Divergence happens for ordinary reasons: a fill message lost in a disconnect, a partial fill counted twice, a manual intervention in the broker's interface, a corporate action that changed a share count overnight.
Reconcile at startup, on every reconnect, and on a schedule during the session. On mismatch, the safe default is to stop trading and alert rather than to auto-correct, because an auto-correction based on a wrong assumption can double the error.
Keep an immutable log of every request and response. When something goes wrong at 09:31, the only way to establish what your system believed and when is a log written before the outcome was known.
Related: idempotent-order, client-order-id, kill-switch, strategy-monitoring