@senpi/runtime 3.0.103 → 3.0.107

package/dist/actions/open-position/open-position.action.js

@@ -12,15 +12,30 @@ import { createLogger } from '../../utils/logger.js';
 import { positionRegistryKey } from '../../runtime/position-id-registry.js';
 import { resolveOpenOrderType, resolveFeeOptimizedLimitOptions } from '../../utils/resolve-order-type.js';
 import { emitActionResultEvents, emitOrderPlaced, emitOrderFilled, emitOrderFailed, buildActionEventContext } from '../action-events.js';
-import { skippedSignalResults } from '../skipped-signal-results.js';
 import { withSpan } from '../../telemetry/tracing.js';
 import { SpanStatusCode } from '@opentelemetry/api';
 import { classifyToolError } from '../../senpi/tool-errors.js';
+import { hasOpenPositionIn } from '../../strategy/strategy-state.js';
+import { createPendingOpensLedger, pendingOpenKey } from '../../runtime/pending-opens-ledger.js';
+import { recordSignalOutcome } from '../../telemetry/metrics.js';
 const logger = createLogger("[actions][open-position]");
 /** Hyperliquid minimum notional value (margin × leverage) required to open a position. */
 const MIN_NOTIONAL_VALUE = 10;
 /** Minimum leverage floor — positions cannot go below 1x. */
 const MIN_LEVERAGE = 1;
+/**
+ * How long the view fetched at the top of `handle` is trusted before the signal loop
+ * refetches it.
+ *
+ * The gap between the two is a decision, and an LLM decision takes seconds — long enough
+ * for a fill, a liquidation or a manual close to move the book underneath the numbers the
+ * entry is about to be sized against. Five seconds is the order of the snapshot's own age,
+ * so anything older is worth a second read; the rule-decision path resolves well inside it
+ * and never pays for one.
+ */
+const CLEARINGHOUSE_VIEW_MAX_AGE_MS = 5_000;
+/** Minimum gap between repeats of the full-book log while the book STAYS full. */
+const NO_SLOTS_LOG_INTERVAL_MS = 30 * 60 * 1000;
 // ─── Open Position Action ───────────────────────────────────────────────────
 export class OpenPositionAction {
     config;
@@ -28,6 +43,21 @@ export class OpenPositionAction {
     name;
     actionType = 'OPEN_POSITION';
     decisionEngine;
+    /**
+     * Ledger of last resort for a context that carries none (standalone scripts, older call
+     * sites). Private to this action, so it still counts this action's own in-flight opens.
+     */
+    ownPendingOpens = createPendingOpensLedger();
+    /**
+     * Edge-trigger state for the full-book log: `full` is the level, the rest bound the repeat
+     * rate while it stays full. Instance state on purpose — a full book is a property of this
+     * strategy, and the action is one per recipe.
+     */
+    noSlotsLog = {
+        full: false,
+        lastLoggedAt: 0,
+        suppressed: 0,
+    };
     constructor(config, context) {
         this.config = config;
         this.context = context;
@@ -94,53 +124,61 @@ export class OpenPositionAction {
         // re-submitting on every signal.
         if (this.context.backendPauseRegistry?.isPaused(address)) {
             logger.warn('Skipping signals: strategy is paused or closed on the backend', { wallet: address });
-            const pausedResults = skippedSignalResults(scanResult.signals, 'strategy_backend_paused', Date.now());
-            const pausedResult = {
+            return {
                 success: true,
                 action_type: this.actionType,
                 summary: 'Strategy is paused or closed on the backend — skipping signals until it is resumed',
                 skipped: true,
                 skipReason: 'strategy_backend_paused',
-                data: {
-                    results: pausedResults,
-                    submittedCount: 0,
-                    failedCount: 0,
-                    skippedCount: pausedResults.length,
-                },
             };
-            // No decision ran yet, so the pass carries no `_decisionMeta` and yields no `decision.made`.
-            emitActionResultEvents(this.eventCtx(), event, address, pausedResult, { scanResult });
-            return pausedResult;
         }
-        // Early exit: no slots.
+        // The exchange view for THIS pass. Read here, once, and threaded through the rest of it.
+        //
+        // This context's StrategyState is not the instance the DSL monitor refreshes each tick —
+        // they are two objects built from the same config — so its cached view was only ever
+        // written by an earlier pass through this action, if at all. Reading the cache therefore
+        // froze the slot gate, the dedupe check and the margin budget at whatever the first
+        // signal after boot happened to see: a full snapshot skipped every later signal forever,
+        // an empty one let the slot cap and the dedupe never bind at all.
+        const view = await strategyState.fetchClearinghouseState({ retryUnreadable: true });
+        if (view === undefined) {
+            return this.skipClearinghouseUnknown(event, address, [], undefined, undefined, { scanResult });
+        }
+        const snapshot = { view, fetchedAt: Date.now() };
+        // Early exit: no slots. Counted as snapshot positions PLUS opens this runtime has already
+        // submitted that the snapshot is too old to show (see PendingOpensLedger).
+        //
         // NOTE re "zero slots skips cap alerts": we intentionally do NOT evaluate risk
         // halts/cap self-pause here. It would add a per-signal getPnlHistoryWithSnapshot
         // MCP call on the full-book path (costly on a full + high-signal-rate strategy),
         // and that halt data is fetched nowhere else to reuse (only risk-guard.checkGate
-        // fetches it; the DSL monitor fetches clearinghouse = different data). Self-pause
+        // fetches it — the clearinghouse read above is different data). Self-pause
         // alerts still fire via the normal open path once a slot frees and a signal
         // arrives (delayed, not lost). A durable fix — a periodic lifecycle driven off
         // the monitor tick / bus events (also catches a fully-silent producer) — is
         // deliberately out of scope here.
-        if (!strategyState.getAvailableSlots?.()) {
-            const noSlotResults = skippedSignalResults(scanResult.signals, 'no_slots', Date.now());
-            const noSlotResult = {
+        const ledger = this.pendingOpens();
+        ledger.reconcile(view.positions);
+        const pending = ledger.unseen(view.positions);
+        const slots = strategyState.config.slots;
+        const openCount = view.positions.length + pending.length;
+        if (openCount >= slots) {
+            this.logBookFull(address, openCount, slots, pending.map((p) => p.coin), view.positions);
+            // The per-signal `results[]`/event fan-out is deliberately NOT built here: a full book
+            // on a high-signal-rate strategy is the loudest path there is, and the outcome is one
+            // fact about the strategy, not one per candidate. The counter still carries it.
+            recordSignalOutcome({ result: 'skipped', reasonCode: 'no_slots' });
+            return {
                 success: true,
                 action_type: this.actionType,
-                summary: 'No slots available',
+                summary: `No slots available (${openCount}/${slots} open)`,
                 skipped: true,
                 skipReason: 'no_slots',
-                data: {
-                    results: noSlotResults,
-                    submittedCount: 0,
-                    failedCount: 0,
-                    skippedCount: noSlotResults.length,
-                },
+                data: { openCount, slots, pendingCount: pending.length },
             };
-            // No decision ran yet, so the pass carries no `_decisionMeta` and yields no `decision.made`.
-            emitActionResultEvents(this.eventCtx(), event, address, noSlotResult, { scanResult });
-            return noSlotResult;
         }
+        // A pass with room re-arms the edge, so the next time the book fills it is logged again.
+        this.noSlotsLog.full = false;
         logger.info('building context');
         // Build context
         const providerRequest = {
@@ -152,43 +190,17 @@ export class OpenPositionAction {
                 ? (address, scannerId) => this.context.scannerModule.getScannerContext(address, scannerId)
                 : undefined,
         };
-        // A context provider or the prompt template can throw before any decision exists. Both are
-        // preparation for the same decision, so they fail as one unit: the scan signals are recorded as
-        // failures and the pass returns, instead of the throw escaping to the caller unrecorded.
-        let contextData;
-        let interpolatedPrompt;
-        try {
-            contextData = this.config.context?.length
-                ? await this.context.contextBuilder.build(this.config.context, providerRequest)
-                : {};
-            logger.info('context data', contextData);
-            // Interpolate prompt template with resolved context + action params
-            interpolatedPrompt = this.config.decision_prompt
-                ? interpolatePrompt(this.config.decision_prompt, {
-                    ...contextData,
-                    ...(this.config.params ?? {}),
-                })
-                : undefined;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            logger.error('context build failed', error, { wallet: address });
-            const contextErrorResults = skippedSignalResults(scanResult.signals, 'context_error', Date.now(), { success: false, error: message });
-            const contextErrorResult = {
-                success: false,
-                action_type: this.actionType,
-                summary: `Context build failed: ${message}`,
-                error: message,
-                data: {
-                    results: contextErrorResults,
-                    submittedCount: 0,
-                    failedCount: contextErrorResults.length,
-                    skippedCount: 0,
-                },
-            };
-            emitActionResultEvents(this.eventCtx(), event, address, contextErrorResult, { scanResult });
-            return contextErrorResult;
-        }
+        const contextData = this.config.context?.length
+            ? await this.context.contextBuilder.build(this.config.context, providerRequest)
+            : {};
+        logger.info('context data', contextData);
+        // Interpolate prompt template with resolved context + action params
+        const interpolatedPrompt = this.config.decision_prompt
+            ? interpolatePrompt(this.config.decision_prompt, {
+                ...contextData,
+                ...(this.config.params ?? {}),
+            })
+            : undefined;
         // Get decision
         let decision;
         try {
@@ -204,20 +216,12 @@ export class OpenPositionAction {
             const message = error instanceof Error ? error.message : String(error);
             await emitDecisionErrorNotification(this.context, message);
             const eventCtx = this.eventCtx();
-            // The decision produced nothing usable, so the scan signals are the only attributable inputs.
-            // The rows are failures, not skips: `success: false` plus the error message, counted under
-            // `failedCount` so the pass does not read as benign on the span or the stored record.
-            const errorResults = skippedSignalResults(scanResult.signals, 'decision_error', Date.now(), { success: false, error: message });
             const errorResult = {
                 success: false,
                 action_type: this.actionType,
                 summary: `Decision failed: ${message}`,
                 error: message,
                 data: {
-                    results: errorResults,
-                    submittedCount: 0,
-                    failedCount: errorResults.length,
-                    skippedCount: 0,
                     _decisionMeta: {
                         durationMs: 0,
                         tokensUsed: null,
@@ -241,7 +245,6 @@ export class OpenPositionAction {
         // Check decision
         if (!decision.execute) {
             logger.info('decision no execute', decision);
-            const noExecuteResults = skippedSignalResults(scanResult.signals, 'decision_no_execute', Date.now());
             const rejectedResult = {
                 success: true,
                 action_type: this.actionType,
@@ -249,10 +252,6 @@ export class OpenPositionAction {
                 skipped: true,
                 skipReason: 'decision_no_execute',
                 data: {
-                    results: noExecuteResults,
-                    submittedCount: 0,
-                    failedCount: 0,
-                    skippedCount: noExecuteResults.length,
                     confidence: decision.confidence,
                     reasoning: decision.reasoning,
                     _decisionMeta: decisionMetaFromDecision(this.config, decision),
@@ -265,7 +264,6 @@ export class OpenPositionAction {
         // Check confidence threshold
         if (isBelowConfidence) {
             logger.info('confidence below threshold', { confidence: decision.confidence, threshold: minConfidence });
-            const belowConfResults = skippedSignalResults(scanResult.signals, 'below_confidence', Date.now());
             const belowConfResult = {
                 success: true,
                 action_type: this.actionType,
@@ -273,10 +271,6 @@ export class OpenPositionAction {
                 skipped: true,
                 skipReason: 'below_confidence',
                 data: {
-                    results: belowConfResults,
-                    submittedCount: 0,
-                    failedCount: 0,
-                    skippedCount: belowConfResults.length,
                     confidence: decision.confidence,
                     threshold: minConfidence,
                     _decisionMeta: decisionMetaFromDecision(this.config, decision),
@@ -290,27 +284,92 @@ export class OpenPositionAction {
         const signals = this.normalizeSignals(decision.payload);
         const meta = decisionMetaFromDecision(this.config, decision);
         if (!signals.length) {
-            // `success: false` on each row so the outcome classifies as rejected, matching the batch
-            // result, and the rows are counted as failures rather than skips.
-            const invalidPayloadResults = skippedSignalResults(scanResult.signals, 'invalid_payload', Date.now(), { success: false });
             const invalidPayloadResult = {
                 success: false,
                 action_type: this.actionType,
                 summary: 'Invalid decision payload: no actionable signals',
                 error: 'invalid_payload',
-                data: {
-                    results: invalidPayloadResults,
-                    submittedCount: 0,
-                    failedCount: invalidPayloadResults.length,
-                    skippedCount: 0,
-                    _decisionMeta: meta,
-                    _decisionPrompt: interpolatedPrompt ?? null,
-                },
+                data: { _decisionMeta: meta, _decisionPrompt: interpolatedPrompt ?? null },
             };
             emitActionResultEvents(eventCtx, event, address, invalidPayloadResult, trackingExtras);
             return invalidPayloadResult;
         }
-        return this.handleSignals(signals, event, strategyState, decision.reasoning, meta, interpolatedPrompt, trackingExtras);
+        return this.handleSignals(signals, event, strategyState, snapshot, decision.reasoning, meta, interpolatedPrompt, trackingExtras);
+    }
+    /** The pending-opens ledger this action counts against — the context's when it has one. */
+    pendingOpens() {
+        return this.context.pendingOpensLedger ?? this.ownPendingOpens;
+    }
+    /**
+     * Edge-triggered full-book log: once on the transition into full, then at most once per
+     * {@link NO_SLOTS_LOG_INTERVAL_MS} with the count it suppressed in between.
+     *
+     * The early `no_slots` skip used to return silently, so a strategy that had stopped
+     * entering looked identical in the logs to one with no signals — the single hardest state
+     * to diagnose from a box. Logging every signal instead would bury the log, which is how it
+     * came to be silent in the first place.
+     */
+    logBookFull(address, openCount, slots, pendingCoins, positions) {
+        const now = Date.now();
+        const attributes = {
+            wallet: address,
+            open: openCount,
+            slots,
+            pending: pendingCoins.length,
+            coins: [...positions.map((p) => p.coin), ...pendingCoins],
+        };
+        if (!this.noSlotsLog.full) {
+            this.noSlotsLog = { full: true, lastLoggedAt: now, suppressed: 0 };
+            logger.info('skipping: no_slots', attributes);
+            return;
+        }
+        this.noSlotsLog.suppressed++;
+        if (now - this.noSlotsLog.lastLoggedAt >= NO_SLOTS_LOG_INTERVAL_MS) {
+            logger.info('skipping: no_slots', { ...attributes, suppressed: this.noSlotsLog.suppressed });
+            this.noSlotsLog.lastLoggedAt = now;
+            this.noSlotsLog.suppressed = 0;
+        }
+    }
+    /**
+     * Never open against an unknown exchange view. If the view is undefined after retries we
+     * cannot tell what is already open or how much free margin exists — skip every signal
+     * rather than risk a duplicate or an over-margined open.
+     *
+     * Shared by both read sites (the gate at the top of `handle`, and the stale-view refetch in
+     * the signal loop). `sorted` is empty at the early site — there is no decision, hence no
+     * candidates, yet — which is why the entries are built from it rather than assumed.
+     */
+    skipClearinghouseUnknown(event, address, sorted, meta, decisionPrompt, trackingExtras) {
+        const skippedResults = sorted.map((signal) => ({
+            asset: signal.asset,
+            direction: signal.direction,
+            dex: typeof signal.dex === 'string' && signal.dex.trim() !== '' ? signal.dex.trim() : 'main',
+            score: signal.score,
+            success: true,
+            reason: 'clearinghouse_unknown',
+        }));
+        logger.error('Skipping open: clearinghouse view unknown after retries', {
+            wallet: address,
+            skippedCount: skippedResults.length,
+            assets: skippedResults.map((r) => r.asset),
+        });
+        const skipResult = {
+            success: true,
+            action_type: this.actionType,
+            summary: 'Clearinghouse view unknown — skipped open',
+            skipped: true,
+            skipReason: 'clearinghouse_unknown',
+            data: {
+                results: skippedResults,
+                submittedCount: 0,
+                failedCount: 0,
+                skippedCount: skippedResults.length,
+                ...(meta ? { _decisionMeta: meta } : {}),
+                _decisionPrompt: decisionPrompt ?? null,
+            },
+        };
+        emitActionResultEvents(this.eventCtx(), event, address, skipResult, trackingExtras);
+        return skipResult;
     }
     normalizeSignals(payload) {
         if (Array.isArray(payload.signals))
@@ -325,7 +384,7 @@ export class OpenPositionAction {
         }
         return [];
     }
-    async handleSignals(signals, event, strategyState, reasoning, meta, decisionPrompt, trackingExtras) {
+    async handleSignals(signals, event, strategyState, snapshot, reasoning, meta, decisionPrompt, trackingExtras) {
         const address = event.address;
         const orderType = resolveOpenOrderType(this.config.params?.order_type);
         const feeOptimizedLimitOptions = orderType === 'FEE_OPTIMIZED_LIMIT'
@@ -352,70 +411,39 @@ export class OpenPositionAction {
                 return undefined;
             })(),
             (async () => {
-                // Resolve the exchange view once: it sizes margin_pct AND feeds the
-                // free-margin pre-flight below. A cached defined view is trusted;
-                // otherwise fetch with retry-on-unreadable so a transient unreadable
-                // response is retried rather than treated as an unknown book.
-                // A throw here is the same situation as an unreadable response — an unknown
-                // book — so it resolves undefined and falls into the skip below rather than
-                // escaping the action with no per-signal outcome recorded.
-                try {
-                    return strategyState.getClearinghouseState()
-                        ?? await strategyState.fetchClearinghouseState({ retryUnreadable: true });
-                }
-                catch (error) {
-                    logger.warn('Clearinghouse fetch threw; treating the exchange view as unknown', error, { wallet: address });
-                    return undefined;
-                }
+                // The view handed down from the slot gate, re-read only if the decision took long
+                // enough for it to go stale. No cached-getter fallback: the only view this action
+                // trusts is one it read itself, on this pass.
+                if (Date.now() - snapshot.fetchedAt <= CLEARINGHOUSE_VIEW_MAX_AGE_MS)
+                    return snapshot.view;
+                return strategyState.fetchClearinghouseState({ retryUnreadable: true });
             })(),
         ]);
         riskSnapshot = riskSnapResult;
-        // Never open against an unknown exchange view. If the view is still
-        // undefined after retries, we cannot tell what is already open or how much
-        // free margin exists — skip every signal rather than risk a duplicate or
-        // over-margined open.
         if (clearinghouseView === undefined) {
-            const skippedResults = sorted.map((signal) => ({
-                asset: signal.asset,
-                direction: signal.direction,
-                dex: typeof signal.dex === 'string' && signal.dex.trim() !== '' ? signal.dex.trim() : 'main',
-                score: signal.score,
-                success: true,
-                reason: 'clearinghouse_unknown',
-            }));
-            logger.error('Skipping open: clearinghouse view unknown after retries', {
-                wallet: address,
-                skippedCount: skippedResults.length,
-                assets: skippedResults.map((r) => r.asset),
-            });
-            const skipResult = {
-                success: true,
-                action_type: this.actionType,
-                summary: 'Clearinghouse view unknown — skipped open',
-                skipped: true,
-                skipReason: 'clearinghouse_unknown',
-                data: {
-                    results: skippedResults,
-                    submittedCount: 0,
-                    failedCount: 0,
-                    skippedCount: skippedResults.length,
-                    ...(meta ? { _decisionMeta: meta } : {}),
-                    // The snapshot resolved alongside the clearinghouse view, so it is in hand here. An
-                    // absent snapshot tells telemetry the gates never ran, which on this path is false.
-                    ...(riskSnapshot ? { _riskSnapshot: riskSnapshot } : {}),
-                    _decisionPrompt: decisionPrompt ?? null,
-                },
-            };
-            emitActionResultEvents(this.eventCtx(), event, address, skipResult, trackingExtras);
-            return skipResult;
+            return this.skipClearinghouseUnknown(event, address, sorted, meta, decisionPrompt, trackingExtras);
         }
-        const withdrawable = clearinghouseView.withdrawable;
-        let remainingSlots = strategyState.getAvailableSlots?.() ?? 0;
-        // Free-margin pre-flight budget. Undefined when withdrawable is unknown
-        // (no clearinghouse read) — in that case we do NOT block, preserving prior behavior.
+        // ONE snapshot decides everything below: slots, dedupe and margin. Mixing a second read
+        // in mid-batch is how the counts stopped agreeing with each other in the first place.
+        const view = clearinghouseView;
+        const withdrawable = view.withdrawable;
+        const ledger = this.pendingOpens();
+        ledger.reconcile(view.positions);
+        const pendingEntries = ledger.unseen(view.positions);
+        // Keys of opens already in flight: a dedupe hit the snapshot cannot produce yet.
+        const pendingKeys = new Set(pendingEntries.map((entry) => entry.key));
+        const pendingMargin = pendingEntries.reduce((sum, entry) => sum + entry.marginAmount, 0);
+        let remainingSlots = Math.max(0, strategyState.config.slots - (view.positions.length + pendingEntries.length));
+        // Free-margin pre-flight budget, and the basis `margin_pct` sizes off. Undefined when
+        // withdrawable is unknown — in that case we do NOT block, preserving prior behavior.
+        // Margin already committed by in-flight opens is subtracted: the snapshot still counts it
+        // as free, so sizing off the raw figure would size two positions out of one pot. Erring
+        // small is the safe direction — an undersized entry is a worse fill, an oversized one is
+        // a rejection or a liquidation-adjacent position.
+        const availableWithdrawable = withdrawable != null ? withdrawable - pendingMargin : undefined;
         // Decremented per submitted signal so later signals in the same batch are
         // evaluated against the margin already consumed by earlier ones.
-        let remainingMargin = withdrawable;
+        let remainingMargin = availableWithdrawable;
         const results = [];
         let submittedCount = 0;
         let failedCount = 0;
@@ -451,7 +479,9 @@ export class OpenPositionAction {
                     outcome("failed", 'invalid_direction');
                     return;
                 }
-                if (strategyState.hasOpenPosition(asset, dexForLookup)) {
+                // Dedupe against THIS snapshot plus the in-flight opens it is too old to show.
+                const pendingKey = pendingOpenKey(asset, dexForLookup);
+                if (hasOpenPositionIn(view.positions, asset, dexForLookup) || pendingKeys.has(pendingKey)) {
                     results.push({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: 'position_already_exists', startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", 'position_already_exists');
                     return;
@@ -486,7 +516,9 @@ export class OpenPositionAction {
                 const { amount: marginAmount, source: marginSource } = resolveMarginWithSource({
                     signalMarginPct,
                     marginPct: strategyState.config.marginPct,
-                    withdrawable,
+                    // The pending-adjusted figure, not the raw snapshot one: a percent of a balance that
+                    // an in-flight open has already claimed sizes the same dollars twice.
+                    withdrawable: availableWithdrawable,
                     marginPerSlot: strategyState.config.marginPerSlot,
                     budget: strategyState.config.budget,
                     slots: strategyState.config.slots,
@@ -551,11 +583,23 @@ export class OpenPositionAction {
                         direction,
                         source: marginSource,
                         withdrawable,
-                        accountValue: clearinghouseView.accountValue,
+                        availableWithdrawable,
+                        accountValue: view.accountValue,
                         marginAmount,
                         leverage,
                         notional: notionalValue,
                     });
+                    // Reserved BEFORE the await: between the submit and its outcome the next signal can
+                    // already be evaluating, and the exchange snapshot will not show this for seconds.
+                    ledger.reserve(asset, submittedDex, marginAmount);
+                    pendingKeys.add(pendingKey);
+                    // Charge the batch counters here, not on the success path: the reservation just made
+                    // stands for every outcome below except an outright rejection (resting, filled, and
+                    // even a throw all keep the slot/margin held). Refund only where the reservation is
+                    // actually released.
+                    remainingSlots--;
+                    if (remainingMargin != null)
+                        remainingMargin -= marginAmount;
                     const result = await withSpan("mcp.createPosition", { "senpi.signal.asset": asset, "senpi.signal.direction": direction }, async (mcpSpan) => {
                         const r = await this.context.senpi.createPosition({
                             strategyWalletAddress: address,
@@ -579,10 +623,6 @@ export class OpenPositionAction {
                             const detail = r.error || orderErrors || 'unknown error';
                             mcpSpan.addEvent("order.failed");
                             mcpSpan.setStatus({ code: SpanStatusCode.ERROR, message: detail });
-                            // Cross-system correlation handle: the server's trace id for this
-                            // rejection, when the envelope carried one.
-                            if (r.errorTraceId)
-                                mcpSpan.setAttribute("senpi.error.trace_id", r.errorTraceId);
                         }
                         else {
                             const o = r.orders[0];
@@ -608,19 +648,32 @@ export class OpenPositionAction {
                             .map((o) => `${o.coin}: ${o.error}`)
                             .join('; ');
                         const detail = result.error || orderErrors || 'unknown error';
+                        // A resting maker order is NOT a rejection: the order is live on the book and will
+                        // consume this slot and this margin the moment it fills. The reservation therefore
+                        // stands (on the longer resting TTL) while the result entry still reports the open
+                        // as unfilled. The code arrives either as the top-level envelope code or, when the
+                        // venue reported it per-order, only inside the joined order errors — hence both.
+                        const restingOrder = result.errorCode === 'CREATE_ORDER_RESTING' || /ORDER_RESTING/i.test(detail);
+                        if (restingOrder) {
+                            ledger.settle(pendingKey, 'resting', result.orders[0]?.orderId ?? undefined);
+                        }
+                        else {
+                            // A rejected submit holds nothing — free the slot and the margin immediately.
+                            ledger.release(pendingKey);
+                            pendingKeys.delete(pendingKey);
+                            remainingSlots++;
+                            if (remainingMargin != null)
+                                remainingMargin += marginAmount;
+                        }
                         // Backend says the strategy is PAUSED/CLOSED: arm the pause registry so
                         // subsequent signals skip instead of re-submitting (2026-07 storm class),
                         // and tell the user once. Classify with the structured envelope fields
                         // (code/retryable) when the client parsed them, message text otherwise.
-                        // When the envelope carried no code but exactly the orders did (the
-                        // per-order {code, description} shape), classify with the first
-                        // structured order code rather than falling back to message text.
-                        const effectiveCode = result.errorCode ?? result.orders.find((o) => o.errorCode)?.errorCode ?? null;
                         const classification = classifyToolError({
                             success: false,
                             error: {
                                 message: detail,
-                                ...(effectiveCode != null ? { code: effectiveCode } : {}),
+                                ...(result.errorCode != null ? { code: result.errorCode } : {}),
                                 ...(result.errorRetryable != null ? { retryable: result.errorRetryable } : {}),
                             },
                         });
@@ -639,7 +692,6 @@ export class OpenPositionAction {
                             asset, direction, dex: submittedDex, score: signalScore,
                             leverage, marginAmount, marginSource, marginPct, orderType,
                             success: false, reason: 'position_open_failed', error: detail,
-                            errorCode: effectiveCode, errorTraceId: result.errorTraceId ?? null,
                             startedAt: signalStartedAt, endedAt: Date.now(),
                         });
                         // Task 8a: the venue rejected the open submit.
@@ -648,8 +700,6 @@ export class OpenPositionAction {
                             direction,
                             reason: 'position_open_failed',
                             error: detail,
-                            errorCode: effectiveCode ?? undefined,
-                            errorTraceId: result.errorTraceId ?? undefined,
                             reduceOnly: false,
                         });
                         failedCount++;
@@ -659,6 +709,8 @@ export class OpenPositionAction {
                     // A successful submit proves the strategy is active again — re-arm immediately.
                     this.context.backendPauseRegistry?.clear(address);
                     const submittedOrder = result.orders[0];
+                    // Accepted: hold the slot and the margin until a snapshot carries the position.
+                    ledger.settle(pendingKey, 'filled', submittedOrder?.orderId ?? undefined);
                     // Mint the position.id at intent — the moment the open order is submitted,
                     // before the position is confirmed open — so the id rides the action.open
                     // emit and the open trace correlates by position.id directly (no ~60s
@@ -730,9 +782,6 @@ export class OpenPositionAction {
                         });
                     }
                     submittedCount++;
-                    remainingSlots--;
-                    if (remainingMargin != null)
-                        remainingMargin -= marginAmount;
                     outcome("submitted", 'submitted');
                 }
                 catch (error) {
@@ -743,6 +792,10 @@ export class OpenPositionAction {
                     const timedOut = error instanceof SenpiTimeoutError;
                     const reason = timedOut ? 'timeout' : 'exception';
                     logger.error(timedOut ? 'open timed out — order may be live' : 'open failed', error, { asset });
+                    // The submit may have landed server-side; nothing here proves it did not. The
+                    // reservation stands on the ambiguous TTL so the next signal counts it rather than
+                    // opening a second position on the same margin.
+                    ledger.settle(pendingKey, 'ambiguous');
                     results.push({
                         asset, direction, dex: submittedDex, score: signalScore,
                         leverage, marginAmount, marginSource, marginPct, orderType,