@deeeed/metamask-harness 0.87.0 → 0.88.0

package/dist/adapters/perps-mainnet-cleanup.js

@@ -0,0 +1,122 @@
+import {
+  VENUE_ORDER_FIELDS,
+  cleanupOwns,
+  clearMainnetSwitch,
+  ledgerOrderTargets,
+  mainnetOrderLeftOpenError,
+  markRunAborting,
+  readHyperliquidVenue,
+  readMainnetOrderLedger,
+  settleMainnetOrder
+} from "../../library/actions/shared/perps/mainnet-order-ledger.mjs";
+const PENDING_SETTLE_MS = 1e4;
+async function platformPerps(platform) {
+  if (platform === "mobile") return import("../../library/actions/mobile/perps/perps.mjs");
+  if (platform === "extension") return import("../../library/actions/extension/perps/perps.mjs");
+  throw new Error(`no mainnet order cleanup for platform ${platform}`);
+}
+async function currentEntry(projectRoot, id) {
+  return (await readMainnetOrderLedger(projectRoot)).entries.find((entry) => entry.id === id);
+}
+async function venueRead(entry) {
+  const venue = await readHyperliquidVenue(entry.address, entry.symbol);
+  const open = ledgerOrderTargets(entry, venue.openOrders, VENUE_ORDER_FIELDS);
+  return { source: venue.source, open: open.map((order) => order.orderId), positionSize: venue.positionSize };
+}
+async function closeOut(projectRoot, env, via, id) {
+  const deadline = Date.now() + PENDING_SETTLE_MS;
+  for (; ; ) {
+    const entry = await currentEntry(projectRoot, id);
+    if (!entry) return;
+    const cancelInApp = async () => (await platformPerps(entry.platform)).cancelMainnetLedgerOrder(entry, { projectRoot, env });
+    let proof = entry.state === "cancelled" ? { canceled: entry.cancelProof.canceled, read: null } : await cancelInApp();
+    let venue = await venueRead(entry);
+    if (entry.state === "cancelled" && venue.open.length > 0) {
+      proof = await cancelInApp();
+      venue = await venueRead(entry);
+    }
+    for (let wait = 0; venue.open.length > 0 && proof.canceled.length > 0 && wait < 5; wait += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 1e3));
+      venue = await venueRead(entry);
+    }
+    if (venue.open.length > 0) {
+      throw new Error(`the venue still lists order(s) ${venue.open.join(", ")} after the app ${proof.read?.notOpen ? "reported none open" : "cancelled"}`);
+    }
+    if (proof.read?.notOpen && entry.state === "pending" && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 1e3));
+      continue;
+    }
+    const recorded = { via: entry.cancelProof?.via ?? via, canceled: proof.canceled, app: proof.read, venue };
+    const evidencePath = await settleMainnetOrder(projectRoot, entry, recorded);
+    process.stderr.write(
+      `mainnet ${entry.symbol} order ${entry.orderId ?? "(pending)"}: ${proof.canceled.length > 0 ? "cancelled" : "not open"} at run ${via}, gone at the venue; proof in ${evidencePath}
+`
+    );
+    if (venue.positionSize !== Number(entry.baselinePositionSize ?? 0)) {
+      throw new Error(`the ${entry.symbol} position is ${venue.positionSize}, was ${entry.baselinePositionSize ?? 0} before the order: it filled; close that position now`);
+    }
+    return;
+  }
+}
+async function cleanup(projectRoot, env, via) {
+  const ledger = await readMainnetOrderLedger(projectRoot);
+  const failures = [];
+  for (const entry of ledger.entries.filter((record) => cleanupOwns(record, process.pid))) {
+    try {
+      await closeOut(projectRoot, env, via, entry.id);
+    } catch (error) {
+      failures.push({ entry, error });
+    }
+  }
+  if (failures.length > 0) throw mainnetOrderLeftOpenError(failures);
+  if (ledger.networkSwitch && cleanupOwns(ledger.networkSwitch, process.pid)) {
+    const { restoreTestnetAfterRun } = await import("../../library/actions/extension/perps/perps.mjs");
+    await restoreTestnetAfterRun(ledger.networkSwitch, { projectRoot });
+    await clearMainnetSwitch(projectRoot);
+    process.stderr.write(`Perps network switched back to testnet at run ${via}.
+`);
+  }
+}
+let inFlight;
+function cancelRunMainnetOrders(projectRoot, env, via) {
+  inFlight ??= cleanup(projectRoot, env, via).finally(() => {
+    inFlight = void 0;
+  });
+  return inFlight;
+}
+const ABORT_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+async function abortRunMainnetOrders(projectRoot) {
+  await markRunAborting(projectRoot, process.pid);
+  await cancelRunMainnetOrders(projectRoot, process.env, "abort");
+}
+async function withMainnetOrderAbort(projectRoot, run) {
+  let aborting;
+  const remove = () => {
+    for (const signal of ABORT_SIGNALS) process.off(signal, onSignal);
+  };
+  function onSignal(signal) {
+    if (aborting) return;
+    aborting = abortRunMainnetOrders(projectRoot).then(
+      () => void 0,
+      (error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}
+`);
+      }
+    ).then(() => {
+      remove();
+      process.kill(process.pid, signal);
+    });
+  }
+  for (const signal of ABORT_SIGNALS) process.on(signal, onSignal);
+  try {
+    return await run();
+  } finally {
+    if (aborting) await aborting;
+    else remove();
+  }
+}
+export {
+  abortRunMainnetOrders,
+  cancelRunMainnetOrders,
+  withMainnetOrderAbort
+};

package/dist/engine.js

@@ -6,11 +6,15 @@ import {
   fixturePolicyMutationBase,
   fundingOptionsFromCli,
   isFixturePolicyBase,
-  loadTrustedMutationBase
+  loadTrustedMutationBase,
+  validateTrustedMutationPlan
 } from "./funding-execution-context.js";
 import { resolveActionManifest, validateManifest } from "./manifest.js";
 import { LIBRARY_ACTION_NAMESPACE, runnerDir } from "./paths.js";
 import { metaMaskActionExecutionCapabilities } from "./recipe-security.js";
+async function loadEngineMutation({ cli, adapter, ...run }) {
+  return await loadTrustedMutationBase({ ...fundingOptionsFromCli(cli), ...run }) ?? (getAdapterSurface(adapter).actions.trustedMutation === true ? fixturePolicyMutationBase({ artifactsDir: run.artifactsDir, rootRecipe: run.rootRecipe }) : void 0);
+}
 const metaMaskEngine = {
   bundledLibrary: {
     name: "metamask",
@@ -24,12 +28,17 @@ const metaMaskEngine = {
     const { createMetaMaskRunner } = await import("./runner.js");
     return createMetaMaskRunner(adapter, manifest, options);
   },
+  // Preflight checks policy; execution also claims the plan and checks claim conflicts.
   // Funding files from the run's command line, bound to the run's plan. Without
   // them, a platform whose actions take a trusted mutation (the Extension) runs a
   // plan with external mutations in the fixture-policy lane, where each action
   // applies the shared order policy; any other plan runs without one.
   trustedMutation: {
-    load: async ({ cli, adapter, ...run }) => await loadTrustedMutationBase({ ...fundingOptionsFromCli(cli), ...run }) ?? (getAdapterSurface(adapter).actions.trustedMutation === true ? fixturePolicyMutationBase({ artifactsDir: run.artifactsDir, rootRecipe: run.rootRecipe }) : void 0),
+    preflight: async (input, plan) => {
+      const base = await loadEngineMutation(input);
+      if (base) validateTrustedMutationPlan(base, plan);
+    },
+    load: loadEngineMutation,
     // Nothing to bind (undefined): recipe-cli keeps the runner it planned with.
     authorize: async (base, plan) => {
       if (!base) return void 0;

package/dist/funding-execution-context.js

@@ -181,10 +181,9 @@ function fixturePolicyMutationBase(options) {
 function isFixturePolicyBase(base) {
   return base?.proofLane === FIXTURE_POLICY_LANE;
 }
-async function authorizeFixturePolicyPlan(base, plan) {
+async function authorizeFixturePolicyPlan(base, executionPlanSha256) {
   const source = fixturePolicySources.get(base);
   if (!source) throw new Error("Fixture-policy plan authorization requires the runner-created context.");
-  const executionPlanSha256 = normalizeRecipeDigest(plan.digest);
   await mkdir(source.artifactsDir, { recursive: true, mode: 448 });
   const artifactsDir = await realpath(source.artifactsDir);
   const artifactsIdentitySha256 = await directoryIdentity(artifactsDir);
@@ -204,11 +203,9 @@ async function authorizeFixturePolicyPlan(base, plan) {
   });
   return authorized;
 }
-async function authorizeTrustedMutationPlan(base, plan, testIo = {}) {
-  if (isFixturePolicyBase(base)) return authorizeFixturePolicyPlan(base, plan);
-  const source = fundingSources.get(base);
-  if (!source) throw new Error("Funding plan authorization requires the original runner-verified context.");
+function validateTrustedMutationPlan(base, plan) {
   const executionPlanSha256 = normalizeRecipeDigest(plan.digest);
+  if (isFixturePolicyBase(base)) return { executionPlanSha256, operationCounts: [] };
   const nodes = Array.isArray(plan.nodes) ? plan.nodes : [];
   const actual = /* @__PURE__ */ new Map();
   for (const node of nodes) {
@@ -235,9 +232,16 @@ async function authorizeTrustedMutationPlan(base, plan, testIo = {}) {
     }
   }
   if (actual.size === 0) throw new Error("Funding documents require a resolved external-mutation plan.");
+  const operationCounts = [...expected.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([action, count]) => ({ action, count }));
+  return { executionPlanSha256, operationCounts };
+}
+async function authorizeTrustedMutationPlan(base, plan, testIo = {}) {
+  const { executionPlanSha256, operationCounts } = validateTrustedMutationPlan(base, plan);
+  if (isFixturePolicyBase(base)) return authorizeFixturePolicyPlan(base, executionPlanSha256);
+  const source = fundingSources.get(base);
+  if (!source) throw new Error("Funding plan authorization requires the original runner-verified context.");
   await mkdir(source.artifactsDir, { recursive: true, mode: 448 });
   const artifactsIdentitySha256 = await directoryIdentity(source.artifactsDir);
-  const operationCounts = [...expected.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([action, count]) => ({ action, count }));
   const runId = sha256(canonical({
     requestSha256: base.requestSha256,
     preflightSha256: base.preflightSha256,
@@ -1529,5 +1533,6 @@ export {
   selectedIdentityFromWalletImport,
   serializeTrustedMutationContext,
   trustedMutationContextExtras,
-  trustedMutationForAction
+  trustedMutationForAction,
+  validateTrustedMutationPlan
 };

package/dist/host.js

@@ -3,7 +3,7 @@ import { fileURLToPath } from "node:url";
 import { configureHarnessAdapters, configureHarnessHost } from "@farmslot/recipe-cli/harness";
 import { adapterRegistry } from "./adapters/registry.js";
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-configureHarnessHost({
+const providerHost = {
   name: "mm-harness",
   product: "MetaMask",
   envPrefix: "MM_HARNESS",
@@ -28,5 +28,9 @@ configureHarnessHost({
     "stop",
     "verify"
   ]
-});
+};
+configureHarnessHost(providerHost);
 configureHarnessAdapters(adapterRegistry);
+export {
+  providerHost
+};

package/dist/index.js

@@ -1,4 +1,5 @@
 import "./host.js";
+import { createProvider, providerHost } from "./provider.js";
 import { createDoctorReport } from "./doctor.js";
 import { loadActionManifest, validateManifest } from "./manifest.js";
 import { createMetaMaskExtensionRunner, createMetaMaskMobileRunner, createMetaMaskRunner } from "./runner.js";
@@ -13,10 +14,12 @@ export {
   createMetaMaskExtensionRunner,
   createMetaMaskMobileRunner,
   createMetaMaskRunner,
+  createProvider,
   extensionIdPath,
   importRecipeHarnessRuntimeBrowserExtension,
   importRecipeHarnessRuntimeCdp,
   loadActionManifest,
+  providerHost,
   validateManifest,
   walletFixturePath
 };

package/dist/mm-harness-cli.js

@@ -22,6 +22,7 @@ import {
 } from "@farmslot/recipe-cli/harness";
 import { stopProjectCollector } from "../library/actions/shared/analytics/collector.mjs";
 import { adoptPluginAdapter, afterAdapterLoad, configuredLibrarySources } from "./adapters/plugin-surface.js";
+import { withMainnetOrderAbort } from "./adapters/perps-mainnet-cleanup.js";
 import { adapterRegistry } from "./adapters/registry.js";
 import {
   explainMissingAdapterLibrary,
@@ -155,8 +156,9 @@ const PUBLIC_RUN = {
   "execution-template": { run: handleExecutionTemplate },
   actions: { run: (args) => handleActions(parseArgs(args), { catalog: metaMaskEngine }) },
   stop: { run: (args) => handleStop(args, stopOptions) },
-  call: { run: (args) => handleCall(args, callOptions) },
-  run: { run: (args) => handleRun(args, runOptions) },
+  // A signal during run or call still cancels the run's mainnet orders.
+  call: { run: (args) => withMainnetOrderAbort(targetPath(parseArgs(args).options), () => handleCall(args, callOptions)) },
+  run: { run: (args) => withMainnetOrderAbort(targetPath(parseArgs(args).options), () => handleRun(args, runOptions)) },
   last: { run: (args) => handleLast(parseArgs(args)) },
   doctor: { run: (args) => handleDoctor(parseArgs(args)) },
   check: { run: handleCheck },

package/dist/provider.js

@@ -0,0 +1,72 @@
+import "./adapters/surface.js";
+import {
+  configureHarnessAdapters,
+  adapterForPlatform,
+  applyRuntimeDirOption,
+  configureHarnessHost,
+  ensureAdapterLoaded,
+  optionFlag,
+  optionStrings,
+  usageError
+} from "@farmslot/recipe-cli/harness";
+import { MAINNET_RUN_OWNER_ENV } from "../library/actions/shared/perps/mainnet-order-ledger.mjs";
+import { adoptPluginAdapter, afterAdapterLoad, configuredLibrarySources, operatorLibraryEnv } from "./adapters/plugin-surface.js";
+import { abortRunMainnetOrders, cancelRunMainnetOrders } from "./adapters/perps-mainnet-cleanup.js";
+import { adapterRegistry } from "./adapters/registry.js";
+import { getAdapterSurface } from "./adapters/surface.js";
+import { applyDeviceTargeting } from "./commands/device-target.js";
+import { metaMaskEngine } from "./engine.js";
+import { providerHost } from "./host.js";
+import { providerHost as providerHost2 } from "./host.js";
+async function createProvider(context) {
+  configureHarnessHost(context.host ?? providerHost);
+  configureHarnessAdapters(adapterRegistry);
+  const selection = context.adapter?.value;
+  if (!selection) throw usageError("The MetaMask provider requires a resolved adapter.");
+  const adapter = adapterForPlatform(selection) ?? selection;
+  const options = {
+    ...context.options,
+    ...!context.options?.platform && (selection === "ios" || selection === "android") ? { platform: selection } : {}
+  };
+  await ensureAdapterLoaded(adapter, {
+    libraries: optionStrings(options, "library"),
+    configured: context.libraries ?? configuredLibrarySources(),
+    env: operatorLibraryEnv(),
+    adopt: adoptPluginAdapter
+  });
+  await afterAdapterLoad();
+  const runtime = getAdapterSurface(adapter);
+  const executes = (context.command === "run" || context.command === "call") && !["plan", "list", "describe", "help"].some((flag) => optionFlag(options, flag));
+  if (executes) {
+    applyRuntimeDirOption(options);
+    runtime.resolveSlotPorts(context.target.value);
+    const selected = applyDeviceTargeting(context.command, adapter, {
+      ...options,
+      target: context.target.value
+    }, { gate: true, rerun: "" });
+    if (selected.ok === false) throw Object.assign(usageError(selected.message), { code: selected.code, userAction: selected.userAction });
+  }
+  const previousOwner = process.env[MAINNET_RUN_OWNER_ENV];
+  if (executes) process.env[MAINNET_RUN_OWNER_ENV] = String(process.pid);
+  return {
+    runtime,
+    engine: metaMaskEngine,
+    ...executes ? {
+      async cancel() {
+        await abortRunMainnetOrders(context.target.value);
+      },
+      async finalize() {
+        try {
+          await cancelRunMainnetOrders(context.target.value, process.env, "teardown");
+        } finally {
+          if (previousOwner === void 0) delete process.env[MAINNET_RUN_OWNER_ENV];
+          else process.env[MAINNET_RUN_OWNER_ENV] = previousOwner;
+        }
+      }
+    } : {}
+  };
+}
+export {
+  createProvider,
+  providerHost2 as providerHost
+};

package/dist/recipe-security.js

@@ -76,6 +76,7 @@ const APP_MUTATION_CUSTOM_ACTIONS = /* @__PURE__ */ new Set([
   "metamask.perps.open_balance_action",
   "metamask.perps.assert_visible_consistency",
   "metamask.perps.start_state",
+  "metamask.perps.set_network",
   "metamask.perps.teardown_state",
   // Consent changes wallet state and is therefore an app mutation.
   "metamask.analytics.set_consent",

package/docs/CONTRIBUTING.md

@@ -199,6 +199,13 @@ when packed, so `agent-runtime` and `adapter-rn` can retain older copies until
 republished. Verify the complete install with
 `bash tests/contract/packaging-dist-install.test.sh` before releasing the harness.
 
+`yarn install` hardlinks every `node_modules` file to Yarn's store
+(`~/.yarn/berry/store`), shared by all worktrees. Never edit an installed
+dependency in place: a write into an existing file reaches the store and every
+other worktree, and a reinstall does not undo it. Use `yarn dev:link-farmslot`
+for local Farmslot builds. To repair a package, remove `node_modules/<package>`
+in one worktree and run `yarn install`.
+
 Docs describe only current behavior. History belongs in the changelog and Git;
 do not add handovers, audits, speculative roadmaps, or duplicate command guides
 under `docs/`.

package/docs/RECIPES.md

@@ -261,12 +261,34 @@ Perps orders follow one rule on Mobile, Extension and Core
 (`library/actions/shared/perps/order-policy.mjs`), checked before dispatch:
 
 - Testnet: allowed with no funding proof.
-- Mainnet: only from a synced fixture account (`wallet-fixture.json`), as a 1x
-  isolated market order with `close_immediately: true`, and the node must
-  declare `network: mainnet`. The $15 limit bounds the size the controller would
-  submit: (amount + one size step × price) × (1 + max slippage). Anything else
-  is refused with `PERPS_MAINNET_ORDER_REFUSED`, naming each broken limit, and
-  no order is sent.
+- Mainnet: only from a synced fixture account (`wallet-fixture.json`), 1x
+  isolated, and the node must declare `network: mainnet`. Either a market order
+  with `close_immediately: true`, where the $15 limit bounds the size the
+  controller would submit: (amount + one size step × price) × (1 + max
+  slippage); or, on Mobile and Extension `place_order`, a `dev1` Hyperliquid
+  limit order away from the live market price, sent post-only and bounded at its limit
+  price: amount + one size step × limit price. Mainnet orders take no
+  `current_price`. Anything else is refused with `PERPS_MAINNET_ORDER_REFUSED`,
+  naming each broken limit, and no order is sent: more than 1x or $15, a limit
+  that would fill now, another account, Core, and `ensure_orders` or
+  `ensure_positions` opening state.
+- A mainnet limit order lasts one run. It is tracked before dispatch in
+  `temp/recipe/runtime/perps-mainnet-orders.json`, and the run cancels whatever
+  is still open when it ends (success, failure, or abort by signal; after a
+  kill, the next run on the checkout). The order counts as gone only when the
+  Hyperliquid API, read for the placing address, no longer lists it. Each
+  order's ID, cancel result and both reads (app and venue) land in
+  `<artifacts>/perps-mainnet-orders.json`. An order
+  that cannot be proven cancelled, or that filled (the market's position moved),
+  fails the run with `PERPS_MAINNET_ORDER_LEFT_OPEN`; a fill is reported, never
+  closed for you. On mainnet, `close_orders` cancels only orders the run placed,
+  and leaving mainnet while the run holds one is refused
+  (`PERPS_MAINNET_ORDER_OPEN`).
+- Switching to mainnet: Mobile `metamask.perps.start_state network=mainnet`;
+  Extension `metamask.perps.set_network network=mainnet`, which the run switches
+  back to testnet at its end (the fixture loads testnet). Mobile stays on
+  mainnet after the run: switch back with `start_state network=testnet` once
+  the run's orders are settled.
 - `close_immediately: true` needs a market order from a flat market: no
   position and no resting order in it. Positions are netted per market, so the
   close takes the market's whole position; don't share a fixture account's
@@ -342,9 +364,11 @@ rather than refuse. Extension `ensure_*` and `teardown_state` only assert, so
 converge there through an explicitly funded leaf action. Never broaden cleanup
 onto an account or market the task does not own; obtain an owned one instead
 of blocking. On mainnet, orders follow the Perps order rule above, Core needs
-`CORE_PERPS_ALLOW_MAINNET_WRITES=1` for any write, Mobile cleanup acts on
-whatever network the app is on, and Extension refuses mainnet writes other than
-orders and `close_visible_position` in the fixture-policy lane.
+`CORE_PERPS_ALLOW_MAINNET_WRITES=1` for any write, Mobile `close_positions`
+acts on whatever network the app is on, `close_orders` there cancels only the
+run's own orders, and Extension refuses mainnet writes other than orders,
+`close_visible_position` and cancelling the run's own orders in the
+fixture-policy lane.
 
 ### Mobile advanced-order setup
 
@@ -445,10 +469,11 @@ A recording that fails fails the run: the `record.video` trace entry starts
 with `RECORDING_FAILED` or `RECORDER_INTERRUPTED`, names the cause, and says the
 run has no video. When capture stopped mid-run but a finalized partial file was
 kept (capture-helper 0.3.1's `stream_interrupted`, or the screenrecord files
-finished before a failure), the video is published and its manifest entry's
-`recorder.interrupted` gives the code, the cause and the video time up to the
-last captured frame (`coveredMs`). `mm-harness doctor` shows the recorder for
-the selected device and is not ready while it cannot record.
+finished before a failure), the video is published, its manifest entry's
+`interruption` gives the frames, the video time up to the last captured frame
+(`mediaTimeMs`) and the cause, and the run fails as `CAPTURE_INTERRUPTED`, a
+capture (environment) failure, not a product one. `mm-harness doctor` shows the
+recorder for the selected device and is not ready while it cannot record.
 
 ### Mobile setup and command budgets
 

package/docs/RELEASE-QA-CAPABILITY-MAP.md

@@ -63,7 +63,11 @@ outside the declared root, incomplete run directories, and any non-empty
 
 Supported verdicts are `PASS`, `FAIL`, `BLOCKED_FUNDS`, `BLOCKED_COST`, and
 `BLOCKED_ENVIRONMENT`. Product failures must remain failures; infrastructure,
-funding, and cost limits must not be reported as passes.
+funding, and cost limits must not be reported as passes. If every run cited by a
+case failed only on `CAPTURE_INTERRUPTED`, the gate requires `BLOCKED_ENVIRONMENT`
+with "evidence incomplete (capture interrupted)" in its summary and the partial
+video in its run directory. Retain interrupted attempts alongside the retry's
+evidence. A passing retry can be `PASS`; a product-failing retry remains `FAIL`.
 
 ## Capability matrix
 

package/docs/cli-contract.md

@@ -146,7 +146,7 @@ The goldens need the harness to be a git checkout: `execution-provenance.json` `
 2. UUIDs become `<UUID>`. Git object ids (40 hex, or a short hex value under a `*head`/`*gitRef`/`*commit` key) become `<GIT_REF>`. ISO-8601 timestamps become `<TIMESTAMP>`, and compact stamps in names `<STAMP>`. Path-derived slot ids `local-<adapter>-<8 hex>` become `local-<adapter>-<HASH>`.
 3. The package version becomes `<HARNESS_VERSION>`. Any other `x.y.z` under a key ending in `version` becomes `<VERSION>`.
 4. Numbers under volatile keys: `*pid` becomes `<PID>`, `inode` `<INODE>`, `*port` `<PORT>`, `*At`/`*Time`/`*timestamp`/`mtime*` `<TIMESTAMP>`, and `*Ms`/`duration*`/`elapsed*` `<DURATION>`. Values inside `schema` and `examples` subtrees (static manifest content) are never rewritten.
-5. `invocationDigest` becomes `<DIGEST>`: it hashes `recipe-invocation.json`, which carries sandbox paths and timestamps and is frozen itself in normalised form. `runner.sourceFingerprint` becomes `<FINGERPRINT>`: it hashes the harness source tree, so any harness edit changes it. A `status` holding `git status --porcelain` output (provenance `runner.status` and `libraries[].status`, empty when clean) becomes `<GIT_STATUS>`. A loaded adapter plugin's code digest in doctor's `adapter-plugin:<id>` message becomes `sha256:<PLUGIN_DIGEST>`: it hashes the recipe library's plugin files, so any library edit changes it. Content-only digests (recipe and dependency digests) stay frozen.
+5. `invocationDigest` becomes `<DIGEST>`: it hashes `recipe-invocation.json`, which carries sandbox paths and timestamps and is frozen itself in normalised form. `runner.sourceFingerprint` becomes `<FINGERPRINT>`: it hashes the harness source tree, so any harness edit changes it. A `status` holding `git status --porcelain` output (provenance `runner.status` and `libraries[].status`, empty when clean) becomes `<GIT_STATUS>`. A loaded adapter plugin's code digest in doctor's `adapter-plugin:<id>` message becomes `sha256:<PLUGIN_DIGEST>`: it hashes the recipe library's plugin files, so any library edit changes it. Within `executionPlan`, SHA-256 `digest` and `executionContextDigest` values become `sha256:<DIGEST>` because plans bind sandbox paths, environment and loaded source bytes. `schema` and `examples` remain exempt. Other content-only digests (recipe and dependency digests) stay frozen.
 6. Durations in text (`0.3s`, `123ms`) become `<DURATION>`.
 
 In tree listings, files whose names differ only by a volatile token collapse into one row: a count and the union of their key shapes, or the sorted list of their values in a value tree.

package/library/actions/extension/perps/mutation-receipt.mjs

@@ -228,8 +228,9 @@ export function inFixturePolicyLane(input) {
  *   non-order mutation (allowed on testnet; on mainnet only a close from a fixture account).
  * @returns {{ input, network, policy }} input with the completed context.
  */
-export async function withFixturePolicyContext(input, page, { operations, order = null, mainnetAllowed = false }) {
-  // mainnetAllowed: a non-order mutation (a close) a fixture account may run on mainnet.
+export async function withFixturePolicyContext(input, page, { operations, order = null, mainnetAllowed = false, mainnetRefusal = null }) {
+  // mainnetAllowed: a non-order mutation (a close, or a cancel of an order this
+  // run placed) a fixture account may run on mainnet; mainnetRefusal says why not.
   if (!inFixturePolicyLane(input)) return { input, network: null, policy: null };
   const state = await page.evaluate(readPerpsRuntimeStateExpression());
   if (!state?.available || !state?.networkKnown) {
@@ -246,7 +247,7 @@ export async function withFixturePolicyContext(input, page, { operations, order
   if (!order && network === 'mainnet'
     && (!mainnetAllowed || !(await isFixtureAccount(projectRoot, address)))) {
     throw Object.assign(
-      new Error(`PERPS_MAINNET_ORDER_REFUSED: ${input.action} on mainnet needs the funding-file release lane${mainnetAllowed ? ' or a synced test account' : ''}; refused before dispatch.`),
+      new Error(`PERPS_MAINNET_ORDER_REFUSED: ${input.action} on mainnet ${mainnetRefusal && !mainnetAllowed ? `${mainnetRefusal} without funding files` : `needs the funding-file release lane${mainnetAllowed ? ' or a synced test account' : ''}`}; refused before dispatch.`),
       { code: 'PERPS_MAINNET_ORDER_REFUSED' },
     );
   }