@senpi/runtime 3.0.81 → 3.0.83

package/dist/runtime/runtime.d.ts

@@ -25,7 +25,8 @@ export interface RuntimeOptions {
     unresolvedConfig?: Record<string, unknown>;
 }
 export declare class Runtime {
-    private readonly config;
+    /** Not readonly: {@link Runtime.rebuildComponents} swaps it, which is the whole point. */
+    private config;
     private readonly options;
     private bus;
     private hookSystem;
@@ -60,6 +61,8 @@ export declare class Runtime {
     private actionRuntimeModule;
     /** Stored so we can call off() in stop() and avoid retaining Runtime via scanner EventEmitter. */
     private onScannerRunComplete;
+    /** Set at the end of start()'s dependency phase; read by every build and rebuild. */
+    private componentDeps;
     /** Cached strategy id resolved from the runtime wallet on first {@link auditQuery} call. */
     private cachedStrategyId;
     /** In-flight resolution promise; ensures concurrent first-burst callers reuse one `listStrategies`. */
@@ -184,6 +187,101 @@ export declare class Runtime {
      * Cancel exchange SLs and archive DSL state for the strategy, then log removal.
      */
     /** @returns Count of active DSL positions archived during teardown. */
+    /**
+     * Build every component derived from the recipe: scanners, actions, the DSL plugin, and the
+     * health surface that holds references to all three.
+     *
+     * Called by `start()` and again by {@link rebuildComponents}. Deliberately does NOT create the
+     * reconcile gate, launch the boot-reconcile loop, or call `initRisk` — those are once-per-runtime
+     * and re-running them would re-block trading on an already-converged runtime, duplicate a
+     * detached loop, and double-subscribe the bus respectively.
+     */
+    private buildComponents;
+    /**
+     * Phase one of a build: everything the recipe determines, constructed but NOT installed on `this`
+     * and NOT started.
+     *
+     * The split exists so a rebuild can do all of its fallible work while the OLD components are
+     * still running. A recipe that names a scanner which will not construct, or an action class that
+     * does not exist, throws here — with the live runtime untouched, still scanning and still holding
+     * its stops. The alternative (the previous shape) tore everything down first and then discovered
+     * the new config was unbuildable, leaving a funded wallet with an open book, no scanners and no
+     * exit engine.
+     *
+     * Nothing in here may subscribe to the bus, start a timer, or touch disk. That is what makes it
+     * safe to run twice over — once for the attempt, once more for a rollback. `DslPlugin.create` is
+     * deliberately NOT called here for exactly that reason: it subscribes position handlers and
+     * starts the monitor loop, so pre-building it would put two plugins on one bus, both ticking the
+     * same positions. Its config is parsed here instead, which is where a bad preset actually throws.
+     */
+    private constructComponents;
+    /**
+     * Phase two of a build: install the constructed components on `this`, then create the one
+     * component that cannot be constructed without side effects.
+     *
+     * Everything fallible that COULD be done earlier already has been, in
+     * {@link constructComponents}. What remains is assignment — which cannot throw — plus
+     * `DslPlugin.create`, whose config this build already parsed and whose state manager, senpi
+     * client and strategy-state map are all passed in (each of those resolvers returns immediately
+     * when supplied). That is why the teardown window in {@link rebuildComponents} is narrow enough
+     * to be worth taking, and why its rollback is a backstop rather than the plan.
+     */
+    private commitComponents;
+    /**
+     * Register the scan-complete listener on the CURRENT scanner module.
+     *
+     * Separate from {@link buildComponents} because the listener is held against a specific module
+     * instance: a rebuild replaces the module, so the old registration goes with it and a fresh one
+     * has to be made against the new one.
+     */
+    private wireScannerRunListener;
+    /**
+     * Swap this runtime onto a new recipe without restarting it or touching its state.
+     *
+     * Teardown is the reverse of the build, and both halves matter. The scan listener is released
+     * before the module it is registered on; `scannerModule.stop()` clears its timers and awaits
+     * in-flight runs; `dslPlugin.stop()` is AWAITED, because it releases its bus subscriptions and
+     * drains the tick that may still be mid-flight at the venue — without that the outgoing monitor
+     * keeps writing state while the incoming one is already ticking the same positions, and the two
+     * hold independent StateManagers so nothing else serialises them.
+     *
+     * State on disk is untouched throughout: DSL position files, scanner stores and action history
+     * all survive, which is the entire reason an update is worth having over a delete-and-recreate.
+     */
+    rebuildComponents(config: RuntimeConfig): Promise<void>;
+    /**
+     * Install the freshly built components, serialized against the trade loop.
+     *
+     * The signal consumer runs every action pass inside
+     * `reconcileMutex.withKeyLock("reconcile", () => this.runActionsForSignal(...))`, reading
+     * `runActionsForSignal` at call time from inside the lock. Taking the same lock here means a
+     * signal already in flight finishes against the OLD actions before the swap happens, and the next
+     * one picks up the new ones — no pass can straddle the change.
+     *
+     * The lock is scoped to the SWAP and deliberately NOT to the teardown that precedes it.
+     * `teardownComponentsForRebuild` awaits the DSL plugin's in-flight tick, and that tick takes this
+     * very lock for its periodic reconcile (`runReconcile` is handed `reconcileSerialize`). Holding
+     * the lock across the drain would deadlock the runtime — permanently, with an open book and
+     * nothing managing it — because `KeyedMutex` is a plain FIFO and grants no reentrancy.
+     *
+     * Creating the DSL plugin inside the lock is safe for the mirror-image reason: `create()` starts
+     * the monitor loop but does not await its first tick, so that tick queues behind this lock
+     * instead of blocking the call that holds it.
+     */
+    private swapInComponents;
+    /**
+     * Drop the scan listener, stop the scanner module, stop and release the DSL plugin.
+     *
+     * Shared by the rebuild and its rollback so the two cannot drift — the rollback runs it a second
+     * time to clear whatever the failed commit had already installed, and every step is idempotent
+     * for exactly that reason.
+     *
+     * Order matters: the listener comes off before the module it is registered on;
+     * `scannerModule.stop()` clears its timers and awaits in-flight runs; `dslPlugin.stop()` is
+     * AWAITED, because it releases its bus subscriptions and drains the tick that may still be
+     * mid-flight at the venue.
+     */
+    private teardownComponentsForRebuild;
     removeStrategy(address: string): Promise<number>;
     /** Tear down DSL for the runtime strategy before deleting the runtime (gateway / CLI). */
     teardownDslForRuntimeDeletion(): Promise<void>;

package/dist/runtime/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK/E,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAkCjF,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiBrE,OAAO,KAAK,EAKV,mBAAmB,EACnB,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,2BAA2B,CAAC;AA6CnC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAcD,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,UAAU,CAAuC;IACzD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,SAAS,CAA+B;IAEhD,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,qBAAqB,CAAsC;IACnE,6FAA6F;IAC7F,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,2FAA2F;IAC3F,OAAO,CAAC,kBAAkB,CAAC,CAAyB;IACpD,OAAO,CAAC,aAAa,CAAC,CAAmB;IACzC,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IAExC,4FAA4F;IAC5F,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,kBAAkB,CAA8B;IACxD,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAA6B;IAC3D,0GAA0G;IAC1G,OAAO,CAAC,8BAA8B,CAA6B;IACnE,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB,CAA+C;IAC7E,OAAO,CAAC,mBAAmB,CAAuC;IAClE,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,kGAAkG;IAClG,OAAO,CAAC,oBAAoB,CAA2D;IAEvF,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,uGAAuG;IACvG,OAAO,CAAC,oBAAoB,CAAgC;IAG5D,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAgC;IACtD,yFAAyF;IACzF,OAAO,CAAC,aAAa,CAAmF;IACxG,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAAS;IACjC,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAA8C;IACzE,+IAA+I;IAC/I,OAAO,CAAC,cAAc,CAAuB;IAC7C,wEAAwE;IACxE,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;gBAElC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc;IAK1D,IAAI,GAAG,IAAI,cAAc,GAAG,IAAI,CAE/B;IAEK,eAAe,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAItD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAI1D;;;OAGG;IACH,sBAAsB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAI3E,wEAAwE;IACxE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI5F,sDAAsD;IACtD,yBAAyB,CACvB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAInC;;;;;;;;;OASG;IACG,yBAAyB,CAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,2BAA2B,CAAC;IAQvC;;;;;;OAMG;IACH,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO;IASV;;;OAGG;IACH,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI;IAItE;;;;;OAKG;IACI,mBAAmB,IAAI,MAAM;IAIpC;;;;;;;;;;;OAWG;IACI,aAAa,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACU,UAAU,CACrB,IAAI,EAAE,cAAc,EACpB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAkC5B;;;OAGG;YACW,2BAA2B;IASzC;;;;;OAKG;YACW,iBAAiB;IA6CzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4a5B;;OAEG;IACH,uEAAuE;IACjE,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAStD,0FAA0F;IACpF,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpD;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;YACW,iBAAiB;IAyI/B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;;OAIG;YACW,oBAAoB;IAiElC;;;OAGG;YACW,kBAAkB;IAc1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA4D5B"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAK/E,OAAO,KAAK,EACV,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAsCjF,OAAO,EAAE,SAAS,IAAI,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAiBrE,OAAO,KAAK,EAKV,mBAAmB,EACnB,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,2BAA2B,CAAC;AA6CnC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAoDD,qBAAa,OAAO;IAClB,0FAA0F;IAC1F,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,UAAU,CAAuC;IACzD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,SAAS,CAA+B;IAEhD,OAAO,CAAC,KAAK,CAA4B;IACzC,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,qBAAqB,CAAsC;IACnE,6FAA6F;IAC7F,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,2FAA2F;IAC3F,OAAO,CAAC,kBAAkB,CAAC,CAAyB;IACpD,OAAO,CAAC,aAAa,CAAC,CAAmB;IACzC,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IAExC,4FAA4F;IAC5F,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,kBAAkB,CAA8B;IACxD,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAA6B;IAC3D,0GAA0G;IAC1G,OAAO,CAAC,8BAA8B,CAA6B;IACnE,0FAA0F;IAC1F,OAAO,CAAC,sBAAsB,CAA+C;IAC7E,OAAO,CAAC,mBAAmB,CAAuC;IAClE,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,kGAAkG;IAClG,OAAO,CAAC,oBAAoB,CAA2D;IACvF,qFAAqF;IACrF,OAAO,CAAC,aAAa,CAAiB;IAEtC,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,uGAAuG;IACvG,OAAO,CAAC,oBAAoB,CAAgC;IAG5D,0EAA0E;IAC1E,OAAO,CAAC,cAAc,CAAgC;IACtD,yFAAyF;IACzF,OAAO,CAAC,aAAa,CAAmF;IACxG,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAAS;IACjC,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB,CAA8C;IACzE,+IAA+I;IAC/I,OAAO,CAAC,cAAc,CAAuB;IAC7C,wEAAwE;IACxE,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;gBAElC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc;IAK1D,IAAI,GAAG,IAAI,cAAc,GAAG,IAAI,CAE/B;IAEK,eAAe,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAItD,cAAc,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAI1D;;;OAGG;IACH,sBAAsB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAI3E,wEAAwE;IACxE,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAI5F,sDAAsD;IACtD,yBAAyB,CACvB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAInC;;;;;;;;;OASG;IACG,yBAAyB,CAC7B,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,2BAA2B,CAAC;IAQvC;;;;;;OAMG;IACH,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7D,OAAO;IASV;;;OAGG;IACH,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI;IAItE;;;;;OAKG;IACI,mBAAmB,IAAI,MAAM;IAIpC;;;;;;;;;;;OAWG;IACI,aAAa,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACU,UAAU,CACrB,IAAI,EAAE,cAAc,EACpB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IAkC5B;;;OAGG;YACW,2BAA2B;IASzC;;;;;OAKG;YACW,iBAAiB;IA6CzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAqT5B;;OAEG;IACH,uEAAuE;IACvE;;;;;;;;OAQG;YACW,eAAe;IAK7B;;;;;;;;;;;;;;;;OAgBG;YACW,mBAAmB;IA6EjC;;;;;;;;;;OAUG;YACW,gBAAgB;IAqD9B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAyD9B;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC7D;;;;;;;;;;;;;;;;;;OAkBG;YACW,gBAAgB;IAW9B;;;;;;;;;;;OAWG;YACW,4BAA4B;IAYpC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAStD,0FAA0F;IACpF,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpD;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;YACW,iBAAiB;IAyI/B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;;OAIG;YACW,oBAAoB;IAiElC;;;OAGG;YACW,kBAAkB;IAc1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA4D5B"}

package/dist/runtime/runtime.js

@@ -26,6 +26,8 @@ import { validateDslPositionTracking } from "./validate-dsl-position-tracking.js
 import { ScannerRegistry } from "./scanner-registry.js";
 import { ActionRegistry } from "./action-registry.js";
 import { initRisk } from "../risk/index.js";
+import { parseDslPluginConfig } from "../dsl/config/parse-plugin-config.js";
+import { RuntimeRebuildRollbackFailedError } from "./rebuild-errors.js";
 import { createHealthStateModule, } from "../health/index.js";
 import { DslPlugin as DslPluginClass } from "../dsl/plugin/index.js";
 import { HOOK_EVENT } from "../types/hooks.js";
@@ -59,6 +61,7 @@ const SIGNAL_QUEUE_BACKPRESSURE_THRESHOLD = 10;
 /** Default liveness-heartbeat window (~15 min) when `health.window_seconds` is unset. */
 const DEFAULT_LIVENESS_WINDOW_SECONDS = 900;
 export class Runtime {
+    /** Not readonly: {@link Runtime.rebuildComponents} swaps it, which is the whole point. */
     config;
     options;
     bus;
@@ -95,6 +98,8 @@ export class Runtime {
     actionRuntimeModule;
     /** Stored so we can call off() in stop() and avoid retaining Runtime via scanner EventEmitter. */
     onScannerRunComplete = null;
+    /** Set at the end of start()'s dependency phase; read by every build and rebuild. */
+    componentDeps;
     /** Cached strategy id resolved from the runtime wallet on first {@link auditQuery} call. */
     cachedStrategyId = null;
     /** In-flight resolution promise; ensures concurrent first-burst callers reuse one `listStrategies`. */
@@ -436,50 +441,6 @@ export class Runtime {
                 })
                 : createRiskGuardStub();
             logger.info("Runtime.start() creating scanner module");
-            const layout = buildStateLayout(stateDir);
-            // Augment caller-supplied providers with StateManager-backed DSL state access
-            const augmentedProviders = {
-                ...scannerProviders,
-                getDslStatesForStrategy: scannerProviders?.getDslStatesForStrategy
-                    ?? (async (address) => this.stateManager.listDslStates(address)),
-            };
-            this.scannerModule = createScannerModuleFromRuntimeConfig(this.config, layout.scannerRoot, augmentedProviders, undefined, buildIdentityEnvelope);
-            logger.info("Runtime.start() scanner module created, calling start()");
-            // Pre-load max leverage cache (non-blocking — log warning on failure)
-            const maxLeverageCache = new MaxLeverageCache(senpi);
-            try {
-                await maxLeverageCache.load();
-            }
-            catch (err) {
-                logger.warn("failed to pre-load max leverage cache, will retry on first use", { err });
-            }
-            // Build RuntimeContext once per trading recipe and reuse for all actions.
-            const runtimeContext = createRuntimeContext(this.strategyConfig, {
-                senpi,
-                hookSystem: this.hookSystem,
-                llmDecision,
-                contextBuilder,
-                riskGuard,
-                notifications,
-                scannerModule: this.scannerModule,
-                maxLeverageCache,
-                positionIdRegistry: this.positionIdRegistry,
-                notificationLabel,
-            });
-            this.actionRuntimeModule = new ActionRuntimeModule({ stateDir: layout.actionRoot });
-            const { runActionsForSignal } = await createActions(this.config, {
-                bus: this.bus,
-                senpi,
-                stateManager: this.stateManager,
-                hookSystem: this.hookSystem,
-                llmDecision,
-                contextBuilder,
-                riskGuard,
-                notifications,
-                runtimeContext,
-                actionModule: this.actionRuntimeModule,
-            });
-            this.runActionsForSignal = runActionsForSignal;
             // Create the reconcile gate BEFORE DslPlugin.create() so the monitor's
             // first synchronous tick (fired inside create()) sees a gate that already exists.
             this.reconcileGate = (() => {
@@ -496,25 +457,24 @@ export class Runtime {
             })();
             // Build strategyStates map once — shared by DslPlugin and the reconcile loop.
             const strategyStatesMap = createStrategyStatesMap(this.strategyConfig, senpi);
-            if (hasDsl) {
-                this.dslPlugin = await DslPluginClass.create({
-                    config: exitConfig,
-                    bus: this.bus,
-                    stateDir,
-                    stateManager: this.stateManager,
-                    senpiClient: senpi,
-                    strategyStates: strategyStatesMap,
-                    notifications,
-                    // Monitor runs the unified periodic reconcile (adopt/resize/gone), serialized
-                    // against the trade loop on the same reconcileMutex key, and can resolve the boot gate.
-                    reconcileSerialize: (fn) => this.reconcileMutex.withKeyLock("reconcile", fn),
-                    reconcileGateResolve: () => this.resolveReconcileGate(),
-                    identity: buildIdentityEnvelope,
-                });
-            }
-            else {
-                this.dslPlugin = null;
-            }
+            // Everything a rebuild reuses. Config-derived values are deliberately absent: those are
+            // recomputed from the config each build, which is what makes a rebuild a rebuild.
+            this.componentDeps = {
+                senpi,
+                llmDecision,
+                contextBuilder,
+                riskGuard,
+                notifications,
+                notificationLabel,
+                stateDir,
+                scannerProviders,
+                buildIdentityEnvelope,
+                strategyStates: strategyStatesMap,
+            };
+            // Once per runtime, not once per build: a rebuild must not re-run it. (It is a no-op today,
+            // kept for backward compatibility, but the placement is the contract.)
+            initRisk(this.bus);
+            await this.buildComponents(this.config);
             // Launch detached boot-reconcile loop (does NOT block start()).
             // Last-resort guard: an unexpected throw here would otherwise become an
             // unhandled rejection and silently kill the loop. Do NOT resolve the gate
@@ -523,70 +483,7 @@ export class Runtime {
             void this.runBootReconcileLoop(strategyStatesMap).catch((err) => {
                 logger.error("[runtime][reconcile] boot reconcile loop crashed", { err });
             });
-            initRisk(this.bus);
-            this.healthStateModule = createHealthStateModule({
-                runtimeName: this.config.name,
-                stateDir,
-                startedAt: this.startedAt,
-                providers: {
-                    scanners: this.scannerModule,
-                    dsl: this.dslPlugin ?? createDisabledDslProvider(),
-                    actions: this.actionRuntimeModule,
-                    risk: riskBlock
-                        ? createRiskHealthProvider(riskGuard, strategyAddress)
-                        : undefined,
-                },
-            });
-            this.onScannerRunComplete = (event) => {
-                // Per-scan-run id: stamped on the scanner_run emit and echoed through the pass so scan +
-                // pass land in one trace. Prefer the id minted at the scanner.run span so scan + pass
-                // share one senpi.run.id.
-                const runId = event.result.runId ?? randomUUID();
-                this.signalQueue.push({ result: event.result, enqueuedAt: Date.now(), runId });
-                // Edge-triggered backpressure alarm: depth rises one enqueue at a time, so `=== threshold`
-                // fires exactly once as it crosses up and re-arms only after the consumer drains back below.
-                if (this.signalQueue.length === SIGNAL_QUEUE_BACKPRESSURE_THRESHOLD) {
-                    emitEvent(logger, () => buildQueueBackpressureEvent({
-                        depth: this.signalQueue.length,
-                        threshold: SIGNAL_QUEUE_BACKPRESSURE_THRESHOLD,
-                        scannerId: event.result.scannerId,
-                        address: this.strategyConfig.address,
-                    }));
-                }
-                if (this.signalQueueWait) {
-                    const w = this.signalQueueWait;
-                    this.signalQueueWait = null;
-                    w();
-                }
-                // Scanner-run summary payload (startedAt is data stamping for telemetry durations).
-                const scannerRunPayload = {
-                    address: event.result.address,
-                    data: {
-                        ...event.result,
-                        startedAt: event.startedAt,
-                        runId,
-                    },
-                    timestamp: new Date().toISOString(),
-                };
-                // First-class event log. The build runs inside emitEvent's guard — telemetry never
-                // disturbs the scan path.
-                emitEvent(logger, () => buildScannerSummaryEvent(scannerRunPayload, Date.now()));
-                // The once-per-scan record, emitted for empty runs too — the grain scanner.summary drops.
-                emitEvent(logger, () => buildScannerRunTickEvent(event, Date.now()));
-                recordScannerRun({ scannerId: event.result.scannerId, outcome: event.result.status });
-                // TODO: Market-scanner alerts are default-OFF and MUST NOT be delivered
-                // until per-user default-mute-list support exists (today we have mute-list-only
-                // settings, which can't honour a default-OFF notification). When that lands,
-                // forward `event.result.summary?.alerts` as a MARKET_SCANNER notification with:
-                //   in-app: `🔔 <b>${n} market alert(s)</b><br>${message}<br>Signals only — no trade placed yet.`
-                //   push:   no title (the notification service resolves it), body `🔔 ${message}`
-                // Address-less by design (the scanner watches the market, not one strategy), so
-                // it opens a chat by category alone and the strategy wallet must not leak into
-                // the seed. Re-add per-(scannerId, message) dedupe at that time.
-                // Resolve this TODO when default mute list functionality is available.
-            };
-            this.scannerModule.on("scanner:run:complete", this.onScannerRunComplete);
-            this.signalConsumerDone = this.runSignalConsumer();
+            this.wireScannerRunListener();
             logger.info("Runtime.start() invoking scannerModule.start()");
             await this.scannerModule.start();
             logger.info("Runtime.start() scannerModule.start() returned");
@@ -707,6 +604,303 @@ export class Runtime {
      * Cancel exchange SLs and archive DSL state for the strategy, then log removal.
      */
     /** @returns Count of active DSL positions archived during teardown. */
+    /**
+     * Build every component derived from the recipe: scanners, actions, the DSL plugin, and the
+     * health surface that holds references to all three.
+     *
+     * Called by `start()` and again by {@link rebuildComponents}. Deliberately does NOT create the
+     * reconcile gate, launch the boot-reconcile loop, or call `initRisk` — those are once-per-runtime
+     * and re-running them would re-block trading on an already-converged runtime, duplicate a
+     * detached loop, and double-subscribe the bus respectively.
+     */
+    async buildComponents(config) {
+        const constructed = await this.constructComponents(config);
+        await this.commitComponents(config, constructed);
+    }
+    /**
+     * Phase one of a build: everything the recipe determines, constructed but NOT installed on `this`
+     * and NOT started.
+     *
+     * The split exists so a rebuild can do all of its fallible work while the OLD components are
+     * still running. A recipe that names a scanner which will not construct, or an action class that
+     * does not exist, throws here — with the live runtime untouched, still scanning and still holding
+     * its stops. The alternative (the previous shape) tore everything down first and then discovered
+     * the new config was unbuildable, leaving a funded wallet with an open book, no scanners and no
+     * exit engine.
+     *
+     * Nothing in here may subscribe to the bus, start a timer, or touch disk. That is what makes it
+     * safe to run twice over — once for the attempt, once more for a rollback. `DslPlugin.create` is
+     * deliberately NOT called here for exactly that reason: it subscribes position handlers and
+     * starts the monitor loop, so pre-building it would put two plugins on one bus, both ticking the
+     * same positions. Its config is parsed here instead, which is where a bad preset actually throws.
+     */
+    async constructComponents(config) {
+        const { senpi, llmDecision, contextBuilder, riskGuard, notifications, notificationLabel, stateDir, scannerProviders, buildIdentityEnvelope, } = this.componentDeps;
+        const exitConfig = mapRuntimeExitToDslConfig(config.exit);
+        const hasDsl = exitConfig.dsl_preset != null &&
+            typeof exitConfig.dsl_preset === "object" &&
+            !Array.isArray(exitConfig.dsl_preset);
+        // Parse the preset now rather than inside `DslPlugin.create`, so a malformed exit block is
+        // rejected while the old plugin is still holding its stops. The result is discarded — this is
+        // a validation, and `create` re-parses from the same input.
+        if (hasDsl)
+            parseDslPluginConfig(exitConfig);
+        const layout = buildStateLayout(stateDir);
+        // Augment caller-supplied providers with StateManager-backed DSL state access
+        const augmentedProviders = {
+            ...scannerProviders,
+            getDslStatesForStrategy: scannerProviders?.getDslStatesForStrategy
+                ?? (async (address) => this.stateManager.listDslStates(address)),
+        };
+        const scannerModule = createScannerModuleFromRuntimeConfig(config, layout.scannerRoot, augmentedProviders, undefined, buildIdentityEnvelope);
+        logger.info("Runtime.start() scanner module created, calling start()");
+        // Pre-load max leverage cache (non-blocking — log warning on failure)
+        const maxLeverageCache = new MaxLeverageCache(senpi);
+        try {
+            await maxLeverageCache.load();
+        }
+        catch (err) {
+            logger.warn("failed to pre-load max leverage cache, will retry on first use", { err });
+        }
+        // Build RuntimeContext once per trading recipe and reuse for all actions.
+        const runtimeContext = createRuntimeContext(this.strategyConfig, {
+            senpi,
+            hookSystem: this.hookSystem,
+            llmDecision,
+            contextBuilder,
+            riskGuard,
+            notifications,
+            scannerModule,
+            maxLeverageCache,
+            positionIdRegistry: this.positionIdRegistry,
+            notificationLabel,
+        });
+        const actionRuntimeModule = new ActionRuntimeModule({ stateDir: layout.actionRoot });
+        const { runActionsForSignal } = await createActions(config, {
+            bus: this.bus,
+            senpi,
+            stateManager: this.stateManager,
+            hookSystem: this.hookSystem,
+            llmDecision,
+            contextBuilder,
+            riskGuard,
+            notifications,
+            runtimeContext,
+            actionModule: actionRuntimeModule,
+        });
+        return { scannerModule, actionRuntimeModule, runActionsForSignal, exitConfig, hasDsl };
+    }
+    /**
+     * Phase two of a build: install the constructed components on `this`, then create the one
+     * component that cannot be constructed without side effects.
+     *
+     * Everything fallible that COULD be done earlier already has been, in
+     * {@link constructComponents}. What remains is assignment — which cannot throw — plus
+     * `DslPlugin.create`, whose config this build already parsed and whose state manager, senpi
+     * client and strategy-state map are all passed in (each of those resolvers returns immediately
+     * when supplied). That is why the teardown window in {@link rebuildComponents} is narrow enough
+     * to be worth taking, and why its rollback is a backstop rather than the plan.
+     */
+    async commitComponents(config, built) {
+        const { senpi, riskGuard, notifications, stateDir, buildIdentityEnvelope, strategyStates: strategyStatesMap, } = this.componentDeps;
+        const riskBlock = config.risk;
+        const strategyAddress = this.strategyConfig.address;
+        this.scannerModule = built.scannerModule;
+        this.actionRuntimeModule = built.actionRuntimeModule;
+        this.runActionsForSignal = built.runActionsForSignal;
+        if (built.hasDsl) {
+            this.dslPlugin = await DslPluginClass.create({
+                config: built.exitConfig,
+                bus: this.bus,
+                stateDir,
+                stateManager: this.stateManager,
+                senpiClient: senpi,
+                strategyStates: strategyStatesMap,
+                notifications,
+                // Monitor runs the unified periodic reconcile (adopt/resize/gone), serialized
+                // against the trade loop on the same reconcileMutex key, and can resolve the boot gate.
+                reconcileSerialize: (fn) => this.reconcileMutex.withKeyLock("reconcile", fn),
+                reconcileGateResolve: () => this.resolveReconcileGate(),
+                identity: buildIdentityEnvelope,
+            });
+        }
+        else {
+            this.dslPlugin = null;
+        }
+        this.healthStateModule = createHealthStateModule({
+            runtimeName: config.name,
+            stateDir,
+            startedAt: this.startedAt ?? undefined,
+            providers: {
+                scanners: this.scannerModule,
+                dsl: this.dslPlugin ?? createDisabledDslProvider(),
+                actions: this.actionRuntimeModule,
+                risk: riskBlock
+                    ? createRiskHealthProvider(riskGuard, strategyAddress)
+                    : undefined,
+            },
+        });
+    }
+    /**
+     * Register the scan-complete listener on the CURRENT scanner module.
+     *
+     * Separate from {@link buildComponents} because the listener is held against a specific module
+     * instance: a rebuild replaces the module, so the old registration goes with it and a fresh one
+     * has to be made against the new one.
+     */
+    wireScannerRunListener() {
+        const { senpi } = this.componentDeps;
+        this.onScannerRunComplete = (event) => {
+            // Per-scan-run id: stamped on the scanner_run emit and echoed through the pass so scan +
+            // pass land in one trace. Prefer the id minted at the scanner.run span so scan + pass
+            // share one senpi.run.id.
+            const runId = event.result.runId ?? randomUUID();
+            this.signalQueue.push({ result: event.result, enqueuedAt: Date.now(), runId });
+            // Edge-triggered backpressure alarm: depth rises one enqueue at a time, so `=== threshold`
+            // fires exactly once as it crosses up and re-arms only after the consumer drains back below.
+            if (this.signalQueue.length === SIGNAL_QUEUE_BACKPRESSURE_THRESHOLD) {
+                emitEvent(logger, () => buildQueueBackpressureEvent({
+                    depth: this.signalQueue.length,
+                    threshold: SIGNAL_QUEUE_BACKPRESSURE_THRESHOLD,
+                    scannerId: event.result.scannerId,
+                    address: this.strategyConfig.address,
+                }));
+            }
+            if (this.signalQueueWait) {
+                const w = this.signalQueueWait;
+                this.signalQueueWait = null;
+                w();
+            }
+            // Scanner-run summary payload (startedAt is data stamping for telemetry durations).
+            const scannerRunPayload = {
+                address: event.result.address,
+                data: {
+                    ...event.result,
+                    startedAt: event.startedAt,
+                    runId,
+                },
+                timestamp: new Date().toISOString(),
+            };
+            // First-class event log. The build runs inside emitEvent's guard — telemetry never
+            // disturbs the scan path.
+            emitEvent(logger, () => buildScannerSummaryEvent(scannerRunPayload, Date.now()));
+            // The once-per-scan record, emitted for empty runs too — the grain scanner.summary drops.
+            emitEvent(logger, () => buildScannerRunTickEvent(event, Date.now()));
+            recordScannerRun({ scannerId: event.result.scannerId, outcome: event.result.status });
+            // TODO: Market-scanner alerts are default-OFF and MUST NOT be delivered
+            // until per-user default-mute-list support exists (today we have mute-list-only
+            // settings, which can't honour a default-OFF notification). When that lands,
+            // forward `event.result.summary?.alerts` as a MARKET_SCANNER notification with:
+            //   in-app: `🔔 <b>${n} market alert(s)</b><br>${message}<br>Signals only — no trade placed yet.`
+            //   push:   no title (the notification service resolves it), body `🔔 ${message}`
+            // Address-less by design (the scanner watches the market, not one strategy), so
+            // it opens a chat by category alone and the strategy wallet must not leak into
+            // the seed. Re-add per-(scannerId, message) dedupe at that time.
+            // Resolve this TODO when default mute list functionality is available.
+        };
+        this.scannerModule.on("scanner:run:complete", this.onScannerRunComplete);
+        this.signalConsumerDone = this.runSignalConsumer();
+    }
+    /**
+     * Swap this runtime onto a new recipe without restarting it or touching its state.
+     *
+     * Teardown is the reverse of the build, and both halves matter. The scan listener is released
+     * before the module it is registered on; `scannerModule.stop()` clears its timers and awaits
+     * in-flight runs; `dslPlugin.stop()` is AWAITED, because it releases its bus subscriptions and
+     * drains the tick that may still be mid-flight at the venue — without that the outgoing monitor
+     * keeps writing state while the incoming one is already ticking the same positions, and the two
+     * hold independent StateManagers so nothing else serialises them.
+     *
+     * State on disk is untouched throughout: DSL position files, scanner stores and action history
+     * all survive, which is the entire reason an update is worth having over a delete-and-recreate.
+     */
+    async rebuildComponents(config) {
+        // Everything fallible happens FIRST, while the old components are still running. A recipe that
+        // will not build throws here, and the live runtime never notices: it is still scanning, still
+        // ticking, still holding the stops it has already promised.
+        const next = await this.constructComponents(config);
+        const previousConfig = this.config;
+        await this.teardownComponentsForRebuild();
+        this.config = config;
+        try {
+            await this.swapInComponents(config, next);
+        }
+        catch (err) {
+            // Backstop, not the plan. Reaching here means something threw in the narrow window that
+            // construction could not cover — realistically `DslPlugin.create` failing to resolve state
+            // it has already been handed. The runtime is currently torn down with an open book, so the
+            // only acceptable outcome is to get the PREVIOUS recipe running again.
+            logger.error("[runtime] rebuild failed after teardown — restoring the previous recipe", { err });
+            try {
+                await this.teardownComponentsForRebuild();
+                const restored = await this.constructComponents(previousConfig);
+                this.config = previousConfig;
+                await this.swapInComponents(previousConfig, restored);
+            }
+            catch (rollbackErr) {
+                // Both the new recipe and the old one failed to build. Nothing is managing the book, and
+                // no further automatic recovery is available — say so in the loudest terms the process has,
+                // naming the wallet, because a human has to act.
+                logger.error("[runtime] ROLLBACK FAILED — runtime is down with an open book", {
+                    address: this.strategyConfig.address,
+                    rebuildError: err,
+                    rollbackError: rollbackErr,
+                });
+                throw new RuntimeRebuildRollbackFailedError(this.strategyConfig.address, err, rollbackErr);
+            }
+            // The runtime is healthy again on its previous recipe; the update itself did not apply.
+            throw err;
+        }
+    }
+    /**
+     * Install the freshly built components, serialized against the trade loop.
+     *
+     * The signal consumer runs every action pass inside
+     * `reconcileMutex.withKeyLock("reconcile", () => this.runActionsForSignal(...))`, reading
+     * `runActionsForSignal` at call time from inside the lock. Taking the same lock here means a
+     * signal already in flight finishes against the OLD actions before the swap happens, and the next
+     * one picks up the new ones — no pass can straddle the change.
+     *
+     * The lock is scoped to the SWAP and deliberately NOT to the teardown that precedes it.
+     * `teardownComponentsForRebuild` awaits the DSL plugin's in-flight tick, and that tick takes this
+     * very lock for its periodic reconcile (`runReconcile` is handed `reconcileSerialize`). Holding
+     * the lock across the drain would deadlock the runtime — permanently, with an open book and
+     * nothing managing it — because `KeyedMutex` is a plain FIFO and grants no reentrancy.
+     *
+     * Creating the DSL plugin inside the lock is safe for the mirror-image reason: `create()` starts
+     * the monitor loop but does not await its first tick, so that tick queues behind this lock
+     * instead of blocking the call that holds it.
+     */
+    async swapInComponents(config, built) {
+        await this.reconcileMutex.withKeyLock("reconcile", async () => {
+            await this.commitComponents(config, built);
+            this.wireScannerRunListener();
+            await this.scannerModule.start();
+        });
+    }
+    /**
+     * Drop the scan listener, stop the scanner module, stop and release the DSL plugin.
+     *
+     * Shared by the rebuild and its rollback so the two cannot drift — the rollback runs it a second
+     * time to clear whatever the failed commit had already installed, and every step is idempotent
+     * for exactly that reason.
+     *
+     * Order matters: the listener comes off before the module it is registered on;
+     * `scannerModule.stop()` clears its timers and awaits in-flight runs; `dslPlugin.stop()` is
+     * AWAITED, because it releases its bus subscriptions and drains the tick that may still be
+     * mid-flight at the venue.
+     */
+    async teardownComponentsForRebuild() {
+        if (this.onScannerRunComplete != null) {
+            this.scannerModule.off("scanner:run:complete", this.onScannerRunComplete);
+            this.onScannerRunComplete = null;
+        }
+        await this.scannerModule.stop();
+        if (this.dslPlugin) {
+            await this.dslPlugin.stop();
+            this.dslPlugin = null;
+        }
+    }
     async removeStrategy(address) {
         let abandoned = 0;
         if (this.dslPlugin) {