@senpi/runtime 3.0.108 → 3.0.111

package/dist/actions/open-position/open-position.action.js

@@ -1,3 +1,4 @@
+import { ACTION_TYPE } from '../types.js';
 import { decisionMetaFromDecision } from '../decision-meta.js';
 import { DecisionEngine, LlmDecisionStrategy, NoDecisionStrategy, RuleDecisionStrategy } from '../decision-engine.js';
 import { HOOK_EVENT } from '../../types/hooks.js';
@@ -6,21 +7,57 @@ import { emitDecisionErrorNotification } from '../decision-error-notification.js
 import { emitEvent } from '../event-derivation.js';
 import { buildRuntimePausedEvent } from '../../runtime/lifecycle-events.js';
 import { resolveLeverage } from '../../leverage/resolve-leverage.js';
-import { SenpiTimeoutError } from '../../senpi/client.js';
+import { SenpiTimeoutError, isOutcomeUnknownCode } from '../../senpi/client.js';
 import { resolveMarginWithSource } from './resolve-margin.js';
 import { createLogger } from '../../utils/logger.js';
 import { positionRegistryKey } from '../../runtime/position-id-registry.js';
 import { resolveOpenOrderType, resolveFeeOptimizedLimitOptions } from '../../utils/resolve-order-type.js';
 import { emitActionResultEvents, emitOrderPlaced, emitOrderFilled, emitOrderFailed, buildActionEventContext } from '../action-events.js';
+import { skippedSignalResults } from '../skipped-signal-results.js';
 import { withSpan } from '../../telemetry/tracing.js';
 import { SpanStatusCode } from '@opentelemetry/api';
 import { classifyToolError } from '../../senpi/tool-errors.js';
 import { hasOpenPositionIn } from '../../strategy/strategy-state.js';
 import { createPendingOpensLedger, pendingOpenKey } from '../../runtime/pending-opens-ledger.js';
-import { recordSignalOutcome } from '../../telemetry/metrics.js';
 const logger = createLogger("[actions][open-position]");
 /** Hyperliquid minimum notional value (margin × leverage) required to open a position. */
 const MIN_NOTIONAL_VALUE = 10;
+/**
+ * Wall-clock bound on the clearing-house reads this action makes.
+ *
+ * These reads run inside the runtime's `reconcile` key-lock, which the DSL monitor's own
+ * reconcile waits on. The client's retry ladder bounds attempt COUNT, not time — three 45s
+ * attempts plus backoff is ~2.5 min of held lock, and it holds exactly when the MCP is
+ * degraded, which is when the exit engine can least afford to wait. 20s sits under the DSL
+ * tick's 30s default (a recipe on a faster tick loses at most one tick) while leaving a
+ * healthy read, which lands in 1–5s, several attempts of headroom.
+ */
+export const CLEARINGHOUSE_READ_TIMEOUT_MS = 20_000;
+/**
+ * A deadline for one clearing-house read. `AbortSignal.timeout` would do, but its timer is
+ * invisible to test fake-timers and never cleared — this one is both controllable and
+ * cancelled on the happy path, so a bounded read leaves nothing pending behind it.
+ */
+function readDeadline(ms) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        controller.abort(new Error(`clearinghouse read exceeded ${ms}ms`));
+    }, ms);
+    return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+/** Run one clearing-house read under {@link CLEARINGHOUSE_READ_TIMEOUT_MS}. Fails closed. */
+async function readBookBounded(strategyState) {
+    const deadline = readDeadline(CLEARINGHOUSE_READ_TIMEOUT_MS);
+    try {
+        return await strategyState.fetchClearinghouseState({
+            retryUnreadable: true,
+            signal: deadline.signal,
+        });
+    }
+    finally {
+        deadline.clear();
+    }
+}
 /** Minimum leverage floor — positions cannot go below 1x. */
 const MIN_LEVERAGE = 1;
 /**
@@ -41,7 +78,7 @@ export class OpenPositionAction {
     config;
     context;
     name;
-    actionType = 'OPEN_POSITION';
+    actionType = ACTION_TYPE.openPosition;
     decisionEngine;
     /**
      * Ledger of last resort for a context that carries none (standalone scripts, older call
@@ -124,13 +161,23 @@ export class OpenPositionAction {
         // re-submitting on every signal.
         if (this.context.backendPauseRegistry?.isPaused(address)) {
             logger.warn('Skipping signals: strategy is paused or closed on the backend', { wallet: address });
-            return {
+            const pausedResults = skippedSignalResults(scanResult.signals, 'strategy_backend_paused', Date.now());
+            const pausedResult = {
                 success: true,
                 action_type: this.actionType,
                 summary: 'Strategy is paused or closed on the backend — skipping signals until it is resumed',
                 skipped: true,
                 skipReason: 'strategy_backend_paused',
+                data: {
+                    results: pausedResults,
+                    submittedCount: 0,
+                    failedCount: 0,
+                    skippedCount: pausedResults.length,
+                },
             };
+            // No decision ran yet, so the pass carries no `_decisionMeta` and yields no `decision.made`.
+            emitActionResultEvents(this.eventCtx(), event, address, pausedResult, { scanResult });
+            return pausedResult;
         }
         // The exchange view for THIS pass. Read here, once, and threaded through the rest of it.
         //
@@ -140,9 +187,11 @@ export class OpenPositionAction {
         // froze the slot gate, the dedupe check and the margin budget at whatever the first
         // signal after boot happened to see: a full snapshot skipped every later signal forever,
         // an empty one let the slot cap and the dedupe never bind at all.
-        const view = await strategyState.fetchClearinghouseState({ retryUnreadable: true });
+        const view = await this.readClearinghouseView(strategyState, address);
         if (view === undefined) {
-            return this.skipClearinghouseUnknown(event, address, [], undefined, undefined, { scanResult });
+            return this.skipClearinghouseUnknown(event, address, 
+            // No decision has run, so the scan's own signals are the only attributable inputs.
+            skippedSignalResults(scanResult.signals, 'clearinghouse_unknown', Date.now()), undefined, undefined, undefined, { scanResult });
         }
         const snapshot = { view, fetchedAt: Date.now() };
         // Early exit: no slots. Counted as snapshot positions PLUS opens this runtime has already
@@ -163,19 +212,30 @@ export class OpenPositionAction {
         const slots = strategyState.config.slots;
         const openCount = view.positions.length + pending.length;
         if (openCount >= slots) {
+            // The log is edge-triggered and rate-limited: a full book on a high-signal-rate strategy
+            // is the loudest path there is, and the fact is one about the strategy, not one per
+            // candidate. The per-signal rows below are the event plane, which is bounded per pass.
             this.logBookFull(address, openCount, slots, pending.map((p) => p.coin), view.positions);
-            // The per-signal `results[]`/event fan-out is deliberately NOT built here: a full book
-            // on a high-signal-rate strategy is the loudest path there is, and the outcome is one
-            // fact about the strategy, not one per candidate. The counter still carries it.
-            recordSignalOutcome({ result: 'skipped', reasonCode: 'no_slots' });
-            return {
+            const noSlotResults = skippedSignalResults(scanResult.signals, 'no_slots', Date.now());
+            const noSlotResult = {
                 success: true,
                 action_type: this.actionType,
                 summary: `No slots available (${openCount}/${slots} open)`,
                 skipped: true,
                 skipReason: 'no_slots',
-                data: { openCount, slots, pendingCount: pending.length },
+                data: {
+                    results: noSlotResults,
+                    submittedCount: 0,
+                    failedCount: 0,
+                    skippedCount: noSlotResults.length,
+                    openCount,
+                    slots,
+                    pendingCount: pending.length,
+                },
             };
+            // No decision ran yet, so the pass carries no `_decisionMeta` and yields no `decision.made`.
+            emitActionResultEvents(this.eventCtx(), event, address, noSlotResult, { scanResult });
+            return noSlotResult;
         }
         // A pass with room re-arms the edge, so the next time the book fills it is logged again.
         this.noSlotsLog.full = false;
@@ -190,17 +250,43 @@ export class OpenPositionAction {
                 ? (address, scannerId) => this.context.scannerModule.getScannerContext(address, scannerId)
                 : undefined,
         };
-        const contextData = this.config.context?.length
-            ? await this.context.contextBuilder.build(this.config.context, providerRequest)
-            : {};
-        logger.info('context data', contextData);
-        // Interpolate prompt template with resolved context + action params
-        const interpolatedPrompt = this.config.decision_prompt
-            ? interpolatePrompt(this.config.decision_prompt, {
-                ...contextData,
-                ...(this.config.params ?? {}),
-            })
-            : undefined;
+        // A context provider or the prompt template can throw before any decision exists. Both are
+        // preparation for the same decision, so they fail as one unit: the scan signals are recorded as
+        // failures and the pass returns, instead of the throw escaping to the caller unrecorded.
+        let contextData;
+        let interpolatedPrompt;
+        try {
+            contextData = this.config.context?.length
+                ? await this.context.contextBuilder.build(this.config.context, providerRequest)
+                : {};
+            logger.info('context data', contextData);
+            // Interpolate prompt template with resolved context + action params
+            interpolatedPrompt = this.config.decision_prompt
+                ? interpolatePrompt(this.config.decision_prompt, {
+                    ...contextData,
+                    ...(this.config.params ?? {}),
+                })
+                : undefined;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logger.error('context build failed', error, { wallet: address });
+            const contextErrorResults = skippedSignalResults(scanResult.signals, 'context_error', Date.now(), { success: false, error: message });
+            const contextErrorResult = {
+                success: false,
+                action_type: this.actionType,
+                summary: `Context build failed: ${message}`,
+                error: message,
+                data: {
+                    results: contextErrorResults,
+                    submittedCount: 0,
+                    failedCount: contextErrorResults.length,
+                    skippedCount: 0,
+                },
+            };
+            emitActionResultEvents(this.eventCtx(), event, address, contextErrorResult, { scanResult });
+            return contextErrorResult;
+        }
         // Get decision
         let decision;
         try {
@@ -216,12 +302,20 @@ export class OpenPositionAction {
             const message = error instanceof Error ? error.message : String(error);
             await emitDecisionErrorNotification(this.context, message);
             const eventCtx = this.eventCtx();
+            // The decision produced nothing usable, so the scan signals are the only attributable inputs.
+            // The rows are failures, not skips: `success: false` plus the error message, counted under
+            // `failedCount` so the pass does not read as benign on the span or the stored record.
+            const errorResults = skippedSignalResults(scanResult.signals, 'decision_error', Date.now(), { success: false, error: message });
             const errorResult = {
                 success: false,
                 action_type: this.actionType,
                 summary: `Decision failed: ${message}`,
                 error: message,
                 data: {
+                    results: errorResults,
+                    submittedCount: 0,
+                    failedCount: errorResults.length,
+                    skippedCount: 0,
                     _decisionMeta: {
                         durationMs: 0,
                         tokensUsed: null,
@@ -245,6 +339,7 @@ export class OpenPositionAction {
         // Check decision
         if (!decision.execute) {
             logger.info('decision no execute', decision);
+            const noExecuteResults = skippedSignalResults(scanResult.signals, 'decision_no_execute', Date.now());
             const rejectedResult = {
                 success: true,
                 action_type: this.actionType,
@@ -252,6 +347,10 @@ export class OpenPositionAction {
                 skipped: true,
                 skipReason: 'decision_no_execute',
                 data: {
+                    results: noExecuteResults,
+                    submittedCount: 0,
+                    failedCount: 0,
+                    skippedCount: noExecuteResults.length,
                     confidence: decision.confidence,
                     reasoning: decision.reasoning,
                     _decisionMeta: decisionMetaFromDecision(this.config, decision),
@@ -264,6 +363,7 @@ export class OpenPositionAction {
         // Check confidence threshold
         if (isBelowConfidence) {
             logger.info('confidence below threshold', { confidence: decision.confidence, threshold: minConfidence });
+            const belowConfResults = skippedSignalResults(scanResult.signals, 'below_confidence', Date.now());
             const belowConfResult = {
                 success: true,
                 action_type: this.actionType,
@@ -271,6 +371,10 @@ export class OpenPositionAction {
                 skipped: true,
                 skipReason: 'below_confidence',
                 data: {
+                    results: belowConfResults,
+                    submittedCount: 0,
+                    failedCount: 0,
+                    skippedCount: belowConfResults.length,
                     confidence: decision.confidence,
                     threshold: minConfidence,
                     _decisionMeta: decisionMetaFromDecision(this.config, decision),
@@ -284,12 +388,23 @@ export class OpenPositionAction {
         const signals = this.normalizeSignals(decision.payload);
         const meta = decisionMetaFromDecision(this.config, decision);
         if (!signals.length) {
+            // `success: false` plus the error code on each row, matching the batch result and its
+            // `decision_error`/`context_error` siblings: the decision returned something unusable, so
+            // the rows classify as errors rather than as a benign skip indistinguishable from no_slots.
+            const invalidPayloadResults = skippedSignalResults(scanResult.signals, 'invalid_payload', Date.now(), { success: false, error: 'invalid_payload' });
             const invalidPayloadResult = {
                 success: false,
                 action_type: this.actionType,
                 summary: 'Invalid decision payload: no actionable signals',
                 error: 'invalid_payload',
-                data: { _decisionMeta: meta, _decisionPrompt: interpolatedPrompt ?? null },
+                data: {
+                    results: invalidPayloadResults,
+                    submittedCount: 0,
+                    failedCount: invalidPayloadResults.length,
+                    skippedCount: 0,
+                    _decisionMeta: meta,
+                    _decisionPrompt: interpolatedPrompt ?? null,
+                },
             };
             emitActionResultEvents(eventCtx, event, address, invalidPayloadResult, trackingExtras);
             return invalidPayloadResult;
@@ -300,6 +415,27 @@ export class OpenPositionAction {
     pendingOpens() {
         return this.context.pendingOpensLedger ?? this.ownPendingOpens;
     }
+    /**
+     * One clearinghouse read, fail-closed on both an unreadable response and a throw. A throw is
+     * the same situation as an unreadable response — an unknown book — so it resolves undefined
+     * and reaches the skip below rather than escaping the action with no per-signal outcome
+     * recorded. Shared by the gate at the top of `handle` and the stale-view refetch in the
+     * signal loop.
+     */
+    /**
+     * The bounded book read, failing closed. A read that throws — including one the deadline
+     * aborts — leaves the exchange view unknown, which the callers treat as a skip rather than
+     * trading against numbers nobody read.
+     */
+    async readClearinghouseView(strategyState, address) {
+        try {
+            return await readBookBounded(strategyState);
+        }
+        catch (error) {
+            logger.warn('Clearinghouse fetch threw; treating the exchange view as unknown', error, { wallet: address });
+            return undefined;
+        }
+    }
     /**
      * Edge-triggered full-book log: once on the transition into full, then at most once per
      * {@link NO_SLOTS_LOG_INTERVAL_MS} with the count it suppressed in between.
@@ -336,18 +472,12 @@ export class OpenPositionAction {
      * rather than risk a duplicate or an over-margined open.
      *
      * Shared by both read sites (the gate at the top of `handle`, and the stale-view refetch in
-     * the signal loop). `sorted` is empty at the early site — there is no decision, hence no
-     * candidates, yet — which is why the entries are built from it rather than assumed.
+     * the signal loop). The rows come from the caller because the two sites attribute to
+     * different inputs: the scan's own signals before a decision exists, the decision's
+     * candidates after. `riskSnapshot` is undefined at the early site, where no gate snapshot
+     * has been taken yet.
      */
-    skipClearinghouseUnknown(event, address, sorted, meta, decisionPrompt, trackingExtras) {
-        const skippedResults = sorted.map((signal) => ({
-            asset: signal.asset,
-            direction: signal.direction,
-            dex: typeof signal.dex === 'string' && signal.dex.trim() !== '' ? signal.dex.trim() : 'main',
-            score: signal.score,
-            success: true,
-            reason: 'clearinghouse_unknown',
-        }));
+    skipClearinghouseUnknown(event, address, skippedResults, meta, riskSnapshot, decisionPrompt, trackingExtras) {
         logger.error('Skipping open: clearinghouse view unknown after retries', {
             wallet: address,
             skippedCount: skippedResults.length,
@@ -365,6 +495,7 @@ export class OpenPositionAction {
                 failedCount: 0,
                 skippedCount: skippedResults.length,
                 ...(meta ? { _decisionMeta: meta } : {}),
+                ...(riskSnapshot ? { _riskSnapshot: riskSnapshot } : {}),
                 _decisionPrompt: decisionPrompt ?? null,
             },
         };
@@ -416,12 +547,24 @@ export class OpenPositionAction {
                 // trusts is one it read itself, on this pass.
                 if (Date.now() - snapshot.fetchedAt <= CLEARINGHOUSE_VIEW_MAX_AGE_MS)
                     return snapshot.view;
-                return strategyState.fetchClearinghouseState({ retryUnreadable: true });
+                return this.readClearinghouseView(strategyState, address);
             })(),
         ]);
         riskSnapshot = riskSnapResult;
         if (clearinghouseView === undefined) {
-            return this.skipClearinghouseUnknown(event, address, sorted, meta, decisionPrompt, trackingExtras);
+            const skippedResults = sorted.map((signal) => ({
+                asset: signal.asset,
+                direction: signal.direction,
+                dex: typeof signal.dex === 'string' && signal.dex.trim() !== '' ? signal.dex.trim() : 'main',
+                score: signal.score,
+                success: true,
+                reason: 'clearinghouse_unknown',
+                // Telemetry join back to this signal's scan entry — see `pushResult` in the signal loop.
+                ...(typeof signal.__signalIndex === 'number' ? { __signalIndex: signal.__signalIndex } : {}),
+            }));
+            // The risk snapshot resolved alongside the view, so it is in hand here. An absent
+            // snapshot tells telemetry the gates never ran, which on this path is false.
+            return this.skipClearinghouseUnknown(event, address, skippedResults, meta, riskSnapshot, decisionPrompt, trackingExtras);
         }
         // ONE snapshot decides everything below: slots, dedupe and margin. Mixing a second read
         // in mid-batch is how the counts stopped agreeing with each other in the first place.
@@ -465,16 +608,24 @@ export class OpenPositionAction {
                 };
                 // Telemetry: per-signal work window — every result entry below carries startedAt/endedAt.
                 const signalStartedAt = Date.now();
+                // Telemetry join: every row this signal produces carries its index into the scan's signal
+                // array, so the event mapper pairs the row with THIS signal's `meta`. Without it, two signals
+                // on the same asset in one pass would both be read as the first one. Absent on the LLM path
+                // (the model authors its own signals), where the mapper falls back to matching by asset.
+                const signalIndex = typeof signal.__signalIndex === 'number' ? signal.__signalIndex : undefined;
+                const pushResult = (row) => {
+                    results.push(signalIndex !== undefined ? { ...row, __signalIndex: signalIndex } : row);
+                };
                 const signalDex = signal.dex;
                 const submittedDex = typeof signalDex === "string" && signalDex.trim() !== "" ? signalDex.trim() : "main";
                 const dexForLookup = submittedDex === "main" ? undefined : submittedDex;
                 if (remainingSlots <= 0) {
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: 'no_slots', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: 'no_slots', startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", 'no_slots');
                     return;
                 }
                 if (!direction || (direction !== 'LONG' && direction !== 'SHORT')) {
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, success: false, reason: 'invalid_direction', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, success: false, reason: 'invalid_direction', startedAt: signalStartedAt, endedAt: Date.now() });
                     failedCount++;
                     outcome("failed", 'invalid_direction');
                     return;
@@ -482,7 +633,7 @@ export class OpenPositionAction {
                 // Dedupe against THIS snapshot plus the in-flight opens it is too old to show.
                 const pendingKey = pendingOpenKey(asset, dexForLookup);
                 if (hasOpenPositionIn(view.positions, asset, dexForLookup) || pendingKeys.has(pendingKey)) {
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: 'position_already_exists', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: 'position_already_exists', startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", 'position_already_exists');
                     return;
                 }
@@ -495,7 +646,7 @@ export class OpenPositionAction {
                     return g;
                 });
                 if (gate.gate !== 'OPEN') {
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: `risk_gate_${gate.gate}`, startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, success: true, reason: `risk_gate_${gate.gate}`, startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", `risk_gate_${gate.gate}`);
                     return;
                 }
@@ -542,7 +693,7 @@ export class OpenPositionAction {
                         slots: strategyState.config.slots,
                         withdrawable,
                     });
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, leverage, success: false, reason: 'no_margin_configured', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, leverage, success: false, reason: 'no_margin_configured', startedAt: signalStartedAt, endedAt: Date.now() });
                     failedCount++;
                     outcome("failed", 'no_margin_configured');
                     return;
@@ -551,7 +702,7 @@ export class OpenPositionAction {
                 if (notionalValue < MIN_NOTIONAL_VALUE) {
                     logger.warn(`Skipping ${asset}: notional value $${notionalValue.toFixed(2)} ` +
                         `(margin $${marginAmount.toFixed(2)} × ${leverage}x) is below minimum $${MIN_NOTIONAL_VALUE}`);
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, notionalValue, success: false, reason: 'below_min_notional', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, notionalValue, success: false, reason: 'below_min_notional', startedAt: signalStartedAt, endedAt: Date.now() });
                     failedCount++;
                     outcome("failed", 'below_min_notional');
                     return;
@@ -562,14 +713,14 @@ export class OpenPositionAction {
                 if (remainingMargin != null && remainingMargin < marginAmount) {
                     logger.warn(`Skipping ${asset}: insufficient free margin ` +
                         `($${remainingMargin.toFixed(2)} available < $${marginAmount.toFixed(2)} required)`);
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, requiredMarginAmount: marginAmount, availableMarginAmount: remainingMargin, success: true, reason: 'insufficient_margin', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, requiredMarginAmount: marginAmount, availableMarginAmount: remainingMargin, success: true, reason: 'insufficient_margin', startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", 'insufficient_margin');
                     return;
                 }
                 // A previous signal in this batch may have just armed the backend pause —
                 // stop submitting the rest of the batch too.
                 if (this.context.backendPauseRegistry?.isPaused(address)) {
-                    results.push({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, success: true, reason: 'strategy_backend_paused', startedAt: signalStartedAt, endedAt: Date.now() });
+                    pushResult({ asset, direction, dex: submittedDex, score: signalScore, leverage, marginAmount, marginSource, marginPct, success: true, reason: 'strategy_backend_paused', startedAt: signalStartedAt, endedAt: Date.now() });
                     outcome("skipped", 'strategy_backend_paused');
                     return;
                 }
@@ -654,9 +805,23 @@ export class OpenPositionAction {
                         // as unfilled. The code arrives either as the top-level envelope code or, when the
                         // venue reported it per-order, only inside the joined order errors — hence both.
                         const restingOrder = result.errorCode === 'CREATE_ORDER_RESTING' || /ORDER_RESTING/i.test(detail);
+                        // The server aborting its own trading-engine call (UNAVAILABLE, or the unclassified
+                        // INTERNAL) is not a rejection either: it says nothing about whether the venue
+                        // accepted the order, and the next pass's book is too young to answer. Freeing the
+                        // slot here is how one ambiguous failure becomes two positions on one slot — the
+                        // same class this fix closes. Hold it on the ambiguous TTL, exactly as the thrown
+                        // timeout path below does.
+                        const outcomeUnknown = !restingOrder && isOutcomeUnknownCode(result.errorCode);
                         if (restingOrder) {
                             ledger.settle(pendingKey, 'resting', result.orders[0]?.orderId ?? undefined);
                         }
+                        else if (outcomeUnknown) {
+                            logger.error('open outcome unknown — order may be live', new Error(detail), {
+                                asset,
+                                errorCode: result.errorCode,
+                            });
+                            ledger.settle(pendingKey, 'ambiguous');
+                        }
                         else {
                             // A rejected submit holds nothing — free the slot and the margin immediately.
                             ledger.release(pendingKey);
@@ -665,6 +830,9 @@ export class OpenPositionAction {
                             if (remainingMargin != null)
                                 remainingMargin += marginAmount;
                         }
+                        // Same reason code the thrown timeout uses: downstream (and the agent reading it)
+                        // must reconcile against real position state, not treat a live order as rejected.
+                        const failureReason = outcomeUnknown ? 'timeout' : 'position_open_failed';
                         // Backend says the strategy is PAUSED/CLOSED: arm the pause registry so
                         // subsequent signals skip instead of re-submitting (2026-07 storm class),
                         // and tell the user once. Classify with the structured envelope fields
@@ -688,22 +856,22 @@ export class OpenPositionAction {
                                 emitEvent(logger, () => buildRuntimePausedEvent('backend_paused', 'Backend paused', detail, address));
                             }
                         }
-                        results.push({
+                        pushResult({
                             asset, direction, dex: submittedDex, score: signalScore,
                             leverage, marginAmount, marginSource, marginPct, orderType,
-                            success: false, reason: 'position_open_failed', error: detail,
+                            success: false, reason: failureReason, error: detail,
                             startedAt: signalStartedAt, endedAt: Date.now(),
                         });
-                        // Task 8a: the venue rejected the open submit.
+                        // Task 8a: the venue rejected the open submit (or left it unresolved).
                         emitOrderFailed(this.context.hookSystem, event, address, {
                             asset,
                             direction,
-                            reason: 'position_open_failed',
+                            reason: failureReason,
                             error: detail,
                             reduceOnly: false,
                         });
                         failedCount++;
-                        outcome("failed", 'position_open_failed');
+                        outcome("failed", failureReason);
                         return;
                     }
                     // A successful submit proves the strategy is active again — re-arm immediately.
@@ -750,7 +918,7 @@ export class OpenPositionAction {
                         },
                         timestamp: new Date().toISOString(),
                     });
-                    results.push({
+                    pushResult({
                         asset, direction, dex: submittedDex, score: signalScore,
                         leverage, marginAmount, marginSource, marginPct, orderType,
                         orderId: submittedOrder?.orderId ?? null,
@@ -796,7 +964,7 @@ export class OpenPositionAction {
                     // reservation stands on the ambiguous TTL so the next signal counts it rather than
                     // opening a second position on the same margin.
                     ledger.settle(pendingKey, 'ambiguous');
-                    results.push({
+                    pushResult({
                         asset, direction, dex: submittedDex, score: signalScore,
                         leverage, marginAmount, marginSource, marginPct, orderType,
                         success: false, reason, error: message,