@deeeed/metamask-harness 0.79.0 → 0.81.0

package/library/actions/core/perps/place_order.mjs

@@ -13,7 +13,16 @@ import {
   redactPosition,
   runAdapter,
   selectedItems,
+  symbolForItem,
 } from './_controller.mjs';
+import { waitForPositionsAbsent } from './close_positions.mjs';
+import {
+  assertFlatBeforeRoundTrip,
+  assertHouseLimitPosition,
+  closeImmediatelyRequested,
+  requireHouseNotional,
+  requirePerpsOrderAllowed,
+} from '../../shared/perps/order-policy.mjs';
 
 // LIMIT orders (orderType=limit) place a RESTING order on the book instead of
 // filling: the provider sends tif=Gtc and uses the provided `price` verbatim
@@ -359,7 +368,7 @@ export async function placeOrder(input) {
   if (usdAmount === undefined) {
     throw new Error('metamask.perps.place_order requires amount=<usd> or notional=<usd>.');
   }
-  const { controller, accountAddress, network } = await getCoreControllerWithSigner(input);
+  const { controller, accountAddress, network, signerAddress } = await getCoreControllerWithSigner(input);
   if (side !== 'long' && side !== 'short') {
     throw new Error(
       `metamask.perps.place_order received invalid side: ${side} (expected long or short).`,
@@ -421,7 +430,37 @@ export async function placeOrder(input) {
     throw new Error(`metamask.perps.place_order received invalid leverage: ${leverage}.`);
   }
 
+  const closeImmediately = closeImmediatelyRequested(input.node);
+  const policy = await requirePerpsOrderAllowed({
+    network,
+    amount: usdAmount,
+    leverage,
+    orderType,
+    closeImmediately,
+    projectRoot: input.context?.projectRoot,
+    selectedAddress: signerAddress,
+  });
+  if (closeImmediately) {
+    assertFlatBeforeRoundTrip(
+      await controller.getPositions({ standalone: true, userAddress: accountAddress }),
+      symbol,
+      symbolForItem,
+      await controller.getOpenOrders({ standalone: true, userAddress: accountAddress }),
+    );
+  }
+
   const currentPrice = await currentMarketPrice(controller, symbol);
+  const houseNotional = requireHouseNotional({
+    network,
+    symbol,
+    amount: usdAmount,
+    leverage,
+    price: currentPrice,
+    szDecimals: network === 'mainnet'
+      ? (await controller.getMarkets({ symbols: [symbol] }))?.find((market) => market?.name === symbol)?.szDecimals
+      : null,
+    maxSlippageBps,
+  });
 
   const reduceOnly = optionalBooleanParam(
     input.node ?? {},
@@ -524,59 +563,86 @@ export async function placeOrder(input) {
     };
   }
 
-  const result = await controller.placeOrder(orderParams);
-  if (!result || result.success !== true) {
-    throw controllerRejection({
-      action: 'core placeOrder',
-      detail: `${symbol} (${orderType}), currentPrice=${currentPrice}${limitPrice ? `, limitPrice=${limitPrice}` : ''}`,
-      code: result?.error ?? 'unknown error',
-    });
+  // close_immediately started from a flat market (checked above), so a position
+  // in it after a failed placement is this order's: close it rather than leave it open.
+  const restsOnBook = orderType === 'limit' || isTriggerOrderType(orderType);
+  const placeAndVerify = async () => {
+    const result = await controller.placeOrder(orderParams);
+    if (!result || result.success !== true) {
+      throw controllerRejection({
+        action: 'core placeOrder',
+        detail: `${symbol} (${orderType}), currentPrice=${currentPrice}${limitPrice ? `, limitPrice=${limitPrice}` : ''}`,
+        code: result?.error ?? 'unknown error',
+      });
+    }
+
+    // For limit orders, confirm a RESTING open order exists (not a filled position);
+    // for market orders, confirm the position opened. Both read the real
+    // provider/exchange state (not the submit ack) before reporting success.
+    let matchingOrders = [];
+    let positions = [];
+    if (restsOnBook) {
+      matchingOrders = await waitForPlacedOrder(
+        controller,
+        accountAddress,
+        input,
+        {
+          orderId: result.orderId,
+          triggerOrderType: isTriggerOrderType(orderType) ? orderType : null,
+          triggerPrice,
+          limitPrice,
+          size: result.submittedSize ?? orderParams.size,
+          reduceOnly: orderParams.reduceOnly ?? false,
+        },
+        Number(optionalParam(input.node ?? {}, 'timeout_ms', 'timeoutMs') ?? 30000),
+      );
+    } else {
+      positions = await controller.getPositions({
+        standalone: true,
+        userAddress: accountAddress,
+      });
+    }
+    const matchingPositions = selectedItems(input, positions, 'position');
+
+    if (restsOnBook && matchingOrders.length === 0) {
+      throw new Error(
+        `core placeOrder (${orderType}) for ${symbol} reported success but no resting open order is visible (orderId=${result.orderId ?? 'null'}, limitPrice=${limitPrice}, triggerPrice=${triggerPrice}).`,
+      );
+    }
+    if (!restsOnBook && matchingPositions.length === 0) {
+      throw new Error(
+        `core placeOrder (market) for ${symbol} reported success but no matching position is visible (orderId=${result.orderId ?? 'null'}).`,
+      );
+    }
+    return { result, matchingOrders, matchingPositions };
+  };
+  let placed;
+  try {
+    placed = await placeAndVerify();
+  } catch (error) {
+    if (!closeImmediately) throw error;
+    throw await closeAfterFailedPlacement({ controller, accountAddress, symbol, maxSlippageBps, error });
   }
+  const { result, matchingOrders, matchingPositions } = placed;
 
-  // For limit orders, confirm a RESTING open order exists (not a filled position);
-  // for market orders, confirm the position opened. Both read the real
-  // provider/exchange state (not the submit ack) before reporting success.
-  const restsOnBook = orderType === 'limit' || isTriggerOrderType(orderType);
-  let matchingOrders = [];
-  let positions = [];
-  if (restsOnBook) {
-    matchingOrders = await waitForPlacedOrder(
+  const roundTrip = closeImmediately
+    ? await closeOpenedPosition({
       controller,
       accountAddress,
-      input,
-      {
-        orderId: result.orderId,
-        triggerOrderType: isTriggerOrderType(orderType) ? orderType : null,
-        triggerPrice,
-        limitPrice,
-        size: result.submittedSize ?? orderParams.size,
-        reduceOnly: orderParams.reduceOnly ?? false,
-      },
-      Number(optionalParam(input.node ?? {}, 'timeout_ms', 'timeoutMs') ?? 30000),
-    );
-  } else {
-    positions = await controller.getPositions({
-      standalone: true,
-      userAddress: accountAddress,
-    });
-  }
-  const matchingPositions = selectedItems(input, positions, 'position');
-
-  if (restsOnBook && matchingOrders.length === 0) {
-    throw new Error(
-      `core placeOrder (${orderType}) for ${symbol} reported success but no resting open order is visible (orderId=${result.orderId ?? 'null'}, limitPrice=${limitPrice}, triggerPrice=${triggerPrice}).`,
-    );
-  }
-  if (!restsOnBook && matchingPositions.length === 0) {
-    throw new Error(
-      `core placeOrder (market) for ${symbol} reported success but no matching position is visible (orderId=${result.orderId ?? 'null'}).`,
-    );
-  }
+      symbol,
+      network,
+      maxSlippageBps,
+      timeoutMs: Number(optionalParam(input.node ?? {}, 'timeout_ms', 'timeoutMs') ?? 30000),
+    })
+    : null;
 
   return {
     action: input.action,
     source: 'perps-controller-placeOrder',
     network,
+    policy: policy.lane,
+    ...(houseNotional ? { houseNotional } : {}),
+    ...(roundTrip ? { roundTrip } : {}),
     account: accountAddress,
     market: symbol,
     side,
@@ -602,4 +668,60 @@ export async function placeOrder(input) {
   };
 }
 
+// close_immediately: close the position this order opened and prove the market
+// is flat. On mainnet the opened position must be isolated 1x; it is closed
+// either way before that check fails the action.
+async function closeOpenedPosition({ controller, accountAddress, symbol, network, maxSlippageBps, timeoutMs }) {
+  const positions = await controller.getPositions({ standalone: true, userAddress: accountAddress });
+  const position = positions.find((candidate) => symbolForItem(candidate) === symbol);
+  if (!position) throw new Error(`close_immediately could not find the ${symbol} position the order opened.`);
+  let limitError = null;
+  if (network === 'mainnet') {
+    try {
+      assertHouseLimitPosition(position, symbol);
+    } catch (error) {
+      limitError = error;
+    }
+  }
+  const currentPrice = await currentMarketPrice(controller, symbol);
+  const result = await controller.closePosition({
+    symbol,
+    orderType: 'market',
+    currentPrice,
+    priceAtCalculation: currentPrice,
+    maxSlippageBps,
+    position,
+  });
+  const after = await waitForPositionsAbsent(controller, accountAddress, [symbol], timeoutMs);
+  if (result?.success !== true || after.some((candidate) => symbolForItem(candidate) === symbol)) {
+    throw new Error(
+      `close_immediately left the ${symbol} position open (${result?.error ?? 'still visible after close'}): ${JSON.stringify(redactPosition(position))}. Close it now.`,
+    );
+  }
+  if (limitError) throw limitError;
+  return { opened: redactPosition(position), closed: true, result };
+}
+
+async function closeAfterFailedPlacement({ controller, accountAddress, symbol, maxSlippageBps, error }) {
+  const message = error instanceof Error ? error.message : String(error);
+  let outcome;
+  try {
+    const positions = await controller.getPositions({ standalone: true, userAddress: accountAddress });
+    const position = positions.find((candidate) => symbolForItem(candidate) === symbol);
+    if (!position) {
+      outcome = `no ${symbol} position is open`;
+    } else {
+      const currentPrice = await currentMarketPrice(controller, symbol);
+      await controller.closePosition({ symbol, orderType: 'market', currentPrice, priceAtCalculation: currentPrice, maxSlippageBps, position });
+      const after = await waitForPositionsAbsent(controller, accountAddress, [symbol], 30000);
+      outcome = after.some((candidate) => symbolForItem(candidate) === symbol)
+        ? `the ${symbol} position is STILL OPEN after a close; close it now`
+        : `the ${symbol} position it opened was closed`;
+    }
+  } catch (closeError) {
+    outcome = `the ${symbol} position could not be checked or closed (${closeError instanceof Error ? closeError.message : String(closeError)}); check it now`;
+  }
+  return new Error(`${message} close_immediately: ${outcome}.`);
+}
+
 if (isDirectRun(import.meta.url)) runAdapter(placeOrder);

package/library/actions/core/perps/quote_fees.mjs

@@ -0,0 +1,61 @@
+// Quote an order's fees through the controller's calculateFees: the preview the
+// clients show, with the rewards and subscription sources the fee resolver uses.
+// Read-only: nothing is placed, and the only signature is the rewards API login.
+
+import {
+  configuredSymbols,
+  getCoreController,
+  isDirectRun,
+  optionalBooleanParam,
+  optionalParam,
+  requestedRewardsDiscountBips,
+  runAdapter,
+} from './_controller.mjs';
+import { rewardsApiUrl } from './_rewards.mjs';
+
+const ORDER_TYPES = ['market', 'limit'];
+
+export async function quoteFees(input) {
+  const symbols = configuredSymbols(input, []);
+  if (symbols.length !== 1) {
+    throw new Error(`metamask.perps.quote_fees requires exactly one market; got ${JSON.stringify(symbols)}.`);
+  }
+  const orderType = (optionalParam(input.node, 'order_type', 'orderType') ?? 'market').toLowerCase();
+  if (!ORDER_TYPES.includes(orderType)) {
+    throw new Error(`metamask.perps.quote_fees order_type must be ${ORDER_TYPES.join(' or ')}; got ${orderType}.`);
+  }
+  const isMaker = optionalBooleanParam(input.node, 'is_maker', 'isMaker');
+  const amount = optionalParam(input.node, 'amount');
+  if (amount !== undefined && !(Number(amount) > 0)) {
+    throw new Error(`metamask.perps.quote_fees amount must be a positive USD notional; got ${amount}.`);
+  }
+
+  const { controller, accountAddress, network, rewardsClient } = await getCoreController(input);
+  // calculateFees routes to the active provider, which init() brings up.
+  await controller.init();
+  const fees = await controller.calculateFees({
+    symbol: symbols[0],
+    orderType,
+    ...(isMaker === undefined ? {} : { isMaker }),
+    ...(amount === undefined ? {} : { amount }),
+  });
+  return {
+    action: input.action,
+    source: 'perps-controller-calculateFees',
+    network,
+    account: accountAddress,
+    market: symbols[0],
+    orderType,
+    isMaker: isMaker ?? null,
+    amount: amount ?? null,
+    rewardsDiscountBips: requestedRewardsDiscountBips(input) ?? null,
+    // The node's discount, or the rewards API's answer for the account.
+    rewardsSource: requestedRewardsDiscountBips(input) === undefined ? 'rewards-api' : 'node.rewards_discount_bips',
+    // Each discount the controller asked the rewards API for (no token).
+    rewardsApi: { url: rewardsApiUrl(), calls: rewardsClient.calls },
+    fees,
+    proofPath: 'perps-controller-calculateFees',
+  };
+}
+
+if (isDirectRun(import.meta.url)) runAdapter(quoteFees);

package/library/actions/core/wallet/list_accounts.mjs

@@ -3,72 +3,29 @@
 
 import { readFile, writeFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
-import { mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
 
 import { walletFixturePath } from '../../harness-exports.mjs';
-
-function fixtureAccountName(base, index, count) {
-  if (count === 1) return base || 'account1';
-  const match = /^(.*?)(\d+)$/u.exec(base || 'account1');
-  return match
-    ? `${match[1]}${Number(match[2]) + index}`
-    : `${base || 'account'}${index + 1}`;
-}
-
-function mnemonicCount(entry, fixturePath, index) {
-  const count = Number(entry.count ?? entry.numberOfAccounts ?? 1);
-  if (!Number.isInteger(count) || count < 1 || count > 100) {
-    throw new Error(`${fixturePath} accounts[${index}] mnemonic count must be an integer from 1 through 100.`);
-  }
-  return count;
-}
-
-function deriveFixtureAccounts(fixture, fixturePath) {
-  if (!Array.isArray(fixture.accounts) || fixture.accounts.length === 0) {
-    throw new Error(`wallet fixture at ${fixturePath} has no accounts array.`);
-  }
-  return fixture.accounts.flatMap((entry, fixtureIndex) => {
-    if (!entry || typeof entry !== 'object' || typeof entry.value !== 'string' || !entry.value.trim()) {
-      throw new Error(`${fixturePath} accounts[${fixtureIndex}] must contain a non-empty value.`);
-    }
-    if (entry.type === 'mnemonic') {
-      const count = mnemonicCount(entry, fixturePath, fixtureIndex);
-      return Array.from({ length: count }, (_, addressIndex) => {
-        const account = mnemonicToAccount(entry.value.trim(), { addressIndex });
-        return {
-          id: `fixture:${fixtureAccountName(entry.name, addressIndex, count)}`,
-          address: account.address,
-          name: fixtureAccountName(entry.name, addressIndex, count),
-          type: 'eip155:eoa',
-        };
-      });
-    }
-    if (entry.type === 'privateKey') {
-      const raw = entry.value.trim();
-      const normalized = raw.startsWith('0x') ? raw : `0x${raw}`;
-      if (!/^0x[0-9a-fA-F]{64}$/u.test(normalized)) {
-        throw new Error(`${fixturePath} accounts[${fixtureIndex}] privateKey is not a 32-byte hex key.`);
-      }
-      const account = privateKeyToAccount(normalized);
-      const name = entry.name || `account${fixtureIndex + 1}`;
-      return [{ id: `fixture:${name}`, address: account.address, name, type: 'eip155:eoa' }];
-    }
-    throw new Error(`${fixturePath} accounts[${fixtureIndex}].type must be mnemonic or privateKey.`);
-  });
-}
+import { readFixtureAccounts } from '../../shared/wallet/fixture-accounts.mjs';
 
 async function listAccounts(input) {
   const scope = input.node?.scope == null ? 'named' : String(input.node.scope);
   if (scope !== 'selected' && scope !== 'named' && scope !== 'evm' && scope !== 'all') {
     throw new Error('metamask.wallet.list_accounts scope must be selected, named, evm, or all.');
   }
-  const fixturePath = walletFixturePath(input.context.projectRoot);
-  const fixture = JSON.parse(await readFile(fixturePath, 'utf8'));
+  const loaded = await readFixtureAccounts(input.context.projectRoot);
+  if (!loaded) {
+    throw new Error(
+      `no wallet fixture at ${walletFixturePath(input.context.projectRoot)}.\nNext: run mm-harness fixtures set`,
+    );
+  }
   const selectedName = String(input.node?.account_name ?? input.node?.account ?? 'dev1');
-  const accounts = deriveFixtureAccounts(fixture, fixturePath)
-    .map((account) => ({
-      ...account,
-      selected: account.name === selectedName,
+  const accounts = loaded.accounts
+    .map(({ name, address }) => ({
+      id: `fixture:${name}`,
+      address,
+      name,
+      type: 'eip155:eoa',
+      selected: name === selectedName,
     }))
     .filter((account) => {
       if (scope === 'selected') return account.selected;

package/library/actions/extension/feature_flags/state.mjs

@@ -15,7 +15,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { recipeRuntimeDir } from '../../harness-exports.mjs';
+import { recipeRuntimeDir } from '@farmslot/recipe-cli/harness';
 
 export const EXTENSION_SET_UNSUPPORTED_REASON =
   'The extension exposes no runtime remote feature-flag override RPC: RemoteFeatureFlagController.setFlagOverride is never registered in metamask-controller.js getApi(), so stateHooks.submitRequestToBackground cannot reach it. Overrides are pinned into the per-run dist snapshot manifest at launch.';

package/library/actions/extension/perps/close_visible_position.mjs

@@ -11,6 +11,7 @@ import {
   trustedExternalMutationBudget,
   trustedExternalMutationIdentity,
   trustedExternalMutationPlanIsExact,
+  withFixturePolicyContext,
   withExternalMutationRecovery,
 } from './mutation-receipt.mjs';
 import { observeHyperliquidSubmission, placementReceiptSelection, requireCurrentVisibleFundingBalance, requirePerpsTradingContext } from './perps.mjs';
@@ -248,6 +249,10 @@ export async function closeVisiblePosition(input) {
   if (input.node?.confirm_live !== true) {
     throw new Error('metamask.perps.close_visible_position requires confirm_live=true.');
   }
+  ({ input } = await withFixturePolicyContext(input, page, {
+    operations: [{ operation: 'perps-close-position', amount: String(input.node?.funding_amount ?? '') }],
+    mainnetAllowed: true,
+  }));
   const fundingSide = String(input.node?.funding_side ?? '').toLowerCase();
   const fundingAmount = String(input.node?.funding_amount ?? '');
   const fundingPositionSize = String(input.node?.funding_position_size ?? '');

package/library/actions/extension/perps/edit_margin.mjs

@@ -8,6 +8,7 @@ import {
   readPriorMutationReceipt,
   runGuardedExternalMutation,
   trustedExternalMutationIdentity,
+  withFixturePolicyContext,
   withExternalMutationRecovery,
 } from './mutation-receipt.mjs';
 import { requireCurrentVisibleFundingBalance, requirePerpsTradingContext } from './perps.mjs';
@@ -182,6 +183,9 @@ export async function editMargin(input) {
   if (input.node?.confirm_live !== true) {
     throw new Error('metamask.perps.edit_margin requires confirm_live=true for live submission.');
   }
+  ({ input } = await withFixturePolicyContext(input, page, {
+    operations: [{ operation: 'perps-margin-adjust', amount, count: 2 }],
+  }));
   const identity = trustedExternalMutationIdentity(input, page, {
     operation: 'perps-margin-adjust',
     authorizationCount: 2,

package/library/actions/extension/perps/mutation-receipt.mjs

@@ -17,6 +17,11 @@ import {
 } from 'node:fs/promises';
 import path from 'node:path';
 
+import { isFixtureAccount } from '../../shared/wallet/fixture-accounts.mjs';
+import { MAINNET_HOUSE_LIMITS, orderNetwork, requirePerpsOrderAllowed } from '../../shared/perps/order-policy.mjs';
+import { readWalletStateExpression } from '../wallet/state.mjs';
+import { readPerpsRuntimeStateExpression } from './state.mjs';
+
 const SHA256 = /^[a-f0-9]{64}$/u;
 const EXECUTION_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
 const NODE_ID = /^(?=.{1,256}$)[A-Za-z0-9][A-Za-z0-9._-]{0,63}(?:\/[A-Za-z0-9][A-Za-z0-9._-]{0,63})*$/u;
@@ -185,6 +190,90 @@ function trustedString(value, label, pattern) {
   return text;
 }
 
+// Without funding files the runner gives Extension mutations a fixture-policy
+// context (F21) that names no account, runtime or operation. Before its receipt
+// identity, a mutating action completes it from the live app: the network
+// (checked with the node's), the selected account, the CDP runtime, and the
+// one or two operations it is about to run, after the shared order policy
+// (library/actions/shared/perps/order-policy.mjs) allows them. Everything after
+// that (identity, budget, receipts, ledger, resume) is the funded path's code.
+export const FIXTURE_POLICY_LANE = 'fixture-policy';
+
+export function inFixturePolicyLane(input) {
+  return input.context?.trustedMutation?.proofLane === FIXTURE_POLICY_LANE;
+}
+
+/**
+ * @param input - Action input carrying the runner's fixture-policy context.
+ * @param page - The Extension page (runtimeIdentity, evaluate).
+ * @param options.operations - [{ operation, amount, count?, order? }]: what this action may run
+ *   (order: true caps it at the mainnet house limit on mainnet).
+ * @param options.order - Perps order to check with the shared policy, or null for a
+ *   non-order mutation (allowed on testnet; on mainnet only a close from a fixture account).
+ * @returns {{ input, network, policy }} input with the completed context.
+ */
+export async function withFixturePolicyContext(input, page, { operations, order = null, mainnetAllowed = false }) {
+  // mainnetAllowed: a non-order mutation (a close) a fixture account may run on mainnet.
+  if (!inFixturePolicyLane(input)) return { input, network: null, policy: null };
+  const state = await page.evaluate(readPerpsRuntimeStateExpression());
+  if (!state?.available || !state?.networkKnown) {
+    throw new Error('Perps mutation cannot verify the current provider and network.');
+  }
+  const network = orderNetwork({ declared: input.node?.network, liveIsTestnet: state.isTestnet });
+  const wallet = await page.evaluate(readWalletStateExpression());
+  const address = String(wallet?.selectedAccount?.address ?? '').toLowerCase();
+  if (!/^0x[0-9a-f]{40}$/u.test(address)) throw new Error('Perps mutation cannot read the selected account.');
+  const projectRoot = input.context?.projectRoot;
+  const policy = order
+    ? await requirePerpsOrderAllowed({ ...order, network, projectRoot, selectedAddress: address })
+    : null;
+  if (!order && network === 'mainnet'
+    && (!mainnetAllowed || !(await isFixtureAccount(projectRoot, address)))) {
+    throw Object.assign(
+      new Error(`PERPS_MAINNET_ORDER_REFUSED: ${input.action} on mainnet needs the funding-file release lane${mainnetAllowed ? ' or a synced test account' : ''}; refused before dispatch.`),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  const runtime = page?.runtimeIdentity ?? {};
+  const requirements = [{
+    kind: 'metric',
+    id: 'perps-available-margin-usdc',
+    minBaseUnits: '1',
+    actualBaseUnits: '1',
+    evidenceSha256: digest(`${FIXTURE_POLICY_LANE}:no-funding-minimum`),
+  }];
+  const trustedMutation = {
+    ...input.context.trustedMutation,
+    selectedIdentitySha256: digest(address),
+    runtimeSessionId: runtime.runtimeSessionId,
+    cdpPort: runtime.cdpPort,
+    cdpTargetId: runtime.cdpTargetId,
+    extensionOrigin: runtime.extensionOrigin,
+    operations: operations.map((entry) => ({
+      operation: entry.operation,
+      unit: 'usdc-base-units',
+      amountBaseUnits: decimalBaseUnits(entry.amount),
+      count: entry.count ?? 1,
+    })),
+    budgets: operations.map((entry) => ({
+      operation: entry.operation,
+      unit: 'usdc-base-units',
+      // A mainnet order's exposure is capped at the house limit; testnet orders
+      // and closes are bounded by the policy alone.
+      maxBaseUnits: entry.order && network === 'mainnet'
+        ? `${MAINNET_HOUSE_LIMITS.maxNotionalBaseUnits}`
+        : MAX_POLICY_BUDGET_BASE_UNITS,
+      maxCount: entry.count ?? 1,
+    })),
+    requirements,
+    fundingRequirementsSha256: digest(canonical(requirements)),
+  };
+  return { input: { ...input, context: { ...input.context, trustedMutation } }, network, policy };
+}
+
+// Testnet and close budgets: the policy, not a funding request, bounds them.
+const MAX_POLICY_BUDGET_BASE_UNITS = '999999999999999999999999999999';
+
 export function trustedExternalMutationIdentity(input, page, operation) {
   const trusted = input.context?.trustedMutation;
   if (!trusted || typeof trusted !== 'object' || Array.isArray(trusted)) {
@@ -803,9 +892,12 @@ export async function runGuardedExternalMutation({ input, identity, dispatch, ob
     } catch (error) {
       if (error instanceof ExternalMutationNotDispatchedError) {
         await markExternalMutationNotDispatched(input, receipt, error, receiptIo);
-        throw new Error(
-          `External mutation was safely not dispatched (${error.message}). ` +
-          'Next: correct the observed state and create a fresh consent request, claim, and artifact root.',
+        throw Object.assign(
+          new Error(
+            `External mutation was safely not dispatched (${error.message}). ` +
+            'Next: correct the observed state and create a fresh consent request, claim, and artifact root.',
+          ),
+          { knownNotDispatched: true },
         );
       }
       throw recoveryError(receipt, `pointer dispatch may have occurred (${error instanceof Error ? error.message : String(error)})`);