@deeeed/metamask-harness 0.86.0 → 0.86.2

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## Unreleased
 
+## 0.86.2 - 2026-10-09
+
+### Fixed
+
+- Extension `metamask.perps.place_order` through the background Perps request accepts the venue's lot-rounded market fill. The controller sizes a USD order to the market's size step, so $12 of SOL at 109.94 fills 0.11 SOL with $12.09 margin. The observer required the margin within $0.01 of $12 and left every such placement `outcome-unknown`. It now reads the market's size decimals before dispatch and computes the lot the controller fills. The position size must equal the venue-reported filled size (or be within one step of the computed lot when the controller reports none, and never off the step grid), and the margin must be within one size step at the current price plus `identity_rounding_tolerance_base_units`. A reported fill more than one step from the computed lot fails. The lot is stored in the receipt (`facts.marketLot`), so a resume checks against it, not against a lot recomputed at a moved price. A lot whose notional exceeds the trusted operation cap is refused before the receipt. A filled position whose exposure (margin × leverage) exceeds the cap leaves the outcome unknown. Market, side and leverage still match exactly, and mainnet limits are unchanged. With no known size step the exact-cent check stays, and the size must equal a reported fill.
+- Background market placements now record the venue's filled order (`acceptance.source: "background-perpsPlaceOrder"`, with `venueOrderId`, `filledSize` and `averagePrice` from `perpsPlaceOrder`) and the pre-order balance (`facts.balanceBeforeBaseUnits`). Before, the receipt had neither, so `metamask.perps.close_visible_position` refused cleanup with "Position cleanup requires the exact accepted venue order ID", even after a successful placement. Cleanup still proves the position from that order's own fills.
+
+### Changed
+
+- Extension `metamask.perps.close_visible_position cleanup_only=true` now takes the released amount from the position's margin (`marginUsed`, already read from the position detail), not from the close modal text. It records the amount in the receipt as `closeReleaseBaseUnits` with `closeReleaseSource: "position-margin"`. Unrealized PnL is not added, because the available balance (Hyperliquid `withdrawable`) already includes it. The modal's "You'll receive" amount (`marginUsed` minus fees) is now a cross-check, recorded as `closeModalReceiveBaseUnits`. If it differs from the margin by more than the reconciliation tolerance, the action refuses before publishing a receipt or clicking. If the modal amount cannot be read, the action no longer refuses; it reconciles on the margin. The $1 tolerance is unchanged.
+
+### Fixed
+
+- Mobile route waits (`navigate` and `waitForRoute` in the action library) now end at the calling action's deadline. Before, once a Perps `start_state` or `teardown_state` ran out of budget, the bridge refused each new `get-route` with `CDP_TIMEOUT`. The waits took that refusal for a target transition and kept polling for up to 30 s more on their own 15 s windows. They could not see a route that did arrive, and failed with "did not start before its action deadline: get-route". On a physical Pixel 6a this showed up as `CDP_TIMEOUT` in clean-market setup and teardown, while one `get-route` took 0.1 to 0.5 s. Both now stop at the deadline. A route that never matched fails with the expected route, the last route read and the limit applied; a recovery cut short by the deadline fails with its last bridge error.
+
+## 0.86.1 - 2026-10-09
+
+### Fixed
+
+- Extension `metamask.perps.close_visible_position cleanup_only=true` reconciles the final balance against the margin the close releases. With no placement receipt, the baseline is the available balance read while the position is still open. That baseline excludes the position's margin, so a clean full close went over the $1 tolerance and left an `outcome-unknown` receipt. A 0.11 SOL testnet close moved $524.42 to $536.45 and failed this way. The action now reads the close modal's "You'll receive" amount before dispatch and records it in the receipt as `closeReleaseBaseUnits`. It then checks the final balance against baseline + receive, with the same tolerance. If the amount is not visible, the action refuses before publishing a receipt or clicking. Closes backed by a placement receipt still reconcile against the pre-order balance. Cleanup output adds `releaseBaseUnits` and `expectedBalanceAfterBaseUnits`.
+- Mobile `metamask.perps.read_visible_state` on iOS sees Perps Text test IDs. iOS accessibility lists React Native Text as a StaticText with no identifier, so a visible Lite market price (`perps-market-header-price`) failed `require_features: ["price"]`. On a non-opaque iOS run, `ui.visible` now reads each mounted `perps-` Text's test ID, string and size over the dev bridge. It gives that test ID to the on-screen StaticText with the same label and size, when exactly one test ID matches. Offscreen StaticText stays unbound, and so does a same-text twin of another size (the collapsed header price). Other Text, such as a revealed Secret Recovery Phrase word, is not read. This reaches every iOS `ui.visible` consumer: `ui.locators`, native-navigation test-ID waits, `readVisiblePerpsTestIds`, `configure_order`, and the assets and swap-bridge `read_visible_state`. Opaque runtimes and Android are unchanged. A non-opaque run with Metro down pays one bridge attempt (at most 2 s) per observation and gets a `ui.visible` warning; a read over 500 Texts is truncated with a warning.
+- An empty `METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT` means the bundled `cdp-bridge.cjs` everywhere the TypeScript side spawns the Mobile bridge, as `run` and the action library already treated it. `launch`'s feature-flag reads and pins (and `doctor`'s) and the `status` live probe read the variable with `??`. An empty value made them check for a script named `""`, so they reported no runtime and never spawned a bridge. All TypeScript callers now share one `mobileBridgeScript()`; the action library keeps the same rule in its own `bridgeScript()` because it cannot import `src/`.
+
 ## 0.86.0 - 2026-10-09
 
 ### Added

package/dist/adapters/mobile/bridge-script.js

@@ -0,0 +1,12 @@
+import path from "node:path";
+import { runnerDir } from "../../paths.js";
+function mobileBridgeScriptOverride() {
+  return process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT || void 0;
+}
+function mobileBridgeScript() {
+  return mobileBridgeScriptOverride() ?? path.join(runnerDir, "adapters", "mobile", "bridge-runtime", "cdp-bridge.cjs");
+}
+export {
+  mobileBridgeScript,
+  mobileBridgeScriptOverride
+};

package/dist/adapters/mobile/feature-flags.js

@@ -1,11 +1,7 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
-import path from "node:path";
-import { runnerDir } from "../../paths.js";
+import { mobileBridgeScript } from "./bridge-script.js";
 const DEFAULT_TIMEOUT_MS = 1e4;
-function bridgeScriptPath() {
-  return process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT ?? path.join(runnerDir, "adapters", "mobile", "bridge-runtime", "cdp-bridge.cjs");
-}
 const CONTROLLER_PREAMBLE = `
   var ctx = globalThis.Engine && globalThis.Engine.context;
   var c = ctx && ctx.RemoteFeatureFlagController;
@@ -19,7 +15,7 @@ function evalExpression(body) {
   return `(function(){ try {${CONTROLLER_PREAMBLE}${body} } catch (e) { return JSON.stringify({ ok: false, error: e && (e.message || String(e)) }); } })()`;
 }
 function runBridgeEval(target, expression, timeoutMs) {
-  const script = bridgeScriptPath();
+  const script = mobileBridgeScript();
   if (!fs.existsSync(script)) return Promise.resolve(null);
   return new Promise((resolve) => {
     let settled = false;

package/dist/adapters/mobile/run.js

@@ -2,7 +2,6 @@ import { EXIT, isRecord } from "@farmslot/recipe-cli/harness";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { IOS_SIMULATOR_RECORDING_TARGET_PREFIX } from "@farmslot/adapter-rn";
-import { runnerDir } from "../../paths.js";
 import { devicePlatformFromEnv } from "../performance/device-platform.js";
 import {
   resolveAndroidDeviceSerial,
@@ -10,6 +9,7 @@ import {
 } from "./recording-target.js";
 import { emitProofFailure } from "../proof-failure.js";
 import { mobileAppIdentityEnv } from "./app-identity.js";
+import { mobileBridgeScript } from "./bridge-script.js";
 import { requireCurrentMobileReleaseArtifactState } from "./release-artifact-state.js";
 const EXPLICIT_DEVICE_KEYS = [
   "PLATFORM",
@@ -158,7 +158,7 @@ const mobileObservation = {
   }
 };
 function runMobileIssueCommand(projectRoot, command) {
-  const bridge = process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT || path.join(runnerDir, "adapters", "mobile", "bridge-runtime", "cdp-bridge.cjs");
+  const bridge = mobileBridgeScript();
   const result = spawnSync(process.execPath, [bridge, command], {
     cwd: projectRoot,
     env: { ...process.env, APP_ROOT: projectRoot, CDP_TIMEOUT: "5000" },

package/dist/adapters/mobile/ui.js

@@ -10,6 +10,7 @@ import { trustedMutationContextExtras } from "../../funding-execution-context.js
 import { LIBRARY_ACTION_NAMESPACE } from "../../paths.js";
 import { liveTsxCandidates } from "../../live-tsx.js";
 import { mobileAppIdentityEnv } from "./app-identity.js";
+import { mobileBridgeScriptOverride } from "./bridge-script.js";
 const execFileAsync = promisify(execFile);
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -58,7 +59,7 @@ function mobileProbeOutput(status, input, projectRoot) {
   };
 }
 function mobileBridgePath(_projectRoot) {
-  return process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT || "runner:adapters/mobile/bridge-runtime/cdp-bridge.cjs";
+  return mobileBridgeScriptOverride() ?? "runner:adapters/mobile/bridge-runtime/cdp-bridge.cjs";
 }
 function resolveMobileWaitTarget(payload) {
   const testId = optionalScalarText(

package/dist/commands/status-probe.js

@@ -1,13 +1,9 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
-import path from "node:path";
 import { fixtureSummary } from "../doctor.js";
 import { normalizeFeatureFlagRecord } from "../feature-flags.js";
-import { runnerDir } from "../paths.js";
+import { mobileBridgeScript } from "../adapters/mobile/bridge-script.js";
 const PROBE_TIMEOUT_MS = 2e3;
-function bridgeScriptPath() {
-  return process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT ?? path.join(runnerDir, "adapters", "mobile", "bridge-runtime", "cdp-bridge.cjs");
-}
 function truncateAddress(address) {
   if (!address || address.length <= 10) return address;
   return `${address.slice(0, 6)}\u2026${address.slice(-4)}`;
@@ -77,7 +73,7 @@ function matchBridgeEntry(device, entries, devices) {
   return null;
 }
 function probeMobileBridge(target) {
-  const script = bridgeScriptPath();
+  const script = mobileBridgeScript();
   if (!fs.existsSync(script)) {
     return Promise.resolve({ ok: false, liveState: "no-bridge" });
   }

package/library/actions/extension/perps/close_visible_position.mjs

@@ -208,10 +208,11 @@ async function prepareCloseModal(page, partialAmount) {
   return confirmation;
 }
 
-async function proveGlobalCleanup(page, balanceBeforeBaseUnits, toleranceBaseUnits, timeoutMs = 20_000) {
+async function proveGlobalCleanup(page, balanceBeforeBaseUnits, releaseBaseUnits, toleranceBaseUnits, timeoutMs = 20_000) {
   await page.navigateHash('#/perps-home');
   const state = await waitForStableGlobalPerpsHome(page, { timeoutMs, requireZero: true });
-  const balanceDeltaBaseUnits = absoluteDelta(state.balanceBaseUnits, balanceBeforeBaseUnits);
+  const expectedBalanceAfterBaseUnits = `${BigInt(balanceBeforeBaseUnits) + BigInt(releaseBaseUnits ?? '0')}`;
+  const balanceDeltaBaseUnits = absoluteDelta(state.balanceBaseUnits, expectedBalanceAfterBaseUnits);
   if (BigInt(balanceDeltaBaseUnits) > BigInt(toleranceBaseUnits)) {
     throw new Error('Final visible Perps balance exceeds the authorized reconciliation tolerance.');
   }
@@ -219,6 +220,8 @@ async function proveGlobalCleanup(page, balanceBeforeBaseUnits, toleranceBaseUni
     positionCount: 0,
     orderCount: 0,
     balanceBeforeBaseUnits,
+    releaseBaseUnits: releaseBaseUnits ?? null,
+    expectedBalanceAfterBaseUnits,
     balanceAfterBaseUnits: state.balanceBaseUnits,
     balanceDeltaBaseUnits,
     toleranceBaseUnits,
@@ -327,9 +330,14 @@ export async function closeVisiblePosition(input) {
                 if (!/^(?:0|[1-9][0-9]{0,29})$/u.test(balanceBeforeBaseUnits)) {
                   throw new Error('Resumed close receipt has no valid pre-order balance.');
                 }
+                const releaseBaseUnits = existingReceipt.record?.facts?.closeReleaseBaseUnits ?? null;
+                if (releaseBaseUnits != null && !/^-?(?:0|[1-9][0-9]{0,29})$/u.test(String(releaseBaseUnits))) {
+                  throw new Error('Resumed close receipt has an invalid close release amount.');
+                }
                 const cleanup = await proveGlobalCleanup(
                   page,
                   balanceBeforeBaseUnits,
+                  releaseBaseUnits,
                   balanceToleranceBaseUnits,
                 );
                 return {
@@ -413,6 +421,14 @@ export async function closeVisiblePosition(input) {
   if (partialAmount == null && (!confirmation.fullSizeSelected || !confirmation.marketOrder)) {
     throw new Error('Receipt-bound full close requires the visible 100% market-close form.');
   }
+  // Without a placement receipt the baseline is the in-position balance, which excludes the position's
+  // margin. The close returns marginUsed (PnL is already in the balance); the modal receive cross-checks it.
+  const closeReleaseBaseUnits = placement ? null : exactBefore.marginBaseUnits;
+  const closeModalReceiveBaseUnits = placement ? null : parseUsdBaseUnits(confirmation.receive);
+  if (closeModalReceiveBaseUnits != null
+    && BigInt(absoluteDelta(closeModalReceiveBaseUnits, closeReleaseBaseUnits)) > BigInt(balanceToleranceBaseUnits)) {
+    throw new Error('Visible close receive amount disagrees with the position margin beyond the reconciliation tolerance.');
+  }
   const closeSizing = partialAmount == null ? { size: sizeMatch[1], side: fundingSide === 'long' ? 'short' : 'long' } : null;
   let submissionObserver = null;
   let mutation;
@@ -427,6 +443,8 @@ export async function closeVisiblePosition(input) {
       cleanupOnly,
       fundingBalance,
       tradingContext,
+      ...(closeReleaseBaseUnits != null ? { closeReleaseBaseUnits, closeReleaseSource: 'position-margin' } : {}),
+      ...(closeModalReceiveBaseUnits != null ? { closeModalReceiveBaseUnits } : {}),
       ...(acceptedFill ? { acceptedFill } : {}),
       ...(closeSizing ? { closeSizing } : {}),
     },
@@ -507,6 +525,7 @@ export async function closeVisiblePosition(input) {
             const cleanup = await proveGlobalCleanup(
               page,
               balanceBeforeBaseUnits,
+              closeReleaseBaseUnits,
               balanceToleranceBaseUnits,
             );
             return {

package/library/actions/extension/perps/mutation-receipt.mjs

@@ -831,8 +831,27 @@ export async function recordExternalMutationCleanupCandidate(input, receipt, can
   });
 }
 
+// A market order placed through the background Perps request reports the venue's
+// filled order itself; there is no observed network request to bind.
+export const BACKGROUND_ACCEPTANCE_SOURCE = 'background-perpsPlaceOrder';
+
+function validFilledOrder(filledSize, averagePrice) {
+  return /^(?:0|[1-9][0-9]{0,19})(?:\.[0-9]{1,8})?$/u.test(String(filledSize)) && Number(filledSize) > 0
+    && /^(?:0|[1-9][0-9]{0,19})(?:\.[0-9]{1,18})?$/u.test(String(averagePrice)) && Number(averagePrice) > 0;
+}
+
 async function recordSubmissionAcceptance(input, receipt, acceptance) {
   const { venueOrderId, status, requestId, serviceWorkerTargetId, asset, size, limitPriceBaseUnits, filledSize, averagePrice } = acceptance;
+  if (acceptance.source === BACKGROUND_ACCEPTANCE_SOURCE) {
+    if (receipt.record.identity.operation !== 'perps-market-order' || receipt.record.identity.provider !== 'hyperliquid'
+      || !/^[1-9][0-9]{0,19}$/u.test(String(venueOrderId)) || status !== 'filled' || size !== filledSize
+      || !validFilledOrder(filledSize, averagePrice)) {
+      throw recoveryError(receipt, 'background market acceptance has invalid filled order identity');
+    }
+    return writeSubmissionAcceptance(input, receipt, {
+      source: BACKGROUND_ACCEPTANCE_SOURCE, venueOrderId, status, size, filledSize, averagePrice,
+    });
+  }
   const closing = receipt.record.identity.operation === 'perps-close-position';
   const market = closing || receipt.record.identity.operation === 'perps-market-order';
   const sizing = closing ? receipt.record.facts?.closeSizing
@@ -849,20 +868,22 @@ async function recordSubmissionAcceptance(input, receipt, acceptance) {
     || !BASE_UNITS.test(String(limitPriceBaseUnits))) {
     throw recoveryError(receipt, 'submission acceptance has invalid order identity');
   }
-  if (market && status === 'filled' && (!/^(?:0|[1-9][0-9]{0,19})(?:\.[0-9]{1,8})?$/u.test(String(filledSize))
-    || !(Number(filledSize) > 0) || Number(filledSize) > Number(size)
-    || !/^(?:0|[1-9][0-9]{0,19})(?:\.[0-9]{1,18})?$/u.test(String(averagePrice)) || !(Number(averagePrice) > 0))) {
+  if (market && status === 'filled' && (!validFilledOrder(filledSize, averagePrice) || Number(filledSize) > Number(size))) {
     throw recoveryError(receipt, 'market acceptance has invalid filled size or price');
   }
+  return writeSubmissionAcceptance(input, receipt, {
+    venueOrderId, status, requestId, serviceWorkerTargetId, asset, size, limitPriceBaseUnits,
+    ...(market && status === 'filled' ? { filledSize, averagePrice } : {}),
+  });
+}
+
+async function writeSubmissionAcceptance(input, receipt, acceptance) {
   const destination = await receiptDestination(input);
   const current = await readPublished(destination);
   if (!current || current.sha256 !== receipt.sha256 || current.record?.state !== 'outcome-unknown') {
     throw recoveryError(receipt, 'the receipt changed before submission acceptance was recorded');
   }
-  const record = { ...current.record, acceptance: {
-    venueOrderId, status, requestId, serviceWorkerTargetId, asset, size, limitPriceBaseUnits,
-    ...(market && status === 'filled' ? { filledSize, averagePrice } : {}),
-  } };
+  const record = { ...current.record, acceptance };
   const staged = await stagedRecord(destination.directory, record);
   try {
     await rename(staged.stagedPath, destination.absolute);

package/library/actions/extension/perps/perps.mjs

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { dataTestId, marketSymbol, normalizeMarketSymbol, runAdapter, withExtensionPage } from '../platform/cdp.mjs';
 import {
   assertTrustedExternalMutationTarget,
+  BACKGROUND_ACCEPTANCE_SOURCE,
   externalMutationNotDispatched,
   readExternalMutationReceipt,
   readPriorMutationReceipt,
@@ -27,6 +28,7 @@ import {
   assertFlatBeforeRoundTrip,
   assertHouseLimitPosition,
   closeImmediatelyRequested,
+  marketOrderLot,
   requireHouseNotional,
 } from '../../shared/perps/order-policy.mjs';
 import {
@@ -780,8 +782,33 @@ function backgroundPositionObservation(position) {
   return { market, side, leverage, size: String(position?.size ?? position?.szi), marginBaseUnits };
 }
 
-async function observeBackgroundPlace(page, expected, baselineIds, timeoutMs) {
+// Whole size steps in a size, or null when it is off the step grid.
+function sizeLots(size, sizeDecimals) {
+  const scaled = Math.abs(Number(size)) * 10 ** sizeDecimals;
+  const lots = Math.round(scaled);
+  return Number.isSafeInteger(lots) && lots > 0 && Math.abs(scaled - lots) < 1e-6 ? lots : null;
+}
+
+async function observeBackgroundPlace(page, expected, baselineIds, timeoutMs, acceptance) {
   const deadline = Date.now() + timeoutMs;
+  const lot = expected.orderType === 'market' ? expected.marketLot : null;
+  // A venue-reported fill fixes the exact size; without one the size may be a step
+  // off the lot computed here, since the controller sizes at its own fresh price.
+  const acceptedLots = lot && acceptance?.source === BACKGROUND_ACCEPTANCE_SOURCE
+    ? sizeLots(acceptance.filledSize, lot.sizeDecimals) : null;
+  if (lot && acceptance?.source === BACKGROUND_ACCEPTANCE_SOURCE
+    && (acceptedLots == null || Math.abs(acceptedLots - lot.lots) > 1)) {
+    throw new Error('Background Perps market fill size is not within one size step of the requested amount.');
+  }
+  const marginToleranceBaseUnits = lot
+    ? `${BigInt(expected.roundingToleranceBaseUnits) + BigInt(lot.stepMarginBaseUnits)}`
+    : expected.roundingToleranceBaseUnits;
+  const reported = acceptance?.source === BACKGROUND_ACCEPTANCE_SOURCE;
+  const sizeMatches = (size) => {
+    if (!lot) return !reported || Math.abs(Number(size)) === Number(acceptance.filledSize);
+    const observed = sizeLots(size, lot.sizeDecimals);
+    return observed != null && (acceptedLots != null ? observed === acceptedLots : Math.abs(observed - lot.lots) <= 1);
+  };
   while (Date.now() <= deadline) {
     if (expected.orderType === 'limit') {
       const matches = (await readOpenOrders(page))
@@ -798,12 +825,20 @@ async function observeBackgroundPlace(page, expected, baselineIds, timeoutMs) {
           && position.market === expected.market
           && position.side === expected.side
           && position.leverage === expected.leverage
+          && sizeMatches(position.size)
           && withinBaseUnitTolerance(
             position.marginBaseUnits,
             expected.amountBaseUnits,
-            expected.roundingToleranceBaseUnits,
+            marginToleranceBaseUnits,
           ));
-      if (matches.length === 1) return { success: true, position: matches[0] };
+      if (matches.length === 1) {
+        // The step tolerance widens the identity match, never the exposure the run allowed.
+        if (expected.maximumNotionalBaseUnits != null
+          && BigInt(matches[0].marginBaseUnits) * BigInt(matches[0].leverage) > BigInt(expected.maximumNotionalBaseUnits)) {
+          throw new Error('Background Perps position exposure exceeds the runner-trusted operation cap.');
+        }
+        return { success: true, position: matches[0] };
+      }
       if (matches.length > 1) throw new Error('Background position postcondition matched more than one position.');
     }
     await sleep(250);
@@ -870,7 +905,12 @@ async function dispatchBackgroundPlace(page, {
     };
     const result = await request('perpsPlaceOrder', [orderParams]);
     if (!result || result.success !== true) throw new Error(result?.error || 'perpsPlaceOrder failed.');
-    return { success: true };
+    return {
+      success: true,
+      orderId: result.orderId == null ? null : String(result.orderId),
+      filledSize: result.filledSize == null ? null : String(result.filledSize),
+      averagePrice: result.averagePrice == null ? null : String(result.averagePrice),
+    };
   })()`, { awaitPromise: true });
 }
 
@@ -1246,10 +1286,23 @@ async function placeOrderThroughBackground(input, page, {
       }
     }
   }
+  if (!existing && expected.marketLot
+    && BigInt(expected.marketLot.notionalBaseUnits) > BigInt(expected.maximumNotionalBaseUnits)) {
+    throw new Error('Rounded Perps market lot exceeds the runner-trusted operation cap.');
+  }
+  // A resume checks the fill against the lot sized at publication, not one
+  // recomputed at a price that has since moved.
+  const marketLot = existing?.record?.facts?.marketLot ?? expected.marketLot ?? null;
   const mutation = await runGuardedExternalMutation({
     input,
     identity,
-    publicationFacts: { baselineOrderIds: [...baselineIds], fundingBalance },
+    // The pre-order balance lets a receipt-bound close reconcile its final balance.
+    publicationFacts: {
+      balanceBeforeBaseUnits: fundingBalance.observedBaseUnits,
+      baselineOrderIds: [...baselineIds],
+      fundingBalance,
+      ...(expected.marketLot ? { marketLot: expected.marketLot } : {}),
+    },
     dispatch: async () => {
       try {
         await requireCurrentVisibleFundingBalance(
@@ -1278,13 +1331,26 @@ async function placeOrderThroughBackground(input, page, {
       if (accepted?.changed) {
         throw externalMutationNotDispatched('the selected account or Perps network changed after the order rule allowed it');
       }
+      // The venue's filled order ID goes into the receipt, so cleanup can prove the
+      // position is this order's own.
+      if (orderType === 'market' && accepted?.orderId != null && accepted.filledSize != null && accepted.averagePrice != null) {
+        return {
+          source: BACKGROUND_ACCEPTANCE_SOURCE,
+          venueOrderId: accepted.orderId,
+          status: 'filled',
+          size: accepted.filledSize,
+          filledSize: accepted.filledSize,
+          averagePrice: accepted.averagePrice,
+        };
+      }
       return accepted;
     },
-    observe: async () => observeBackgroundPlace(
+    observe: async ({ receipt }) => observeBackgroundPlace(
       page,
-      expected,
+      { ...expected, marketLot },
       baselineIds,
       Number(input.node?.timeout_ms ?? 30_000),
+      receipt?.acceptance,
     ),
   });
   return {
@@ -1676,8 +1742,9 @@ export async function placeOrder(input) {
         const slippage = Number(input.node?.max_slippage_bps ?? input.node?.maxSlippageBps ?? 300) / 10_000;
         const margin = Number(amount);
         if (szDecimals == null) throw new Error(`close_immediately cannot read the ${symbol} size decimals; not dispatched.`);
-        const tolerance = Math.ceil(((10 ** -Number(szDecimals)) * Number(price) / leverage + margin * slippage) * 1_000_000) + 10_000;
-        if (!Number.isInteger(Number(szDecimals)) || !Number.isFinite(tolerance) || tolerance > 1_000_000) {
+        const lot = marketOrderLot({ amount, leverage, price, szDecimals });
+        const tolerance = lot ? Number(lot.stepMarginBaseUnits) + Math.ceil(margin * slippage * 1_000_000) + 10_000 : Number.NaN;
+        if (!Number.isFinite(tolerance) || tolerance > 1_000_000) {
           throw new Error(`close_immediately cannot prove a ${symbol} fill within $1 (size step or slippage too coarse); pass identity_rounding_tolerance_base_units or choose another market.`);
         }
         // The receipt identity must not move with the price, so a resume finds it:
@@ -1743,15 +1810,18 @@ export async function placeOrder(input) {
         symbol,
         input.node?.current_price ?? input.node?.currentPrice,
       );
+      const szDecimals = lane.network === 'mainnet' || orderType === 'market'
+        ? await readSizeDecimals(page, symbol) : null;
       houseNotional = requireHouseNotional({
         network: lane.network,
         symbol,
         amount,
         leverage,
         price: resolvedPrice,
-        szDecimals: lane.network === 'mainnet' ? await readSizeDecimals(page, symbol) : null,
+        szDecimals,
         maxSlippageBps: Number(input.node?.max_slippage_bps ?? input.node?.maxSlippageBps ?? 300),
       });
+      const marketLot = orderType === 'market' ? marketOrderLot({ amount, leverage, price: resolvedPrice, szDecimals }) : null;
       const backgroundLimitPrice = orderType === 'limit'
         ? resolveLimitPrice(input, isBuy, resolvedPrice)
         : null;
@@ -1764,6 +1834,7 @@ export async function placeOrder(input) {
         expected: {
           ...expectedVisibleIdentity,
           limitPriceBaseUnits: backgroundLimitPrice == null ? null : parseUsdBaseUnits(backgroundLimitPrice),
+          ...(marketLot ? { marketLot } : {}),
         },
         identity,
         isBuy,

package/library/actions/mobile/perps/perps.mjs

@@ -4,7 +4,10 @@ import { pathToFileURL } from 'node:url';
 import {
   MOBILE_BRIDGE_RESULT_ERROR_CODES,
   bridgeCommand,
+  deadlineFromTimeout,
+  earliestDeadline,
   evalAsync,
+  inheritedDeadline,
   isTargetTransition,
   navigate,
   routeSatisfiesNavigationTarget,
@@ -94,23 +97,6 @@ const MODE_ROOT_TEST_IDS = {
 };
 const READ_ATTEMPT_TIMEOUT_MS = 10_000;
 
-function inheritedDeadline(input) {
-  const deadline = Number(input.node?._action_deadline_epoch_ms);
-  return Number.isFinite(deadline) ? deadline : null;
-}
-
-function earliestDeadline(input, deadline) {
-  const inherited = inheritedDeadline(input);
-  return inherited === null ? deadline : Math.min(deadline, inherited);
-}
-
-function deadlineFromTimeout(input, timeoutMs) {
-  return earliestDeadline(
-    input,
-    Date.now() + Math.max(0, Number(timeoutMs)),
-  );
-}
-
 async function sleepBeforeDeadline(deadline, maximumMs, wait = sleep) {
   const remainingMs = deadline - Date.now();
   if (remainingMs <= 0) return;

package/library/actions/mobile/platform/bridge.mjs

@@ -107,6 +107,8 @@ export async function runAdapter(callback) {
   }
 }
 
+// Same rule as src/adapters/mobile/bridge-script.ts (unset or empty means the
+// bundled bridge); the library cannot import src/.
 function bridgeScript(input) {
   if (process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT) {
     return process.env.METAMASK_RECIPE_MOBILE_BRIDGE_SCRIPT;
@@ -661,6 +663,24 @@ function routeTransitionProven(previousRoute, currentRoute, expectedRoute, expec
   );
 }
 
+export function inheritedDeadline(input) {
+  const deadline = Number(input.node?.[ACTION_DEADLINE_FIELD]);
+  return Number.isFinite(deadline) ? deadline : null;
+}
+
+export function earliestDeadline(input, deadline) {
+  const inherited = inheritedDeadline(input);
+  return inherited === null ? deadline : Math.min(deadline, inherited);
+}
+
+// The earlier of now + timeoutMs and the calling action's deadline. Route waits
+// use it because past the action deadline bridgeCommand refuses to start
+// get-route (CDP_TIMEOUT): polling on would only retry that refusal and could
+// never see a route that did arrive.
+export function deadlineFromTimeout(input, timeoutMs) {
+  return earliestDeadline(input, Date.now() + Math.max(0, Number(timeoutMs)));
+}
+
 async function waitForNextRouteProbe(deadline) {
   const remaining = deadline - Date.now();
   if (remaining > 0) await sleep(Math.min(250, remaining));
@@ -710,7 +730,7 @@ export async function navigate(input, route, params = {}, expectedRoute) {
 
   while (navigateAttempts < 2 || recoveryPending) {
     if (recoveryPending) {
-      const deadline = recoveryDeadline ?? Date.now() + timeoutMs;
+      const deadline = recoveryDeadline ?? deadlineFromTimeout(input, timeoutMs);
       let currentRoute = null;
       while (Date.now() < deadline) {
         try {
@@ -796,7 +816,7 @@ export async function navigate(input, route, params = {}, expectedRoute) {
       if (!isTargetTransition(error)) throw error;
       lastTransitionError = error;
       transitionCodes.push(error.code);
-      recoveryDeadline = Date.now() + timeoutMs;
+      recoveryDeadline = deadlineFromTimeout(input, timeoutMs);
       recoveryPending = true;
       await waitForNextRouteProbe(recoveryDeadline);
     }
@@ -818,7 +838,8 @@ export async function waitForRoute(
   expectedParams,
 ) {
   const expected = String(expectedRoute);
-  const deadline = Date.now() + timeoutMs;
+  const startedAt = Date.now();
+  const deadline = deadlineFromTimeout(input, timeoutMs);
   // lastRoute is null when bridgeCommand returns null (transient: route not yet
   // settled mid-navigation). Null means "not ready yet" — keep polling.
   let lastRoute = null;
@@ -855,7 +876,7 @@ export async function waitForRoute(
     ? 'empty/undefined (route transiently unavailable — bridge not yet settled)'
     : JSON.stringify(lastRoute);
   const timeoutError = new Error(
-    `Timed out waiting for Mobile route '${expected}' after ${timeoutMs}ms (${pollCount} polls).\n` +
+    `Timed out waiting for Mobile route '${expected}' after ${Date.now() - startedAt}ms (${pollCount} polls; limit ${deadline - startedAt}ms of ${timeoutMs}ms requested).\n` +
     `  Expected route: ${expected}\n` +
     `  Expected params: ${expectedParams === undefined ? 'any' : JSON.stringify(expectedParams)}\n` +
     `  Last parsed route: ${JSON.stringify(lastRoute)}\n` +

package/library/actions/mobile/platform/observe-ui.mjs

@@ -16,6 +16,41 @@ import { mobileToolRecovery, resolveMobileToolPath } from '@farmslot/adapter-rn'
 const execFileAsync = promisify(execFile);
 const VISIBLE_LIMIT = 200;
 const HIDDEN_LIMIT = 100;
+// iOS accessibility exposes React Native Text as StaticText without its testID.
+// Read each mounted Perps Text's testID, string and size (synchronous on Fabric)
+// so the visible native element with the same label and size can carry that
+// testID. Only perps- Texts leave the app: other Text, such as a revealed
+// Secret Recovery Phrase word, never reaches the harness or a trace.
+const TEXT_TEST_ID_LIMIT = 500;
+const IOS_TEXT_TEST_IDS = `(() => {
+  const ui = globalThis.nativeFabricUIManager;
+  const hook = globalThis.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  if (!ui?.measureInWindow || !hook?.getFiberRoots) return { texts: [], total: 0 };
+  const texts = [];
+  const content = (fiber) => {
+    let value = '';
+    for (let child = fiber.child; child; child = child.sibling) {
+      value += typeof child.memoizedProps === 'string' || typeof child.memoizedProps === 'number'
+        ? String(child.memoizedProps) : content(child);
+    }
+    return value;
+  };
+  const visit = (fiber) => {
+    for (; fiber; fiber = fiber.sibling) {
+      const testId = fiber.memoizedProps?.testID;
+      if (fiber.type === 'RCTText' && typeof testId === 'string' && testId.startsWith('perps-') && fiber.stateNode?.node) {
+        let bounds;
+        ui.measureInWindow(fiber.stateNode.node, (x, y, width, height) => { bounds = { x, y, width, height }; });
+        if (bounds) texts.push({ testId, label: content(fiber), bounds });
+      }
+      visit(fiber.child);
+    }
+  };
+  const roots = new Set();
+  for (const id of hook.renderers.keys()) hook.getFiberRoots(id)?.forEach((root) => roots.add(root));
+  roots.forEach((root) => visit(root.current));
+  return { texts: texts.slice(0, ${TEXT_TEST_ID_LIMIT}), total: texts.length };
+})()`;
 
 export async function observeNativeUi(payload, context) {
   await hideAccessibilityMaskingHud(payload, context);
@@ -39,7 +74,26 @@ export async function observeNativeUi(payload, context) {
         warnings.push({ ref: 'ui.screen', message: `Navigation route unavailable: ${error.message}` });
       }
     }
-    const hierarchy = await readNativeHierarchy(payload, context);
+    let textTestIds = [];
+    if (
+      supported.includes('ui.visible') &&
+      resolvePlatform(record(payload?.node), env) === 'ios' &&
+      !isOpaqueRuntime(env) && (env.METRO_PORT || env.WATCHER_PORT)
+    ) {
+      try {
+        const read = await bridgeCommand(routeInput, ['eval', IOS_TEXT_TEST_IDS]);
+        textTestIds = Array.isArray(read?.texts) ? read.texts : [];
+        if (read?.total > textTestIds.length) {
+          warnings.push({
+            ref: 'ui.visible',
+            message: `Text test IDs truncated: read ${textTestIds.length} of ${read.total}.`,
+          });
+        }
+      } catch (error) {
+        warnings.push({ ref: 'ui.visible', message: `Text test IDs unavailable: ${error.message}` });
+      }
+    }
+    const hierarchy = await readNativeHierarchy(payload, context, textTestIds);
     if (routeBefore?.name) {
       const routeAfter = await bridgeCommand(routeInput, ['get-route']);
       if (routeAfter?.name !== routeBefore.name || routeAfter?.key !== routeBefore.key) {
@@ -85,7 +139,7 @@ export async function hideAccessibilityMaskingHud(payload, context) {
   }
 }
 
-async function readNativeHierarchy(payload, context) {
+async function readNativeHierarchy(payload, context, textTestIds) {
   const node = record(payload?.node);
   const env = {
     ...process.env,
@@ -98,13 +152,13 @@ async function readNativeHierarchy(payload, context) {
   const appLabel = nativeAppLabel(env);
   const hierarchy = platform === 'android'
     ? await readAndroidHierarchy(node, env)
-    : await readIosHierarchy(node, env);
+    : await readIosHierarchy(node, env, textTestIds);
   // No screen name and no labelled item: name the screen after the app.
   hierarchy.screen.name ??= appLabel;
   return hierarchy;
 }
 
-async function readIosHierarchy(node, env) {
+async function readIosHierarchy(node, env, textTestIds) {
   const idbPath = resolveMobileToolPath('idb');
   if (!idbPath) {
     throw new Error(
@@ -123,7 +177,7 @@ async function readIosHierarchy(node, env) {
     },
   );
   const parsed = parseJsonOutput(stdout);
-  const hierarchy = flattenIosHierarchy(parsed);
+  const hierarchy = flattenIosHierarchy(parsed, textTestIds);
   if (hierarchy.nodeCount === 0) {
     throw new Error('idb returned an empty accessibility hierarchy.');
   }
@@ -364,7 +418,12 @@ function parseJsonOutput(output) {
   }
 }
 
-function flattenIosHierarchy(value) {
+function flattenIosHierarchy(value, textTestIds = []) {
+  const texts = (Array.isArray(textTestIds) ? textTestIds : []).map((entry) => ({
+    testId: text(entry?.testId),
+    label: text(entry?.label),
+    bounds: normalizeBounds(entry?.bounds),
+  })).filter((entry) => entry.testId && entry.label && entry.bounds);
   const visible = [];
   const hidden = [];
   let nodeCount = 0;
@@ -382,9 +441,10 @@ function flattenIosHierarchy(value) {
       text(item.role_description) ?? text(item.className);
     const label = text(item.label) ?? text(item.AXLabel) ?? text(item.name) ??
       text(item.title);
-    const testId = text(item.identifier) ?? text(item.accessibilityIdentifier) ??
-      text(item.AXUniqueId) ?? text(item.id);
     const bounds = normalizeBounds(item.frame ?? item.AXFrame ?? item.bounds);
+    const testId = text(item.identifier) ?? text(item.accessibilityIdentifier) ??
+      text(item.AXUniqueId) ?? text(item.id) ??
+      (label && hasVisibleBounds(bounds, screenBounds) ? textTestId(texts, label, bounds) : undefined);
     if (isApplicationRole(role)) {
       screenName ??= label;
       screenBounds ??= bounds;
@@ -466,6 +526,17 @@ function parseAndroidHierarchy(output) {
   return { visible, hidden, nodeCount, screenName };
 }
 
+// Bind an exact label and size to one testID. Origins are not compared: Fabric
+// frames omit native screen offsets such as a modal card. A same-text twin with
+// another size (the collapsed header price) or another testID stays unbound.
+function textTestId(texts, label, bounds) {
+  const testIds = new Set(texts
+    .filter((entry) => entry.label === label &&
+      ['width', 'height'].every((key) => Math.abs(entry.bounds[key] - bounds[key]) <= 1))
+    .map((entry) => entry.testId));
+  return testIds.size === 1 ? [...testIds][0] : undefined;
+}
+
 function isApplicationRole(role) {
   return role?.toLowerCase().includes('application') ?? false;
 }

package/library/actions/shared/perps/order-policy.mjs

@@ -123,6 +123,25 @@ export function worstCaseNotionalUsd({ amount, leverage, price, szDecimals, maxS
   return (usd + step * Number(price)) * (1 + Number(maxSlippageBps) / 10_000);
 }
 
+// The lot the controller submits for a market order of `amount` USDC margin (the
+// same rounding as above), in whole size steps, its notional, and the margin one
+// step adds at `price`. Null when the size decimals or price are unknown.
+export function marketOrderLot({ amount, leverage, price, szDecimals }) {
+  const decimals = szDecimals == null || szDecimals === '' ? Number.NaN : Number(szDecimals);
+  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 8 || !(Number(price) > 0)) return null;
+  const multiplier = 10 ** decimals;
+  const usd = Number(amount) * Number(leverage);
+  let lots = Math.round((usd / Number(price)) * multiplier);
+  if ((lots / multiplier) * Number(price) < usd) lots += 1;
+  if (!Number.isSafeInteger(lots) || lots <= 0) return null;
+  return {
+    sizeDecimals: decimals,
+    lots,
+    notionalBaseUnits: `${Math.ceil((lots / multiplier) * Number(price) * 1_000_000)}`,
+    stepMarginBaseUnits: `${Math.ceil((Number(price) / multiplier / Number(leverage)) * 1_000_000)}`,
+  };
+}
+
 // Mainnet only: refuse before dispatch when the size the controller would submit
 // could fill above the house notional limit. Testnet needs no bound.
 export function requireHouseNotional({ network, symbol, amount, leverage, price, szDecimals, maxSlippageBps }) {

package/library/manifests/extension.action-manifest.json

@@ -4465,7 +4465,7 @@
           "identity_rounding_tolerance_base_units": {
             "type": "string",
             "default": "10000",
-            "description": "Maximum visible amount/price rounding delta in six-decimal USDC base units; default 10000 and capped at 1000000."
+            "description": "Maximum visible amount/price rounding delta in six-decimal USDC base units; default 10000 and capped at 1000000. A background market order's margin check adds one venue size step at the current price."
           }
         },
         "additionalProperties": false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.86.0",
+  "version": "0.86.2",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"