@deeeed/metamask-harness 0.80.0 → 0.82.0

package/library/actions/extension/platform/cdp.mjs

@@ -195,6 +195,55 @@ function captureHelperPath() {
   return process.env.CAPTURE_HELPER_PATH || 'capture-helper';
 }
 
+// A snapshot helper that outlived its harness process (a crashed run, or a
+// timeout from before timed-out helpers were killed) is reparented to launchd
+// and makes later snapshots hang. Kill those, and what they started (the npm
+// wrapper `node …/capture-helper snapshot` runs the native binary as its
+// child), before starting a new one. Only this user's processes are touched.
+async function reapOrphanedCaptureHelpers(context) {
+  const ps = await runProcess('ps', ['-axo', 'pid=,ppid=,uid=,command='], {
+    cwd: context.projectRoot,
+    env: process.env,
+    timeoutMs: 5000,
+  });
+  if (ps.exitCode !== 0) throw new Error(`ps failed while reaping capture-helper: ${ps.stderr}`);
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+  const configured = captureHelperPath();
+  // The executable (or the script node runs) and its subcommand, never an
+  // argument. The configured path may contain spaces; other install paths may not.
+  const dir = configured.includes('/') ? `${escape(path.dirname(configured))}/|` : '';
+  const snapshotHelper = new RegExp(
+    `^(?:(?:\\S*/)?node\\s+)?(?:${dir}\\S*/)?${escape(path.basename(configured))} snapshot(?:\\s|$)`,
+    'u',
+  );
+  const processes = ps.stdout.split('\n').flatMap((line) => {
+    const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(.*)$/u.exec(line);
+    return match && Number(match[3]) === process.getuid()
+      ? [{ pid: Number(match[1]), ppid: Number(match[2]), command: match[4] }]
+      : [];
+  });
+  const doomed = new Set(
+    processes.filter((entry) => entry.ppid === 1 && snapshotHelper.test(entry.command)).map((entry) => entry.pid),
+  );
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const entry of processes) {
+      if (doomed.has(entry.ppid) && !doomed.has(entry.pid)) {
+        doomed.add(entry.pid);
+        grew = true;
+      }
+    }
+  }
+  for (const pid of doomed) {
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch (error) {
+      // It exited between ps and kill: already reaped.
+      if (error?.code !== 'ESRCH') throw error;
+    }
+  }
+}
+
 function parsePositivePid(value) {
   const pid = Number(String(value ?? '').trim());
   return Number.isInteger(pid) && pid > 0 ? pid : null;
@@ -280,7 +329,7 @@ async function captureCdpSnapshot(page, context, relPath, metadata, captureHelpe
       provider: 'cdp',
       mode: 'Page.captureScreenshot',
       fullPage: metadata?.fullPage === true,
-      ...(captureHelperError ? { fallbackFrom: 'capture-helper', captureHelperError } : {}),
+      ...(captureHelperError ? { fallbackFrom: 'capture-helper', fallbackReason: captureHelperError, captureHelperError } : {}),
     },
   };
 }
@@ -318,6 +367,7 @@ export async function captureHelperSnapshot(page, context, relPath, metadata) {
         'native snapshot skipped while full-run recording owns the browser window',
       );
     } else {
+      await reapOrphanedCaptureHelpers(context);
       const result = await runProcess(
         captureHelperPath(),
         ['snapshot', '--pid', String(pid), '--output', destination.stagedPath],
@@ -413,17 +463,31 @@ async function execNodeScript(script, args, options) {
 
 function runProcess(command, args, options) {
   return new Promise((resolve, reject) => {
+    // A bounded command runs in its own process group so a timeout kills
+    // everything it started: the npm capture-helper wrapper runs the native
+    // binary as a child, which would otherwise keep our pipes open.
     const child = spawn(command, args, {
       cwd: options.cwd,
       env: options.env || process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
+      detached: Boolean(options.timeoutMs),
     });
     let timer = null;
     let stdout = '';
     let stderr = '';
     if (options.timeoutMs) {
       timer = setTimeout(() => {
-        child.kill('SIGTERM');
+        timer = null;
+        // SIGKILL: capture-helper can ignore SIGTERM while it holds a window capture.
+        try {
+          process.kill(-child.pid, 'SIGKILL');
+        } catch (error) {
+          // ESRCH: the whole group already exited; only the pipe close is pending.
+          if (error?.code !== 'ESRCH') {
+            reject(error);
+            return;
+          }
+        }
         reject(new Error(`Command timed out after ${options.timeoutMs}ms: ${command} ${args.join(' ')}`));
       }, options.timeoutMs);
     }
@@ -650,7 +714,11 @@ export async function openExtensionHomePage(port, extensionId) {
 
 async function ensureExtensionTarget(input, port) {
   let launch = null;
-  const trustedTargetId = input.context?.trustedMutation?.cdpTargetId ?? null;
+  // A fixture-policy run (F21) has no target until its first mutation pins the
+  // live one; every later page in that action uses it.
+  const trusted = input.context?.trustedMutation;
+  const unpinnedPolicyLane = trusted?.proofLane === 'fixture-policy' && trusted.cdpTargetId === '';
+  const trustedTargetId = unpinnedPolicyLane ? null : trusted?.cdpTargetId ?? null;
   if (trustedTargetId !== null && !/^[A-Za-z0-9._:-]{1,128}$/u.test(String(trustedTargetId))) {
     throw new Error('Funded Extension action has no valid trusted CDP target id.');
   }

package/library/actions/mobile/perps/perps.mjs

@@ -14,6 +14,14 @@ import {
 import { ensureUnlocked } from '../wallet/ensure_unlocked.mjs';
 import { selectAccount } from '../wallet/select_account.mjs';
 import { observeNativeUi } from '../platform/observe-ui.mjs';
+import {
+  assertFlatBeforeRoundTrip,
+  assertHouseLimitPosition,
+  closeImmediatelyRequested,
+  orderNetwork,
+  requireHouseNotional,
+  requirePerpsOrderAllowed,
+} from '../../shared/perps/order-policy.mjs';
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -1281,7 +1289,7 @@ function closePositionParams(input, position) {
   return params;
 }
 
-async function closePositionItem(input, position) {
+async function closePositionItem(input, position, bound = null) {
   const maxAttempts = Number(input.node?.close_attempts ?? 3);
   const retryDelayMs = Number(input.node?.close_retry_delay_ms ?? 1000);
   const deadline = deadlineFromTimeout(
@@ -1293,7 +1301,7 @@ async function closePositionItem(input, position) {
   let lastResult = null;
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     if (Date.now() >= deadline) break;
-    const currentPositions = await readPositions(input);
+    const currentPositions = bound ? await readBoundPositions(input, bound) : await readPositions(input);
     const currentPosition = currentPositions.find((candidate) => symbolForItem(candidate) === baseParams.symbol);
     if (!currentPosition) return { symbol: baseParams.symbol, result: { success: true, alreadyClosed: true }, attempts };
 
@@ -1301,8 +1309,12 @@ async function closePositionItem(input, position) {
     const params = { ...baseParams, position: currentPosition, priceAtCalculation };
     const result = await evalAsync(
       input,
-      `Engine.context.PerpsController.closePosition(${JSON.stringify(params)}).then(function(r){return JSON.stringify(r)})`,
+      `(function(){ ${boundContextGuard(bound)}
+        return Engine.context.PerpsController.closePosition(${sourceLiteral(params)}).then(function(r){return JSON.stringify(r)}); })()`,
     );
+    if (result?.contextChanged) {
+      throw new Error(`Close of ${baseParams.symbol} stopped: the selected account or network changed; nothing more was sent.`);
+    }
     attempts.push({ attempt, priceAtCalculation, result });
     lastResult = result;
     if (result?.success === false) {
@@ -1394,7 +1406,37 @@ export async function placeOrder(input) {
   const maxSlippageBps = Number(input.node?.max_slippage_bps ?? input.node?.maxSlippageBps ?? 300);
   const isBuy = orderSideIsBuy(side);
   const orderType = resolveOrderType(input);
+  const closeImmediately = closeImmediatelyRequested(input.node);
+  const runtime = await readPerpsRuntimeState(input);
+  const network = orderNetwork({ declared: input.node?.network, liveIsTestnet: runtime?.isTestnet });
+  // The account and network the rule allows, rechecked at dispatch and before any close.
+  const bound = { network, address: String((await readSelectedAddress(input)) ?? '').toLowerCase() };
+  const policy = await requirePerpsOrderAllowed({
+    network,
+    amount,
+    leverage,
+    orderType,
+    closeImmediately,
+    projectRoot: input.context?.projectRoot,
+    selectedAddress: bound.address,
+  });
+  if ((closeImmediately || network === 'mainnet') && input.node?.size != null) {
+    throw new Error('close_immediately and mainnet orders are sized from amount; drop size.');
+  }
+  if (closeImmediately) {
+    const book = await readBoundBook(input, bound);
+    assertFlatBeforeRoundTrip(book.positions, symbol, symbolForItem, book.orders);
+  }
   const currentPrice = await currentPriceForOrder(input, symbol);
+  const houseNotional = requireHouseNotional({
+    network,
+    symbol,
+    amount,
+    leverage,
+    price: currentPrice,
+    szDecimals: network === 'mainnet' ? await readSizeDecimals(input, symbol) : null,
+    maxSlippageBps,
+  });
   const limitPrice = orderType === 'limit'
     ? resolveLimitPrice(input, isBuy, currentPrice)
     : null;
@@ -1426,16 +1468,179 @@ export async function placeOrder(input) {
       priceAtCalculation: currentPrice,
       maxSlippageBps,
     };
-  const result = await evalAsync(input, `Engine.context.PerpsController.placeOrder(${JSON.stringify(orderParams)}).then(function(r){return JSON.stringify(r)})`);
-  if (result?.success === false || result == null) {
-    throw new Error(`Failed to place ${symbol} ${side}: ${result?.error || JSON.stringify(result)}`);
+  if (await tradingContextChanged(input, bound)) {
+    throw new Error('Perps order not dispatched: the selected account or network changed after the order rule allowed it.');
+  }
+  let result;
+  try {
+    result = await evalAsync(input, `(function(){ ${boundContextGuard(bound)}
+      return Engine.context.PerpsController.placeOrder(${sourceLiteral(orderParams)}).then(function(r){return JSON.stringify(r)}); })()`);
+    if (result?.contextChanged) {
+      throw Object.assign(
+        new Error('Perps order not dispatched: the selected account or network changed after the order rule allowed it.'),
+        { knownNotDispatched: true },
+      );
+    }
+    if (result?.success === false || result == null) {
+      throw new Error(`Failed to place ${symbol} ${side}: ${result?.error || JSON.stringify(result)}`);
+    }
+    if (orderType === 'limit') {
+      await waitForSelectedState(input, readOpenOrders, true, Number(input.node?.timeout_ms ?? 30000));
+    } else {
+      await waitForPositionPresent(input, symbol, Number(input.node?.timeout_ms ?? 30000));
+    }
+  } catch (error) {
+    if (!closeImmediately || error?.knownNotDispatched) throw error;
+    throw await closeAfterFailedPlacement(input, symbol, error, bound);
+  }
+  const placed = { action: input.action, market: symbol, side, orderType, amount, size, leverage, limitPrice, submitted: true, result, network, policy: policy.lane, ...(houseNotional ? { houseNotional } : {}), proofPath: 'mobile-perps-controller-place-order' };
+  if (!closeImmediately) return placed;
+  return { ...placed, roundTrip: await closeOpenedPosition(input, symbol, bound) };
+}
+
+// close_immediately started from a flat market (checked before dispatch), so a
+// position in it after a failed placement is this order's: close it rather
+// than leave it open, and say what happened.
+async function closeAfterFailedPlacement(input, symbol, error, bound) {
+  const message = error instanceof Error ? error.message : String(error);
+  let outcome;
+  try {
+    if (await tradingContextChanged(input, bound)) {
+      return new Error(`${message} close_immediately: the selected account or network changed, so nothing was closed; check ${symbol} on the original account now.`);
+    }
+    const position = (await readBoundPositions(input, bound)).find((candidate) => symbolForItem(candidate) === symbol);
+    if (!position) {
+      outcome = `no ${symbol} position is open`;
+    } else {
+      await closePositionItem(fullCloseInput(input), position, bound);
+      outcome = await waitForBoundPositionAbsent(input, bound, symbol, Number(input.node?.timeout_ms ?? 30000))
+        ? `the ${symbol} position it opened was closed`
+        : `the ${symbol} position is STILL OPEN after a close; close it now`;
+    }
+  } catch (closeError) {
+    outcome = `the ${symbol} position could not be checked or closed (${closeError instanceof Error ? closeError.message : String(closeError)}); check it now`;
+  }
+  return new Error(`${message} close_immediately: ${outcome}.`);
+}
+
+async function readSizeDecimals(input, symbol) {
+  const markets = await evalAsync(
+    input,
+    `Engine.context.PerpsController.getMarkets({ symbols: [${sourceLiteral(symbol)}] }).then(function(r){return JSON.stringify((r||[]).map(function(m){return { name: m.name, szDecimals: m.szDecimals };}))})`,
+  );
+  return (Array.isArray(markets) ? markets : []).find((market) => normalizeMarketSymbol(market?.name ?? '') === symbol)?.szDecimals ?? null;
+}
+
+// The close takes the whole position: the order's own size or amount never
+// becomes a partial close size.
+function fullCloseInput(input) {
+  const { size: _size, amount: _amount, notional: _notional, ...node } = input.node ?? {};
+  return { ...input, node };
+}
+
+// Bridge sources embed values as JSON literals. JSON.stringify leaves `<`, `>`,
+// `/` and U+2028/U+2029 raw; escape them so no value can end a script context
+// or a statement in the evaluated source.
+const UNSAFE_SOURCE_CHARS = { '<': '\\u003C', '>': '\\u003E', '/': '\\u002F', '\u2028': '\\u2028', '\u2029': '\\u2029' };
+export function sourceLiteral(value) {
+  return JSON.stringify(value).replace(/[<>/\u2028\u2029]/gu, (char) => UNSAFE_SOURCE_CHARS[char]);
+}
+
+// Bridge source that resolves to { contextChanged: true } unless the selected
+// account and Perps network are still the bound ones. It runs in the same
+// evaluation as the controller call it guards, so a switch can't slip between.
+function boundContextGuard(bound) {
+  if (!bound) return '';
+  return `var __account = Engine.context.AccountsController.getSelectedAccount();
+    var __address = String((__account && __account.address) || '').toLowerCase();
+    var __network = Engine.context.PerpsController.state.isTestnet ? 'testnet' : 'mainnet';
+    if (__address !== ${sourceLiteral(bound.address)} || __network !== ${sourceLiteral(bound.network)}) {
+      return Promise.resolve(JSON.stringify({ success: false, contextChanged: true }));
+    }`;
+}
+
+// The positions of the bound account on the bound network, read in one guarded
+// evaluation; a changed context throws instead of reading another account.
+async function readBoundPositions(input, bound) {
+  const positions = await evalAsync(input, `(function(){ ${boundContextGuard(bound)}
+    return Engine.context.PerpsController.getPositions().then(function(r){return JSON.stringify(r)}); })()`);
+  if (positions?.contextChanged) {
+    throw new Error('Perps positions not read: the selected account or network changed after the order rule allowed it. Check the order\'s market on the original account now.');
+  }
+  if (!Array.isArray(positions)) throw new Error('PerpsController.getPositions returned a non-array result.');
+  return positions;
+}
+
+// The flat-market baseline: the bound account's positions and resting orders,
+// read in one evaluation with the context guard before, between and after the
+// reads, so a switch to another account's book and back can't pass as flat.
+async function readBoundBook(input, bound) {
+  const guard = `(function(){ ${boundContextGuard(bound)} return null; })()`;
+  const book = await evalAsync(input, `(function(){
+    var controller = Engine.context.PerpsController;
+    var positions;
+    return ${guard} || controller.getPositions().then(function(r){
+      positions = r;
+      return ${guard} || controller.getOpenOrders().then(function(orders){
+        return ${guard} || JSON.stringify({ positions: positions, orders: orders });
+      });
+    }); })()`);
+  if (book?.contextChanged) {
+    throw new Error('Perps order not dispatched: the selected account or network changed while the market was checked flat.');
+  }
+  if (!Array.isArray(book?.positions) || !Array.isArray(book?.orders)) {
+    throw new Error('PerpsController.getPositions or getOpenOrders returned a non-array result.');
+  }
+  return book;
+}
+
+async function waitForBoundPositionAbsent(input, bound, symbol, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const positions = await readBoundPositions(input, bound);
+    if (!positions.some((position) => symbolForItem(position) === symbol)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleep(1000);
+  }
+}
+
+async function tradingContextChanged(input, bound) {
+  const runtime = await readPerpsRuntimeState(input);
+  const network = runtime?.isTestnet === true ? 'testnet' : runtime?.isTestnet === false ? 'mainnet' : null;
+  const address = String((await readSelectedAddress(input)) ?? '').toLowerCase();
+  return network !== bound.network || address !== bound.address;
+}
+
+async function readSelectedAddress(input) {
+  return evalAsync(input, 'JSON.stringify(Engine.context.AccountsController.getSelectedAccount()?.address ?? null)');
+}
+
+// close_immediately: close the position this order opened and prove the market
+// is flat. On mainnet the opened position must be isolated 1x; it is closed
+// either way before that check fails the action.
+async function closeOpenedPosition(input, symbol, bound) {
+  const { network } = bound;
+  if (await tradingContextChanged(input, bound)) {
+    throw new Error(`close_immediately did not close ${symbol}: the selected account or network changed after the order. The order's position is still open on the original account; close it now.`);
+  }
+  const position = (await readBoundPositions(input, bound)).find((candidate) => symbolForItem(candidate) === symbol);
+  if (!position) {
+    throw new Error(`close_immediately could not find the ${symbol} position the order opened; it may still fill. Check ${symbol} now and close it if it opened.`);
+  }
+  let limitError = null;
+  if (network === 'mainnet') {
+    try {
+      assertHouseLimitPosition(position, symbol);
+    } catch (error) {
+      limitError = error;
+    }
   }
-  if (orderType === 'limit') {
-    await waitForSelectedState(input, readOpenOrders, true, Number(input.node?.timeout_ms ?? 30000));
-  } else {
-    await waitForPositionPresent(input, symbol, Number(input.node?.timeout_ms ?? 30000));
+  const closed = await closePositionItem(fullCloseInput(input), position, bound);
+  if (!(await waitForBoundPositionAbsent(input, bound, symbol, Number(input.node?.timeout_ms ?? 30000)))) {
+    throw new Error(`close_immediately left the ${symbol} position open: ${JSON.stringify(redactPosition(position))}. Close it now.`);
   }
-  return { action: input.action, market: symbol, side, orderType, amount, size, leverage, limitPrice, submitted: true, result, proofPath: 'mobile-perps-controller-place-order' };
+  if (limitError) throw limitError;
+  return { opened: redactPosition(position), closed: true, result: closed.result };
 }
 
 export async function ensurePositions(input) {

package/library/actions/mobile/perps/place_order.mjs

@@ -1,8 +1,10 @@
 // Submit a Perps order through the Mobile controller and assert a matching open position.
+// With close_immediately the order's position is already closed again, so the market must be flat.
 import { runAdapter } from '../platform/bridge.mjs';
+import { closeImmediatelyRequested } from '../../shared/perps/order-policy.mjs';
 import { assertPositions, placeOrder } from './perps.mjs';
 runAdapter(async (input) => {
   const order = await placeOrder(input);
-  const assertion = await assertPositions(input, true);
+  const assertion = await assertPositions(input, !closeImmediatelyRequested(input.node));
   return { ...assertion, submitted: order.submitted === true, order };
 });

package/library/actions/shared/console-collector.mjs

@@ -15,7 +15,7 @@ export const COLLECTOR_SCRIPT_NAME = 'console-tail.mjs';
 export const CAPTURE_CONTROL_MARK = '[mm-harness-capture-control]';
 
 // Same derivation as ownerMarker('console-collector', …) in
-// adapters/terminal/lib/processes.mjs, so the terminal stop path finds it.
+// adapters/web-dapp/lib/processes.mjs, so the web-dapp stop path finds it.
 export function collectorOwnerMarker(runtimeDir) {
   const id = createHash('sha256').update(path.resolve(runtimeDir)).digest('hex').slice(0, 32);
   return `--mm-harness-owner=console-collector-${id}`;

package/library/actions/shared/perps/order-policy.mjs

@@ -0,0 +1,177 @@
+// The Perps order rule every adapter applies before dispatch (F21).
+// Testnet orders need no funding proof. A mainnet order is allowed only from a
+// synced fixture account within the house limits: 1x isolated, notional at
+// most $15, closed again inside the same action (close_immediately: true).
+
+import { isFixtureAccount } from '../wallet/fixture-accounts.mjs';
+
+export const MAINNET_HOUSE_LIMITS = Object.freeze({
+  maxNotionalUsd: '15',
+  maxNotionalBaseUnits: 15_000_000n,
+  leverage: 1,
+  marginType: 'isolated',
+});
+
+const USDC_DECIMAL = /^(?:0|[1-9][0-9]{0,11})(?:\.([0-9]{1,6}))?$/u;
+
+// USDC base units (6 decimals) of a non-negative decimal amount.
+export function usdcBaseUnits(value) {
+  const text = String(value ?? '').trim();
+  const match = USDC_DECIMAL.exec(text);
+  if (!match) throw new Error(`Perps order amount must be a USDC decimal with at most 6 decimals, got ${JSON.stringify(text)}.`);
+  const [whole, fraction = ''] = text.split('.');
+  return BigInt(whole) * 1_000_000n + BigInt(fraction.padEnd(6, '0'));
+}
+
+// The order's network: the live app's, which must agree with the node's
+// declared one. A mainnet order must declare network: mainnet, so a recipe
+// written for testnet never trades real funds because the app moved.
+export function orderNetwork({ declared, liveIsTestnet }) {
+  const live = liveIsTestnet === true ? 'testnet' : liveIsTestnet === false ? 'mainnet' : null;
+  if (!live) throw new Error('Perps order cannot verify whether the app is on testnet or mainnet.');
+  const wanted = declared == null || declared === '' ? null : String(declared).toLowerCase();
+  if (wanted && wanted !== 'testnet' && wanted !== 'mainnet') {
+    throw new Error(`Perps order network must be testnet or mainnet, got ${JSON.stringify(declared)}.`);
+  }
+  if (wanted && wanted !== live) throw new Error(`Perps order expected ${wanted}, but the app is on ${live}.`);
+  if (live === 'mainnet' && wanted !== 'mainnet') {
+    throw Object.assign(
+      new Error('PERPS_MAINNET_ORDER_REFUSED: Perps app is on mainnet but the order does not declare network: mainnet. Next: switch to testnet, or declare network: mainnet within the house limits.'),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  return live;
+}
+
+// Whether the node asks the action to close the position it opens.
+export function closeImmediatelyRequested(node) {
+  return node?.close_immediately === true || node?.closeImmediately === true;
+}
+
+/**
+ * Decide whether a Perps order may be dispatched.
+ * @param {object} order
+ * @param {'testnet'|'mainnet'} order.network - The live app network, already cross-checked with the node.
+ * @param {string|number} order.amount - Margin in USDC.
+ * @param {number} order.leverage
+ * @param {'market'|'limit'} [order.orderType]
+ * @param {boolean} order.closeImmediately
+ * @param {boolean} order.fixtureAccount - The selected account is a synced fixture account.
+ * @returns {{ lane: 'testnet' } | { lane: 'mainnet-house-limits', notionalBaseUnits: string }}
+ */
+export function decidePerpsOrder({ network, amount, leverage, orderType = 'market', closeImmediately, fixtureAccount }) {
+  if (closeImmediately && orderType !== 'market') {
+    throw new Error('close_immediately needs a market order: a resting limit order is not a position the action can close.');
+  }
+  // Testnet keeps whatever amount format the adapter accepts; only mainnet sizes are parsed strictly.
+  if (network === 'testnet') return { lane: 'testnet' };
+  if (network !== 'mainnet') throw new Error(`Perps order network must be testnet or mainnet, got ${JSON.stringify(network)}.`);
+  const leverageValue = Number(leverage);
+  const amountBaseUnits = usdcBaseUnits(amount);
+  const notionalBaseUnits = amountBaseUnits * BigInt(Number.isInteger(leverageValue) && leverageValue > 0 ? leverageValue : 1);
+  const broken = [];
+  if (amountBaseUnits <= 0n) broken.push('the amount is not positive');
+  if (!fixtureAccount) broken.push('the selected account is not one of the synced test accounts');
+  if (leverageValue !== MAINNET_HOUSE_LIMITS.leverage) broken.push(`leverage is ${leverage}, not 1`);
+  if (notionalBaseUnits > MAINNET_HOUSE_LIMITS.maxNotionalBaseUnits) {
+    broken.push(`notional ${formatUsd(notionalBaseUnits)} is above $${MAINNET_HOUSE_LIMITS.maxNotionalUsd}`);
+  }
+  if (orderType !== 'market') broken.push(`order type is ${orderType}, not market`);
+  if (!closeImmediately) broken.push('close_immediately is not true');
+  if (broken.length > 0) {
+    throw Object.assign(
+      new Error(
+        // The code leads the message: it is what survives a live adapter's process
+        // boundary, and the wording avoids the words bounded healing reads as wallet state.
+        `PERPS_MAINNET_ORDER_REFUSED: Mainnet Perps order refused before dispatch: ${broken.join('; ')}. ` +
+          `Mainnet orders need a synced test account, a 1x isolated market order, notional at most $${MAINNET_HOUSE_LIMITS.maxNotionalUsd} and close_immediately: true. ` +
+          'Next: use testnet, or stay within those limits.',
+      ),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  return { lane: 'mainnet-house-limits', notionalBaseUnits: `${notionalBaseUnits}` };
+}
+
+// decidePerpsOrder with the fixture check resolved from the checkout's fixture.
+export async function requirePerpsOrderAllowed({ projectRoot, selectedAddress, ...order }) {
+  const fixtureAccount = order.network === 'mainnet'
+    ? await isFixtureAccount(projectRoot, selectedAddress)
+    : false;
+  return decidePerpsOrder({ ...order, fixtureAccount });
+}
+
+// close_immediately closes the market's whole position (positions are netted
+// per market), so it must start flat: no position and no resting order that
+// could fill into the position it then closes.
+export function assertFlatBeforeRoundTrip(positions, symbol, symbolOf, orders = []) {
+  if (positions.some((position) => symbolOf(position) === symbol)) {
+    throw new Error(`close_immediately needs no open ${symbol} position before the order; close it first.`);
+  }
+  if (orders.some((order) => symbolOf(order) === symbol)) {
+    throw new Error(`close_immediately needs no resting ${symbol} order before the order; cancel it first.`);
+  }
+}
+
+// The most a market order for `amount` USDC margin can fill at. The controller
+// rounds the size to the market's szDecimals and adds one step when that falls
+// short of the USD amount (perps-controller utils/orderCalculations.ts), and the
+// fill may slip by maxSlippageBps: (amount × leverage + one step × price) × (1 + slippage).
+export function worstCaseNotionalUsd({ amount, leverage, price, szDecimals, maxSlippageBps }) {
+  const usd = Number(amount) * Number(leverage);
+  const step = 10 ** -Number(szDecimals);
+  return (usd + step * Number(price)) * (1 + Number(maxSlippageBps) / 10_000);
+}
+
+// Mainnet only: refuse before dispatch when the size the controller would submit
+// could fill above the house notional limit. Testnet needs no bound.
+export function requireHouseNotional({ network, symbol, amount, leverage, price, szDecimals, maxSlippageBps }) {
+  if (network !== 'mainnet') return null;
+  // A missing value is unknown, never zero (Number(null) is 0).
+  const known = (value) => (value == null || value === '' ? Number.NaN : Number(value));
+  const inputs = { price: known(price), szDecimals: known(szDecimals), maxSlippageBps: known(maxSlippageBps) };
+  if (!(inputs.price > 0) || !Number.isInteger(inputs.szDecimals) || inputs.szDecimals < 0
+    || !Number.isFinite(inputs.maxSlippageBps) || inputs.maxSlippageBps < 0) {
+    throw Object.assign(
+      new Error(`PERPS_MAINNET_ORDER_REFUSED: Mainnet Perps order refused before dispatch: cannot bound the ${symbol} order size (price, size decimals or slippage unknown).`),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  const worst = worstCaseNotionalUsd({ amount, leverage, ...inputs });
+  if (worst > Number(MAINNET_HOUSE_LIMITS.maxNotionalUsd)) {
+    throw Object.assign(
+      new Error(
+        `PERPS_MAINNET_ORDER_REFUSED: Mainnet Perps order refused before dispatch: a ${symbol} order for $${Number(amount) * Number(leverage)} can fill at up to $${worst.toFixed(2)} ` +
+          `(size step ${10 ** -inputs.szDecimals} at $${inputs.price}, max slippage ${inputs.maxSlippageBps} bps), above $${MAINNET_HOUSE_LIMITS.maxNotionalUsd}. ` +
+          'Next: order less, or lower max_slippage_bps.',
+      ),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  return { worstCaseNotionalUsd: Number(worst.toFixed(6)) };
+}
+
+// The opened position must be the isolated 1x one the policy allowed, worth at
+// most the house limit, before the action closes it (mainnet), so a drift is
+// reported, not hidden. The caller closes the position first either way.
+export function assertHouseLimitPosition(position, symbol) {
+  const type = String(position?.leverage?.type ?? position?.marginType ?? '').toLowerCase();
+  const value = Number(position?.leverage?.value ?? position?.leverage);
+  if (type !== MAINNET_HOUSE_LIMITS.marginType || value !== MAINNET_HOUSE_LIMITS.leverage) {
+    throw new Error(
+      `Mainnet ${symbol} position opened as ${type || 'unknown'} ${Number.isFinite(value) ? `${value}x` : 'unknown leverage'}, not isolated 1x; it was closed.`,
+    );
+  }
+  const opened = Math.abs(Number(position?.size ?? position?.szi)) * Number(position?.entryPrice ?? position?.entryPx);
+  if (!Number.isFinite(opened) || opened > Number(MAINNET_HOUSE_LIMITS.maxNotionalUsd) + 1e-6) {
+    throw new Error(
+      `Mainnet ${symbol} position opened at ${Number.isFinite(opened) ? `$${opened.toFixed(2)}` : 'an unknown value'}, above $${MAINNET_HOUSE_LIMITS.maxNotionalUsd}; it was closed.`,
+    );
+  }
+}
+
+function formatUsd(baseUnits) {
+  const whole = baseUnits / 1_000_000n;
+  const fraction = `${baseUnits % 1_000_000n}`.padStart(6, '0').replace(/0+$/u, '');
+  return `$${whole}${fraction ? `.${fraction}` : ''}`;
+}

package/library/actions/{core/wallet/_fixture-accounts.mjs → shared/wallet/fixture-accounts.mjs}

@@ -1,6 +1,8 @@
-// The checkout's wallet fixture expanded into accounts: a mnemonic entry with
-// count N yields N accounts at address indexes 0..N-1, named dev1..devN from the
-// entry's name. list_accounts shows them; Core Perps actions select from them.
+// The checkout's synced wallet fixture (temp/recipe/runtime/wallet-fixture.json)
+// expanded into accounts: a mnemonic entry with count N yields N accounts at
+// address indexes 0..N-1, named dev1..devN from the entry's name. list_accounts
+// shows them, Core Perps actions sign with them, and the Perps order rule
+// (../perps/order-policy.mjs) checks a mainnet order's account against them.
 
 import { readFile } from 'node:fs/promises';
 import { mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
@@ -67,3 +69,16 @@ export async function readFixtureAccounts(projectRoot) {
   }
   return { fixturePath, accounts: deriveFixtureAccounts(JSON.parse(raw), fixturePath) };
 }
+
+// Whether an address is one of the fixture's accounts. A missing or unreadable
+// fixture is "not a fixture account": the caller refuses, it never assumes.
+export async function isFixtureAccount(projectRoot, address) {
+  const wanted = String(address ?? '').toLowerCase();
+  if (!/^0x[0-9a-f]{40}$/u.test(wanted) || !projectRoot) return false;
+  try {
+    const loaded = await readFixtureAccounts(projectRoot);
+    return Boolean(loaded?.accounts.some((account) => account.address.toLowerCase() === wanted));
+  } catch {
+    return false;
+  }
+}

package/library/actions/{terminal → web-dapp}/app/assert_no_console_errors.mjs

@@ -1,4 +1,4 @@
-// Fail the recipe when the terminal page logged an error or uncaught exception
+// Fail the recipe when the app page logged an error or uncaught exception
 // that the recipe libraries' console allowlist does not mark as known
 // third-party noise. Reads the slot console capture (app-console.log, and
 // extension-console.log when asked) from where the current slot browser's
@@ -20,7 +20,7 @@ import {
   loadConsoleAllowlist,
 } from '../../shared/console-findings.mjs';
 import { collectorOwnerMarker, collectorStatus, verifyCapture } from '../../shared/console-collector.mjs';
-import { isDirectRun, readBrowserState, runAdapter, terminalRuntimeDir } from '../platform/runtime.mjs';
+import { isDirectRun, readBrowserState, runAdapter, webDappPolicy, webDappRuntimeDir } from '../platform/runtime.mjs';
 
 const LOGS = Object.freeze({ page: 'app-console.log', extension: 'extension-console.log' });
 
@@ -55,7 +55,7 @@ export async function assertNoConsoleErrors(input, env = process.env, deps = {})
   const projectRoot = input.context?.projectRoot;
   const sources = Array.isArray(node.sources) && node.sources.length ? node.sources.map(String) : ['page', 'browser'];
   const levels = new Set(Array.isArray(node.levels) && node.levels.length ? node.levels.map(String) : ['error', 'exception']);
-  const runtime = terminalRuntimeDir(projectRoot);
+  const runtime = webDappRuntimeDir(projectRoot);
   const state = await readBrowserState(projectRoot);
   if (!state?.cdpPort || !state.appOrigin) throw unavailable('no slot browser state (browser.json)');
   const capture = (deps.collectorStatus ?? collectorStatus)({
@@ -107,7 +107,7 @@ export async function assertNoConsoleErrors(input, env = process.env, deps = {})
     // The recorded launch offset was past the end of a replaced capture
     // file; that file was read from its start.
     offsetResets,
-    proofPath: 'terminal-console-capture',
+    proofPath: `${webDappPolicy().adapterId}-console-capture`,
   };
   if (failing.size > 0) {
     const list = [...failing.values()].map((item) => `${item.level} [${item.source}] ${item.example} ×${item.count}`).join('\n  ');