@metamask-previews/perps-controller 22.0.0-preview-35f016caa → 22.1.0-preview-01e391e

package/dist/providers/HyperLiquidProvider.js

@@ -791,6 +791,9 @@ export class HyperLiquidProvider {
     // Session cache for referral state (cleared on disconnect/reconnect)
     // Key: `network:userAddress`, Value: true if referral is set
     #referralCheckCache = new Map();
+    // Session-scoped, account/network-keyed support probes. Provider instances
+    // are discarded on reconnect; rejected probes are not retained.
+    #accountSupportByContext = new Map();
     // Session cache for builder fee approval state (cleared on disconnect/reconnect)
     // Key: `network:userAddress`, Value: true if builder fee is approved
     #builderFeeCheckCache = new Map();
@@ -1736,19 +1739,21 @@ export class HyperLiquidProvider {
      * multi-sig account with `ApiRequestError: Multi-sig required`, so the
      * unified-account migration must not be attempted for those accounts.
      *
-     * If the probe throws (transient network), returns `false` — fail open so
-     * one bad probe never blocks migration for a normal single-signer account.
+     * If the probe throws (transient network), returns `undefined` so callers
+     * can fail open without caching the transient result.
      * The `isHyperLiquidMultiSigRequiredError` fallback in the write's catch
      * block remains the safety net.
      *
      * @param userAddress - The wallet address to check.
      * @param infoClient - Optional captured reader for an operation-scoped probe.
-     * @returns True only when Hyperliquid reports a multi-sig signer set.
+     * @returns True for multi-sig, false for single-signer, or undefined when
+     * the probe could not complete.
      * @private
      */
-    async #isHyperliquidMultiSigAccount(userAddress, infoClient = this.#clientService.getInfoClient()) {
+    async #isHyperliquidMultiSigAccount(userAddress, infoClient) {
         try {
-            const signers = await infoClient.userToMultiSigSigners({
+            const reader = infoClient ?? this.#clientService.getInfoClient();
+            const signers = await reader.userToMultiSigSigners({
                 user: userAddress,
             });
             return signers !== null && signers !== undefined;
@@ -1758,8 +1763,176 @@ export class HyperLiquidProvider {
                 user: userAddress,
                 error: ensureError(error, 'HyperLiquidProvider.isHyperliquidMultiSigAccount').message,
             });
+            return undefined;
+        }
+    }
+    #getAccountSupportCacheKey(network, userAddress) {
+        return `${network}:${userAddress.toLowerCase()}`;
+    }
+    #recordAccountSupport(network, userAddress, support) {
+        this.#accountSupportByContext.set(this.#getAccountSupportCacheKey(network, userAddress), Promise.resolve(support));
+    }
+    /**
+     * Replace an optimistic support result after the venue authoritatively
+     * rejects a write from the account that supplied its signature.
+     *
+     * The captured context, rather than the currently selected account, owns the
+     * rejection because selection may change while the request is in flight.
+     *
+     * @param error - The failed write or mapped account-mode error.
+     * @param accountContext - Account and network that authorized the write.
+     * @returns Whether the rejection requires Hyperliquid multi-signature.
+     */
+    #recordUnsupportedAccountFromError(error, accountContext) {
+        const isMultiSigRequired = isHyperLiquidMultiSigRequiredError(error) ||
+            ensureError(error, 'HyperLiquidProvider.recordUnsupportedAccountFromError').message === PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED;
+        if (!isMultiSigRequired) {
             return false;
         }
+        this.#recordAccountSupport(accountContext.network, accountContext.userAddress, {
+            isSupported: false,
+            reason: 'multi_sig_account',
+        });
+        return true;
+    }
+    /**
+     * Correct support from errors returned as resolved per-entry statuses.
+     *
+     * @param statuses - Venue status entries.
+     * @param answer - Full venue answer that owns the statuses.
+     * @param accountContext - Account and network that authorized the write.
+     * @returns Whether any status requires Hyperliquid multi-signature.
+     */
+    #recordUnsupportedAccountFromStatuses(statuses, answer, accountContext) {
+        return statuses.some((status) => isStatusObject(status) &&
+            typeof status.error === 'string' &&
+            this.#recordUnsupportedAccountFromError(createStatusError(status.error, answer), accountContext));
+    }
+    /**
+     * Read support for an account context without initializing the provider.
+     * Successful results are stable for the provider session and coalesced by
+     * account and network. Failed probes fail open and remain retryable.
+     *
+     * @param context - An operation-scoped account context. Defaults to the
+     * currently active account and network.
+     * @returns Whether the account can submit Hyperliquid actions.
+     */
+    async #getAccountSupportForContext(context) {
+        const userAddress = context?.userAddress ??
+            (await this.#walletService.getUserAddressWithDefault());
+        const network = context?.network ??
+            (this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet');
+        const cacheKey = this.#getAccountSupportCacheKey(network, userAddress);
+        const cachedSupport = this.#accountSupportByContext.get(cacheKey);
+        if (cachedSupport) {
+            return cachedSupport;
+        }
+        const probe = this.#isHyperliquidMultiSigAccount(userAddress, context?.infoClient);
+        const support = probe.then((isMultiSig) => isMultiSig
+            ? { isSupported: false, reason: 'multi_sig_account' }
+            : { isSupported: true }, () => ({ isSupported: true }));
+        this.#accountSupportByContext.set(cacheKey, support);
+        probe
+            .then((isMultiSig) => {
+            if (isMultiSig === undefined &&
+                this.#accountSupportByContext.get(cacheKey) === support) {
+                this.#accountSupportByContext.delete(cacheKey);
+            }
+        }, () => {
+            if (this.#accountSupportByContext.get(cacheKey) === support) {
+                this.#accountSupportByContext.delete(cacheKey);
+            }
+        })
+            .catch(() => undefined);
+        return support;
+    }
+    async #assertAccountContextCurrent(context, operation) {
+        this.#assertProviderLifecycleCurrent(context.lifecycleGeneration, operation);
+        await this.#assertAccountIdentityCurrent(context);
+        this.#assertProviderLifecycleCurrent(context.lifecycleGeneration, operation);
+    }
+    /**
+     * Confirm that the selected address and network still match an action,
+     * without requiring the provider lifecycle that created it to remain active.
+     *
+     * @param context - The account and network captured by the action.
+     */
+    async #assertAccountIdentityCurrent(context) {
+        const currentAddress = await this.#walletService
+            .getUserAddressWithDefault()
+            .catch(() => undefined);
+        const currentNetwork = this.#clientService.isTestnetMode()
+            ? 'testnet'
+            : 'mainnet';
+        if (currentAddress?.toLowerCase() !== context.userAddress.toLowerCase() ||
+            currentNetwork !== context.network) {
+            throw new Error(PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE);
+        }
+    }
+    /**
+     * Permit best-effort rollback after teardown only while it still belongs to
+     * the same address and network, and the account is not known unsupported.
+     *
+     * @param context - The account and network captured by the parent action.
+     */
+    async #assertRollbackAccountWritable(context) {
+        await this.#assertAccountIdentityCurrent(context);
+        const cachedSupport = this.#accountSupportByContext.get(this.#getAccountSupportCacheKey(context.network, context.userAddress));
+        const support = cachedSupport ? await cachedSupport : undefined;
+        await this.#assertAccountIdentityCurrent(context);
+        if (support && !support.isSupported) {
+            throw new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED);
+        }
+    }
+    /**
+     * Block an action when another step has authoritatively corrected support
+     * for its captured account. A missing cache entry remains fail-open: this
+     * fence must not turn a transient probe failure into another network probe.
+     *
+     * @param context - The account, network, and lifecycle captured by the action.
+     * @param operation - Operation name included in lifecycle diagnostics.
+     */
+    async #assertNoKnownUnsupportedAccount(context, operation) {
+        await this.#assertAccountContextCurrent(context, operation);
+        const cachedSupport = this.#accountSupportByContext.get(this.#getAccountSupportCacheKey(context.network, context.userAddress));
+        const support = cachedSupport ? await cachedSupport : undefined;
+        await this.#assertAccountContextCurrent(context, operation);
+        if (support && !support.isSupported) {
+            throw new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED);
+        }
+    }
+    /**
+     * Create an operation-local exchange client that revalidates its captured
+     * account after signing and immediately before transport dispatch.
+     *
+     * @param context - Account, network, and lifecycle authorized for the write.
+     * @param operation - Operation name included in lifecycle diagnostics.
+     * @returns An exchange client fenced to the captured account context.
+     */
+    #getAccountGuardedExchangeClient(context, operation) {
+        return this.#clientService.getExchangeClient(async () => await this.#assertNoKnownUnsupportedAccount(context, operation));
+    }
+    /**
+     * Stop an action before signing when Hyperliquid reports a native multi-sig
+     * signer set for the active account.
+     *
+     * @param expectedContext - Existing operation context to validate, or omit
+     * to capture the currently selected account and network.
+     * @returns The account context whose support was checked.
+     */
+    async #assertAccountSupported(expectedContext) {
+        const context = expectedContext ??
+            {
+                lifecycleGeneration: this.#lifecycleGeneration,
+                network: this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet',
+                userAddress: await this.#walletService.getUserAddressWithDefault(),
+            };
+        const support = await this.#getAccountSupportForContext(context);
+        await this.#assertAccountContextCurrent(context, 'Account support check');
+        if (!support.isSupported) {
+            throw new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED);
+        }
+        return context;
     }
     /**
      * Attempt to enable HyperLiquid Unified Account mode for HIP-3 orders
@@ -1772,6 +1945,8 @@ export class HyperLiquidProvider {
      *
      * @param options - Optional configuration.
      * @param options.allowUserSigning - When true, runs the migration for `default` / `disabled` accounts. Defaults to false so init does not surface a signing prompt; action-time entry points (trading, withdraw) pass true.
+     * @param options.accountContext - Account/network/lifecycle captured by the
+     * action that is allowed to authorize the migration.
      * @private
      */
     async #ensureUnifiedAccountEnabled(options) {
@@ -1790,8 +1965,11 @@ export class HyperLiquidProvider {
         if (!this.#useUnifiedAccount) {
             return; // Feature disabled
         }
-        const userAddress = await this.#walletService.getUserAddressWithDefault();
-        const network = this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet';
+        const { accountContext } = options ?? {};
+        const userAddress = accountContext?.userAddress ??
+            (await this.#walletService.getUserAddressWithDefault());
+        const network = accountContext?.network ??
+            (this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet');
         // Check global cache first to avoid repeated signing requests
         // This is CRITICAL for hardware wallets to prevent repeated signing prompts
         // while browsing.
@@ -1859,6 +2037,9 @@ export class HyperLiquidProvider {
             currentMode = await infoClient.userAbstraction({
                 user: userAddress,
             });
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Unified account mode lookup');
+            }
             if (currentMode === 'unifiedAccount' ||
                 currentMode === 'portfolioMargin') {
                 // portfolioMargin is a superset of unifiedAccount — it already supports
@@ -1902,17 +2083,21 @@ export class HyperLiquidProvider {
             // surfaced on the Perps tab on every entry (TAT-3214). Probe right
             // before the write so accounts that never reach one (already compatible,
             // deferred, unknown mode) do not pay the extra round trip.
-            const isMultiSig = await this.#isHyperliquidMultiSigAccount(userAddress);
-            if (isMultiSig) {
+            const accountSupport = await this.#getAccountSupportForContext({
+                userAddress,
+                network,
+                infoClient,
+            });
+            if (!accountSupport.isSupported) {
                 this.#deps.debugLogger.log('[ensureUnifiedAccountEnabled] Multi-sig account, skipping unified account migration', { user: userAddress, network, mode: currentMode });
                 this.#deps.metrics.trackPerpsEvent(PerpsAnalyticsEvent.AccountSetup, {
                     [PERPS_EVENT_PROPERTY.PREVIOUS_ABSTRACTION_MODE]: currentMode,
                     [PERPS_EVENT_PROPERTY.STATUS]: PERPS_EVENT_VALUE.STATUS.NOT_APPLICABLE,
                     [PERPS_EVENT_PROPERTY.ERROR_MESSAGE]: 'multi_sig_account',
                 });
-                // Final state: the write can never succeed for this account, so cache
-                // it as attempted with unified mode off. Perps keeps working through
-                // the programmatic collateral-transfer fallback.
+                // Final state: the migration can never succeed for this account, so
+                // cache it as attempted with unified mode off. Action readiness blocks
+                // this account before any later exchange write.
                 TradingReadinessCache.set(network, userAddress, {
                     attempted: true,
                     enabled: false,
@@ -1933,7 +2118,13 @@ export class HyperLiquidProvider {
                 previousMode: currentMode,
                 note: 'HyperLiquid will auto-manage collateral for HIP-3 orders',
             });
-            await this.#clientService.getExchangeClient().agentSetAbstraction({
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Unified account migration');
+            }
+            const exchangeClient = this.#clientService.getExchangeClient(accountContext
+                ? async () => await this.#assertNoKnownUnsupportedAccount(accountContext, 'Unified account migration dispatch')
+                : undefined);
+            await exchangeClient.agentSetAbstraction({
                 abstraction: HL_ABSTRACTION_WIRE.unifiedAccount,
             });
             this.#deps.debugLogger.log('✅ HyperLiquidProvider: Unified Account enabled successfully');
@@ -1988,6 +2179,10 @@ export class HyperLiquidProvider {
             // account-shape condition, not a failure worth reporting or retrying.
             if (isHyperLiquidMultiSigRequiredError(error)) {
                 this.#deps.debugLogger.log('[ensureUnifiedAccountEnabled] Multi-sig account (race/probe fallback), skipping unified account migration', { user: userAddress, network, mode: currentMode });
+                this.#recordAccountSupport(network, userAddress, {
+                    isSupported: false,
+                    reason: 'multi_sig_account',
+                });
                 this.#deps.metrics.trackPerpsEvent(PerpsAnalyticsEvent.AccountSetup, {
                     ...(currentMode && {
                         [PERPS_EVENT_PROPERTY.PREVIOUS_ABSTRACTION_MODE]: currentMode,
@@ -2020,6 +2215,12 @@ export class HyperLiquidProvider {
                 completeInFlight();
                 return;
             }
+            if (accountContext &&
+                ensureError(error, 'HyperLiquidProvider.ensureUnifiedAccountEnabled')
+                    .message === PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE) {
+                completeInFlight();
+                throw error;
+            }
             // Agent-path failures and read-only userAbstraction lookup failures
             // are not final: signal #ensureReady to drop its memoized promise and
             // retry on the next entry instead of pinning the user in the
@@ -2088,10 +2289,26 @@ export class HyperLiquidProvider {
             // over. The memoized promise is dropped while the cooldown is active
             // (see below), so a later entry retries. Action-time callers are not
             // gated.
-            if (Date.now() >= this.#unifiedAccountTransportRetryAt) {
-                await this.#ensureUnifiedAccountEnabled({
-                    allowUserSigning: !this.#walletService.requiresSignatureConfirmation(),
-                });
+            if (!this.#isDisconnected &&
+                Date.now() >= this.#unifiedAccountTransportRetryAt) {
+                if (this.#walletService.requiresSignatureConfirmation()) {
+                    await this.#ensureUnifiedAccountEnabled({
+                        allowUserSigning: false,
+                    });
+                }
+                else {
+                    const accountContext = {
+                        lifecycleGeneration: this.#lifecycleGeneration,
+                        network: this.#clientService.isTestnetMode()
+                            ? 'testnet'
+                            : 'mainnet',
+                        userAddress: await this.#walletService.getUserAddressWithDefault(),
+                    };
+                    await this.#ensureUnifiedAccountEnabled({
+                        allowUserSigning: true,
+                        accountContext,
+                    });
+                }
             }
         })();
         // Await initialization - keep the promise so subsequent calls resolve immediately
@@ -2169,13 +2386,17 @@ export class HyperLiquidProvider {
      * code (the approval is otherwise non-blocking).
      * @param options.reportRefusal - Throw the venue's refusal, even without an
      * approval failure code.
+     * @param accountContext - Account/network/lifecycle captured by the action
+     * that is allowed to authorize this approval.
      * @returns The account, network, and configured builder for the action.
      */
-    async #ensureBuilderFeeSetup(approvalFailureCode, options = {}) {
-        const lifecycleGeneration = this.#lifecycleGeneration;
-        const isTestnet = this.#clientService.isTestnetMode();
-        const network = isTestnet ? 'testnet' : 'mainnet';
-        const userAddress = await this.#walletService.getUserAddressWithDefault();
+    async #ensureBuilderFeeSetup(approvalFailureCode, options = {}, accountContext) {
+        const lifecycleGeneration = accountContext?.lifecycleGeneration ?? this.#lifecycleGeneration;
+        const network = accountContext?.network ??
+            (this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet');
+        const isTestnet = network === 'testnet';
+        const userAddress = accountContext?.userAddress ??
+            (await this.#walletService.getUserAddressWithDefault());
         const cacheKey = this.#getCacheKey(network, userAddress);
         const builderAddress = this.#getBuilderAddress(isTestnet);
         const context = {
@@ -2203,7 +2424,7 @@ export class HyperLiquidProvider {
         }
         let pendingApproval = this.#builderFeeSetupPromises.get(setupKey);
         if (!pendingApproval) {
-            pendingApproval = this.#ensureBuilderFeeApproval(context);
+            pendingApproval = this.#ensureBuilderFeeApproval(context, accountContext);
             this.#builderFeeSetupPromises.set(setupKey, pendingApproval);
         }
         try {
@@ -2211,6 +2432,10 @@ export class HyperLiquidProvider {
         }
         catch (error) {
             this.#deps.debugLogger.log('[ensureBuilderFeeSetup] Builder fee approval failed', error);
+            if (accountContext &&
+                this.#recordUnsupportedAccountFromError(error, accountContext)) {
+                throw new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED);
+            }
             // A signer that could not sign is retryable, not an approval failure.
             if (approvalFailureCode || options.reportSignerFailure) {
                 const signerFailure = await this.#classifySignerFailure(error);
@@ -2243,10 +2468,15 @@ export class HyperLiquidProvider {
     async #ensureReadyForTrading(options) {
         // First ensure basic initialization is complete
         await this.#ensureReady();
+        const accountContext = await this.#assertAccountSupported(options.accountContext);
         // The migration was deferred during init to avoid a signing prompt on
         // Perps section open. Drive it here, gated by its own cache so
         // already-migrated users are not re-prompted.
-        await this.#ensureUnifiedAccountEnabled({ allowUserSigning: true });
+        await this.#ensureUnifiedAccountEnabled({
+            allowUserSigning: true,
+            accountContext,
+        });
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'Trading setup');
         // Reset right before the check, with no await in between, so a failure
         // above does not leave the setup for an order to run.
         if (options.recheckPendingReferral && this.#referralAwaitsBuilderCode) {
@@ -2268,7 +2498,7 @@ export class HyperLiquidProvider {
                     }
                 }
                 // Set up referral code independently from builder-fee applicability.
-                await this.#ensureReferralSet();
+                await this.#ensureReferralSet(accountContext);
                 this.#assertProviderLifecycleCurrent(lifecycleGeneration, 'Trading setup completion');
                 // Only mark complete if the main-account signer is ready (signing
                 // could actually happen) and the referral does not need another
@@ -2291,10 +2521,14 @@ export class HyperLiquidProvider {
             }
         }
         const builderFeeSetupContext = options.requiresBuilderFee
-            ? await this.#ensureBuilderFeeSetup(options.builderFeeApprovalFailureCode)
+            ? await this.#ensureBuilderFeeSetup(options.builderFeeApprovalFailureCode, {}, accountContext)
             : undefined;
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'Trading setup');
         this.#deps.debugLogger.log('[ensureReadyForTrading] Trading setup complete');
-        return builderFeeSetupContext;
+        return {
+            accountContext,
+            ...(builderFeeSetupContext && { builderFeeSetupContext }),
+        };
     }
     /**
      * Get current price for a symbol using WebSocket cache first, REST API fallback
@@ -3228,10 +3462,14 @@ export class HyperLiquidProvider {
      *
      * @param message - The status entry's error.
      * @param answer - The venue answer with the entry.
+     * @param accountContext - Account and network that authorized the write.
      * @returns The mapped error.
      */
-    async #mapStatusError(message, answer) {
+    async #mapStatusError(message, answer, accountContext) {
         const error = createStatusError(message, answer);
+        if (accountContext) {
+            this.#recordUnsupportedAccountFromError(error, accountContext);
+        }
         return (await this.#classifySignerFailure(error)) ?? this.#mapError(error);
     }
     /**
@@ -3360,10 +3598,17 @@ export class HyperLiquidProvider {
      * @param params.network - HyperLiquid network for the approval.
      * @param params.userAddress - Account that owns the approval.
      * @param params.builderAddress - Builder address being approved.
+     * @param accountContext - Account/network/lifecycle captured by the action
+     * that is allowed to authorize this approval.
      */
-    async #ensureBuilderFeeApproval(params) {
-        const lifecycleGeneration = this.#lifecycleGeneration;
+    async #ensureBuilderFeeApproval(params, accountContext) {
+        const lifecycleGeneration = accountContext?.lifecycleGeneration ?? this.#lifecycleGeneration;
         const { network, userAddress, builderAddress } = params;
+        const supportContext = accountContext ?? {
+            lifecycleGeneration,
+            network,
+            userAddress,
+        };
         this.#assertProviderLifecycleCurrent(lifecycleGeneration, 'Builder fee approval');
         const cacheKey = this.#getCacheKey(network, userAddress);
         // Check GLOBAL cache first to avoid repeated signing requests across reconnections
@@ -3401,7 +3646,12 @@ export class HyperLiquidProvider {
                 return;
             }
             const { isApproved, requiredDecimal } = await this.#checkBuilderFeeStatus(builderAddress, userAddress);
-            this.#assertProviderLifecycleCurrent(lifecycleGeneration, 'Builder fee approval');
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Builder fee approval lookup');
+            }
+            else {
+                this.#assertProviderLifecycleCurrent(lifecycleGeneration, 'Builder fee approval');
+            }
             if (isApproved) {
                 // User already has approval on-chain
                 PerpsSigningCache.setBuilderFee(network, userAddress, {
@@ -3414,12 +3664,20 @@ export class HyperLiquidProvider {
             }
             else {
                 this.#deps.debugLogger.log('[ensureBuilderFeeApproval] Approval required (will show signing request)', { builder: builderAddress, requiredDecimal });
-                const exchangeClient = this.#clientService.getExchangeClient();
+                if (accountContext) {
+                    await this.#assertNoKnownUnsupportedAccount(accountContext, 'Builder fee approval');
+                }
+                const exchangeClient = this.#getAccountGuardedExchangeClient(supportContext, 'Builder fee approval dispatch');
                 const maxFeeRate = BUILDER_FEE_CONFIG.MaxFeeRate;
-                await exchangeClient.approveBuilderFee({
+                const approvalResult = await exchangeClient.approveBuilderFee({
                     builder: builderAddress,
                     maxFeeRate,
                 });
+                if (approvalResult.status !== 'ok') {
+                    const approvalError = new Error(`Builder fee approval failed: ${JSON.stringify(approvalResult)}`);
+                    this.#recordUnsupportedAccountFromError(approvalError, supportContext);
+                    throw approvalError;
+                }
                 // Verify approval was successful before caching
                 const afterApprovalDecimal = await this.#checkBuilderFeeApproval(builderAddress, userAddress);
                 if (afterApprovalDecimal === null ||
@@ -3445,6 +3703,7 @@ export class HyperLiquidProvider {
             completeInFlight();
         }
         catch (error) {
+            this.#recordUnsupportedAccountFromError(error, supportContext);
             if (ensureError(error, 'HyperLiquidProvider.ensureBuilderFeeApproval')
                 .message === PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE) {
                 completeInFlight();
@@ -3641,11 +3900,13 @@ export class HyperLiquidProvider {
      * @param params - Transfer parameters
      * @param params.targetDex - HIP-3 DEX name (e.g., 'xyz')
      * @param params.requiredMargin - Required margin with buffer
+     * @param params.accountContext - Account/network/lifecycle captured by the
+     * order that may authorize a transfer.
      * @returns Transfer info for rollback, or null if no transfer needed
      * @private
      */
     async #autoTransferForHip3Order(params) {
-        const { targetDex, requiredMargin } = params;
+        const { targetDex, requiredMargin, accountContext } = params;
         // Check target DEX balance
         const targetBalance = await this.#getBalanceForDex({ dex: targetDex });
         this.#deps.debugLogger.log('HyperLiquidProvider: HIP-3 balance check', {
@@ -3674,15 +3935,19 @@ export class HyperLiquidProvider {
             to: targetDex,
             amount: transferAmount,
         });
-        const result = await this.transferBetweenDexs({
+        const transferParams = {
             sourceDex: source.sourceDex,
             destinationDex: targetDex,
             amount: transferAmount,
-        });
+        };
+        const result = accountContext
+            ? await this.#transferBetweenDexsForContext(transferParams, accountContext)
+            : await this.transferBetweenDexs(transferParams);
         if (!result.success) {
-            // The signer could not sign the transfer: retryable, not a defect.
-            if (result.error === PERPS_ERROR_CODES.KEYRING_LOCKED) {
-                throw new Error(PERPS_ERROR_CODES.KEYRING_LOCKED);
+            // Preserve stable account/signer outcomes that callers handle directly.
+            if (result.error === PERPS_ERROR_CODES.KEYRING_LOCKED ||
+                result.error === PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED) {
+                throw new Error(result.error);
             }
             throw new Error(`Auto-transfer failed: ${result.error ?? 'Unknown error'}`);
         }
@@ -3710,11 +3975,13 @@ export class HyperLiquidProvider {
      * @param params.freedMargin - Amount of margin released from position close
      * @param params.transferAll - (Future) Transfer all available balance instead
      * @param params.skipTransfer - (Future) Skip auto-transfer if disabled
+     * @param params.accountContext - Original action context to preserve across
+     * the balance read and transfer.
      * @returns Transfer info if successful, null if skipped/failed
      * @private
      */
     async #autoTransferBackAfterClose(params) {
-        const { sourceDex, freedMargin, transferAll = false, skipTransfer = false, } = params;
+        const { sourceDex, freedMargin, transferAll = false, skipTransfer = false, accountContext, } = params;
         // Future: Check user preference to skip auto-transfer
         if (skipTransfer) {
             this.#deps.debugLogger.log('Auto-transfer back skipped (disabled by config)');
@@ -3750,11 +4017,14 @@ export class HyperLiquidProvider {
                 to: 'main',
             });
             // Execute transfer back to main DEX (empty string '' represents main DEX)
-            const result = await this.transferBetweenDexs({
+            const transferParams = {
                 sourceDex,
                 destinationDex: '',
                 amount: transferAmount.toFixed(USDC_DECIMALS),
-            });
+            };
+            const result = accountContext
+                ? await this.#transferBetweenDexsForContext(transferParams, accountContext)
+                : await this.transferBetweenDexs(transferParams);
             if (!result.success) {
                 this.#deps.debugLogger.log('❌ Auto-transfer back failed', {
                     error: result.error,
@@ -3878,11 +4148,12 @@ export class HyperLiquidProvider {
      * @param params.transferInfo - The transfer information.
      * @param params.transferInfo.amount - The amount value.
      * @param params.transferInfo.sourceDex - The source DEX for the transfer.
+     * @param params.accountContext - Original action context for any rebalance.
      * @returns Whether the balance check and any required transfer succeeded.
      * @private
      */
     async #handleHip3PostOrderRebalance(params) {
-        const { dexName, transferInfo } = params;
+        const { accountContext, dexName, transferInfo } = params;
         try {
             const postOrderBalance = await this.#getBalanceForDex({ dex: dexName });
             const transferredAmount = transferInfo.amount;
@@ -3907,11 +4178,11 @@ export class HyperLiquidProvider {
                         excessAmount: excessAmount.toFixed(2),
                         destinationDex: transferInfo.sourceDex,
                     });
-                    const transferResult = await this.transferBetweenDexs({
+                    const transferResult = await this.#transferBetweenDexsForCleanup({
                         sourceDex: dexName,
                         destinationDex: transferInfo.sourceDex,
                         amount: excessAmount.toFixed(USDC_DECIMALS),
-                    });
+                    }, accountContext);
                     if (!transferResult.success) {
                         // The signer could not sign the transfer: retryable, not a defect.
                         if (transferResult.error === PERPS_ERROR_CODES.KEYRING_LOCKED) {
@@ -3971,10 +4242,11 @@ export class HyperLiquidProvider {
      * @param params.transferInfo - The transfer information.
      * @param params.transferInfo.amount - The amount value.
      * @param params.transferInfo.sourceDex - The source DEX for the transfer.
+     * @param params.accountContext - Original action context for the rollback.
      * @private
      */
     async #handleHip3OrderRollback(params) {
-        const { dexName, transferInfo } = params;
+        const { accountContext, dexName, transferInfo } = params;
         try {
             this.#deps.debugLogger.log('HyperLiquidProvider: Rolling back failed order transfer', {
                 from: dexName,
@@ -3982,11 +4254,11 @@ export class HyperLiquidProvider {
                 amount: transferInfo.amount.toFixed(USDC_DECIMALS),
                 reason: 'order_failed',
             });
-            const rollbackResult = await this.transferBetweenDexs({
+            const rollbackResult = await this.#transferBetweenDexsForContext({
                 sourceDex: dexName, // From HIP-3 DEX
                 destinationDex: transferInfo.sourceDex, // Back to source
                 amount: transferInfo.amount.toFixed(USDC_DECIMALS),
-            });
+            }, accountContext);
             if (rollbackResult.success) {
                 this.#deps.debugLogger.log('✅ HyperLiquidProvider: Rollback successful', {
                     amount: transferInfo.amount.toFixed(USDC_DECIMALS),
@@ -4160,7 +4432,7 @@ export class HyperLiquidProvider {
      * @param params - The operation parameters.
      */
     async #prepareAssetForTrading(params) {
-        const { symbol, assetId, leverage } = params;
+        const { symbol, assetId, leverage, accountContext } = params;
         if (!leverage) {
             return;
         }
@@ -4171,14 +4443,21 @@ export class HyperLiquidProvider {
             requestedLeverage: leverage,
             leverageType: marginMode,
         });
-        const exchangeClient = this.#clientService.getExchangeClient();
-        const leverageResult = await exchangeClient.updateLeverage({
-            asset: assetId,
-            isCross: marginMode === 'cross',
-            leverage,
-        });
-        if (leverageResult.status !== 'ok') {
-            throw new Error(`Failed to update leverage: ${JSON.stringify(leverageResult)}`);
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'Leverage update');
+        try {
+            const exchangeClient = this.#getAccountGuardedExchangeClient(accountContext, 'Leverage update dispatch');
+            const leverageResult = await exchangeClient.updateLeverage({
+                asset: assetId,
+                isCross: marginMode === 'cross',
+                leverage,
+            });
+            if (leverageResult.status !== 'ok') {
+                throw new Error(`Failed to update leverage: ${JSON.stringify(leverageResult)}`);
+            }
+        }
+        catch (error) {
+            this.#recordUnsupportedAccountFromError(error, accountContext);
+            throw error;
         }
         this.#deps.debugLogger.log('Leverage updated successfully:', {
             symbol,
@@ -4216,7 +4495,7 @@ export class HyperLiquidProvider {
      * @returns A promise that resolves to the result.
      */
     async #handleHip3PreOrder(params) {
-        const { dexName, symbol, orderPrice, positionSize, leverage, isBuy } = params;
+        const { accountContext, dexName, symbol, orderPrice, positionSize, leverage, isBuy, } = params;
         // TAT-3304: Only USDC-collateral HIP-3 DEXs are supported for trading.
         // Following the USDH sunset, reject orders on any non-USDC-collateral
         // DEX here instead of attempting the (now-removed) USDH auto-swap path.
@@ -4254,6 +4533,7 @@ export class HyperLiquidProvider {
             const transferInfo = await this.#autoTransferForHip3Order({
                 targetDex: dexName,
                 requiredMargin: requiredMarginWithBuffer,
+                accountContext,
             });
             return { transferInfo };
         }
@@ -4275,10 +4555,10 @@ export class HyperLiquidProvider {
      */
     async #submitOrderWithRollback(params) {
         const { orders, grouping, isHip3Order, dexName, transferInfo, symbol } = params;
-        const exchangeClient = this.#clientService.getExchangeClient();
+        const exchangeClient = this.#getAccountGuardedExchangeClient(params.accountContext, 'Order submission dispatch');
         const builder = params.chargesMetamaskBuilderFee
             ? await this.#getBuilderOrderContext(params.builderFeeSetupContext ??
-                (await this.#ensureBuilderFeeSetup()))
+                (await this.#ensureBuilderFeeSetup(undefined, {}, params.accountContext)))
             : undefined;
         this.#deps.debugLogger.log('Submitting order via asset ID routing', {
             symbol,
@@ -4289,6 +4569,7 @@ export class HyperLiquidProvider {
             isHip3: Boolean(dexName),
         });
         try {
+            await this.#assertNoKnownUnsupportedAccount(params.accountContext, 'Order submission');
             const result = await exchangeClient.order({
                 orders: this.#applySubscriptionCloid(orders),
                 grouping,
@@ -4298,6 +4579,9 @@ export class HyperLiquidProvider {
                 throw new Error(`Order failed: ${JSON.stringify(result)}`);
             }
             const status = result.response?.data?.statuses?.[0];
+            if (hasProperty(status, 'error') && typeof status.error === 'string') {
+                throw createStatusError(status.error, result);
+            }
             // Note: `in` narrows the HyperLiquid SDK discriminated union to the
             // branch that has the property; `hasProperty` types the property as
             // `unknown`, losing downstream access to `.oid`, `.totalSz`, `.avgPx`.
@@ -4307,7 +4591,11 @@ export class HyperLiquidProvider {
             /* eslint-enable no-restricted-syntax */
             // Success - auto-rebalance excess funds
             if (isHip3Order && transferInfo && dexName) {
-                await this.#handleHip3PostOrderRebalance({ dexName, transferInfo });
+                await this.#handleHip3PostOrderRebalance({
+                    accountContext: params.accountContext,
+                    dexName,
+                    transferInfo,
+                });
             }
             return {
                 success: true,
@@ -4323,9 +4611,14 @@ export class HyperLiquidProvider {
             };
         }
         catch (orderError) {
+            this.#recordUnsupportedAccountFromError(orderError, params.accountContext);
             // Failure - rollback transfer
             if (transferInfo && dexName) {
-                await this.#handleHip3OrderRollback({ dexName, transferInfo });
+                await this.#handleHip3OrderRollback({
+                    accountContext: params.accountContext,
+                    dexName,
+                    transferInfo,
+                });
             }
             throw orderError;
         }
@@ -4380,6 +4673,20 @@ export class HyperLiquidProvider {
      * @returns A promise that resolves to the result.
      */
     async placeOrder(input, _retryCount = 0, reportFailure = true) {
+        return await this.#placeOrder(input, _retryCount, reportFailure);
+    }
+    /**
+     * Place an order while preserving one account context across parent actions
+     * and minimum-value retries.
+     *
+     * @param input - Order parameters.
+     * @param _retryCount - Unused. Preserves the public call shape internally.
+     * @param reportFailure - Whether this call owns provider-level reporting.
+     * @param expectedAccountContext - Context captured by a parent action or the
+     * first minimum-value attempt.
+     * @returns The order result.
+     */
+    async #placeOrder(input, _retryCount, reportFailure, expectedAccountContext) {
         const deferProviderErrorReport = input.deferProviderErrorReport === true;
         const params = { ...input };
         delete params.deferProviderErrorReport;
@@ -4390,6 +4697,7 @@ export class HyperLiquidProvider {
                 error: PERPS_ERROR_CODES.ORDER_SCALE_PREVIEW_STALE,
             };
         }
+        let actionAccountContext = expectedAccountContext;
         try {
             this.#deps.debugLogger.log('Placing order via HyperLiquid SDK:', params);
             // Basic sync validation (backward compatibility)
@@ -4417,7 +4725,7 @@ export class HyperLiquidProvider {
             // array, the HIP-3 transfer, and the atomic single-order submit, none of
             // which describe what a TWAP, a ladder, or a chase does.
             if (isStrategyOrderType(params.orderType)) {
-                return await this.#placeStrategyOrder(params, params.orderType);
+                return await this.#placeStrategyOrder(params, params.orderType, expectedAccountContext);
             }
             // Extract DEX name for API calls (main DEX = null)
             const { dex: dexName } = parseAssetName(params.symbol);
@@ -4466,9 +4774,11 @@ export class HyperLiquidProvider {
             // Kept after validation so invalid orders never trigger signature prompts
             // (builder-fee approval, DEX abstraction enablement, etc.).
             const { chargesMetamaskBuilderFee } = this.#resolveOrderFeePolicy(params);
-            const builderFeeSetupContext = await this.#ensureReadyForTrading({
+            const { accountContext, builderFeeSetupContext } = await this.#ensureReadyForTrading({
                 requiresBuilderFee: chargesMetamaskBuilderFee,
+                accountContext: actionAccountContext,
             });
+            actionAccountContext = accountContext;
             // Debug: Log asset map state before order placement
             const allMapKeys = Array.from(this.#symbolToAssetId.keys());
             const hip3Keys = allMapKeys.filter((key) => key.includes(':'));
@@ -4526,6 +4836,7 @@ export class HyperLiquidProvider {
                 assetId,
                 leverage: params.leverage,
                 marginMode: params.marginMode,
+                accountContext,
             });
             // 6. Handle HIP-3 balance management (if applicable)
             const isHip3Order = dexName !== null;
@@ -4533,6 +4844,7 @@ export class HyperLiquidProvider {
             if (isHip3Order && dexName) {
                 const effectiveLeverage = params.leverage ?? assetInfo.maxLeverage ?? 1;
                 const hip3Result = await this.#handleHip3PreOrder({
+                    accountContext,
                     dexName,
                     symbol: params.symbol,
                     orderPrice,
@@ -4575,6 +4887,7 @@ export class HyperLiquidProvider {
                 symbol: params.symbol,
                 assetId,
                 chargesMetamaskBuilderFee,
+                accountContext,
                 builderFeeSetupContext,
             });
         }
@@ -4607,15 +4920,16 @@ export class HyperLiquidProvider {
      *
      * @param params - Order parameters, already validated.
      * @param orderType - The strategy type, narrowed by the caller.
+     * @param expectedAccountContext - Context captured by a parent action.
      * @returns A promise that resolves to the result.
      */
-    async #placeStrategyOrder(params, orderType) {
+    async #placeStrategyOrder(params, orderType, expectedAccountContext) {
         // Captured before the shared preamble, not after it: that preamble awaits
         // asset info, validation, trading readiness and a leverage update, and a
         // disconnect during any of them has to be seen before or after submission.
         const generation = this.#strategyGeneration;
         if (orderType !== 'chase') {
-            const context = await this.#prepareStrategyPlacement(params);
+            const context = await this.#prepareStrategyPlacement(params, expectedAccountContext);
             return await this.#submitPreparedStrategy(params, context, async () => {
                 if (generation !== this.#strategyGeneration) {
                     throw new Error(PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE);
@@ -4648,7 +4962,7 @@ export class HyperLiquidProvider {
         this.#chasePlacementWaiters.add(placementWaiter);
         try {
             await this.#chaseTickQueue;
-            const context = await this.#prepareStrategyPlacement(params);
+            const context = await this.#prepareStrategyPlacement(params, expectedAccountContext);
             return await this.#submitPreparedStrategy(params, context, async () => await this.#startChaseSession(params, context, generation));
         }
         finally {
@@ -4674,24 +4988,36 @@ export class HyperLiquidProvider {
      * @returns The strategy placement result.
      */
     async #submitPreparedStrategy(params, context, submit) {
-        const { dexName, network, transferInfo, userAddress } = context;
+        const { accountContext, dexName, network, transferInfo, userAddress } = context;
         let result;
         try {
             result = await submit();
         }
         catch (error) {
+            this.#recordUnsupportedAccountFromError(error, accountContext);
             if (dexName && transferInfo) {
-                await this.#handleHip3OrderRollback({ dexName, transferInfo });
+                await this.#handleHip3OrderRollback({
+                    accountContext,
+                    dexName,
+                    transferInfo,
+                });
             }
             throw error;
         }
+        if (!result.success && result.error) {
+            this.#recordUnsupportedAccountFromError(new Error(result.error), accountContext);
+        }
         const resultFilledSize = new BigNumber(result.filledSize ?? 0);
         const hasVenueExposure = result.success === true ||
             result.orderId !== undefined ||
             (result.childOrderIds?.length ?? 0) > 0 ||
             (resultFilledSize.isFinite() && resultFilledSize.gt(0));
         if (dexName && transferInfo && !hasVenueExposure) {
-            await this.#handleHip3OrderRollback({ dexName, transferInfo });
+            await this.#handleHip3OrderRollback({
+                accountContext,
+                dexName,
+                transferInfo,
+            });
             return result;
         }
         if (params.orderType === 'twap' && result.orderId) {
@@ -4702,7 +5028,13 @@ export class HyperLiquidProvider {
             }), {
                 symbol: params.symbol,
                 ...(dexName && transferInfo
-                    ? { hip3Transfer: { dexName, transferInfo } }
+                    ? {
+                        hip3Transfer: {
+                            accountContext,
+                            dexName,
+                            transferInfo,
+                        },
+                    }
                     : {}),
             });
             return result;
@@ -4714,7 +5046,11 @@ export class HyperLiquidProvider {
             transferInfo) {
             const session = this.#chaseSessions.get(result.orderId);
             if (session) {
-                session.hip3Transfer = { dexName, transferInfo };
+                session.hip3Transfer = {
+                    accountContext,
+                    dexName,
+                    transferInfo,
+                };
                 return result;
             }
         }
@@ -4726,7 +5062,11 @@ export class HyperLiquidProvider {
             return result;
         }
         if (dexName && transferInfo) {
-            await this.#handleHip3PostOrderRebalance({ dexName, transferInfo });
+            await this.#handleHip3PostOrderRebalance({
+                accountContext,
+                dexName,
+                transferInfo,
+            });
         }
         return result;
     }
@@ -4738,9 +5078,10 @@ export class HyperLiquidProvider {
      * so a strategy order is held to the same rules as an ordinary one.
      *
      * @param params - Order parameters.
+     * @param expectedAccountContext - Context captured by a parent action.
      * @returns The asset and sizing context the strategy handlers submit with.
      */
-    async #prepareStrategyPlacement(params) {
+    async #prepareStrategyPlacement(params, expectedAccountContext) {
         const { dex: dexName } = parseAssetName(params.symbol);
         const { assetInfo, currentPrice, meta } = await this.#getAssetInfo({
             symbol: params.symbol,
@@ -4803,9 +5144,16 @@ export class HyperLiquidProvider {
         // Kept after validation so an invalid strategy order never triggers the
         // signature prompts in trading setup — same ordering as `placeOrder`.
         const { chargesMetamaskBuilderFee } = this.#resolveOrderFeePolicy(params);
-        const builderFeeSetupContext = chargesMetamaskBuilderFee
-            ? await this.#ensureReadyForTrading({ requiresBuilderFee: true })
-            : await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+        const tradingActionContext = chargesMetamaskBuilderFee
+            ? await this.#ensureReadyForTrading({
+                requiresBuilderFee: true,
+                accountContext: expectedAccountContext,
+            })
+            : await this.#ensureReadyForTrading({
+                requiresBuilderFee: false,
+                accountContext: expectedAccountContext,
+            });
+        const { accountContext, builderFeeSetupContext } = tradingActionContext;
         const assetId = await this.#getAssetIdWithRepair({
             symbol: params.symbol,
             dexName,
@@ -4816,19 +5164,19 @@ export class HyperLiquidProvider {
             assetId,
             leverage: params.leverage,
             marginMode: params.marginMode,
+            accountContext,
         });
         const builder = builderFeeSetupContext
             ? await this.#getBuilderOrderContext(builderFeeSetupContext)
             : undefined;
-        const network = this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet';
-        const userAddress = builderFeeSetupContext?.userAddress ??
-            (await this.#walletService.getUserAddressWithDefault());
+        const { network, userAddress } = accountContext;
         let transferInfo = null;
         if (dexName) {
             const orderPrice = ladder === undefined
                 ? effectivePrice
                 : Math.max(...ladder.prices.map(Number.parseFloat));
             const hip3Result = await this.#handleHip3PreOrder({
+                accountContext,
                 dexName,
                 symbol: params.symbol,
                 orderPrice,
@@ -4840,6 +5188,7 @@ export class HyperLiquidProvider {
             transferInfo = hip3Result.transferInfo;
         }
         return {
+            accountContext,
             assetId,
             szDecimals: assetInfo.szDecimals,
             formattedSize,
@@ -4927,7 +5276,7 @@ export class HyperLiquidProvider {
      * @returns A promise that resolves to the result.
      */
     async #placeTwapOrder(params, context, generation) {
-        const { assetId, formattedSize } = context;
+        const { accountContext, assetId, formattedSize } = context;
         const durationMinutes = params.twapDuration;
         if (durationMinutes === undefined) {
             throw new Error(PERPS_ERROR_CODES.ORDER_TWAP_DURATION_REQUIRED);
@@ -4945,6 +5294,7 @@ export class HyperLiquidProvider {
             durationMinutes,
             randomize: params.twapRandomize ?? false,
         });
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'TWAP order submission');
         const result = await exchangeClient.twapOrder({
             twap: {
                 a: assetId,
@@ -4974,6 +5324,7 @@ export class HyperLiquidProvider {
         if (generation !== this.#strategyGeneration) {
             let remainsLive = true;
             try {
+                await this.#assertRollbackAccountWritable(accountContext);
                 const cancelResult = await exchangeClient.twapCancel({
                     a: assetId,
                     t: running.twapId,
@@ -5021,7 +5372,7 @@ export class HyperLiquidProvider {
      * @returns A promise that resolves to the result.
      */
     async #placeScaleOrder(params, context, generation) {
-        const { assetId, formattedSize, ladder, builder } = context;
+        const { accountContext, assetId, formattedSize, ladder, builder } = context;
         // Built and validated in `#prepareStrategyPlacement`, before anything was
         // signed, so what is submitted here is exactly what the minimums were
         // applied to.
@@ -5062,6 +5413,7 @@ export class HyperLiquidProvider {
         let result;
         let thrownBulkOrderError;
         try {
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Scale order submission');
             result = await exchangeClient.order({
                 orders,
                 grouping: 'na',
@@ -5078,6 +5430,7 @@ export class HyperLiquidProvider {
         }
         const rawStatuses = result.response?.data?.statuses;
         const statuses = Array.isArray(rawStatuses) ? rawStatuses : [];
+        const isMultiSigRequired = this.#recordUnsupportedAccountFromStatuses(statuses, result, accountContext);
         const outcomes = Array.from({ length: count }, (_unused, index) => parseScaleBulkOrderStatus(statuses[index]));
         const acceptedCount = outcomes.filter((outcome) => outcome?.kind === 'accepted').length;
         const everyStatusClassified = outcomes.every((outcome) => outcome !== undefined);
@@ -5130,6 +5483,19 @@ export class HyperLiquidProvider {
             ...acceptedResult,
         });
         const cancelNonRejectedOrders = async () => {
+            try {
+                await this.#assertRollbackAccountWritable(accountContext);
+            }
+            catch (error) {
+                this.#deps.debugLogger.log('Scale placement rollback not signed after its account context changed', {
+                    error: ensureError(error, 'HyperLiquidProvider.placeScaleOrder.rollback').message,
+                    groupId,
+                });
+                return {
+                    orderIds: restingChildOrderIds,
+                    clientOrderIds: cleanupClientOrderIds,
+                };
+            }
             const [orderIds, pendingClientOrderIds] = await Promise.all([
                 this.#cancelOrderRequests(exchangeClient, restingChildOrderIds.map((orderId) => ({
                     a: assetId,
@@ -5219,7 +5585,9 @@ export class HyperLiquidProvider {
                     childOrderIds: [],
                 });
             }
-            throw new Error(PERPS_ERROR_CODES.ORDER_REJECTED);
+            throw new Error(isMultiSigRequired
+                ? PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED
+                : PERPS_ERROR_CODES.ORDER_REJECTED);
         }
         this.#scaleOrderGroups.set(groupId, {
             symbol: params.symbol,
@@ -5240,7 +5608,7 @@ export class HyperLiquidProvider {
      * @returns A promise that resolves to the result.
      */
     async #startChaseSession(params, context, generation) {
-        const { assetId, szDecimals, formattedSize, builder } = context;
+        const { accountContext, assetId, szDecimals, formattedSize, builder } = context;
         // Captured now, alongside the builder fee and for the same reason: the fee
         // resolution behind it is cleared when the caller's `placeOrder` returns,
         // which for a chase is before any replacement runs.
@@ -5288,6 +5656,7 @@ export class HyperLiquidProvider {
                     reduceOnly: params.reduceOnly ?? false,
                     builder,
                     marksSubscriptionCloid,
+                    accountContext,
                     exchangeClient: placingClient,
                 });
                 break;
@@ -5321,6 +5690,7 @@ export class HyperLiquidProvider {
         const intervalMs = params.chaseIntervalMs ?? CHASE_ORDER_CONFIG.DefaultIntervalMs;
         const sessionId = generatePerpsId('chase');
         const session = {
+            accountContext,
             symbol: params.symbol,
             assetId,
             isBuy: params.isBuy,
@@ -5357,10 +5727,12 @@ export class HyperLiquidProvider {
         // the provider stays pointed at the account that placed it — a disconnect
         // is usually followed by an account or network switch, after which handing
         // the id back is no remedy at all. So it is cancelled here, through the
-        // client that signed it — the account switch cannot reach that instance —
-        // and the failure is then true of the venue as well as of this provider.
-        // Best-effort still: the transport underneath that client may already be
-        // closing, so a cancel that does not land falls back to reporting the id.
+        // client that signed it. The held client remains usable after teardown,
+        // but its adapter resolves the selected account again for each signature,
+        // so rollback validates the captured identity before cancellation. The
+        // failure is then true of the venue as well as of this provider.
+        // Best-effort still: a context change or closing transport falls back to
+        // reporting the live id.
         if (generation !== this.#strategyGeneration) {
             this.#deps.debugLogger.log('Chase placement outlived its provider', {
                 orderId,
@@ -5455,9 +5827,12 @@ export class HyperLiquidProvider {
      * than looked up here so a first placement can keep the instance it signed
      * with, which is the only one that can take the order back once `disconnect`
      * has dropped the service's reference.
+     * @param params.accountContext - Account/network/lifecycle captured by the
+     * action that owns the chase.
      * @returns The resting order's exchange ID.
      */
     async #restChaseOrder(params) {
+        await this.#assertNoKnownUnsupportedAccount(params.accountContext, 'Chase order submission');
         const result = await params.exchangeClient.order({
             orders: this.#applySubscriptionCloid([
                 {
@@ -5498,6 +5873,15 @@ export class HyperLiquidProvider {
             this.#chaseTickQueue = this.#chaseTickQueue
                 .then(() => this.#runChaseTick(sessionId))
                 .catch(async (error) => {
+                const failedSession = this.#chaseSessions.get(sessionId);
+                const accountUnsupported = failedSession
+                    ? this.#recordUnsupportedAccountFromError(error, failedSession.accountContext)
+                    : false;
+                if (accountUnsupported) {
+                    this.#stopChaseSession(sessionId);
+                    this.#deps.debugLogger.log('Chase stopped after account support correction', { sessionId });
+                    return;
+                }
                 // A rejected agent is dropped so the next tick asks for another.
                 await this.#evictRejectedAgent(error);
                 // Resolve the shared queue after every failure. Otherwise one
@@ -5812,8 +6196,7 @@ export class HyperLiquidProvider {
                         reduceOnly: session.reduceOnly,
                         builder: session.builder,
                         marksSubscriptionCloid: session.marksSubscriptionCloid,
-                        // A running session is on a live provider, so the current client is
-                        // the right one; only the first placement has a teardown to survive.
+                        accountContext: session.accountContext,
                         exchangeClient: this.#clientService.getExchangeClient(),
                     });
                     session.size = remaining;
@@ -6037,6 +6420,8 @@ export class HyperLiquidProvider {
      * @param placingClient - Client to cancel through. Omitted by every cancel on
      * a live provider, which wants the current one; an abandoned placement passes
      * the client it signed with, the only one still able to reach its order.
+     * That path separately validates the captured rollback account because the
+     * client's wallet adapter resolves the selected account for every signature.
      * @returns Whether the order was cancelled, was already gone, or still rests.
      */
     async #cancelChaseChild(session, placingClient) {
@@ -6045,6 +6430,12 @@ export class HyperLiquidProvider {
         }
         // Looked up only once there is something to cancel, so a session with
         // nothing resting still answers on a provider whose client is already gone.
+        if (placingClient) {
+            await this.#assertRollbackAccountWritable(session.accountContext);
+        }
+        else {
+            await this.#assertNoKnownUnsupportedAccount(session.accountContext, 'Chase cancellation');
+        }
         const exchangeClient = placingClient ?? this.#clientService.getExchangeClient();
         let result;
         try {
@@ -6053,6 +6444,7 @@ export class HyperLiquidProvider {
             });
         }
         catch (error) {
+            this.#recordUnsupportedAccountFromError(error, session.accountContext);
             const message = ensureError(error, 'HyperLiquidProvider.cancelChaseChild').message.toLowerCase();
             if (ALREADY_GONE_CANCEL_MARKERS.some((marker) => message.includes(marker))) {
                 return CancelChildOutcome.Gone;
@@ -6060,6 +6452,9 @@ export class HyperLiquidProvider {
             throw error;
         }
         const status = result.response?.data?.statuses?.[0];
+        if (isStatusObject(status) && typeof status.error === 'string') {
+            this.#recordUnsupportedAccountFromError(createStatusError(status.error, result), session.accountContext);
+        }
         const signerFailure = await this.#classifyStatusSignerFailure([status], result);
         if (signerFailure) {
             throw signerFailure;
@@ -6258,7 +6653,16 @@ export class HyperLiquidProvider {
         }
         let { rebalancePromise } = trackedOrder;
         if (!rebalancePromise) {
-            rebalancePromise = this.#handleHip3PostOrderRebalance(trackedOrder.hip3Transfer);
+            const { hip3Transfer } = trackedOrder;
+            rebalancePromise = this.#handleHip3PostOrderRebalance({
+                ...hip3Transfer,
+                accountContext: {
+                    ...hip3Transfer.accountContext,
+                    // TWAP tracking deliberately survives reconnects. Keep its stable
+                    // account/network scope, but bind the cleanup write to this lifecycle.
+                    lifecycleGeneration: this.#lifecycleGeneration,
+                },
+            });
             trackedOrder.rebalancePromise = rebalancePromise;
         }
         try {
@@ -6511,9 +6915,10 @@ export class HyperLiquidProvider {
         if (!/^\d+$/u.test(params.orderId) || !Number.isSafeInteger(twapId)) {
             throw new Error(PERPS_ERROR_CODES.ORDER_STRATEGY_HANDLE_UNKNOWN);
         }
-        await this.#ensureReadyForTrading({ requiresBuilderFee: false });
-        const network = this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet';
-        const userAddress = await this.#walletService.getUserAddressWithDefault();
+        const { accountContext } = await this.#ensureReadyForTrading({
+            requiresBuilderFee: false,
+        });
+        const { network, userAddress } = accountContext;
         const trackingKey = getTwapOrderScopeKey({
             network,
             userAddress,
@@ -6549,10 +6954,18 @@ export class HyperLiquidProvider {
             symbol: params.symbol,
             dexName: parseAssetName(params.symbol).dex,
         });
-        const result = await this.#clientService.getExchangeClient().twapCancel({
-            a: assetId,
-            t: twapId,
-        });
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'TWAP cancellation');
+        let result;
+        try {
+            result = await this.#clientService.getExchangeClient().twapCancel({
+                a: assetId,
+                t: twapId,
+            });
+        }
+        catch (error) {
+            this.#recordUnsupportedAccountFromError(error, accountContext);
+            throw error;
+        }
         const status = result.response?.data?.status;
         const cancelOutcome = classifyCancelStatus(status);
         if (cancelOutcome === CancelChildOutcome.Gone && !ownershipAuthenticated) {
@@ -6565,7 +6978,7 @@ export class HyperLiquidProvider {
         const rawError = isStatusObject(status) && typeof status.error === 'string'
             ? status.error
             : 'TWAP cancellation failed';
-        return createErrorResult(await this.#mapStatusError(rawError, result), {
+        return createErrorResult(await this.#mapStatusError(rawError, result, accountContext), {
             success: false,
             orderId: params.orderId,
         });
@@ -6581,7 +6994,9 @@ export class HyperLiquidProvider {
         if (!group) {
             throw new Error(PERPS_ERROR_CODES.ORDER_STRATEGY_HANDLE_UNKNOWN);
         }
-        await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+        const { accountContext } = await this.#ensureReadyForTrading({
+            requiresBuilderFee: false,
+        });
         const assetId = await this.#getAssetIdWithRepair({
             symbol: group.symbol,
             dexName: parseAssetName(group.symbol).dex,
@@ -6595,9 +7010,14 @@ export class HyperLiquidProvider {
             asset: assetId,
             cloid: clientOrderId,
         }));
+        await this.#assertNoKnownUnsupportedAccount(accountContext, 'Scale cancellation');
         const [orderCancellation, cloidCancellation] = await Promise.all([
-            this.#cancelOrderRequestBatch(exchangeClient, cancelRequests),
-            this.#cancelOrderCloidRequestBatch(exchangeClient, cancelByCloidRequests),
+            this.#cancelOrderRequestBatch(exchangeClient, cancelRequests, (error) => {
+                this.#recordUnsupportedAccountFromError(error, accountContext);
+            }),
+            this.#cancelOrderCloidRequestBatch(exchangeClient, cancelByCloidRequests, (error) => {
+                this.#recordUnsupportedAccountFromError(error, accountContext);
+            }),
         ]);
         const remaining = orderCancellation.remainingOrderIds.map(String);
         const { remainingClientOrderIds } = cloidCancellation;
@@ -6697,7 +7117,18 @@ export class HyperLiquidProvider {
             }
             return { success: true, orderId: params.orderId };
         }
-        await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+        this.#assertProviderLifecycleCurrent(session.accountContext.lifecycleGeneration, 'Chase cancellation setup');
+        const currentAddress = await this.#walletService.getUserAddressWithDefault();
+        if (currentAddress.toLowerCase() !==
+            session.accountContext.userAddress.toLowerCase() ||
+            (this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet') !==
+                session.accountContext.network) {
+            throw new Error(PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE);
+        }
+        await this.#ensureReadyForTrading({
+            requiresBuilderFee: false,
+            accountContext: session.accountContext,
+        });
         // Only a refusal leaves an order behind. A child that had already filled or
         // been cancelled is reported as a rejection too, but nothing of it is
         // resting — treating that as a failure would pin the handle open forever on
@@ -6741,11 +7172,11 @@ export class HyperLiquidProvider {
      *
      * @param exchangeClient - Client that owns the orders.
      * @param requests - Venue cancel-by-CLOID requests.
+     * @param onError - Optional operation-specific failure classifier.
      * @returns Client order IDs that may still be resting.
      */
-    async #cancelOrderCloidRequests(exchangeClient, requests) {
-        return (await this.#cancelOrderCloidRequestBatch(exchangeClient, requests))
-            .remainingClientOrderIds;
+    async #cancelOrderCloidRequests(exchangeClient, requests, onError) {
+        return (await this.#cancelOrderCloidRequestBatch(exchangeClient, requests, onError)).remainingClientOrderIds;
     }
     /**
      * Cancel pending orders by client order ID, reporting a signer that could
@@ -6753,14 +7184,20 @@ export class HyperLiquidProvider {
      *
      * @param exchangeClient - Client that owns the orders.
      * @param requests - Venue cancel-by-CLOID requests.
+     * @param onError - Optional operation-specific failure classifier.
      * @returns Client order IDs that may still be resting, and the signer
      * failure when the signer could not sign the request.
      */
-    async #cancelOrderCloidRequestBatch(exchangeClient, requests) {
+    async #cancelOrderCloidRequestBatch(exchangeClient, requests, onError) {
         if (requests.length === 0) {
             return { remainingClientOrderIds: [] };
         }
         const classifyStatuses = async (statuses, answer) => {
+            for (const status of statuses) {
+                if (isStatusObject(status) && typeof status.error === 'string') {
+                    await onError?.(createStatusError(status.error, answer));
+                }
+            }
             // A signer failure is classified (and reported) once for the request;
             // entries the venue cancelled are not resting either way.
             const signerFailure = await this.#classifyStatusSignerFailure(statuses, answer);
@@ -6784,6 +7221,7 @@ export class HyperLiquidProvider {
             return await classifyStatuses(statuses, result);
         }
         catch (error) {
+            await onError?.(error);
             // The SDK throws when any entry failed, with every entry's status.
             const statuses = getCancelStatusesFromError(error, requests.length);
             if (statuses) {
@@ -6824,6 +7262,11 @@ export class HyperLiquidProvider {
             };
         }
         const classifyStatuses = async (statuses, answer) => {
+            for (const status of statuses) {
+                if (isStatusObject(status) && typeof status.error === 'string') {
+                    await onError?.(createStatusError(status.error, answer));
+                }
+            }
             // A signer failure is classified (and reported) once for the request;
             // entries the venue cancelled still count as cancelled.
             const signerFailure = await this.#classifyStatusSignerFailure(statuses, answer);
@@ -6969,9 +7412,11 @@ export class HyperLiquidProvider {
      * Apply both signer invalidation and account-shape classification to writes.
      *
      * @param error - Failed protection write.
+     * @param accountContext - Account and network that authorized the write.
      * @returns Actionable error retaining the venue message when unmapped.
      */
-    async #classifyProtectionWriteError(error) {
+    async #classifyProtectionWriteError(error, accountContext) {
+        this.#recordUnsupportedAccountFromError(error, accountContext);
         return ((await this.#classifySignerFailure(error)) ??
             (isHyperLiquidMultiSigRequiredError(error)
                 ? new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED)
@@ -7378,19 +7823,30 @@ export class HyperLiquidProvider {
             // Every refusal is behind us, so shared trading readiness can run now.
             // HyperLiquid's modify action has no builder field and must not request a
             // builder-fee approval.
-            await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+            const { accountContext } = await this.#ensureReadyForTrading({
+                requiresBuilderFee: false,
+            });
             // Submit modification via SDK. The cloid is deliberately left unmarked:
             // `modify` carries no builder field, as the readiness call above records,
             // so no MetaMask fee is charged on this action and marking it would tell
             // the fill fan-out a reduction applied to an order that paid nothing.
             // The replacement inherits the resting order's own attribution.
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Order modification');
             const exchangeClient = this.#clientService.getExchangeClient();
-            const result = await exchangeClient.modify({
-                oid: typeof params.orderId === 'string' ? params.orderId : params.orderId,
-                order: newOrder,
-            });
-            if (result.status !== 'ok') {
-                throw new Error(`Order modification failed: ${JSON.stringify(result)}`);
+            try {
+                const result = await exchangeClient.modify({
+                    oid: typeof params.orderId === 'string'
+                        ? params.orderId
+                        : params.orderId,
+                    order: newOrder,
+                });
+                if (result.status !== 'ok') {
+                    throw new Error(`Order modification failed: ${JSON.stringify(result)}`);
+                }
+            }
+            catch (error) {
+                this.#recordUnsupportedAccountFromError(error, accountContext);
+                throw error;
             }
             // `params.orderId` is the order that was just REPLACED, so returning it
             // as OrderResult.orderId (documented as the exchange order ID) names an
@@ -7450,6 +7906,7 @@ export class HyperLiquidProvider {
         // current child instead of leaving a replacement chasing behind the user.
         const owningChase = [...this.#chaseSessions.entries()].find(([, session]) => session.orderId === params.orderId ||
             session.replacingOrderId === params.orderId);
+        let accountContext;
         try {
             if (owningChase) {
                 this.#stopChaseSession(owningChase[0]);
@@ -7472,12 +7929,15 @@ export class HyperLiquidProvider {
             if (!coinValidation.isValid) {
                 throw new Error(coinValidation.error);
             }
-            await this.#ensureReadyForTrading({ requiresBuilderFee: false });
-            const exchangeClient = this.#clientService.getExchangeClient();
+            ({ accountContext } = await this.#ensureReadyForTrading({
+                requiresBuilderFee: false,
+            }));
             const asset = await this.#getAssetIdWithRepair({
                 symbol: params.symbol,
                 dexName: parseAssetName(params.symbol).dex,
             });
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Order cancellation');
+            const exchangeClient = this.#clientService.getExchangeClient();
             const result = await exchangeClient.cancel({
                 cancels: [
                     {
@@ -7500,12 +7960,15 @@ export class HyperLiquidProvider {
             const rawError = isStatusObject(status) && typeof status.error === 'string'
                 ? status.error
                 : 'Order cancellation failed';
-            return createErrorResult(await this.#mapStatusError(rawError, result), {
+            return createErrorResult(await this.#mapStatusError(rawError, result, accountContext), {
                 success: false,
                 orderId: params.orderId,
             });
         }
         catch (error) {
+            if (accountContext) {
+                this.#recordUnsupportedAccountFromError(error, accountContext);
+            }
             const mappedError = await this.#reportWriteError(error, 'cancelOrder', {
                 orderId: params.orderId,
                 coin: params.symbol,
@@ -7577,8 +8040,9 @@ export class HyperLiquidProvider {
             if (ordinaryOrders.length > 0) {
                 // Cancellation carries no builder context, so it must not prompt for a
                 // fee approval that the action cannot use.
-                await this.#ensureReadyForTrading({ requiresBuilderFee: false });
-                const exchangeClient = this.#clientService.getExchangeClient();
+                const { accountContext } = await this.#ensureReadyForTrading({
+                    requiresBuilderFee: false,
+                });
                 const cancelRequests = await Promise.all(ordinaryOrders.map(async ({ order }) => {
                     const asset = await this.#getAssetIdWithRepair({
                         symbol: order.symbol,
@@ -7589,6 +8053,8 @@ export class HyperLiquidProvider {
                         o: parseInt(order.orderId, 10),
                     };
                 }));
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Batch order cancellation');
+                const exchangeClient = this.#clientService.getExchangeClient();
                 let statuses;
                 let answer;
                 try {
@@ -7608,6 +8074,7 @@ export class HyperLiquidProvider {
                     answer = getVenueAnswer(error);
                     statuses = getCancelStatusesFromError(error, ordinaryOrders.length);
                     if (!statuses) {
+                        this.#recordUnsupportedAccountFromError(error, accountContext);
                         throw error;
                     }
                 }
@@ -7623,6 +8090,7 @@ export class HyperLiquidProvider {
                             : undefined;
                         let error = PERPS_ERROR_CODES.BATCH_CANCEL_FAILED;
                         if (statusError) {
+                            this.#recordUnsupportedAccountFromError(statusError, accountContext);
                             error =
                                 signerFailure && (await this.#isSignerFailure(statusError))
                                     ? signerFailure.message
@@ -7666,11 +8134,14 @@ export class HyperLiquidProvider {
     async closePositions(params) {
         // Declare outside try block so it's accessible in catch block
         let positionsToClose = [];
+        let accountContext;
         const unavailableResults = [];
         try {
             // Batch preparation needs trading readiness but not builder approval yet.
             // The provider-owned market policy is resolved from the positions below.
-            await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+            ({ accountContext } = await this.#ensureReadyForTrading({
+                requiresBuilderFee: false,
+            }));
             // Selected symbols only need the DEXes they belong to. Loading every
             // market group would refuse a BTC close when an unrelated HIP-3 DEX
             // cannot be read. closeAll / empty symbols still need a complete
@@ -7741,8 +8212,6 @@ export class HyperLiquidProvider {
                     results: unavailableResults,
                 };
             }
-            // Get exchange client for order submission
-            const exchangeClient = this.#clientService.getExchangeClient();
             // Pre-fetch meta for all unique DEXs to avoid N API calls in loop
             const uniqueDexs = [
                 ...new Set(positionsToClose.map((pos) => parseAssetName(pos.symbol).dex ?? 'main')),
@@ -7857,10 +8326,16 @@ export class HyperLiquidProvider {
             // policy charges, preserving deterministic behavior for future policies
             // that vary by market or route.
             const chargesMetamaskBuilderFee = feePolicyContexts.some((context) => this.#resolveOrderFeePolicy(context).chargesMetamaskBuilderFee);
-            const builder = chargesMetamaskBuilderFee
-                ? await this.#getBuilderOrderContext(await this.#ensureReadyForTrading({ requiresBuilderFee: true }))
-                : undefined;
+            let builder;
+            if (chargesMetamaskBuilderFee) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Batch close setup');
+                const builderFeeSetupContext = await this.#ensureBuilderFeeSetup(undefined, {}, accountContext);
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Batch close setup');
+                builder = await this.#getBuilderOrderContext(builderFeeSetupContext);
+            }
             // Single batch API call
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Batch close submission');
+            const exchangeClient = this.#clientService.getExchangeClient();
             const result = await exchangeClient.order({
                 orders: this.#applySubscriptionCloid(orders),
                 grouping: 'na',
@@ -7868,6 +8343,11 @@ export class HyperLiquidProvider {
             });
             // Parse response statuses (one per order)
             const { statuses } = result.response.data;
+            for (const status of statuses) {
+                if (hasProperty(status, 'error') && typeof status.error === 'string') {
+                    this.#recordUnsupportedAccountFromError(createStatusError(status.error, result), accountContext);
+                }
+            }
             const successCount = statuses.filter((stat) => isStatusObject(stat) &&
                 (hasProperty(stat, 'filled') || hasProperty(stat, 'resting'))).length;
             const failureCount = statuses.length -
@@ -7886,6 +8366,7 @@ export class HyperLiquidProvider {
                         this.#deps.debugLogger.log('Position closed successfully, initiating manual auto-transfer back', { symbol: orderedPositions[i].symbol, freedMargin });
                         // Non-blocking: Transfer freed margin back to main DEX
                         await this.#autoTransferBackAfterClose({
+                            accountContext,
                             sourceDex,
                             freedMargin,
                         });
@@ -7921,6 +8402,9 @@ export class HyperLiquidProvider {
             };
         }
         catch (error) {
+            if (accountContext) {
+                this.#recordUnsupportedAccountFromError(error, accountContext);
+            }
             const signerFailure = await this.#handleSignerFailure(error, 'closePositions', {
                 positionCount: positionsToClose.length,
             });
@@ -8004,6 +8488,11 @@ export class HyperLiquidProvider {
             const lifecycle = this.#lifecycleGeneration;
             const isTestnet = this.#clientService.isTestnetMode();
             const userAddress = await this.#walletService.getUserAddressWithDefault();
+            const accountContext = {
+                lifecycleGeneration: lifecycle,
+                network: isTestnet ? 'testnet' : 'mainnet',
+                userAddress,
+            };
             const assertScope = async () => {
                 const current = await this.#walletService.getUserAddressWithDefault();
                 this.#assertProviderLifecycleCurrent(lifecycle, 'updatePositionTPSL');
@@ -8399,12 +8888,18 @@ export class HyperLiquidProvider {
             const requiresBuilderFee = replacementChargesMetamaskBuilderFee || rollbackRequiresBuilderFee;
             // Approval and builder-context resolution both finish before the
             // pre-cancel. A failure here therefore leaves the old protection intact.
-            const builderFeeSetupContext = requiresBuilderFee
+            await assertScope();
+            const tradingActionContext = requiresBuilderFee
                 ? await this.#ensureReadyForTrading({
                     requiresBuilderFee: true,
                     builderFeeApprovalFailureCode: PERPS_ERROR_CODES.TPSL_UPDATE_FAILED,
+                    accountContext,
                 })
-                : await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+                : await this.#ensureReadyForTrading({
+                    requiresBuilderFee: false,
+                    accountContext,
+                });
+            const { builderFeeSetupContext } = tradingActionContext;
             const builderOrderContext = builderFeeSetupContext
                 ? await this.#getBuilderOrderContext(builderFeeSetupContext)
                 : undefined;
@@ -8449,9 +8944,10 @@ export class HyperLiquidProvider {
                                 builderOrderContext && { builder: builderOrderContext }),
                         });
                         statuses = result.response?.data?.statuses ?? [];
+                        this.#recordUnsupportedAccountFromStatuses(statuses, result, accountContext);
                     }
                     catch (error) {
-                        const failure = await this.#classifyProtectionWriteError(error);
+                        const failure = await this.#classifyProtectionWriteError(error, accountContext);
                         restorationFailure = failure;
                         statuses =
                             this.#readProtectionErrorStatuses(error) ??
@@ -8505,10 +9001,10 @@ export class HyperLiquidProvider {
             await assertCurrentPosition();
             const oldCancellation = await this.#cancelOrderRequestBatch(exchangeClient, cancelRequests, async (error) => {
                 if (cancelGuardFailure !== undefined) {
-                    throw await this.#classifyProtectionWriteError(cancelGuardFailure);
+                    throw await this.#classifyProtectionWriteError(cancelGuardFailure, accountContext);
                 }
                 if (isHyperLiquidMultiSigRequiredError(error)) {
-                    throw await this.#classifyProtectionWriteError(error);
+                    throw await this.#classifyProtectionWriteError(error, accountContext);
                 }
             });
             // The signer could not sign the cancel. With nothing cancelled the old
@@ -8606,11 +9102,12 @@ export class HyperLiquidProvider {
                         builderOrderContext && { builder: builderOrderContext }),
                 });
                 placementStatuses = result.response?.data?.statuses ?? [];
+                this.#recordUnsupportedAccountFromStatuses(placementStatuses, result, accountContext);
                 responseAccepted = result.status === 'ok';
             }
             catch (error) {
                 // Drop and report a rejected agent before restoration signs.
-                placementFailure = await this.#classifyProtectionWriteError(error);
+                placementFailure = await this.#classifyProtectionWriteError(error, accountContext);
                 await assertScope();
                 const statuses = this.#readProtectionErrorStatuses(error);
                 if (statuses !== undefined) {
@@ -8726,7 +9223,7 @@ export class HyperLiquidProvider {
                         error.message === PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED)) {
                     // Old protection has already changed. Classification must not
                     // throw away this batch's still-live replacement identities.
-                    cleanupFailure = await this.#classifyProtectionWriteError(error);
+                    cleanupFailure = await this.#classifyProtectionWriteError(error, accountContext);
                 }
             });
             await assertScope();
@@ -8804,7 +9301,9 @@ export class HyperLiquidProvider {
             this.#deps.debugLogger.log('Closing position:', params);
             // The delegated placeOrder call resolves the builder-fee policy for the
             // concrete close order after validation.
-            await this.#ensureReadyForTrading({ requiresBuilderFee: false });
+            const { accountContext } = await this.#ensureReadyForTrading({
+                requiresBuilderFee: false,
+            });
             // A caller snapshot is never authoritative for a reduce-only close. Use
             // the current DEX slice or its HTTP fallback, and fail closed if neither
             // answers. This keeps the size and side on one freshness contract across
@@ -8883,7 +9382,8 @@ export class HyperLiquidProvider {
             // position.
             const isFullClose = closeSizeNum >= absPositionSize;
             // Execute position close with consistent slippage handling
-            const result = await this.placeOrder({
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Position close');
+            const result = await this.#placeOrder({
                 symbol: params.symbol,
                 isBuy,
                 size: closeSize,
@@ -8903,7 +9403,7 @@ export class HyperLiquidProvider {
                 usdAmount: isFullClose ? undefined : params.usdAmount,
                 priceAtCalculation: params.priceAtCalculation,
                 maxSlippageBps: params.maxSlippageBps,
-            }, 0, false);
+            }, 0, false, accountContext);
             // Return freed margin using native abstraction or programmatic transfer
             if (result.success &&
                 isHip3Position &&
@@ -8912,6 +9412,7 @@ export class HyperLiquidProvider {
                 this.#deps.debugLogger.log('Position closed successfully, initiating manual auto-transfer back');
                 // Non-blocking: Transfer freed margin back to main DEX
                 await this.#autoTransferBackAfterClose({
+                    accountContext,
                     sourceDex: hip3Dex,
                     freedMargin,
                 });
@@ -8954,11 +9455,13 @@ export class HyperLiquidProvider {
      * - ntli: Amount in micro-units (amount * 1e6)
      */
     async updateMargin(params) {
+        let accountContext;
         try {
             this.#deps.debugLogger.log('Updating position margin:', params);
             const { symbol, amount } = params;
             // Ensure provider is ready
             await this.#ensureReady();
+            accountContext = await this.#assertAccountSupported();
             // Use the target DEX's current slice or one targeted HTTP read before
             // deriving the position side.
             const positions = await this.#getPositionsForOperation(parseAssetName(symbol).dex ?? '');
@@ -8994,6 +9497,7 @@ export class HyperLiquidProvider {
                 }
             }
             // Call SDK to update isolated margin
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Margin update');
             const exchangeClient = this.#clientService.getExchangeClient();
             const result = await exchangeClient.updateIsolatedMargin({
                 asset: assetId,
@@ -9009,13 +9513,18 @@ export class HyperLiquidProvider {
             };
         }
         catch (error) {
+            const isMultiSigRequired = accountContext
+                ? this.#recordUnsupportedAccountFromError(error, accountContext)
+                : false;
             const signerFailure = await this.#handleSignerFailure(error, 'updateMargin', {
                 symbol: params.symbol,
             });
             if (signerFailure) {
                 return { success: false, error: signerFailure.message };
             }
-            const safeError = ensureError(error, 'HyperLiquidProvider.updateMargin');
+            const safeError = isMultiSigRequired
+                ? new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED)
+                : ensureError(error, 'HyperLiquidProvider.updateMargin');
             this.#deps.logger.error(safeError, this.#getErrorContext('updateMargin', {
                 symbol: params.symbol,
                 amount: params.amount,
@@ -9904,6 +10413,22 @@ export class HyperLiquidProvider {
             return [];
         }
     }
+    /**
+     * Return whether the active wallet can submit Hyperliquid actions.
+     *
+     * @returns The provider-owned account support result.
+     */
+    async getAccountSupport() {
+        await this.#ensureReady();
+        const context = {
+            lifecycleGeneration: this.#lifecycleGeneration,
+            network: this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet',
+            userAddress: await this.#walletService.getUserAddressWithDefault(),
+        };
+        const support = await this.#getAccountSupportForContext(context);
+        await this.#assertAccountContextCurrent(context, 'Account support read');
+        return support;
+    }
     /**
      * Resolve the provider's currently active CAIP account identifier.
      * Used by the MarketDataService REST coalesce layer so cached payloads
@@ -10943,6 +11468,7 @@ export class HyperLiquidProvider {
      * @returns Result with txHash (HyperLiquid internal) and withdrawal ID
      */
     async withdraw(params) {
+        let accountContext;
         try {
             this.#deps.debugLogger.log('HyperLiquidProvider: STARTING WITHDRAWAL', {
                 params,
@@ -10995,6 +11521,16 @@ export class HyperLiquidProvider {
             this.#deps.debugLogger.log('HyperLiquidProvider: ASSET SUPPORTED', {
                 assetId: params.assetId,
             });
+            const lifecycleGeneration = this.#lifecycleGeneration;
+            const network = this.#clientService.isTestnetMode()
+                ? 'testnet'
+                : 'mainnet';
+            const userAddress = await this.#walletService.getUserAddressWithDefault();
+            accountContext = {
+                lifecycleGeneration,
+                network,
+                userAddress,
+            };
             // Step 3: Determine destination address
             this.#deps.debugLogger.log('HyperLiquidProvider: DETERMINING DESTINATION ADDRESS');
             let destination;
@@ -11005,7 +11541,7 @@ export class HyperLiquidProvider {
                 });
             }
             else {
-                destination = await this.#walletService.getUserAddressWithDefault();
+                destination = userAddress;
                 this.#deps.debugLogger.log('HyperLiquidProvider: USING USER WALLET ADDRESS', {
                     destination,
                 });
@@ -11013,8 +11549,13 @@ export class HyperLiquidProvider {
             // Step 4: Ensure client is ready
             this.#deps.debugLogger.log('HyperLiquidProvider: ENSURING CLIENT READY');
             await this.#ensureReady();
-            await this.#ensureUnifiedAccountEnabled({ allowUserSigning: true });
-            const exchangeClient = this.#clientService.getExchangeClient();
+            accountContext = await this.#assertAccountSupported(accountContext);
+            await this.#ensureUnifiedAccountEnabled({
+                allowUserSigning: true,
+                accountContext,
+            });
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Withdrawal');
+            const exchangeClient = this.#getAccountGuardedExchangeClient(accountContext, 'Withdrawal dispatch');
             this.#deps.debugLogger.log('HyperLiquidProvider: CLIENT READY');
             // Step 5: Validate amount against account balance
             this.#deps.debugLogger.log('HyperLiquidProvider: CHECKING ACCOUNT BALANCE');
@@ -11063,6 +11604,7 @@ export class HyperLiquidProvider {
                 endpoint: 'withdraw3',
                 timestamp: new Date().toISOString(),
             });
+            await this.#assertNoKnownUnsupportedAccount(accountContext, 'Withdrawal');
             const result = await exchangeClient.withdraw3({
                 destination,
                 amount: params.amount,
@@ -11089,7 +11631,11 @@ export class HyperLiquidProvider {
                     // HyperLiquid's withdraw3 API doesn't return a transaction hash immediately
                 };
             }
-            const errorMessage = `Withdrawal failed: ${String(result.status)}`;
+            const rejection = new Error(`Withdrawal failed: ${JSON.stringify(result)}`);
+            const isMultiSigRequired = this.#recordUnsupportedAccountFromError(rejection, accountContext);
+            const errorMessage = isMultiSigRequired
+                ? PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED
+                : `Withdrawal failed: ${String(result.status)}`;
             this.#deps.debugLogger.log('HyperLiquidProvider: WITHDRAWAL FAILED', {
                 error: errorMessage,
                 status: result.status,
@@ -11102,13 +11648,18 @@ export class HyperLiquidProvider {
             };
         }
         catch (error) {
+            const isMultiSigRequired = accountContext
+                ? this.#recordUnsupportedAccountFromError(error, accountContext)
+                : false;
             const signerFailure = await this.#handleSignerFailure(error, 'withdraw', {
                 assetId: params.assetId,
             });
             if (signerFailure) {
                 return createErrorResult(signerFailure, { success: false });
             }
-            const safeError = ensureError(error, 'HyperLiquidProvider.initiateWithdrawal');
+            const safeError = isMultiSigRequired
+                ? new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED)
+                : ensureError(error, 'HyperLiquidProvider.initiateWithdrawal');
             this.#deps.debugLogger.log('HyperLiquidProvider: WITHDRAWAL EXCEPTION', {
                 error: safeError.message,
                 errorType: safeError.name,
@@ -11124,7 +11675,7 @@ export class HyperLiquidProvider {
                 operation: PERPS_ERROR_OPERATION.FinancialOperations,
                 action: PERPS_ERROR_ACTION.FinancialWithdrawal,
             }));
-            return createErrorResult(error, { success: false });
+            return createErrorResult(safeError, { success: false });
         }
     }
     /**
@@ -11147,6 +11698,19 @@ export class HyperLiquidProvider {
      * });
      */
     async transferBetweenDexs(params) {
+        return await this.#transferBetweenDexs(params);
+    }
+    /**
+     * Transfer collateral with an optional context captured by a parent action.
+     *
+     * @param params - Transfer parameters.
+     * @param expectedContext - Context captured by the parent action.
+     * @param allowStaleLifecycle - Whether a compensating cleanup may run after
+     * provider teardown while the address and network remain unchanged.
+     * @returns The transfer result.
+     */
+    async #transferBetweenDexs(params, expectedContext, allowStaleLifecycle = false) {
+        let accountContext;
         try {
             this.#deps.debugLogger.log('HyperLiquidProvider: STARTING DEX TRANSFER', {
                 params,
@@ -11159,14 +11723,23 @@ export class HyperLiquidProvider {
             if (params.sourceDex === params.destinationDex) {
                 throw new Error('Source and destination DEX must be different');
             }
-            // Get user address
-            const userAddress = await this.#walletService.getUserAddressWithDefault();
+            if (allowStaleLifecycle) {
+                if (!expectedContext) {
+                    throw new Error(PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE);
+                }
+                accountContext = expectedContext;
+                await this.#assertRollbackAccountWritable(accountContext);
+            }
+            else {
+                // Ensure client ready
+                await this.#ensureReady();
+                accountContext = await this.#assertAccountSupported(expectedContext);
+            }
+            const transferAccountContext = accountContext;
+            const { userAddress } = accountContext;
             this.#deps.debugLogger.log('HyperLiquidProvider: USER ADDRESS', {
                 userAddress,
             });
-            // Ensure client ready
-            await this.#ensureReady();
-            const exchangeClient = this.#clientService.getExchangeClient();
             // Execute transfer using SDK sendAsset()
             // Note: SDK docs say "testnet-only" but it works on mainnet (verified via Phantom)
             this.#deps.debugLogger.log('HyperLiquidProvider: CALLING SEND_ASSET API', {
@@ -11174,11 +11747,21 @@ export class HyperLiquidProvider {
                 destinationDex: params.destinationDex || '(main)',
                 amount: params.amount,
             });
+            const token = await this.#getUsdcTokenId();
+            if (allowStaleLifecycle) {
+                await this.#assertRollbackAccountWritable(accountContext);
+            }
+            else {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'DEX transfer');
+            }
+            const exchangeClient = this.#clientService.getExchangeClient(allowStaleLifecycle
+                ? async () => await this.#assertRollbackAccountWritable(transferAccountContext)
+                : async () => await this.#assertNoKnownUnsupportedAccount(transferAccountContext, 'DEX transfer dispatch'));
             const result = await exchangeClient.sendAsset({
                 destination: userAddress,
                 sourceDex: params.sourceDex,
                 destinationDex: params.destinationDex,
-                token: await this.#getUsdcTokenId(), // Query correct USDC token ID dynamically
+                token,
                 amount: params.amount,
             });
             this.#deps.debugLogger.log('HyperLiquidProvider: SEND_ASSET RESPONSE', {
@@ -11193,14 +11776,22 @@ export class HyperLiquidProvider {
                     // User can verify transfer in explorer by timestamp
                 };
             }
+            if (this.#recordUnsupportedAccountFromError(new Error(`DEX transfer failed: ${JSON.stringify(result)}`), accountContext)) {
+                throw new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED);
+            }
             throw new Error(PERPS_ERROR_CODES.TRANSFER_FAILED);
         }
         catch (error) {
+            const isMultiSigRequired = accountContext
+                ? this.#recordUnsupportedAccountFromError(error, accountContext)
+                : false;
             const signerFailure = await this.#handleSignerFailure(error, 'transferBetweenDexs', { sourceDex: params.sourceDex, destinationDex: params.destinationDex });
             if (signerFailure) {
                 return { success: false, error: signerFailure.message };
             }
-            const safeError = ensureError(error, 'HyperLiquidProvider.transferToSpot');
+            const safeError = isMultiSigRequired
+                ? new Error(PERPS_ERROR_CODES.EXCHANGE_MULTI_SIG_REQUIRED)
+                : ensureError(error, 'HyperLiquidProvider.transferToSpot');
             this.#deps.debugLogger.log('❌ HyperLiquidProvider: TRANSFER FAILED', {
                 error: safeError.message,
                 params,
@@ -11212,6 +11803,27 @@ export class HyperLiquidProvider {
             };
         }
     }
+    /**
+     * Transfer collateral using a context captured by a parent action.
+     *
+     * @param params - Transfer parameters.
+     * @param accountContext - Original action context for the transfer.
+     * @returns The transfer result.
+     */
+    async #transferBetweenDexsForContext(params, accountContext) {
+        return await this.#transferBetweenDexs(params, accountContext);
+    }
+    /**
+     * Return collateral for a completed action after teardown, provided the
+     * selected address and network still own the captured context.
+     *
+     * @param params - Transfer parameters.
+     * @param accountContext - Original action context for the cleanup.
+     * @returns The transfer result.
+     */
+    async #transferBetweenDexsForCleanup(params, accountContext) {
+        return await this.#transferBetweenDexs(params, accountContext, true);
+    }
     /**
      * Subscribe to live price updates
      *
@@ -11494,6 +12106,11 @@ export class HyperLiquidProvider {
         try {
             const lifecycleGeneration = this.#lifecycleGeneration;
             const userAddress = await this.#walletService.getUserAddressWithDefault();
+            const preparationContext = {
+                lifecycleGeneration,
+                network: this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet',
+                userAddress,
+            };
             // The result is only for the provider and account it started with.
             const assertPreparationCurrent = async () => {
                 this.#assertProviderLifecycleCurrent(lifecycleGeneration, 'Trading wallet preparation');
@@ -11505,13 +12122,13 @@ export class HyperLiquidProvider {
                     throw new Error(PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE);
                 }
             };
-            await this.#ensureReadyForTrading({
+            const { accountContext } = await this.#ensureReadyForTrading({
                 requiresBuilderFee: false,
                 recheckPendingReferral: true,
+                accountContext: preparationContext,
             });
-            const network = this.#clientService.isTestnetMode()
-                ? 'testnet'
-                : 'mainnet';
+            await assertPreparationCurrent();
+            const { network } = accountContext;
             const isRegistered = await this.#isWalletOnHyperliquid(userAddress, network);
             await assertPreparationCurrent();
             // The venue rejects every write from a wallet with no HyperLiquid account
@@ -11527,7 +12144,7 @@ export class HyperLiquidProvider {
             await this.#ensureBuilderFeeSetup(undefined, {
                 reportSignerFailure: true,
                 reportRefusal: true,
-            });
+            }, accountContext);
             // The builder fee setup ends quietly when the provider disconnects.
             await assertPreparationCurrent();
             if (!this.#walletService.isMainAccountSignerReady()) {
@@ -12171,6 +12788,7 @@ export class HyperLiquidProvider {
             // Clear session caches. Capability and fee reads use the lifecycle
             // generation above to discard any old response that resolves later.
             this.clearFeeCache();
+            this.#accountSupportByContext.clear();
             this.#referralCheckCache.clear();
             this.#builderFeeCheckCache.clear();
             this.#builderFeeRefusals.clear();
@@ -12416,20 +13034,26 @@ export class HyperLiquidProvider {
      *
      * Note: This is network-specific - testnet and mainnet have separate referral states
      * Note: Non-blocking - failures are logged to Sentry but don't prevent trading
+     *
+     * @param accountContext - Account/network/lifecycle captured by the action
+     * that is allowed to authorize a referral write.
      */
-    async #ensureReferralSet() {
+    async #ensureReferralSet(accountContext) {
         this.#referralSetupNeedsRetry = false;
         this.#referralAwaitsBuilderCode = false;
-        const isTestnet = this.#clientService.isTestnetMode();
-        const network = isTestnet ? 'testnet' : 'mainnet';
+        const network = accountContext?.network ??
+            (this.#clientService.isTestnetMode() ? 'testnet' : 'mainnet');
+        const isTestnet = network === 'testnet';
         const expectedReferralCode = this.#getReferralCode(isTestnet);
         const referrerAddress = this.#getBuilderAddress(isTestnet);
-        let userAddress;
-        try {
-            userAddress = await this.#walletService.getUserAddressWithDefault();
-        }
-        catch {
-            return; // Can't proceed without address
+        let userAddress = accountContext?.userAddress;
+        if (!userAddress) {
+            try {
+                userAddress = await this.#walletService.getUserAddressWithDefault();
+            }
+            catch {
+                return; // Can't proceed without address
+            }
         }
         if (userAddress.toLowerCase() === referrerAddress.toLowerCase()) {
             this.#deps.debugLogger.log('[ensureReferralSet] User is builder, skipping', { network });
@@ -12471,6 +13095,9 @@ export class HyperLiquidProvider {
                 return;
             }
             const codeStatus = await this.#getReferralCodeStatus();
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Referral code lookup');
+            }
             if (codeStatus !== 'ready') {
                 this.#deps.debugLogger.log('[ensureReferralSet] Builder referral not ready, skipping', { network, codeStatus });
                 // Don't cache. A failed lookup (already logged) waits for the next
@@ -12480,7 +13107,10 @@ export class HyperLiquidProvider {
                 return;
             }
             // Check if user already has a referral on-chain
-            const hasReferral = await this.#checkReferralSet();
+            const hasReferral = await this.#checkReferralSet(userAddress);
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Referral account lookup');
+            }
             if (hasReferral) {
                 // Already has referral on-chain
                 PerpsSigningCache.setReferral(network, userAddress, {
@@ -12491,7 +13121,7 @@ export class HyperLiquidProvider {
             }
             else {
                 this.#deps.debugLogger.log('[ensureReferralSet] Setting referral (will show signing request)', { network, referralCode: expectedReferralCode });
-                const result = await this.#setReferralCode();
+                const result = await this.#setReferralCode(accountContext);
                 if (result) {
                     this.#deps.debugLogger.log('[ensureReferralSet] Referral set successfully', { network });
                     PerpsSigningCache.setReferral(network, userAddress, {
@@ -12519,6 +13149,11 @@ export class HyperLiquidProvider {
                 completeInFlight();
                 return;
             }
+            if (accountContext &&
+                this.#recordUnsupportedAccountFromError(error, accountContext)) {
+                completeInFlight();
+                return;
+            }
             // Safety net: wallet looked registered but the SDK still rejects with
             // "User or API Wallet 0x... does not exist." Do not forward to Sentry.
             // The walletRegistered cache stores positive observations only, so no
@@ -12528,6 +13163,12 @@ export class HyperLiquidProvider {
                 completeInFlight();
                 return;
             }
+            if (accountContext &&
+                ensureError(error, 'HyperLiquidProvider.ensureReferralSet').message ===
+                    PERPS_ERROR_CODES.PROVIDER_LIFECYCLE_STALE) {
+                completeInFlight();
+                throw error;
+            }
             // Cache failure to prevent retries
             PerpsSigningCache.setReferral(network, userAddress, {
                 attempted: true,
@@ -12585,18 +13226,20 @@ export class HyperLiquidProvider {
     /**
      * Check if user has a referral code set with HyperLiquid
      *
+     * @param userAddress - Account to inspect, or the currently selected account
+     * when omitted.
      * @returns Promise resolving to true if referral is set, false otherwise
      */
-    async #checkReferralSet() {
+    async #checkReferralSet(userAddress) {
         try {
             const infoClient = this.#clientService.getInfoClient();
-            const userAddress = await this.#walletService.getUserAddressWithDefault();
+            const referralUserAddress = userAddress ?? (await this.#walletService.getUserAddressWithDefault());
             // Call HyperLiquid API to check if user has a referral set
             const referralData = await infoClient.referral({
-                user: userAddress,
+                user: referralUserAddress,
             });
             this.#deps.debugLogger.log('Referral check result:', {
-                userAddress,
+                userAddress: referralUserAddress,
                 referralData,
             });
             return Boolean(referralData?.referredBy?.code);
@@ -12620,11 +13263,18 @@ export class HyperLiquidProvider {
     /**
      * Set MetaMask as the user's referrer on HyperLiquid
      *
+     * @param accountContext - Account/network/lifecycle captured by the action
+     * that is allowed to authorize this write.
      * @returns A promise that resolves to the boolean result.
      */
-    async #setReferralCode() {
+    async #setReferralCode(accountContext) {
         try {
-            const exchangeClient = this.#clientService.getExchangeClient();
+            if (accountContext) {
+                await this.#assertNoKnownUnsupportedAccount(accountContext, 'Referral setup');
+            }
+            const exchangeClient = accountContext
+                ? this.#getAccountGuardedExchangeClient(accountContext, 'Referral setup dispatch')
+                : this.#clientService.getExchangeClient();
             const referralCode = this.#getReferralCode(this.#clientService.isTestnetMode());
             this.#deps.debugLogger.log('[setReferralCode] Setting referral code', {
                 code: referralCode,
@@ -12635,9 +13285,18 @@ export class HyperLiquidProvider {
                 code: referralCode,
             });
             this.#deps.debugLogger.log('[setReferralCode] Referral code set result', result);
+            if (result?.status !== 'ok' &&
+                accountContext &&
+                this.#recordUnsupportedAccountFromError(new Error(`Referral setup failed: ${JSON.stringify(result)}`), accountContext)) {
+                return false;
+            }
             return result?.status === 'ok';
         }
         catch (error) {
+            if (accountContext &&
+                this.#recordUnsupportedAccountFromError(error, accountContext)) {
+                throw error;
+            }
             // Retryable (a locked keyring, an unavailable agent, or one the venue
             // rejected): `#ensureReferralSet` retries at the next entry, so it is
             // not an error to report.