@deeeed/metamask-harness 0.87.0 → 0.88.0

package/library/actions/extension/perps/perps.mjs

@@ -33,6 +33,18 @@ import {
 } from '../../shared/perps/order-policy.mjs';
 import { liveAdapterDeadline } from '../../shared/app/live-adapter-deadline.mjs';
 import { withRateLimitRetry } from '../../shared/perps/rate-limit.mjs';
+import {
+  clearMainnetSwitch,
+  dropMainnetOrder,
+  ledgerOrderTargets,
+  markMainnetOrderCancelled,
+  ownedMainnetOrder,
+  recordMainnetSwitch,
+  recordPendingMainnetOrder,
+  recordPlacedMainnetOrder,
+  requireNoOpenMainnetOrders,
+  requirePendingMainnetOrder,
+} from '../../shared/perps/mainnet-order-ledger.mjs';
 import {
   orderIdentityMatches,
   parseOrderCard,
@@ -240,8 +252,13 @@ export async function closePositions(input) {
 }
 
 async function closeOrderThroughBackground(input, page, timeoutMs) {
-  ({ input } = await withFixturePolicyContext(input, page, {
+  // On mainnet the fixture lane cancels only an order this checkout's runs placed.
+  const owned = await ownedMainnetOrder(input.context?.projectRoot, input.node?.order_id);
+  let network;
+  ({ input, network } = await withFixturePolicyContext(input, page, {
     operations: [{ operation: 'perps-cancel-order', amount: String(input.node?.amount ?? '') }],
+    mainnetAllowed: Boolean(owned),
+    mainnetRefusal: 'cancels only orders this run placed',
   }));
   await requirePerpsTradingContext(input, page);
   const symbol = marketSymbol(input);
@@ -335,6 +352,10 @@ async function closeOrderThroughBackground(input, page, timeoutMs) {
       throw new Error('Exact background order did not become absent after cancellation.');
     },
   });
+  // The run's teardown settles it once the market's position is checked too.
+  if (network === 'mainnet' && owned) {
+    await markMainnetOrderCancelled(input.context.projectRoot, owned.id, { via: input.action, canceled: [{ orderId, receipt: mutation.receipt }] });
+  }
   return {
     action: input.action,
     canceled: true,
@@ -886,6 +907,7 @@ async function dispatchBackgroundPlace(page, {
   orderType,
   resolvedPrice,
   symbol,
+  timeInForce = 'GTC',
 }) {
   return page.evaluate(`(async () => {
     const request = globalThis.stateHooks?.submitRequestToBackground;
@@ -902,7 +924,7 @@ async function dispatchBackgroundPlace(page, {
       size: ((Number(usdAmount) * Number(leverage)) / Number(limitPrice)).toString(),
       orderType,
       price: String(limitPrice),
-      timeInForce: 'GTC',
+      timeInForce: ${JSON.stringify(timeInForce)},
       leverage,
       currentPrice,
       priceAtCalculation: currentPrice,
@@ -1306,6 +1328,7 @@ async function verifyNothingPlacedOnVenue(input, page, identity, sinceMs) {
 async function placeOrderThroughBackground(input, page, {
   amount,
   bound = null,
+  mainnetLimit = false,
   onDispatch = () => {},
   expected,
   identity,
@@ -1354,6 +1377,20 @@ async function placeOrderThroughBackground(input, page, {
   // A resume checks the fill against the lot sized at publication, not one
   // recomputed at a price that has since moved.
   const marketLot = existing?.record?.facts?.marketLot ?? expected.marketLot ?? null;
+  const projectRoot = input.context?.projectRoot;
+  // A mainnet limit order is tracked for the run's forced cancel (mainnet-order-ledger.mjs).
+  const ledgerFields = mainnetLimit ? {
+    platform: 'extension',
+    provider: String(input.node?.provider ?? '').toLowerCase(),
+    symbol,
+    side: expected.side,
+    limitPrice,
+    address: bound.address,
+    baselineOrderIds: [...baselineIds],
+    artifactsDir: input.context.artifactsDir,
+    connection: { cdpPort: page.runtimeIdentity?.cdpPort },
+  } : null;
+  let ledgerId = null;
   const mutation = await runGuardedExternalMutation({
     input,
     identity,
@@ -1382,12 +1419,16 @@ async function placeOrderThroughBackground(input, page, {
         );
         await requirePerpsTradingContext(input, page);
         assertTrustedExternalMutationTarget(input, page, identity);
+        // A 429 retry (proven not placed) reuses the pending entry and its pre-order
+        // baseline, unless the run began aborting or its cleanup settled the entry.
+        if (ledgerId) await requirePendingMainnetOrder(projectRoot, ledgerId);
         if (deadline != null && Date.now() >= deadline) {
           throw new Error('it reached the action deadline before dispatch');
         }
       } catch (error) {
         throw externalMutationNotDispatched(error instanceof Error ? error.message : String(error));
       }
+      if (ledgerFields && !ledgerId) ledgerId = await recordPendingMainnetOrder(projectRoot, ledgerFields);
       onDispatch();
       const accepted = await dispatchBackgroundPlace(page, {
         amount,
@@ -1399,8 +1440,11 @@ async function placeOrderThroughBackground(input, page, {
         orderType,
         resolvedPrice,
         symbol,
+        // Post-only on mainnet: the venue rejects a limit that would fill now.
+        timeInForce: mainnetLimit ? 'ALO' : 'GTC',
       });
       if (accepted?.changed) {
+        if (ledgerId) await dropMainnetOrder(projectRoot, ledgerId);
         throw externalMutationNotDispatched('the selected account or Perps network changed after the order rule allowed it');
       }
       // The venue's filled order ID goes into the receipt, so cleanup can prove the
@@ -1425,6 +1469,14 @@ async function placeOrderThroughBackground(input, page, {
       receipt?.acceptance,
     ),
   });
+  const placedOrderId = mutation.observation?.order?.id;
+  if (ledgerFields && placedOrderId) {
+    // A resumed placement dispatched in an earlier attempt: track it if that attempt did not.
+    if (ledgerId) await recordPlacedMainnetOrder(projectRoot, ledgerId, placedOrderId);
+    else if (!(await ownedMainnetOrder(projectRoot, placedOrderId))) {
+      await recordPlacedMainnetOrder(projectRoot, await recordPendingMainnetOrder(projectRoot, ledgerFields), placedOrderId);
+    }
+  }
   return {
     action: input.action,
     market: symbol,
@@ -1786,11 +1838,15 @@ export async function placeOrder(input) {
   // The account and network the order rule allowed, rechecked before any close.
   let bound = null;
   const place = () => withExtensionPage(input, async (page) => {
+    const hasBackgroundRequest = await page.evaluate(
+      `typeof globalThis.stateHooks?.submitRequestToBackground === 'function'`,
+    );
     const lane = await withFixturePolicyContext(input, page, {
       operations: [
         { operation: orderType === 'limit' ? 'perps-limit-order' : 'perps-market-order', amount, order: true },
       ],
-      order: { amount, leverage, orderType, closeImmediately },
+      // Only the background placement tracks a limit order for the run's forced cancel.
+      order: { amount, leverage, orderType, closeImmediately, runCancelsLimit: hasBackgroundRequest && !fromCurrentForm },
     });
     input = lane.input;
     if (lane.network) {
@@ -1856,9 +1912,6 @@ export async function placeOrder(input) {
       } : {}),
       ...(fromCurrentForm && orderType === 'limit' ? { maximumNotionalBaseUnits: placementBudget.maxBaseUnits } : {}),
     };
-    const hasBackgroundRequest = await page.evaluate(
-      `typeof globalThis.stateHooks?.submitRequestToBackground === 'function'`,
-    );
     if (closeImmediately) {
       // The close goes through the background request, so the order must too.
       if (!hasBackgroundRequest) throw new Error('close_immediately needs the background Perps request; it is unavailable.');
@@ -1873,6 +1926,9 @@ export async function placeOrder(input) {
     }
     if (hasBackgroundRequest && !fromCurrentForm) {
       await requirePerpsTradingContext(input, page);
+      if (lane.network === 'mainnet' && (input.node?.current_price ?? input.node?.currentPrice) != null) {
+        throw new Error('Mainnet orders are bounded at the live market price; drop current_price.');
+      }
       const resolvedPrice = await readCurrentMarketPrice(
         page,
         symbol,
@@ -1880,6 +1936,9 @@ export async function placeOrder(input) {
       );
       const szDecimals = lane.network === 'mainnet' || orderType === 'market'
         ? await readSizeDecimals(page, symbol) : null;
+      const backgroundLimitPrice = orderType === 'limit'
+        ? resolveLimitPrice(input, isBuy, resolvedPrice)
+        : null;
       houseNotional = requireHouseNotional({
         network: lane.network,
         symbol,
@@ -1888,14 +1947,13 @@ export async function placeOrder(input) {
         price: resolvedPrice,
         szDecimals,
         maxSlippageBps: Number(input.node?.max_slippage_bps ?? input.node?.maxSlippageBps ?? 300),
+        limit: orderType === 'limit' ? { price: backgroundLimitPrice, isBuy } : null,
       });
       const marketLot = orderType === 'market' ? marketOrderLot({ amount, leverage, price: resolvedPrice, szDecimals }) : null;
-      const backgroundLimitPrice = orderType === 'limit'
-        ? resolveLimitPrice(input, isBuy, resolvedPrice)
-        : null;
       return placeOrderThroughBackground(input, page, {
         amount,
         bound,
+        mainnetLimit: lane.network === 'mainnet' && orderType === 'limit',
         onDispatch: () => {
           dispatchMayHaveHappened = true;
         },
@@ -2550,6 +2608,139 @@ async function ensureNetwork(input, config) {
   return withExtensionPage(input, (page) => assertNetwork(page, config.network));
 }
 
+// metamask.perps.set_network network=<testnet|mainnet> (default testnet): switch
+// the Perps network when it differs; the fixture loads testnet. A switch to
+// mainnet is recorded so the run's teardown switches back to testnet
+// (mainnet-order-ledger.mjs): mainnet lasts one run.
+export async function setNetwork(input) {
+  const network = String(input.node?.network ?? 'testnet').toLowerCase();
+  if (network !== 'testnet' && network !== 'mainnet') throw new Error(`${input.action} network must be testnet or mainnet, got ${JSON.stringify(input.node?.network)}.`);
+  await applyStateNavigation(input, { page: 'home' });
+  return withExtensionPage(input, async (page) => {
+    if (network === 'testnet') {
+      const state = await readPerpsRuntimeState(page);
+      if (state.networkKnown && !state.isTestnet) await requireNoOpenMainnetOrders(input.context.projectRoot, input.action);
+    }
+    // Recorded before the toggle, so an abort mid-switch still switches back.
+    if (network === 'mainnet') {
+      await recordMainnetSwitch(input.context.projectRoot, {
+        platform: 'extension',
+        artifactsDir: input.context.artifactsDir,
+        connection: { cdpPort: page.runtimeIdentity?.cdpPort },
+      });
+    }
+    const switched = await togglePerpsNetwork(page, network, Number(input.node?.timeout_ms ?? 30_000));
+    if (network === 'testnet' && switched.changed) await clearMainnetSwitch(input.context.projectRoot);
+    return { action: input.action, ...switched, proofPath: 'background-perpsToggleTestnet' };
+  });
+}
+
+async function togglePerpsNetwork(page, network, timeoutMs) {
+  const before = await readPerpsRuntimeState(page);
+  if (!before.available || !before.networkKnown) {
+    throw new Error('Cannot verify the current Perps network.\nNext: mm-harness verify');
+  }
+  if ((before.isTestnet ? 'testnet' : 'mainnet') === network) return { requested: network, isTestnet: before.isTestnet, changed: false };
+  await requestBackground(page, 'perpsToggleTestnet', []);
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const after = await readPerpsRuntimeState(page);
+    if (after.networkKnown && (after.isTestnet ? 'testnet' : 'mainnet') === network) {
+      return { requested: network, isTestnet: after.isTestnet, changed: true };
+    }
+    if (Date.now() >= deadline) throw new Error(`Perps network did not switch to ${network} within ${timeoutMs} ms of perpsToggleTestnet.`);
+    await sleep(250);
+  }
+}
+
+function cleanupInput(projectRoot, artifactsDir, cdpPort) {
+  return {
+    action: 'metamask.perps.close_orders',
+    node: { cdp_port: cdpPort },
+    context: { nodeId: 'mainnet-order-cleanup', projectRoot, artifactsDir },
+  };
+}
+
+// The order book fields the mainnet order ledger matches on.
+const LEDGER_ORDER_FIELDS = {
+  idOf: (order) => order?.orderId ?? order?.id,
+  symbolOf: symbolForItem,
+  sideOf: sideForItem,
+  priceOf: (order) => order?.price ?? order?.limitPrice ?? order?.limitPx ?? order?.px,
+};
+
+// The account's open orders and the market's signed position size, from the
+// background requests only: a stream cache can be stale or empty after a
+// reload, which would read as "cancelled".
+async function readAuthoritativeBook(page, symbol) {
+  const orders = await readOpenOrdersState(page);
+  const positions = await page.readPositions();
+  if (orders.source !== 'background-perpsGetOpenOrders' || positions.source !== 'background-perpsGetPositions') {
+    throw new Error(`cannot read the ${symbol} book from the Extension background (got ${orders.source} and ${positions.source})`);
+  }
+  return {
+    orders: orders.orders,
+    positionSize: positions.positions
+      .filter((position) => symbolForItem(position) === symbol)
+      .reduce((total, position) => total + Number(position.size ?? position.szi ?? 0), 0),
+  };
+}
+
+// The run's forced cancel of one mainnet limit order it opened (see
+// mainnet-order-ledger.mjs), from the run's process: on the account that placed
+// it, still on mainnet, cancel it and read the book until it is gone. The read
+// also carries the market's position, which the caller compares with the one
+// before the order (a fill is reported, never closed here).
+export async function cancelMainnetLedgerOrder(entry, { projectRoot }) {
+  const bound = { address: entry.address, network: 'mainnet' };
+  // Only the proof: withExtensionPage adds the page's runtime identity to its result.
+  const { canceled, read } = await withExtensionPage(cleanupInput(projectRoot, entry.artifactsDir, entry.connection?.cdpPort), async (page) => {
+    const guard = await page.evaluate(`(async () => { ${boundContextGuard(bound)} return { changed: false }; })()`, { awaitPromise: true });
+    const runtime = await readPerpsRuntimeState(page);
+    if (guard?.changed || String(runtime.activeProvider ?? '').toLowerCase() !== entry.provider) {
+      throw new Error(`the Extension is not on mainnet ${entry.provider} with the placing account ${entry.address} selected`);
+    }
+    const bookRead = (book, outcome) => ({
+      source: 'background-perpsGetOpenOrders+perpsGetPositions',
+      openOrderIds: book.orders.map((order) => String(LEDGER_ORDER_FIELDS.idOf(order) ?? '')),
+      positionSize: book.positionSize,
+      ...outcome,
+    });
+    const before = await readAuthoritativeBook(page, entry.symbol);
+    const targets = ledgerOrderTargets(entry, before.orders, LEDGER_ORDER_FIELDS);
+    if (targets.length === 0) return { canceled: [], read: bookRead(before, { notOpen: true }) };
+    const canceled = [];
+    for (const order of targets) {
+      const orderId = String(LEDGER_ORDER_FIELDS.idOf(order));
+      const result = await page.evaluate(`(async () => {
+        ${boundContextGuard(bound)}
+        return globalThis.stateHooks.submitRequestToBackground('perpsCancelOrder', [${JSON.stringify({ orderId, symbol: entry.symbol })}]);
+      })()`, { awaitPromise: true });
+      if (result?.changed) throw new Error(`the Extension left mainnet or account ${entry.address} before the cancel`);
+      if (!result || result.success === false) throw new Error(`perpsCancelOrder ${orderId} failed: ${result?.error ?? JSON.stringify(result)}`);
+      canceled.push({ orderId, result });
+    }
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+      const after = await readAuthoritativeBook(page, entry.symbol);
+      const open = after.orders.map((order) => String(LEDGER_ORDER_FIELDS.idOf(order))).filter((id) => canceled.some((item) => item.orderId === id));
+      if (open.length === 0) return { canceled, read: bookRead(after, { absent: true }) };
+      if (Date.now() >= deadline) throw new Error(`order(s) ${open.join(', ')} still open 30 s after the cancel`);
+      await sleep(500);
+    }
+  });
+  return { canceled, read };
+}
+
+// The run's teardown: switch Perps back to the fixture's testnet after a
+// start_state network=mainnet.
+export async function restoreTestnetAfterRun(networkSwitch, { projectRoot }) {
+  return withExtensionPage(
+    cleanupInput(projectRoot, networkSwitch.artifactsDir, networkSwitch.connection?.cdpPort),
+    (page) => togglePerpsNetwork(page, 'testnet', 30_000),
+  );
+}
+
 async function assertReadyToTrade(input, config) {
   if (config.readyToTrade === undefined || config.readyToTrade === false) return { skipped: true };
   return withExtensionPage(input, async (page) => {

package/library/actions/extension/perps/set_network.mjs

@@ -0,0 +1,6 @@
+// Switch the Extension's Perps network (default testnet). A switch to mainnet
+// lasts one run: the run's teardown switches back to testnet.
+import { runAdapter } from '../platform/cdp.mjs';
+import { setNetwork } from './perps.mjs';
+
+runAdapter(setNetwork);

package/library/actions/mobile/perps/perps.mjs

@@ -27,6 +27,16 @@ import {
   requireHouseNotional,
   requirePerpsOrderAllowed,
 } from '../../shared/perps/order-policy.mjs';
+import {
+  dropMainnetOrder,
+  ledgerOrderTargets,
+  markMainnetOrderCancelled,
+  ownedMainnetOrder,
+  readMainnetOrderLedger,
+  recordPendingMainnetOrder,
+  recordPlacedMainnetOrder,
+  requireNoOpenMainnetOrders,
+} from '../../shared/perps/mainnet-order-ledger.mjs';
 import { isRateLimited, rateLimitedError, withRateLimitRetry } from '../../shared/perps/rate-limit.mjs';
 
 function sleep(ms) {
@@ -1354,6 +1364,7 @@ export async function closeOrders(input) {
   if (invalid) {
     throw new Error(`Cannot cancel selected Perps order without orderId and symbol: ${JSON.stringify(invalid)}`);
   }
+  const owned = await mainnetOrdersOwned(input, orders);
   const result = await evalAsync(
     input,
     `(function(){
@@ -1385,10 +1396,105 @@ export async function closeOrders(input) {
   const after = await waitForOrdersAbsent(input, symbols, Number(input.node?.timeout_ms ?? 30000));
   const stillOpen = after.filter((order) => symbols.includes(symbolForItem(order)));
   if (stillOpen.length > 0) throw new Error(`Expected selected Perps orders to cancel, but ${stillOpen.length} are still open.`);
+  // The run's teardown settles them once the market's position is checked too.
+  // Only a cancel the controller accepted: anything else stays for the teardown to cancel.
+  for (const entry of owned ?? []) {
+    const canceled = (result?.results ?? []).filter((item) => item.orderId === entry.orderId && item.success);
+    if (canceled.length > 0) await markMainnetOrderCancelled(input.context.projectRoot, entry.id, { via: input.action, canceled });
+  }
   return { action: input.action, canceled: true, matchingCount: matching.length, symbols, result, proofPath: 'mobile-perps-controller-cancel-order' };
 }
 
-export async function placeOrder(input) {
+// The order book fields the mainnet order ledger matches on.
+const LEDGER_ORDER_FIELDS = {
+  idOf: orderIdForItem,
+  symbolOf: symbolForItem,
+  sideOf: sideForItem,
+  priceOf: (order) => order?.price ?? order?.limitPrice ?? order?.limitPx ?? order?.px,
+};
+
+// The signed size held in a market (0 when flat): a fill changes it.
+function positionSizeIn(positions, symbol) {
+  return positions
+    .filter((position) => symbolForItem(position) === symbol)
+    .reduce((total, position) => total + Number(position.size ?? position.szi ?? 0), 0);
+}
+
+// The run's forced cancel of one mainnet limit order it opened (see
+// mainnet-order-ledger.mjs), from the run's process: on the account that placed
+// it, still on mainnet, cancel it and read the book until it is gone. The read
+// also carries the market's position, which the caller compares with the one
+// before the order (a fill is reported, never closed here).
+export async function cancelMainnetLedgerOrder(entry, { projectRoot, env = {} }) {
+  const input = {
+    action: 'metamask.perps.close_orders',
+    node: { controller_ready_timeout_ms: 15_000 },
+    context: { nodeId: 'mainnet-order-cleanup', projectRoot, artifactsDir: entry.artifactsDir, env: { ...env, ...entry.connection } },
+  };
+  const bound = { address: entry.address, network: 'mainnet' };
+  // The placing provider too: another provider's book would read as empty.
+  const providerGuard = `if (String(Engine.context.PerpsController.state.activeProvider || '').toLowerCase() !== ${sourceLiteral(entry.provider)}) {
+      return Promise.resolve(JSON.stringify({ contextChanged: true }));
+    }`;
+  const readBook = async () => {
+    const book = await evalAsync(input, `(function(){ ${boundContextGuard(bound)} ${providerGuard}
+      var c = Engine.context.PerpsController;
+      return Promise.all([c.getOpenOrders(), c.getPositions()]).then(function(r){ return JSON.stringify({ orders: r[0], positions: r[1] }); }); })()`);
+    if (book?.contextChanged) {
+      throw new Error(`the app is not on mainnet ${entry.provider} with the placing account ${entry.address} selected`);
+    }
+    if (!Array.isArray(book?.orders) || !Array.isArray(book?.positions)) throw new Error('PerpsController returned a non-array book.');
+    return book;
+  };
+  const bookRead = (book, outcome) => ({
+    source: 'PerpsController.getOpenOrders+getPositions',
+    openOrderIds: book.orders.map(orderIdForItem).map(String),
+    positionSize: positionSizeIn(book.positions, entry.symbol),
+    ...outcome,
+  });
+  const before = await readBook();
+  const targets = ledgerOrderTargets(entry, before.orders, LEDGER_ORDER_FIELDS);
+  if (targets.length === 0) return { canceled: [], read: bookRead(before, { notOpen: true }) };
+  const orders = targets.map((order) => ({ orderId: String(orderIdForItem(order)), symbol: entry.symbol }));
+  const canceled = await evalAsync(input, `(function(){ ${boundContextGuard(bound)} ${providerGuard}
+    var c = Engine.context.PerpsController;
+    return Promise.all(${sourceLiteral(orders)}.map(function(o){
+      return c.cancelOrder(o).then(function(r){ return { orderId: o.orderId, success: !r || r.success !== false, result: r }; });
+    })).then(function(r){ return JSON.stringify(r); }); })()`);
+  if (canceled?.contextChanged) throw new Error(`the app left mainnet, ${entry.provider} or account ${entry.address} before the cancel`);
+  if (!Array.isArray(canceled) || canceled.some((item) => !item.success)) throw new Error(`cancelOrder failed: ${JSON.stringify(canceled)}`);
+  const deadline = Date.now() + 30_000;
+  for (;;) {
+    const after = await readBook();
+    const open = after.orders.filter((order) => orders.some((target) => String(orderIdForItem(order)) === target.orderId));
+    if (open.length === 0) return { canceled, read: bookRead(after, { absent: true }) };
+    if (Date.now() >= deadline) throw new Error(`order(s) ${open.map(orderIdForItem).join(', ')} still open 30 s after the cancel: ${JSON.stringify(canceled)}`);
+    await sleep(1000);
+  }
+}
+
+// On mainnet a cancel may only take orders this checkout's runs placed (the
+// mainnet order ledger); anything else is refused before dispatch. Returns the
+// ledger entries on mainnet, null on testnet.
+async function mainnetOrdersOwned(input, orders) {
+  const runtime = await readPerpsRuntimeState(input);
+  if (runtime?.isTestnet !== false) return null;
+  const owned = await Promise.all(orders.map((order) => ownedMainnetOrder(input.context?.projectRoot, order.orderId)));
+  const foreign = orders.filter((_order, index) => !owned[index]);
+  if (foreign.length > 0) {
+    throw Object.assign(
+      new Error(
+        `PERPS_MAINNET_ORDER_REFUSED: ${input.action} on mainnet cancels only orders this run placed; ` +
+          `${foreign.map((order) => `${order.symbol} ${order.orderId}`).join(', ')} ${foreign.length === 1 ? 'is' : 'are'} not. Refused before dispatch.`,
+      ),
+      { code: 'PERPS_MAINNET_ORDER_REFUSED' },
+    );
+  }
+  return owned;
+}
+
+// ensure: an ensure_* action opening state; it never leaves a mainnet limit order.
+export async function placeOrder(input, { ensure = false } = {}) {
   requirePlaceOrderInputs(input);
   const symbol = marketSymbol(input);
   const side = String(input.node.side).toLowerCase();
@@ -1408,17 +1514,27 @@ export async function placeOrder(input) {
     leverage,
     orderType,
     closeImmediately,
+    runCancelsLimit: !ensure,
     projectRoot: input.context?.projectRoot,
     selectedAddress: bound.address,
   });
+  const mainnetLimit = network === 'mainnet' && orderType === 'limit';
+  // A mainnet limit is also bound to the provider it is recorded under.
+  if (mainnetLimit) bound.provider = String(runtime?.activeProvider ?? '').toLowerCase();
   if ((closeImmediately || network === 'mainnet') && input.node?.size != null) {
     throw new Error('close_immediately and mainnet orders are sized from amount; drop size.');
   }
+  if (network === 'mainnet' && hasNodeValue(input, 'current_price', 'currentPrice')) {
+    throw new Error('Mainnet orders are bounded at the live market price; drop current_price.');
+  }
   if (closeImmediately) {
     const book = await readBoundBook(input, bound);
     assertFlatBeforeRoundTrip(book.positions, symbol, symbolForItem, book.orders);
   }
   const currentPrice = await currentPriceForOrder(input, symbol);
+  const limitPrice = orderType === 'limit'
+    ? resolveLimitPrice(input, isBuy, currentPrice)
+    : null;
   const houseNotional = requireHouseNotional({
     network,
     symbol,
@@ -1427,10 +1543,8 @@ export async function placeOrder(input) {
     price: currentPrice,
     szDecimals: network === 'mainnet' ? await readSizeDecimals(input, symbol) : null,
     maxSlippageBps,
+    limit: orderType === 'limit' ? { price: limitPrice, isBuy } : null,
   });
-  const limitPrice = orderType === 'limit'
-    ? resolveLimitPrice(input, isBuy, currentPrice)
-    : null;
   const size = String(
     input.node?.size
       ?? ((Number(amount) * leverage) / (limitPrice ?? currentPrice)),
@@ -1442,7 +1556,8 @@ export async function placeOrder(input) {
       orderType,
       size,
       price: String(limitPrice),
-      timeInForce: 'GTC',
+      // Post-only on mainnet: the venue rejects a limit that would fill now.
+      timeInForce: mainnetLimit ? 'ALO' : 'GTC',
       leverage,
       currentPrice,
       priceAtCalculation: currentPrice,
@@ -1462,6 +1577,21 @@ export async function placeOrder(input) {
   if (await tradingContextChanged(input, bound)) {
     throw new Error('Perps order not dispatched: the selected account or network changed after the order rule allowed it.');
   }
+  // Tracked before dispatch, so the run cancels it even if this action dies.
+  const baseline = mainnetLimit ? await readBoundBook(input, bound) : null;
+  const ledgerId = mainnetLimit
+    ? await recordPendingMainnetOrder(input.context.projectRoot, {
+      platform: 'mobile',
+      provider: bound.provider,
+      symbol,
+      side: isBuy ? 'long' : 'short',
+      limitPrice,
+      address: bound.address,
+      baselineOrderIds: baseline.orders.map(orderIdForItem).filter(Boolean),
+      artifactsDir: input.context.artifactsDir,
+      connection: input.context.env ?? {},
+    })
+    : null;
   let result;
   try {
     result = await evalAsync(input, `(function(){ ${boundContextGuard(bound)}
@@ -1473,28 +1603,31 @@ export async function placeOrder(input) {
       );
     }
     if (result?.success === false || result == null) {
+      const restNote = ledgerId ? "; the run's teardown cancels it if it rests" : '';
       // Mobile keeps no placement receipt, so a 429 is never retried: nothing proves the venue saw no order.
       if (isRateLimited(result?.error)) {
         throw rateLimitedError({
           call: 'PerpsController.placeOrder',
           attempts: 1,
           waitedMs: 0,
-          reason: `no retry, since nothing proves the ${symbol} order was not placed`,
+          reason: `no retry, since nothing proves the ${symbol} order was not placed${restNote}`,
           next: `read the ${symbol} positions and orders, then wait a minute and rerun only if nothing was placed`,
         });
       }
-      throw new Error(`Failed to place ${symbol} ${side}: ${result?.error || JSON.stringify(result)}`);
+      throw new Error(`Failed to place ${symbol} ${side}: ${result?.error || JSON.stringify(result)}${restNote}`);
     }
     if (orderType === 'limit') {
       await waitForSelectedState(input, readOpenOrders, true, Number(input.node?.timeout_ms ?? 30000));
+      if (ledgerId) await recordPlacedMainnetOrder(input.context.projectRoot, ledgerId, await placedMainnetOrderId(input, bound, ledgerId, result));
     } else {
       await waitForPositionPresent(input, symbol, Number(input.node?.timeout_ms ?? 30000));
     }
   } catch (error) {
+    if (ledgerId && error?.knownNotDispatched) await dropMainnetOrder(input.context.projectRoot, ledgerId);
     if (!closeImmediately || error?.knownNotDispatched) throw error;
     throw await closeAfterFailedPlacement(input, symbol, error, bound);
   }
-  const placed = { action: input.action, market: symbol, side, orderType, amount, size, leverage, limitPrice, submitted: true, result, network, policy: policy.lane, ...(houseNotional ? { houseNotional } : {}), proofPath: 'mobile-perps-controller-place-order' };
+  const placed = { action: input.action, market: symbol, side, orderType, amount, size, leverage, limitPrice, submitted: true, result, network, policy: policy.lane, ...(policy.autoCancel ? { autoCancel: policy.autoCancel } : {}), ...(houseNotional ? { houseNotional } : {}), proofPath: 'mobile-perps-controller-place-order' };
   if (!closeImmediately) return placed;
   return { ...placed, roundTrip: await closeOpenedPosition(input, symbol, bound) };
 }
@@ -1524,6 +1657,18 @@ async function closeAfterFailedPlacement(input, symbol, error, bound) {
   return new Error(`${message} close_immediately: ${outcome}.`);
 }
 
+// The venue ID of the mainnet limit order just placed: the controller's answer,
+// else the one new order in its market and side since the pending entry.
+async function placedMainnetOrderId(input, bound, ledgerId, result) {
+  if (result?.orderId != null && String(result.orderId) !== '') return String(result.orderId);
+  const entry = (await readMainnetOrderLedger(input.context.projectRoot)).entries.find((candidate) => candidate.id === ledgerId);
+  const targets = ledgerOrderTargets(entry, (await readBoundBook(input, bound)).orders, LEDGER_ORDER_FIELDS);
+  if (targets.length !== 1) {
+    throw new Error(`Mainnet ${entry.symbol} limit order placed but its ID is unknown (${targets.length} new orders match); the run's teardown cancels it.`);
+  }
+  return String(orderIdForItem(targets[0]));
+}
+
 async function readSizeDecimals(input, symbol) {
   const markets = await evalAsync(
     input,
@@ -1555,7 +1700,9 @@ function boundContextGuard(bound) {
   return `var __account = Engine.context.AccountsController.getSelectedAccount();
     var __address = String((__account && __account.address) || '').toLowerCase();
     var __network = Engine.context.PerpsController.state.isTestnet ? 'testnet' : 'mainnet';
-    if (__address !== ${sourceLiteral(bound.address)} || __network !== ${sourceLiteral(bound.network)}) {
+    var __provider = String(Engine.context.PerpsController.state.activeProvider || '').toLowerCase();
+    if (__address !== ${sourceLiteral(bound.address)} || __network !== ${sourceLiteral(bound.network)}
+      || (${sourceLiteral(bound.provider ?? null)} !== null && __provider !== ${sourceLiteral(bound.provider ?? null)})) {
       return Promise.resolve(JSON.stringify({ success: false, contextChanged: true }));
     }`;
 }
@@ -1654,7 +1801,7 @@ export async function ensurePositions(input) {
   }
   if (state === 'open' || state === 'present') {
     const existing = await readPositions(input);
-    if (selectedItems(input, existing).length === 0) await placeOrder(input);
+    if (selectedItems(input, existing).length === 0) await placeOrder(input, { ensure: true });
     return assertPositions(input, true);
   }
   throw new Error(`metamask.perps.ensure_positions received unsupported state: ${state}`);
@@ -1672,7 +1819,7 @@ export async function ensureOrders(input) {
     const current = await readOpenOrders(input);
     let order = null;
     if (selectedItems(input, current).length === 0) {
-      order = await placeOrder({ ...input, node: { ...input.node, order_type: 'limit' } });
+      order = await placeOrder({ ...input, node: { ...input.node, order_type: 'limit' } }, { ensure: true });
     }
     return { ...(await assertOrders(input, true)), order };
   }
@@ -1921,6 +2068,7 @@ async function ensureNetwork(input, config) {
   if (Boolean(before.isTestnet) === expectedTestnet) {
     return { requested: config.network, isTestnet: before.isTestnet, changed: false };
   }
+  if (expectedTestnet) await requireNoOpenMainnetOrders(input.context?.projectRoot, input.action);
   const result = await evalAsync(input, 'Engine.context.PerpsController.toggleTestnet().then(function(r){return JSON.stringify(r)})');
   const after = await waitForNetworkState(input, expectedTestnet, Number(input.node?.timeout_ms ?? 30000));
   if (Boolean(after.isTestnet) !== expectedTestnet) {

package/library/actions/mobile/perps/place_order.mjs

@@ -1,10 +1,13 @@
-// Submit a Perps order through the Mobile controller and assert a matching open position.
-// With close_immediately the order's position is already closed again, so the market must be flat.
+// Submit a Perps order through the Mobile controller and assert the resulting
+// order (limit) or position (market). With close_immediately the order's
+// position is already closed again, so the market must be flat.
 import { runAdapter } from '../platform/bridge.mjs';
 import { closeImmediatelyRequested } from '../../shared/perps/order-policy.mjs';
-import { assertPositions, placeOrder } from './perps.mjs';
+import { assertOrders, assertPositions, placeOrder } from './perps.mjs';
 runAdapter(async (input) => {
   const order = await placeOrder(input);
-  const assertion = await assertPositions(input, !closeImmediatelyRequested(input.node));
+  const assertion = order.orderType === 'limit'
+    ? await assertOrders(input, true)
+    : await assertPositions(input, !closeImmediatelyRequested(input.node));
   return { ...assertion, submitted: order.submitted === true, order };
 });