Merge pull request 'fix: add token refresh lock to prevent concurrent API calls (issue #42)' (#46) from feature/issue-42-token-refresh-lock into main

Reviewed-on: #46

.env.example

@@ -26,3 +26,10 @@ MODE=paper
 # NEWS_API_KEY=your_news_api_key_here
 # NEWS_API_PROVIDER=alphavantage
 # MARKET_DATA_API_KEY=your_market_data_key_here
+
+# Telegram Notifications (optional)
+# Get bot token from @BotFather on Telegram
+# Get chat ID from @userinfobot or your chat
+# TELEGRAM_BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz
+# TELEGRAM_CHAT_ID=123456789
+# TELEGRAM_ENABLED=true

CLAUDE.md

@@ -17,6 +17,34 @@ pytest -v --cov=src
 python -m src.main --mode=paper
 ```
 
+## Telegram Notifications (Optional)
+
+Get real-time alerts for trades, circuit breakers, and system events via Telegram.
+
+### Quick Setup
+
+1. **Create bot**: Message [@BotFather](https://t.me/BotFather) on Telegram → `/newbot`
+2. **Get chat ID**: Message [@userinfobot](https://t.me/userinfobot) → `/start`
+3. **Configure**: Add to `.env`:
+   ```bash
+   TELEGRAM_BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz
+   TELEGRAM_CHAT_ID=123456789
+   TELEGRAM_ENABLED=true
+   ```
+4. **Test**: Start bot conversation (`/start`), then run the agent
+
+**Full documentation**: [src/notifications/README.md](src/notifications/README.md)
+
+### What You'll Get
+
+- 🟢 Trade execution alerts (BUY/SELL with confidence)
+- 🚨 Circuit breaker trips (automatic trading halt)
+- ⚠️ Fat-finger rejections (oversized orders blocked)
+- ℹ️ Market open/close notifications
+- 📝 System startup/shutdown status
+
+**Fail-safe**: Notifications never crash the trading system. Missing credentials or API errors are logged but trading continues normally.
+
 ## Documentation
 
 - **[Workflow Guide](docs/workflow.md)** — Git workflow policy and agent-based development
@@ -42,11 +70,12 @@ src/
 ├── core/            # Risk manager (READ-ONLY)
 ├── evolution/       # Self-improvement optimizer
 ├── markets/         # Market schedules and timezone handling
+├── notifications/   # Telegram real-time alerts
 ├── db.py            # SQLite trade logging
 ├── main.py          # Trading loop orchestrator
 └── config.py        # Settings (from .env)
 
-tests/               # 54 tests across 4 files
+tests/               # 273 tests across 13 files
 docs/                # Extended documentation
 ```
 

README.md

@@ -29,6 +29,7 @@ KIS(한국투자증권) API로 매매하고, Google Gemini로 판단하며, 자
 | 브로커 | `src/broker/kis_api.py` | KIS API 비동기 래퍼 (토큰 갱신, 레이트 리미터, 해시키) |
 | 두뇌 | `src/brain/gemini_client.py` | Gemini 프롬프트 구성 및 JSON 응답 파싱 |
 | 방패 | `src/core/risk_manager.py` | 서킷 브레이커 + 팻 핑거 체크 |
+| 알림 | `src/notifications/telegram_client.py` | 텔레그램 실시간 거래 알림 (선택사항) |
 | 진화 | `src/evolution/optimizer.py` | 실패 패턴 분석 → 새 전략 생성 → 테스트 → PR |
 | DB | `src/db.py` | SQLite 거래 로그 기록 |
 
@@ -75,6 +76,34 @@ python -m src.main --mode=paper
 docker compose up -d ouroboros
 ```
 
+## 텔레그램 알림 (선택사항)
+
+거래 실행, 서킷 브레이커 발동, 시스템 상태 등을 텔레그램으로 실시간 알림 받을 수 있습니다.
+
+### 빠른 설정
+
+1. **봇 생성**: 텔레그램에서 [@BotFather](https://t.me/BotFather) 메시지 → `/newbot` 명령
+2. **채팅 ID 확인**: [@userinfobot](https://t.me/userinfobot) 메시지 → `/start` 명령
+3. **환경변수 설정**: `.env` 파일에 추가
+   ```bash
+   TELEGRAM_BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz
+   TELEGRAM_CHAT_ID=123456789
+   TELEGRAM_ENABLED=true
+   ```
+4. **테스트**: 봇과 대화 시작 (`/start` 전송) 후 에이전트 실행
+
+**상세 문서**: [src/notifications/README.md](src/notifications/README.md)
+
+### 알림 종류
+
+- 🟢 거래 체결 알림 (BUY/SELL + 신뢰도)
+- 🚨 서킷 브레이커 발동 (자동 거래 중단)
+- ⚠️ 팻 핑거 차단 (과도한 주문 차단)
+- ℹ️ 장 시작/종료 알림
+- 📝 시스템 시작/종료 상태
+
+**안전장치**: 알림 실패해도 거래는 계속 진행됩니다. 텔레그램 API 오류나 설정 누락이 있어도 거래 시스템은 정상 작동합니다.
+
 ## 테스트
 
 35개 테스트가 TDD 방식으로 구현 전에 먼저 작성되었습니다.
@@ -104,15 +133,16 @@ The-Ouroboros/
 │   ├── agents.md                # AI 에이전트 페르소나 정의
 │   └── skills.md                # 사용 가능한 도구 목록
 ├── src/
-│   ├── config.py                # Pydantic 설정
-│   ├── logging_config.py        # JSON 구조화 로깅
-│   ├── db.py                    # SQLite 거래 기록
-│   ├── main.py                  # 비동기 거래 루프
-│   ├── broker/kis_api.py        # KIS API 클라이언트
-│   ├── brain/gemini_client.py   # Gemini 의사결정 엔진
-│   ├── core/risk_manager.py     # 리스크 관리
-│   ├── evolution/optimizer.py   # 전략 진화 엔진
-│   └── strategies/base.py       # 전략 베이스 클래스
+│   ├── config.py                      # Pydantic 설정
+│   ├── logging_config.py              # JSON 구조화 로깅
+│   ├── db.py                          # SQLite 거래 기록
+│   ├── main.py                        # 비동기 거래 루프
+│   ├── broker/kis_api.py              # KIS API 클라이언트
+│   ├── brain/gemini_client.py         # Gemini 의사결정 엔진
+│   ├── core/risk_manager.py           # 리스크 관리
+│   ├── notifications/telegram_client.py # 텔레그램 알림
+│   ├── evolution/optimizer.py         # 전략 진화 엔진
+│   └── strategies/base.py             # 전략 베이스 클래스
 ├── tests/                       # TDD 테스트 스위트
 ├── Dockerfile                   # 멀티스테이지 빌드
 ├── docker-compose.yml           # 서비스 오케스트레이션

docs/architecture.md

@@ -51,7 +51,26 @@ Self-evolving AI trading agent for global stock markets via KIS (Korea Investmen
 - **Fat-Finger Protection**: Rejects orders exceeding 30% of available cash
   - Must always be enforced, cannot be disabled
 
-### 4. Evolution (`src/evolution/optimizer.py`)
+### 4. Notifications (`src/notifications/telegram_client.py`)
+
+**TelegramClient** — Real-time event notifications via Telegram Bot API
+
+- Sends alerts for trades, circuit breakers, fat-finger rejections, system events
+- Non-blocking: failures are logged but never crash trading
+- Rate-limited: 1 message/second default to respect Telegram API limits
+- Auto-disabled when credentials missing
+- Gracefully handles API errors, network timeouts, invalid tokens
+
+**Notification Types:**
+- Trade execution (BUY/SELL with confidence)
+- Circuit breaker trips (critical alert)
+- Fat-finger protection triggers (order rejection)
+- Market open/close events
+- System startup/shutdown status
+
+**Setup:** See [src/notifications/README.md](../src/notifications/README.md) for bot creation and configuration.
+
+### 5. Evolution (`src/evolution/optimizer.py`)
 
 **StrategyOptimizer** — Self-improvement loop
 
@@ -115,6 +134,14 @@ Self-evolving AI trading agent for global stock markets via KIS (Korea Investmen
                            │
                            ▼
         ┌──────────────────────────────────┐
+        │ Notifications: Send Alert         │
+        │ - Trade execution notification    │
+        │ - Non-blocking (errors logged)    │
+        │ - Rate-limited to 1/sec           │
+        └──────────────────┬────────────────┘
+                           │
+                           ▼
+        ┌──────────────────────────────────┐
         │ Database: Log Trade               │
         │ - SQLite (data/trades.db)         │
         │ - Track: action, confidence,      │
@@ -164,6 +191,11 @@ CONFIDENCE_THRESHOLD=80
 MAX_LOSS_PCT=3.0
 MAX_ORDER_PCT=30.0
 ENABLED_MARKETS=KR,US_NASDAQ  # Comma-separated market codes
+
+# Telegram Notifications (optional)
+TELEGRAM_BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz
+TELEGRAM_CHAT_ID=123456789
+TELEGRAM_ENABLED=true
 ```
 
 Tests use in-memory SQLite (`DB_PATH=":memory:"`) and dummy credentials via `tests/conftest.py`.
@@ -189,3 +221,12 @@ Tests use in-memory SQLite (`DB_PATH=":memory:"`) and dummy credentials via `tes
 - Wait until next market opens
 - Use `get_next_market_open()` to calculate wait time
 - Sleep until market open time
+
+### Telegram API Errors
+- Log warning but continue trading
+- Missing credentials → auto-disable notifications
+- Network timeout → skip notification, no retry
+- Invalid token → log error, trading unaffected
+- Rate limit exceeded → queued via rate limiter
+
+**Guarantee**: Notification failures never interrupt trading operations.

src/broker/kis_api.py

@@ -55,6 +55,7 @@ class KISBroker:
         self._session: aiohttp.ClientSession | None = None
         self._access_token: str | None = None
         self._token_expires_at: float = 0.0
+        self._token_lock = asyncio.Lock()
         self._rate_limiter = LeakyBucket(settings.RATE_LIMIT_RPS)
 
     def _get_session(self) -> aiohttp.ClientSession:
@@ -80,30 +81,42 @@ class KISBroker:
     # ------------------------------------------------------------------
 
     async def _ensure_token(self) -> str:
-        """Return a valid access token, refreshing if expired."""
+        """Return a valid access token, refreshing if expired.
+
+        Uses a lock to prevent concurrent token refresh attempts that would
+        hit the API's 1-per-minute rate limit (EGW00133).
+        """
+        # Fast path: check without lock
         now = asyncio.get_event_loop().time()
         if self._access_token and now < self._token_expires_at:
             return self._access_token
 
-        logger.info("Refreshing KIS access token")
-        session = self._get_session()
-        url = f"{self._base_url}/oauth2/tokenP"
-        body = {
-            "grant_type": "client_credentials",
-            "appkey": self._app_key,
-            "appsecret": self._app_secret,
-        }
+        # Slow path: acquire lock and refresh
+        async with self._token_lock:
+            # Re-check after acquiring lock (another coroutine may have refreshed)
+            now = asyncio.get_event_loop().time()
+            if self._access_token and now < self._token_expires_at:
+                return self._access_token
 
-        async with session.post(url, json=body) as resp:
-            if resp.status != 200:
-                text = await resp.text()
-                raise ConnectionError(f"Token refresh failed ({resp.status}): {text}")
-            data = await resp.json()
+            logger.info("Refreshing KIS access token")
+            session = self._get_session()
+            url = f"{self._base_url}/oauth2/tokenP"
+            body = {
+                "grant_type": "client_credentials",
+                "appkey": self._app_key,
+                "appsecret": self._app_secret,
+            }
 
-        self._access_token = data["access_token"]
-        self._token_expires_at = now + data.get("expires_in", 86400) - 60  # 1-min buffer
-        logger.info("Token refreshed successfully")
-        return self._access_token
+            async with session.post(url, json=body) as resp:
+                if resp.status != 200:
+                    text = await resp.text()
+                    raise ConnectionError(f"Token refresh failed ({resp.status}): {text}")
+                data = await resp.json()
+
+            self._access_token = data["access_token"]
+            self._token_expires_at = now + data.get("expires_in", 86400) - 60  # 1-min buffer
+            logger.info("Token refreshed successfully")
+            return self._access_token
 
     # ------------------------------------------------------------------
     # Hash Key (required for POST bodies)

src/config.py

@@ -54,6 +54,11 @@ class Settings(BaseSettings):
     S3_BUCKET_NAME: str | None = None
     S3_REGION: str = "us-east-1"
 
+    # Telegram Notifications (optional)
+    TELEGRAM_BOT_TOKEN: str | None = None
+    TELEGRAM_CHAT_ID: str | None = None
+    TELEGRAM_ENABLED: bool = True
+
     model_config = {"env_file": ".env", "env_file_encoding": "utf-8"}
 
     @property

src/main.py

@@ -10,6 +10,7 @@ import argparse
 import asyncio
 import logging
 import signal
+import sys
 from datetime import UTC, datetime
 from typing import Any
 
@@ -23,11 +24,12 @@ from src.context.layer import ContextLayer
 from src.context.store import ContextStore
 from src.core.criticality import CriticalityAssessor
 from src.core.priority_queue import PriorityTaskQueue
-from src.core.risk_manager import CircuitBreakerTripped, RiskManager
+from src.core.risk_manager import CircuitBreakerTripped, FatFingerRejected, RiskManager
 from src.db import init_db, log_trade
 from src.logging.decision_logger import DecisionLogger
 from src.logging_config import setup_logging
 from src.markets.schedule import MarketInfo, get_next_market_open, get_open_markets
+from src.notifications.telegram_client import TelegramClient
 
 logger = logging.getLogger(__name__)
 
@@ -62,6 +64,7 @@ async def trading_cycle(
     decision_logger: DecisionLogger,
     context_store: ContextStore,
     criticality_assessor: CriticalityAssessor,
+    telegram: TelegramClient,
     market: MarketInfo,
     stock_code: str,
 ) -> None:
@@ -92,9 +95,17 @@ async def trading_cycle(
         balance_data = await overseas_broker.get_overseas_balance(market.exchange_code)
 
         output2 = balance_data.get("output2", [{}])
-        total_eval = float(output2[0].get("frcr_evlu_tota", "0")) if output2 else 0
-        total_cash = float(output2[0].get("frcr_dncl_amt_2", "0")) if output2 else 0
-        purchase_total = float(output2[0].get("frcr_buy_amt_smtl", "0")) if output2 else 0
+        # Handle both list and dict response formats
+        if isinstance(output2, list) and output2:
+            balance_info = output2[0]
+        elif isinstance(output2, dict):
+            balance_info = output2
+        else:
+            balance_info = {}
+
+        total_eval = float(balance_info.get("frcr_evlu_tota", "0") or "0")
+        total_cash = float(balance_info.get("frcr_dncl_amt_2", "0") or "0")
+        purchase_total = float(balance_info.get("frcr_buy_amt_smtl", "0") or "0")
 
         current_price = float(price_data.get("output", {}).get("last", "0"))
         foreigner_net = 0.0  # Not available for overseas
@@ -199,11 +210,23 @@ async def trading_cycle(
         order_amount = current_price * quantity
 
         # 4. Risk check BEFORE order
-        risk.validate_order(
-            current_pnl_pct=pnl_pct,
-            order_amount=order_amount,
-            total_cash=total_cash,
-        )
+        try:
+            risk.validate_order(
+                current_pnl_pct=pnl_pct,
+                order_amount=order_amount,
+                total_cash=total_cash,
+            )
+        except FatFingerRejected as exc:
+            try:
+                await telegram.notify_fat_finger(
+                    stock_code=stock_code,
+                    order_amount=exc.order_amount,
+                    total_cash=exc.total_cash,
+                    max_pct=exc.max_pct,
+                )
+            except Exception as notify_exc:
+                logger.warning("Fat finger notification failed: %s", notify_exc)
+            raise  # Re-raise to prevent trade
 
         # 5. Send order
         if market.is_domestic:
@@ -223,6 +246,19 @@ async def trading_cycle(
             )
         logger.info("Order result: %s", result.get("msg1", "OK"))
 
+        # 5.5. Notify trade execution
+        try:
+            await telegram.notify_trade_execution(
+                stock_code=stock_code,
+                market=market.name,
+                action=decision.action,
+                quantity=quantity,
+                price=current_price,
+                confidence=decision.confidence,
+            )
+        except Exception as exc:
+            logger.warning("Telegram notification failed: %s", exc)
+
     # 6. Log trade
     log_trade(
         conn=db_conn,
@@ -266,6 +302,13 @@ async def run(settings: Settings) -> None:
     decision_logger = DecisionLogger(db_conn)
     context_store = ContextStore(db_conn)
 
+    # Initialize Telegram notifications
+    telegram = TelegramClient(
+        bot_token=settings.TELEGRAM_BOT_TOKEN,
+        chat_id=settings.TELEGRAM_CHAT_ID,
+        enabled=settings.TELEGRAM_ENABLED,
+    )
+
     # Initialize volatility hunter
     volatility_analyzer = VolatilityAnalyzer(min_volume_surge=2.0, min_price_change=1.0)
     market_scanner = MarketScanner(
@@ -289,6 +332,9 @@ async def run(settings: Settings) -> None:
     # Track last scan time for each market
     last_scan_time: dict[str, float] = {}
 
+    # Track market open/close state for notifications
+    _market_states: dict[str, bool] = {}  # market_code -> is_open
+
     shutdown = asyncio.Event()
 
     def _signal_handler() -> None:
@@ -302,12 +348,31 @@ async def run(settings: Settings) -> None:
     logger.info("The Ouroboros is alive. Mode: %s", settings.MODE)
     logger.info("Enabled markets: %s", settings.enabled_market_list)
 
+    # Notify system startup
+    try:
+        await telegram.notify_system_start(settings.MODE, settings.enabled_market_list)
+    except Exception as exc:
+        logger.warning("System startup notification failed: %s", exc)
+
     try:
         while not shutdown.is_set():
             # Get currently open markets
             open_markets = get_open_markets(settings.enabled_market_list)
 
             if not open_markets:
+                # Notify market close for any markets that were open
+                for market_code, is_open in list(_market_states.items()):
+                    if is_open:
+                        try:
+                            from src.markets.schedule import MARKETS
+
+                            market_info = MARKETS.get(market_code)
+                            if market_info:
+                                await telegram.notify_market_close(market_info.name, 0.0)
+                        except Exception as exc:
+                            logger.warning("Market close notification failed: %s", exc)
+                        _market_states[market_code] = False
+
                 # No markets open — wait until next market opens
                 try:
                     next_market, next_open_time = get_next_market_open(
@@ -333,6 +398,14 @@ async def run(settings: Settings) -> None:
                 if shutdown.is_set():
                     break
 
+                # Notify market open if it just opened
+                if not _market_states.get(market.code, False):
+                    try:
+                        await telegram.notify_market_open(market.name)
+                    except Exception as exc:
+                        logger.warning("Market open notification failed: %s", exc)
+                    _market_states[market.code] = True
+
                 # Volatility Hunter: Scan market periodically to update watchlist
                 now_timestamp = asyncio.get_event_loop().time()
                 last_scan = last_scan_time.get(market.code, 0.0)
@@ -391,12 +464,22 @@ async def run(settings: Settings) -> None:
                                 decision_logger,
                                 context_store,
                                 criticality_assessor,
+                                telegram,
                                 market,
                                 stock_code,
                             )
                             break  # Success — exit retry loop
-                        except CircuitBreakerTripped:
+                        except CircuitBreakerTripped as exc:
                             logger.critical("Circuit breaker tripped — shutting down")
+                            try:
+                                await telegram.notify_circuit_breaker(
+                                    pnl_pct=exc.pnl_pct,
+                                    threshold=exc.threshold,
+                                )
+                            except Exception as notify_exc:
+                                logger.warning(
+                                    "Circuit breaker notification failed: %s", notify_exc
+                                )
                             raise
                         except ConnectionError as exc:
                             if attempt < MAX_CONNECTION_RETRIES:

src/notifications/README.md

@@ -0,0 +1,213 @@
+# Telegram Notifications
+
+Real-time trading event notifications via Telegram Bot API.
+
+## Setup
+
+### 1. Create a Telegram Bot
+
+1. Open Telegram and message [@BotFather](https://t.me/BotFather)
+2. Send `/newbot` command
+3. Follow prompts to name your bot
+4. Save the **bot token** (looks like `1234567890:ABCdefGHIjklMNOpqrsTUVwxyz`)
+
+### 2. Get Your Chat ID
+
+**Option A: Using @userinfobot**
+1. Message [@userinfobot](https://t.me/userinfobot) on Telegram
+2. Send `/start`
+3. Save your numeric **chat ID** (e.g., `123456789`)
+
+**Option B: Using @RawDataBot**
+1. Message [@RawDataBot](https://t.me/rawdatabot) on Telegram
+2. Look for `"id":` in the JSON response
+3. Save your numeric **chat ID**
+
+### 3. Configure Environment
+
+Add to your `.env` file:
+
+```bash
+TELEGRAM_BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz
+TELEGRAM_CHAT_ID=123456789
+TELEGRAM_ENABLED=true
+```
+
+### 4. Test the Bot
+
+Start a conversation with your bot on Telegram first (send `/start`), then run:
+
+```bash
+python -m src.main --mode=paper
+```
+
+You should receive a startup notification.
+
+## Message Examples
+
+### Trade Execution
+```
+🟢 BUY
+Symbol: AAPL (United States)
+Quantity: 10 shares
+Price: 150.25
+Confidence: 85%
+```
+
+### Circuit Breaker
+```
+🚨 CIRCUIT BREAKER TRIPPED
+P&L: -3.15% (threshold: -3.0%)
+Trading halted for safety
+```
+
+### Fat-Finger Protection
+```
+⚠️ Fat-Finger Protection
+Order rejected: TSLA
+Attempted: 45.0% of cash
+Max allowed: 30%
+Amount: 45,000 / 100,000
+```
+
+### Market Open/Close
+```
+ℹ️ Market Open
+Korea trading session started
+
+ℹ️ Market Close
+Korea trading session ended
+📈 P&L: +1.25%
+```
+
+### System Status
+```
+📝 System Started
+Mode: PAPER
+Markets: KRX, NASDAQ
+
+System Shutdown
+Normal shutdown
+```
+
+## Notification Priorities
+
+| Priority | Emoji | Use Case |
+|----------|-------|----------|
+| LOW | ℹ️ | Market open/close |
+| MEDIUM | 📊 | Trade execution, system start/stop |
+| HIGH | ⚠️ | Fat-finger protection, errors |
+| CRITICAL | 🚨 | Circuit breaker trips |
+
+## Rate Limiting
+
+- Default: 1 message per second
+- Prevents hitting Telegram's global rate limits
+- Configurable via `rate_limit` parameter
+
+## Troubleshooting
+
+### No notifications received
+
+1. **Check bot configuration**
+   ```bash
+   # Verify env variables are set
+   grep TELEGRAM .env
+   ```
+
+2. **Start conversation with bot**
+   - Open bot in Telegram
+   - Send `/start` command
+   - Bot cannot message users who haven't started a conversation
+
+3. **Check logs**
+   ```bash
+   # Look for Telegram-related errors
+   python -m src.main --mode=paper 2>&1 | grep -i telegram
+   ```
+
+4. **Verify bot token**
+   ```bash
+   curl https://api.telegram.org/bot<YOUR_TOKEN>/getMe
+   # Should return bot info (not 401 error)
+   ```
+
+5. **Verify chat ID**
+   ```bash
+   curl -X POST https://api.telegram.org/bot<YOUR_TOKEN>/sendMessage \
+     -H 'Content-Type: application/json' \
+     -d '{"chat_id": "<YOUR_CHAT_ID>", "text": "Test"}'
+   # Should send a test message
+   ```
+
+### Notifications delayed
+
+- Check rate limiter settings
+- Verify network connection
+- Look for timeout errors in logs
+
+### "Chat not found" error
+
+- Incorrect chat ID
+- Bot blocked by user
+- Need to send `/start` to bot first
+
+### "Unauthorized" error
+
+- Invalid bot token
+- Token revoked (regenerate with @BotFather)
+
+## Graceful Degradation
+
+The system works without Telegram notifications:
+
+- Missing credentials → notifications disabled automatically
+- API errors → logged but trading continues
+- Network timeouts → trading loop unaffected
+- Rate limiting → messages queued, trading proceeds
+
+**Notifications never crash the trading system.**
+
+## Security Notes
+
+- Never commit `.env` file with credentials
+- Bot token grants full bot control
+- Chat ID is not sensitive (just a number)
+- Messages are sent over HTTPS
+- No trading credentials in notifications
+
+## Advanced Usage
+
+### Group Notifications
+
+1. Add bot to Telegram group
+2. Get group chat ID (negative number like `-123456789`)
+3. Use group chat ID in `TELEGRAM_CHAT_ID`
+
+### Multiple Recipients
+
+Create multiple bots or use a broadcast group with multiple members.
+
+### Custom Rate Limits
+
+Not currently exposed in config, but can be modified in code:
+
+```python
+telegram = TelegramClient(
+    bot_token=settings.TELEGRAM_BOT_TOKEN,
+    chat_id=settings.TELEGRAM_CHAT_ID,
+    rate_limit=2.0,  # 2 messages per second
+)
+```
+
+## API Reference
+
+See `telegram_client.py` for full API documentation.
+
+Key methods:
+- `notify_trade_execution()` - Trade alerts
+- `notify_circuit_breaker()` - Emergency stops
+- `notify_fat_finger()` - Order rejections
+- `notify_market_open/close()` - Session tracking
+- `notify_system_start/shutdown()` - Lifecycle events
+- `notify_error()` - Error alerts

src/notifications/__init__.py

@@ -0,0 +1,5 @@
+"""Real-time notifications for trading events."""
+
+from src.notifications.telegram_client import TelegramClient
+
+__all__ = ["TelegramClient"]

src/notifications/telegram_client.py

@@ -0,0 +1,325 @@
+"""Telegram notification client for real-time trading alerts."""
+
+import asyncio
+import logging
+import time
+from dataclasses import dataclass
+from enum import Enum
+
+import aiohttp
+
+logger = logging.getLogger(__name__)
+
+
+class NotificationPriority(Enum):
+    """Priority levels for notifications with emoji indicators."""
+
+    LOW = ("ℹ️", "info")
+    MEDIUM = ("📊", "medium")
+    HIGH = ("⚠️", "warning")
+    CRITICAL = ("🚨", "critical")
+
+    def __init__(self, emoji: str, label: str) -> None:
+        self.emoji = emoji
+        self.label = label
+
+
+class LeakyBucket:
+    """Rate limiter using leaky bucket algorithm."""
+
+    def __init__(self, rate: float, capacity: int = 1) -> None:
+        """
+        Initialize rate limiter.
+
+        Args:
+            rate: Maximum requests per second
+            capacity: Bucket capacity (burst size)
+        """
+        self._rate = rate
+        self._capacity = capacity
+        self._tokens = float(capacity)
+        self._last_update = time.monotonic()
+        self._lock = asyncio.Lock()
+
+    async def acquire(self) -> None:
+        """Wait until a token is available, then consume it."""
+        async with self._lock:
+            now = time.monotonic()
+            elapsed = now - self._last_update
+            self._tokens = min(self._capacity, self._tokens + elapsed * self._rate)
+            self._last_update = now
+
+            if self._tokens < 1.0:
+                wait_time = (1.0 - self._tokens) / self._rate
+                await asyncio.sleep(wait_time)
+                self._tokens = 0.0
+            else:
+                self._tokens -= 1.0
+
+
+@dataclass
+class NotificationMessage:
+    """Internal notification message structure."""
+
+    priority: NotificationPriority
+    message: str
+
+
+class TelegramClient:
+    """Telegram Bot API client for sending trading notifications."""
+
+    API_BASE = "https://api.telegram.org/bot{token}"
+    DEFAULT_TIMEOUT = 5.0  # seconds
+    DEFAULT_RATE = 1.0  # messages per second
+
+    def __init__(
+        self,
+        bot_token: str | None = None,
+        chat_id: str | None = None,
+        enabled: bool = True,
+        rate_limit: float = DEFAULT_RATE,
+    ) -> None:
+        """
+        Initialize Telegram client.
+
+        Args:
+            bot_token: Telegram bot token from @BotFather
+            chat_id: Target chat ID (user or group)
+            enabled: Enable/disable notifications globally
+            rate_limit: Maximum messages per second
+        """
+        self._bot_token = bot_token
+        self._chat_id = chat_id
+        self._enabled = enabled
+        self._rate_limiter = LeakyBucket(rate=rate_limit)
+        self._session: aiohttp.ClientSession | None = None
+
+        if not enabled:
+            logger.info("Telegram notifications disabled via configuration")
+        elif bot_token is None or chat_id is None:
+            logger.warning(
+                "Telegram notifications disabled (missing bot_token or chat_id)"
+            )
+            self._enabled = False
+        else:
+            logger.info("Telegram notifications enabled for chat_id=%s", chat_id)
+
+    def _get_session(self) -> aiohttp.ClientSession:
+        """Get or create aiohttp session."""
+        if self._session is None or self._session.closed:
+            self._session = aiohttp.ClientSession(
+                timeout=aiohttp.ClientTimeout(total=self.DEFAULT_TIMEOUT)
+            )
+        return self._session
+
+    async def close(self) -> None:
+        """Close HTTP session."""
+        if self._session is not None and not self._session.closed:
+            await self._session.close()
+
+    async def _send_notification(self, msg: NotificationMessage) -> None:
+        """
+        Send notification to Telegram with graceful degradation.
+
+        Args:
+            msg: Notification message to send
+        """
+        if not self._enabled:
+            return
+
+        try:
+            await self._rate_limiter.acquire()
+
+            formatted_message = f"{msg.priority.emoji} {msg.message}"
+            url = f"{self.API_BASE.format(token=self._bot_token)}/sendMessage"
+
+            payload = {
+                "chat_id": self._chat_id,
+                "text": formatted_message,
+                "parse_mode": "HTML",
+            }
+
+            session = self._get_session()
+            async with session.post(url, json=payload) as resp:
+                if resp.status != 200:
+                    error_text = await resp.text()
+                    logger.error(
+                        "Telegram API error (status=%d): %s", resp.status, error_text
+                    )
+                else:
+                    logger.debug("Telegram notification sent: %s", msg.message[:50])
+
+        except asyncio.TimeoutError:
+            logger.error("Telegram notification timeout")
+        except aiohttp.ClientError as exc:
+            logger.error("Telegram notification failed: %s", exc)
+        except Exception as exc:
+            logger.error("Unexpected error sending notification: %s", exc)
+
+    async def notify_trade_execution(
+        self,
+        stock_code: str,
+        market: str,
+        action: str,
+        quantity: int,
+        price: float,
+        confidence: float,
+    ) -> None:
+        """
+        Notify trade execution.
+
+        Args:
+            stock_code: Stock ticker symbol
+            market: Market name (e.g., "Korea", "United States")
+            action: "BUY" or "SELL"
+            quantity: Number of shares
+            price: Execution price
+            confidence: AI confidence level (0-100)
+        """
+        emoji = "🟢" if action == "BUY" else "🔴"
+        message = (
+            f"<b>{emoji} {action}</b>\n"
+            f"Symbol: <code>{stock_code}</code> ({market})\n"
+            f"Quantity: {quantity:,} shares\n"
+            f"Price: {price:,.2f}\n"
+            f"Confidence: {confidence:.0f}%"
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.MEDIUM, message=message)
+        )
+
+    async def notify_market_open(self, market_name: str) -> None:
+        """
+        Notify market opening.
+
+        Args:
+            market_name: Name of the market (e.g., "Korea", "United States")
+        """
+        message = f"<b>Market Open</b>\n{market_name} trading session started"
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.LOW, message=message)
+        )
+
+    async def notify_market_close(self, market_name: str, pnl_pct: float) -> None:
+        """
+        Notify market closing.
+
+        Args:
+            market_name: Name of the market
+            pnl_pct: Final P&L percentage for the session
+        """
+        pnl_sign = "+" if pnl_pct >= 0 else ""
+        pnl_emoji = "📈" if pnl_pct >= 0 else "📉"
+        message = (
+            f"<b>Market Close</b>\n"
+            f"{market_name} trading session ended\n"
+            f"{pnl_emoji} P&L: {pnl_sign}{pnl_pct:.2f}%"
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.LOW, message=message)
+        )
+
+    async def notify_circuit_breaker(
+        self, pnl_pct: float, threshold: float
+    ) -> None:
+        """
+        Notify circuit breaker activation.
+
+        Args:
+            pnl_pct: Current P&L percentage
+            threshold: Circuit breaker threshold
+        """
+        message = (
+            f"<b>CIRCUIT BREAKER TRIPPED</b>\n"
+            f"P&L: {pnl_pct:.2f}% (threshold: {threshold:.1f}%)\n"
+            f"Trading halted for safety"
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.CRITICAL, message=message)
+        )
+
+    async def notify_fat_finger(
+        self,
+        stock_code: str,
+        order_amount: float,
+        total_cash: float,
+        max_pct: float,
+    ) -> None:
+        """
+        Notify fat-finger protection rejection.
+
+        Args:
+            stock_code: Stock ticker symbol
+            order_amount: Attempted order amount
+            total_cash: Total available cash
+            max_pct: Maximum allowed percentage
+        """
+        attempted_pct = (order_amount / total_cash) * 100 if total_cash > 0 else 0
+        message = (
+            f"<b>Fat-Finger Protection</b>\n"
+            f"Order rejected: <code>{stock_code}</code>\n"
+            f"Attempted: {attempted_pct:.1f}% of cash\n"
+            f"Max allowed: {max_pct:.0f}%\n"
+            f"Amount: {order_amount:,.0f} / {total_cash:,.0f}"
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.HIGH, message=message)
+        )
+
+    async def notify_system_start(
+        self, mode: str, enabled_markets: list[str]
+    ) -> None:
+        """
+        Notify system startup.
+
+        Args:
+            mode: Trading mode ("paper" or "live")
+            enabled_markets: List of enabled market codes
+        """
+        mode_emoji = "📝" if mode == "paper" else "💰"
+        markets_str = ", ".join(enabled_markets)
+        message = (
+            f"<b>{mode_emoji} System Started</b>\n"
+            f"Mode: {mode.upper()}\n"
+            f"Markets: {markets_str}"
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.MEDIUM, message=message)
+        )
+
+    async def notify_system_shutdown(self, reason: str) -> None:
+        """
+        Notify system shutdown.
+
+        Args:
+            reason: Reason for shutdown (e.g., "Normal shutdown", "Circuit breaker")
+        """
+        message = f"<b>System Shutdown</b>\n{reason}"
+        priority = (
+            NotificationPriority.CRITICAL
+            if "circuit breaker" in reason.lower()
+            else NotificationPriority.MEDIUM
+        )
+        await self._send_notification(
+            NotificationMessage(priority=priority, message=message)
+        )
+
+    async def notify_error(
+        self, error_type: str, error_msg: str, context: str
+    ) -> None:
+        """
+        Notify system error.
+
+        Args:
+            error_type: Type of error (e.g., "Connection Error")
+            error_msg: Error message
+            context: Error context (e.g., stock code, market)
+        """
+        message = (
+            f"<b>Error: {error_type}</b>\n"
+            f"Context: {context}\n"
+            f"Message: {error_msg[:200]}"  # Truncate long errors
+        )
+        await self._send_notification(
+            NotificationMessage(priority=NotificationPriority.HIGH, message=message)
+        )

tests/test_broker.py

@@ -49,6 +49,46 @@ class TestTokenManagement:
 
         await broker.close()
 
+    @pytest.mark.asyncio
+    async def test_concurrent_token_refresh_calls_api_once(self, settings):
+        """Multiple concurrent token requests should only call API once."""
+        broker = KISBroker(settings)
+
+        # Track how many times the mock API is called
+        call_count = [0]
+
+        def create_mock_resp():
+            call_count[0] += 1
+            mock_resp = AsyncMock()
+            mock_resp.status = 200
+            mock_resp.json = AsyncMock(
+                return_value={
+                    "access_token": "tok_concurrent",
+                    "token_type": "Bearer",
+                    "expires_in": 86400,
+                }
+            )
+            mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+            mock_resp.__aexit__ = AsyncMock(return_value=False)
+            return mock_resp
+
+        with patch("aiohttp.ClientSession.post", return_value=create_mock_resp()):
+            # Launch 5 concurrent token requests
+            tokens = await asyncio.gather(
+                broker._ensure_token(),
+                broker._ensure_token(),
+                broker._ensure_token(),
+                broker._ensure_token(),
+                broker._ensure_token(),
+            )
+
+            # All should get the same token
+            assert all(t == "tok_concurrent" for t in tokens)
+            # API should be called only once (due to lock)
+            assert call_count[0] == 1
+
+        await broker.close()
+
 
 # ---------------------------------------------------------------------------
 # Network Error Handling

tests/test_main.py

@@ -0,0 +1,561 @@
+"""Tests for main trading loop telegram integration."""
+
+import asyncio
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from src.core.risk_manager import CircuitBreakerTripped, FatFingerRejected
+from src.main import trading_cycle
+
+
+class TestTradingCycleTelegramIntegration:
+    """Test telegram notifications in trading_cycle function."""
+
+    @pytest.fixture
+    def mock_broker(self) -> MagicMock:
+        """Create mock broker."""
+        broker = MagicMock()
+        broker.get_orderbook = AsyncMock(
+            return_value={
+                "output1": {
+                    "stck_prpr": "50000",
+                    "frgn_ntby_qty": "100",
+                }
+            }
+        )
+        broker.get_balance = AsyncMock(
+            return_value={
+                "output2": [
+                    {
+                        "tot_evlu_amt": "10000000",
+                        "dnca_tot_amt": "5000000",
+                        "pchs_amt_smtl_amt": "5000000",
+                    }
+                ]
+            }
+        )
+        broker.send_order = AsyncMock(return_value={"msg1": "OK"})
+        return broker
+
+    @pytest.fixture
+    def mock_overseas_broker(self) -> MagicMock:
+        """Create mock overseas broker."""
+        broker = MagicMock()
+        return broker
+
+    @pytest.fixture
+    def mock_brain(self) -> MagicMock:
+        """Create mock brain that decides to buy."""
+        brain = MagicMock()
+        decision = MagicMock()
+        decision.action = "BUY"
+        decision.confidence = 85
+        decision.rationale = "Test buy"
+        brain.decide = AsyncMock(return_value=decision)
+        return brain
+
+    @pytest.fixture
+    def mock_risk(self) -> MagicMock:
+        """Create mock risk manager."""
+        risk = MagicMock()
+        risk.validate_order = MagicMock()
+        return risk
+
+    @pytest.fixture
+    def mock_db(self) -> MagicMock:
+        """Create mock database connection."""
+        return MagicMock()
+
+    @pytest.fixture
+    def mock_decision_logger(self) -> MagicMock:
+        """Create mock decision logger."""
+        logger = MagicMock()
+        logger.log_decision = MagicMock()
+        return logger
+
+    @pytest.fixture
+    def mock_context_store(self) -> MagicMock:
+        """Create mock context store."""
+        store = MagicMock()
+        store.get_latest_timeframe = MagicMock(return_value=None)
+        return store
+
+    @pytest.fixture
+    def mock_criticality_assessor(self) -> MagicMock:
+        """Create mock criticality assessor."""
+        assessor = MagicMock()
+        assessor.assess_market_conditions = MagicMock(
+            return_value=MagicMock(value="NORMAL")
+        )
+        assessor.get_timeout = MagicMock(return_value=5.0)
+        return assessor
+
+    @pytest.fixture
+    def mock_telegram(self) -> MagicMock:
+        """Create mock telegram client."""
+        telegram = MagicMock()
+        telegram.notify_trade_execution = AsyncMock()
+        telegram.notify_fat_finger = AsyncMock()
+        telegram.notify_circuit_breaker = AsyncMock()
+        return telegram
+
+    @pytest.fixture
+    def mock_market(self) -> MagicMock:
+        """Create mock market info."""
+        market = MagicMock()
+        market.name = "Korea"
+        market.code = "KR"
+        market.exchange_code = "KRX"
+        market.is_domestic = True
+        return market
+
+    @pytest.mark.asyncio
+    async def test_trade_execution_notification_sent(
+        self,
+        mock_broker: MagicMock,
+        mock_overseas_broker: MagicMock,
+        mock_brain: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_market: MagicMock,
+    ) -> None:
+        """Test telegram notification sent on trade execution."""
+        with patch("src.main.log_trade"):
+            await trading_cycle(
+                broker=mock_broker,
+                overseas_broker=mock_overseas_broker,
+                brain=mock_brain,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_market,
+                stock_code="005930",
+            )
+
+        # Verify notification was sent
+        mock_telegram.notify_trade_execution.assert_called_once()
+        call_kwargs = mock_telegram.notify_trade_execution.call_args.kwargs
+        assert call_kwargs["stock_code"] == "005930"
+        assert call_kwargs["market"] == "Korea"
+        assert call_kwargs["action"] == "BUY"
+        assert call_kwargs["confidence"] == 85
+
+    @pytest.mark.asyncio
+    async def test_trade_execution_notification_failure_doesnt_crash(
+        self,
+        mock_broker: MagicMock,
+        mock_overseas_broker: MagicMock,
+        mock_brain: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_market: MagicMock,
+    ) -> None:
+        """Test trading continues even if notification fails."""
+        # Make notification fail
+        mock_telegram.notify_trade_execution.side_effect = Exception("API error")
+
+        with patch("src.main.log_trade"):
+            # Should not raise exception
+            await trading_cycle(
+                broker=mock_broker,
+                overseas_broker=mock_overseas_broker,
+                brain=mock_brain,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_market,
+                stock_code="005930",
+            )
+
+        # Verify notification was attempted
+        mock_telegram.notify_trade_execution.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_fat_finger_notification_sent(
+        self,
+        mock_broker: MagicMock,
+        mock_overseas_broker: MagicMock,
+        mock_brain: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_market: MagicMock,
+    ) -> None:
+        """Test telegram notification sent on fat finger rejection."""
+        # Make risk manager reject the order
+        mock_risk.validate_order.side_effect = FatFingerRejected(
+            order_amount=2000000,
+            total_cash=5000000,
+            max_pct=30.0,
+        )
+
+        with patch("src.main.log_trade"):
+            with pytest.raises(FatFingerRejected):
+                await trading_cycle(
+                    broker=mock_broker,
+                    overseas_broker=mock_overseas_broker,
+                    brain=mock_brain,
+                    risk=mock_risk,
+                    db_conn=mock_db,
+                    decision_logger=mock_decision_logger,
+                    context_store=mock_context_store,
+                    criticality_assessor=mock_criticality_assessor,
+                    telegram=mock_telegram,
+                    market=mock_market,
+                    stock_code="005930",
+                )
+
+        # Verify notification was sent
+        mock_telegram.notify_fat_finger.assert_called_once()
+        call_kwargs = mock_telegram.notify_fat_finger.call_args.kwargs
+        assert call_kwargs["stock_code"] == "005930"
+        assert call_kwargs["order_amount"] == 2000000
+        assert call_kwargs["total_cash"] == 5000000
+        assert call_kwargs["max_pct"] == 30.0
+
+    @pytest.mark.asyncio
+    async def test_fat_finger_notification_failure_still_raises(
+        self,
+        mock_broker: MagicMock,
+        mock_overseas_broker: MagicMock,
+        mock_brain: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_market: MagicMock,
+    ) -> None:
+        """Test fat finger exception still raised even if notification fails."""
+        # Make risk manager reject the order
+        mock_risk.validate_order.side_effect = FatFingerRejected(
+            order_amount=2000000,
+            total_cash=5000000,
+            max_pct=30.0,
+        )
+        # Make notification fail
+        mock_telegram.notify_fat_finger.side_effect = Exception("API error")
+
+        with patch("src.main.log_trade"):
+            with pytest.raises(FatFingerRejected):
+                await trading_cycle(
+                    broker=mock_broker,
+                    overseas_broker=mock_overseas_broker,
+                    brain=mock_brain,
+                    risk=mock_risk,
+                    db_conn=mock_db,
+                    decision_logger=mock_decision_logger,
+                    context_store=mock_context_store,
+                    criticality_assessor=mock_criticality_assessor,
+                    telegram=mock_telegram,
+                    market=mock_market,
+                    stock_code="005930",
+                )
+
+        # Verify notification was attempted
+        mock_telegram.notify_fat_finger.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_no_notification_on_hold_decision(
+        self,
+        mock_broker: MagicMock,
+        mock_overseas_broker: MagicMock,
+        mock_brain: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_market: MagicMock,
+    ) -> None:
+        """Test no trade notification sent when decision is HOLD."""
+        # Change brain decision to HOLD
+        decision = MagicMock()
+        decision.action = "HOLD"
+        decision.confidence = 50
+        decision.rationale = "Insufficient signal"
+        mock_brain.decide = AsyncMock(return_value=decision)
+
+        with patch("src.main.log_trade"):
+            await trading_cycle(
+                broker=mock_broker,
+                overseas_broker=mock_overseas_broker,
+                brain=mock_brain,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_market,
+                stock_code="005930",
+            )
+
+        # Verify no trade notification sent
+        mock_telegram.notify_trade_execution.assert_not_called()
+
+
+class TestRunFunctionTelegramIntegration:
+    """Test telegram notifications in run function."""
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_notification_sent(self) -> None:
+        """Test telegram notification sent when circuit breaker trips."""
+        mock_telegram = MagicMock()
+        mock_telegram.notify_circuit_breaker = AsyncMock()
+
+        # Simulate circuit breaker exception
+        exc = CircuitBreakerTripped(pnl_pct=-3.5, threshold=-3.0)
+
+        # Test the notification logic
+        try:
+            await mock_telegram.notify_circuit_breaker(
+                pnl_pct=exc.pnl_pct,
+                threshold=exc.threshold,
+            )
+        except Exception:
+            pass  # Ignore errors in notification
+
+        # Verify notification was called
+        mock_telegram.notify_circuit_breaker.assert_called_once_with(
+            pnl_pct=-3.5,
+            threshold=-3.0,
+        )
+
+
+class TestOverseasBalanceParsing:
+    """Test overseas balance output2 parsing handles different formats."""
+
+    @pytest.fixture
+    def mock_overseas_broker_with_list(self) -> MagicMock:
+        """Create mock overseas broker returning list format."""
+        broker = MagicMock()
+        broker.get_overseas_price = AsyncMock(
+            return_value={"output": {"last": "150.50"}}
+        )
+        broker.get_overseas_balance = AsyncMock(
+            return_value={
+                "output2": [
+                    {
+                        "frcr_evlu_tota": "10000.00",
+                        "frcr_dncl_amt_2": "5000.00",
+                        "frcr_buy_amt_smtl": "4500.00",
+                    }
+                ]
+            }
+        )
+        return broker
+
+    @pytest.fixture
+    def mock_overseas_broker_with_dict(self) -> MagicMock:
+        """Create mock overseas broker returning dict format."""
+        broker = MagicMock()
+        broker.get_overseas_price = AsyncMock(
+            return_value={"output": {"last": "150.50"}}
+        )
+        broker.get_overseas_balance = AsyncMock(
+            return_value={
+                "output2": {
+                    "frcr_evlu_tota": "10000.00",
+                    "frcr_dncl_amt_2": "5000.00",
+                    "frcr_buy_amt_smtl": "4500.00",
+                }
+            }
+        )
+        return broker
+
+    @pytest.fixture
+    def mock_overseas_broker_with_empty(self) -> MagicMock:
+        """Create mock overseas broker returning empty output2."""
+        broker = MagicMock()
+        broker.get_overseas_price = AsyncMock(
+            return_value={"output": {"last": "150.50"}}
+        )
+        broker.get_overseas_balance = AsyncMock(return_value={"output2": []})
+        return broker
+
+    @pytest.fixture
+    def mock_domestic_broker(self) -> MagicMock:
+        """Create minimal mock domestic broker."""
+        broker = MagicMock()
+        return broker
+
+    @pytest.fixture
+    def mock_overseas_market(self) -> MagicMock:
+        """Create mock overseas market info."""
+        market = MagicMock()
+        market.name = "NASDAQ"
+        market.code = "US_NASDAQ"
+        market.exchange_code = "NASD"
+        market.is_domestic = False
+        return market
+
+    @pytest.fixture
+    def mock_brain_hold(self) -> MagicMock:
+        """Create mock brain that always holds."""
+        brain = MagicMock()
+        decision = MagicMock()
+        decision.action = "HOLD"
+        decision.confidence = 50
+        decision.rationale = "Testing balance parsing"
+        brain.decide = AsyncMock(return_value=decision)
+        return brain
+
+    @pytest.fixture
+    def mock_risk(self) -> MagicMock:
+        """Create mock risk manager."""
+        return MagicMock()
+
+    @pytest.fixture
+    def mock_db(self) -> MagicMock:
+        """Create mock database."""
+        return MagicMock()
+
+    @pytest.fixture
+    def mock_decision_logger(self) -> MagicMock:
+        """Create mock decision logger."""
+        return MagicMock()
+
+    @pytest.fixture
+    def mock_context_store(self) -> MagicMock:
+        """Create mock context store."""
+        store = MagicMock()
+        store.get_latest_timeframe = MagicMock(return_value=None)
+        return store
+
+    @pytest.fixture
+    def mock_criticality_assessor(self) -> MagicMock:
+        """Create mock criticality assessor."""
+        assessor = MagicMock()
+        assessor.assess_market_conditions = MagicMock(
+            return_value=MagicMock(value="NORMAL")
+        )
+        assessor.get_timeout = MagicMock(return_value=5.0)
+        return assessor
+
+    @pytest.fixture
+    def mock_telegram(self) -> MagicMock:
+        """Create mock telegram client."""
+        return MagicMock()
+
+    @pytest.mark.asyncio
+    async def test_overseas_balance_list_format(
+        self,
+        mock_domestic_broker: MagicMock,
+        mock_overseas_broker_with_list: MagicMock,
+        mock_brain_hold: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_overseas_market: MagicMock,
+    ) -> None:
+        """Test overseas balance parsing with list format (output2=[{...}])."""
+        with patch("src.main.log_trade"):
+            # Should not raise KeyError
+            await trading_cycle(
+                broker=mock_domestic_broker,
+                overseas_broker=mock_overseas_broker_with_list,
+                brain=mock_brain_hold,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_overseas_market,
+                stock_code="AAPL",
+            )
+
+        # Verify balance API was called
+        mock_overseas_broker_with_list.get_overseas_balance.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_overseas_balance_dict_format(
+        self,
+        mock_domestic_broker: MagicMock,
+        mock_overseas_broker_with_dict: MagicMock,
+        mock_brain_hold: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_overseas_market: MagicMock,
+    ) -> None:
+        """Test overseas balance parsing with dict format (output2={...})."""
+        with patch("src.main.log_trade"):
+            # Should not raise KeyError
+            await trading_cycle(
+                broker=mock_domestic_broker,
+                overseas_broker=mock_overseas_broker_with_dict,
+                brain=mock_brain_hold,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_overseas_market,
+                stock_code="AAPL",
+            )
+
+        # Verify balance API was called
+        mock_overseas_broker_with_dict.get_overseas_balance.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_overseas_balance_empty_format(
+        self,
+        mock_domestic_broker: MagicMock,
+        mock_overseas_broker_with_empty: MagicMock,
+        mock_brain_hold: MagicMock,
+        mock_risk: MagicMock,
+        mock_db: MagicMock,
+        mock_decision_logger: MagicMock,
+        mock_context_store: MagicMock,
+        mock_criticality_assessor: MagicMock,
+        mock_telegram: MagicMock,
+        mock_overseas_market: MagicMock,
+    ) -> None:
+        """Test overseas balance parsing with empty output2."""
+        with patch("src.main.log_trade"):
+            # Should not raise KeyError, should default to 0
+            await trading_cycle(
+                broker=mock_domestic_broker,
+                overseas_broker=mock_overseas_broker_with_empty,
+                brain=mock_brain_hold,
+                risk=mock_risk,
+                db_conn=mock_db,
+                decision_logger=mock_decision_logger,
+                context_store=mock_context_store,
+                criticality_assessor=mock_criticality_assessor,
+                telegram=mock_telegram,
+                market=mock_overseas_market,
+                stock_code="AAPL",
+            )
+
+        # Verify balance API was called
+        mock_overseas_broker_with_empty.get_overseas_balance.assert_called_once()

tests/test_telegram.py

@@ -0,0 +1,269 @@
+"""Tests for Telegram notification client."""
+
+from unittest.mock import AsyncMock, patch
+
+import aiohttp
+import pytest
+
+from src.notifications.telegram_client import NotificationPriority, TelegramClient
+
+
+class TestTelegramClientInit:
+    """Test client initialization scenarios."""
+
+    def test_disabled_via_flag(self) -> None:
+        """Client disabled via enabled=False flag."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=False
+        )
+        assert client._enabled is False
+
+    def test_disabled_missing_token(self) -> None:
+        """Client disabled when bot_token is None."""
+        client = TelegramClient(bot_token=None, chat_id="456", enabled=True)
+        assert client._enabled is False
+
+    def test_disabled_missing_chat_id(self) -> None:
+        """Client disabled when chat_id is None."""
+        client = TelegramClient(bot_token="123:abc", chat_id=None, enabled=True)
+        assert client._enabled is False
+
+    def test_enabled_with_credentials(self) -> None:
+        """Client enabled when credentials provided."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+        assert client._enabled is True
+
+
+class TestNotificationSending:
+    """Test notification sending behavior."""
+
+    @pytest.mark.asyncio
+    async def test_no_send_when_disabled(self) -> None:
+        """Notifications not sent when client disabled."""
+        client = TelegramClient(enabled=False)
+
+        with patch("aiohttp.ClientSession.post") as mock_post:
+            await client.notify_trade_execution(
+                stock_code="AAPL",
+                market="United States",
+                action="BUY",
+                quantity=10,
+                price=150.0,
+                confidence=85.0,
+            )
+            mock_post.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_trade_execution_format(self) -> None:
+        """Trade notification has correct format."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp) as mock_post:
+            await client.notify_trade_execution(
+                stock_code="TSLA",
+                market="United States",
+                action="SELL",
+                quantity=5,
+                price=250.50,
+                confidence=92.0,
+            )
+
+            # Verify API call was made
+            assert mock_post.call_count == 1
+            call_args = mock_post.call_args
+
+            # Check payload structure
+            payload = call_args.kwargs["json"]
+            assert payload["chat_id"] == "456"
+            assert "TSLA" in payload["text"]
+            assert "SELL" in payload["text"]
+            assert "5" in payload["text"]
+            assert "250.50" in payload["text"]
+            assert "92%" in payload["text"]
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_priority(self) -> None:
+        """Circuit breaker uses CRITICAL priority."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp) as mock_post:
+            await client.notify_circuit_breaker(pnl_pct=-3.15, threshold=-3.0)
+
+            payload = mock_post.call_args.kwargs["json"]
+            # CRITICAL priority has 🚨 emoji
+            assert NotificationPriority.CRITICAL.emoji in payload["text"]
+            assert "-3.15%" in payload["text"]
+
+    @pytest.mark.asyncio
+    async def test_api_error_handling(self) -> None:
+        """API errors logged but don't crash."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 400
+        mock_resp.text = AsyncMock(return_value="Bad Request")
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp):
+            # Should not raise exception
+            await client.notify_system_start(mode="paper", enabled_markets=["KR"])
+
+    @pytest.mark.asyncio
+    async def test_timeout_handling(self) -> None:
+        """Timeouts logged but don't crash."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        with patch(
+            "aiohttp.ClientSession.post",
+            side_effect=aiohttp.ClientError("Connection timeout"),
+        ):
+            # Should not raise exception
+            await client.notify_error(
+                error_type="Test Error", error_msg="Test", context="test"
+            )
+
+    @pytest.mark.asyncio
+    async def test_session_management(self) -> None:
+        """Session created and reused correctly."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        # Session should be None initially
+        assert client._session is None
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp):
+            await client.notify_market_open("Korea")
+            # Session should be created
+            assert client._session is not None
+
+            session1 = client._session
+            await client.notify_market_close("Korea", 1.5)
+            # Same session should be reused
+            assert client._session is session1
+
+
+class TestRateLimiting:
+    """Test rate limiter behavior."""
+
+    @pytest.mark.asyncio
+    async def test_rate_limiter_enforced(self) -> None:
+        """Rate limiter delays rapid requests."""
+        import time
+
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True, rate_limit=2.0
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp):
+            start = time.monotonic()
+
+            # Send 3 messages (rate: 2/sec = 0.5s per message)
+            await client.notify_market_open("Korea")
+            await client.notify_market_open("United States")
+            await client.notify_market_open("Japan")
+
+            elapsed = time.monotonic() - start
+
+            # Should take at least 0.4 seconds (3 msgs at 2/sec with some tolerance)
+            assert elapsed >= 0.4
+
+
+class TestMessagePriorities:
+    """Test priority-based messaging."""
+
+    @pytest.mark.asyncio
+    async def test_low_priority_uses_info_emoji(self) -> None:
+        """LOW priority uses ℹ️ emoji."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp) as mock_post:
+            await client.notify_market_open("Korea")
+
+            payload = mock_post.call_args.kwargs["json"]
+            assert NotificationPriority.LOW.emoji in payload["text"]
+
+    @pytest.mark.asyncio
+    async def test_critical_priority_uses_alarm_emoji(self) -> None:
+        """CRITICAL priority uses 🚨 emoji."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_resp = AsyncMock()
+        mock_resp.status = 200
+        mock_resp.__aenter__ = AsyncMock(return_value=mock_resp)
+        mock_resp.__aexit__ = AsyncMock(return_value=False)
+
+        with patch("aiohttp.ClientSession.post", return_value=mock_resp) as mock_post:
+            await client.notify_system_shutdown("Circuit breaker tripped")
+
+            payload = mock_post.call_args.kwargs["json"]
+            assert NotificationPriority.CRITICAL.emoji in payload["text"]
+
+
+class TestClientCleanup:
+    """Test client cleanup behavior."""
+
+    @pytest.mark.asyncio
+    async def test_close_closes_session(self) -> None:
+        """close() closes the HTTP session."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        mock_session = AsyncMock()
+        mock_session.closed = False
+        mock_session.close = AsyncMock()
+        client._session = mock_session
+
+        await client.close()
+        mock_session.close.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_close_handles_no_session(self) -> None:
+        """close() handles None session gracefully."""
+        client = TelegramClient(
+            bot_token="123:abc", chat_id="456", enabled=True
+        )
+
+        # Should not raise exception
+        await client.close()