permission/idempotency guidance, and `AEG-X-005_RECONCILIATION_AUTH_DECISION_REQUIRED.md`.
- Assumption: the client must reuse the same `Idempotency-Key` for retries of one reconciliation command.
- Unknown: approved reconciliation role/policy, durable request/result binding schema, and production database migration owner.
- Decision Required: approve endpoint authority and JobRun/request deduplication storage before production registration.

## Implemented

- Reconciliation POST rejects a missing or whitespace-only idempotency key with HTTP 400.
- The handler defensively rejects a missing key when invoked outside HTTP boundary.
- The previous random fallback key was removed; supplied key is propagated unchanged to the outbox event.
- No role was invented and no automatic order/KIS capability was enabled.

## Evidence

Command: `dotnet test tests/KArtSell.ModelOperations.UnitTests/KArtSell.ModelOperations.UnitTests.csproj --no-restore -c Release --filter FullyQualifiedName~ReconciliationRequestValidatorTests`

- Actual result: 1 test file / 2 tests passed.
- `git diff --check`: passed; repository emitted only existing LF/CRLF normalization warnings.

## Outstanding

Durable request/result deduplication, database-backed replay integration, fresh/upgrade/re-run/failure migration rehearsal, approved authorization, and negative endpoint authorization evidence remain outstanding. This note does not claim full Reconciliation WBS completion.