dexbot 1.1.13 → 1.2.0

package/dist/modules/dexbot_class.js

@@ -71,7 +71,7 @@ const { ProcessedFillStore, PROCESSED_FILL_PERSISTENCE_MODES } = require('./orde
 const DexbotFillRuntime = require('./dexbot_fill_runtime');
 const DexbotMaintenanceRuntime = require('./dexbot_maintenance_runtime');
 const CreditRuntime = require('./credit_runtime');
-const { ORDER_STATES, ORDER_TYPES, REBALANCE_STATES, COW_ACTIONS, TIMING, PIPELINE_TIMING, MAINTENANCE, FILL_PROCESSING, DAEMON_CODES, } = require('./constants');
+const { ORDER_STATES, ORDER_TYPES, REBALANCE_STATES, COW_ACTIONS, TIMING, PIPELINE_TIMING, GRID_LIMITS, MAINTENANCE, FILL_PROCESSING, DAEMON_CODES, } = require('./constants');
 const { PATHS, getRecalculateTriggerFile } = require('./paths');
 const { attemptResumePersistedGridByPriceMatch, decideStartupGridAction, reconcileGridOrders } = require('./order/grid_reconcile');
 const { AccountOrders } = require('./account_orders');
@@ -127,6 +127,7 @@ class DEXBot {
     _batchInFlight;
     _recoverySyncInFlight;
     _lastTargetedDriftSyncAt;
+    _lightweightSyncCheckAt;
     _targetedDriftSyncCooldownMs;
     _maintenanceCooldownCycles;
     _lastGridActivityAt;
@@ -218,6 +219,7 @@ class DEXBot {
         this._batchInFlight = false;
         this._recoverySyncInFlight = false;
         this._lastTargetedDriftSyncAt = 0;
+        this._lightweightSyncCheckAt = 0;
         this._targetedDriftSyncCooldownMs = this.config.timing.TARGETED_DRIFT_SYNC_COOLDOWN_MS;
         this._maintenanceCooldownCycles = 0;
         this._lastGridActivityAt = 0;
@@ -246,25 +248,28 @@ class DEXBot {
      */
     _validateStartupConfig(config) {
         const errors = [];
-        // Validate startPrice is numeric or valid string mode
-        const startPrice = config.startPrice;
-        const validPriceModes = ['pool', 'book'];
-        const isPriceNumeric = typeof startPrice === 'number' && Number.isFinite(startPrice) && startPrice > 0;
-        const isPriceMode = typeof startPrice === 'string' && validPriceModes.includes(startPrice.toLowerCase());
-        if (!isPriceNumeric && !isPriceMode) {
-            errors.push(`startPrice must be a positive number or valid mode (${validPriceModes.join('/')}), got: ${startPrice}`);
-        }
-        // Validate assetA and assetB are present
-        if (!config.assetA || typeof config.assetA !== 'string') {
-            errors.push(`assetA must be a non-empty string, got: ${config.assetA}`);
-        }
-        if (!config.assetB || typeof config.assetB !== 'string') {
-            errors.push(`assetB must be a non-empty string, got: ${config.assetB}`);
-        }
-        // Validate incrementPercent
-        const increment = config.incrementPercent;
-        if (!Number.isFinite(increment) || increment <= 0 || increment > 100) {
-            errors.push(`incrementPercent must be between 0 and 100, got: ${increment}`);
+        // Skip trading field validation in credit-only mode
+        if (!config.creditOnly) {
+            // Validate startPrice is numeric or valid string mode
+            const startPrice = config.startPrice;
+            const validPriceModes = ['pool', 'book'];
+            const isPriceNumeric = typeof startPrice === 'number' && Number.isFinite(startPrice) && startPrice > 0;
+            const isPriceMode = typeof startPrice === 'string' && validPriceModes.includes(startPrice.toLowerCase());
+            if (!isPriceNumeric && !isPriceMode) {
+                errors.push(`startPrice must be a positive number or valid mode (${validPriceModes.join('/')}), got: ${startPrice}`);
+            }
+            // Validate assetA and assetB are present
+            if (!config.assetA || typeof config.assetA !== 'string') {
+                errors.push(`assetA must be a non-empty string, got: ${config.assetA}`);
+            }
+            if (!config.assetB || typeof config.assetB !== 'string') {
+                errors.push(`assetB must be a non-empty string, got: ${config.assetB}`);
+            }
+            // Validate incrementPercent
+            const increment = config.incrementPercent;
+            if (!Number.isFinite(increment) || increment <= 0 || increment > 100) {
+                errors.push(`incrementPercent must be between 0 and 100, got: ${increment}`);
+            }
         }
         // Throw all validation errors at once
         if (errors.length > 0) {
@@ -373,7 +378,7 @@ class DEXBot {
             this.manager.logger.log(`Triggering state recovery sync (${reason})...`, 'info');
             await this.manager.fetchAccountTotals(this.accountId);
             const openOrders = await chainOrders.readOpenOrders(this.accountId);
-            await this.manager.syncFromOpenOrders(openOrders, { skipAccounting: true, fillLockAlreadyHeld: true, protectCommittedOrders: true });
+            await this.manager.syncFromOpenOrders(openOrders, { skipAccounting: true });
             if (typeof this.manager.persistGrid === 'function') {
                 await this.manager.persistGrid();
             }
@@ -575,14 +580,16 @@ class DEXBot {
             const boundaryIdx = this.accountOrders.loadBoundaryIdx(true);
             // 2. Load into manager (same path as startup at line 1340)
             await Grid.loadGrid(this.manager, persistedGrid, boundaryIdx);
+            // Gap 1: Grid snapshot sanity check — shared logic with startup path.
+            if (await this._rejectCorruptedGridSnapshot('recovery')) {
+                return { success: false, reason: 'corrupted grid snapshot rejected (fund drift)' };
+            }
             // 3. Read current chain state
             const chainOpenOrders = await chainOrders.readOpenOrders(accountRef);
             // 4. Reconcile
             if (chainOpenOrders.length > 0 && this.manager?.syncFromOpenOrders) {
                 await this.manager.syncFromOpenOrders(chainOpenOrders, {
                     skipAccounting: true,
-                    fillLockAlreadyHeld: true,
-                    protectCommittedOrders: true
                 });
             }
             // 5. Persist the reconciled state
@@ -598,6 +605,35 @@ class DEXBot {
             return { success: false, reason: err.message };
         }
     }
+    /**
+     * Reject a corrupted grid snapshot when catastrophic fund drift is detected.
+     * Shared between startup and recovery paths to avoid duplicating the
+     * drift-ratio math and snapshot-clearing logic.
+     *
+     * @param {'startup'|'recovery'} context - Controls log prefix.
+     * @returns {Promise<boolean>} True if the snapshot was rejected (cleared).
+     */
+    async _rejectCorruptedGridSnapshot(context) {
+        if (!this.manager?.checkFundDriftAfterFills)
+            return false;
+        const driftCheck = this.manager.checkFundDriftAfterFills();
+        if (driftCheck.isValid)
+            return false;
+        const tag = context === 'recovery' ? '[RECOVERY][SNAPSHOT-REJECT]' : '[SNAPSHOT-REJECT]';
+        this._warn(`${tag} Corrupted grid snapshot detected: ` +
+            `drift sell=${driftCheck.driftSell.toFixed(2)} buy=${driftCheck.driftBuy.toFixed(2)}. ` +
+            `Deleting corrupted snapshot.`);
+        if (this.accountOrders && typeof this.accountOrders.clearGrid === 'function') {
+            try {
+                await this.accountOrders.clearGrid();
+                this._warn(`${tag} Corrupted grid snapshot deleted.`);
+            }
+            catch (clearErr) {
+                this._warn(`${tag} Failed to delete corrupted snapshot: ${clearErr.message}`);
+            }
+        }
+        return true;
+    }
     /**
      * Attempt to repair size-drift for specific order IDs by reading their
      * current on-chain state and correcting the local grid directly.
@@ -784,13 +820,14 @@ class DEXBot {
     _buildOrphanFillFallbackKey(fill) {
         return DexbotFillRuntime.buildOrphanFillFallbackKey(this, fill);
     }
-    _isNewFillKey(fillKey, processedFillKeys, label = '') {
+    _isNewFillKey(fillKey, processedFillKeys, label = '', orderId = '') {
         const now = Date.now();
         if (this._recentlyQueuedFills.has(fillKey)) {
             const lastProcessed = this._recentlyQueuedFills.get(fillKey);
             if (now - lastProcessed < this._fillDedupeWindowMs) {
                 if (label) {
-                    this.manager?.logger?.log?.(`${label} Skipping duplicate fill (processed ${now - lastProcessed}ms ago)`, 'debug');
+                    const idSuffix = orderId ? ` for ${orderId}` : '';
+                    this.manager?.logger?.log?.(`${label} Skipping duplicate fill${idSuffix} (processed ${now - lastProcessed}ms ago)`, 'debug');
                 }
                 return false;
             }
@@ -918,7 +955,7 @@ class DEXBot {
                                 const chainOpenOrders = await chainOrders.readOpenOrders(this.accountId);
                                 if (this._shuttingDown)
                                     return;
-                                const syncResult = await this.manager.synchronizeWithChain(chainOpenOrders, 'readOpenOrders', { fillLockAlreadyHeld: true });
+                                const syncResult = await this.manager.synchronizeWithChain(chainOpenOrders, 'readOpenOrders');
                                 if (this._shuttingDown)
                                     return;
                                 if (syncResult?.filledOrders?.length > 0) {
@@ -935,7 +972,6 @@ class DEXBot {
                                         await this._cancelDustOrders({
                                             buy: reconnectHealth.buyDustOrders,
                                             sell: reconnectHealth.sellDustOrders,
-                                            fillLockAlreadyHeld: true,
                                         });
                                     }
                                     catch (_dustErr) {
@@ -1015,7 +1051,7 @@ class DEXBot {
                                 if (!orphanFillKey) {
                                     orphanFillKey = this._buildOrphanFillFallbackKey(fill);
                                 }
-                                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[POST-RESET]')) {
+                                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[POST-RESET]', fillOp.order_id)) {
                                     continue;
                                 }
                                 this._log(`[POST-RESET] Processing funds for unknown order ${fillOp.order_id} (not in grid but crediting proceeds)`, 'warn');
@@ -1031,7 +1067,7 @@ class DEXBot {
                             }
                             this._log(`[POST-RESET] Processing fill for ${gridOrder.type} order ${gridOrder.id} at price ${gridOrder.price}`);
                             const trackedFillKey = buildFillKey(fill);
-                            if (trackedFillKey && !this._isNewFillKey(trackedFillKey, processedFillKeys, '[POST-RESET]')) {
+                            if (trackedFillKey && !this._isNewFillKey(trackedFillKey, processedFillKeys, '[POST-RESET]', fillOp.order_id)) {
                                 continue;
                             }
                             const accountingResult = await this._applyReplaySafeTrackedFillAccounting(fill, fillOp, {
@@ -1057,7 +1093,7 @@ class DEXBot {
                         if (requiresOpenOrdersSync) {
                             this._log('[POST-RESET] Falling back to open-orders sync for fill(s) missing replay-safe history identifiers', 'warn');
                             const postResetChainOpenOrders = await chainOrders.readOpenOrders(this.accountId);
-                            const syncResult = await this.manager.syncFromOpenOrders(postResetChainOpenOrders, { fillLockAlreadyHeld: true });
+                            const syncResult = await this.manager.syncFromOpenOrders(postResetChainOpenOrders);
                             if (syncResult.filledOrders?.length > 0) {
                                 await this._processFillsWithBatching(syncResult.filledOrders, new Set(), '[POST-RESET] open-orders fallback');
                             }
@@ -1088,7 +1124,6 @@ class DEXBot {
                             await this._cancelDustOrders({
                                 buy: postResetHealth.buyDustOrders,
                                 sell: postResetHealth.sellDustOrders,
-                                fillLockAlreadyHeld: true,
                             });
                         }
                         catch (_dustErr) {
@@ -1184,7 +1219,7 @@ class DEXBot {
                         if (Array.isArray(chainOpenOrders) && chainOpenOrders.length > 0) {
                             this._log('Generating new grid and syncing with existing on-chain orders...');
                             await Grid.initializeGrid(this.manager);
-                            await this.manager.syncFromOpenOrders(chainOpenOrders, { skipAccounting: true, fillLockAlreadyHeld: true });
+                            await this.manager.syncFromOpenOrders(chainOpenOrders, { skipAccounting: true });
                             const rebalanceResult = await reconcileGridOrders({
                                 manager: this.manager,
                                 config: this.config,
@@ -1192,7 +1227,6 @@ class DEXBot {
                                 privateKey: this.privateKey,
                                 chainOrders,
                                 chainOpenOrders,
-                                fillLockAlreadyHeld: true,
                             });
                             await this._executeBatchIfNeeded(rebalanceResult, 'startup reconcile (regenerated grid)');
                         }
@@ -1206,7 +1240,7 @@ class DEXBot {
                         this._log('Found active session. Loading and syncing existing grid.');
                         await Grid.loadGrid(this.manager, persistedGrid, persistedBoundaryIdx);
                         let startupChainOpenOrders = chainOpenOrders;
-                        const syncResult = await this.manager.syncFromOpenOrders(startupChainOpenOrders, { skipAccounting: true, fillLockAlreadyHeld: true });
+                        const syncResult = await this.manager.syncFromOpenOrders(startupChainOpenOrders, { skipAccounting: true });
                         // Process price corrections queued during startup sync.
                         // These are not picked up by _consumeFillQueue until a fill
                         // arrives, which may never come for an idle market.
@@ -1220,7 +1254,7 @@ class DEXBot {
                                 // Refresh open orders so startup reconcile works with post-batch chain reality
                                 // and avoids reconciling against a stale pre-batch snapshot.
                                 startupChainOpenOrders = await chainOrders.readOpenOrders(this.accountId);
-                                await this.manager.synchronizeWithChain(startupChainOpenOrders, 'readOpenOrders', { fillLockAlreadyHeld: true });
+                                await this.manager.synchronizeWithChain(startupChainOpenOrders, 'readOpenOrders');
                             }
                         }
                         const rebalanceResult = await reconcileGridOrders({
@@ -1230,11 +1264,12 @@ class DEXBot {
                             privateKey: this.privateKey,
                             chainOrders,
                             chainOpenOrders: startupChainOpenOrders,
-                            fillLockAlreadyHeld: true,
                         });
                         await this._executeBatchIfNeeded(rebalanceResult, 'startup reconcile (loaded grid)');
                         // Dust state is no longer persisted — cancelled immediately on detection.
                         await this._persistAndRecoverIfNeeded();
+                        // Gap 1: Grid snapshot sanity check — shared logic with recovery path.
+                        await this._rejectCorruptedGridSnapshot('startup');
                     }
                     // Drain any fills that arrived during startup while still in bootstrap
                     // mode. Safe to call directly since we already hold _fillProcessingLock
@@ -1247,13 +1282,12 @@ class DEXBot {
                     // Perform initial grid maintenance (thresholds, divergence, spread, health)
                     // Consolidated into shared logic to ensure consistent behavior at boot and runtime.
                     // CRITICAL: Pass lockAlreadyHeld since we're inside _fillProcessingLock.acquire()
-                    await this._runGridMaintenance('startup', { fillLockAlreadyHeld: true });
+                    await this._runGridMaintenance('startup');
                     // Cancel any dust from a previous bot lifetime immediately.
                     const startupHealth = await this.manager.checkGridHealth(this.updateOrdersOnChainPlan.bind(this));
                     await this._cancelDustOrders({
                         buy: startupHealth.buyDustOrders,
                         sell: startupHealth.sellDustOrders,
-                        fillLockAlreadyHeld: true,
                     });
                     this._log('Bootstrap phase complete - fill processing resumed', 'info');
                 }
@@ -1265,7 +1299,7 @@ class DEXBot {
             await this._setupTriggerFileDetection();
             await this._setupCreditRuntime();
             await this._refreshAndSyncCreditRuntime();
-            await this._runCreditRuntimeMaintenance('startup', { fillLockAlreadyHeld: true });
+            await this._runCreditRuntimeMaintenance('startup');
             this._setupBlockchainFetchInterval();
             this._setupCreditWatchdogInterval();
             this._setupCredentialDaemonWatchdogInterval();
@@ -1309,14 +1343,14 @@ class DEXBot {
         }
         try {
             let openOrders = await chainOrders.readOpenOrders(this.accountId);
-            const syncResult = await this.manager.synchronizeWithChain(openOrders, 'readOpenOrders', { fillLockAlreadyHeld: true });
+            const syncResult = await this.manager.synchronizeWithChain(openOrders, 'readOpenOrders');
             let aborted = false;
             if (syncResult?.filledOrders?.length > 0) {
                 this._log(`[SYNC-CHAIN] ${syncResult.filledOrders.length} filled order(s) found during ${tag}`, 'info');
                 const batchResult = await this._processFillsWithBatching(syncResult.filledOrders, new Set(), `${tag} sync-fill`);
                 if (!batchResult?.aborted) {
                     openOrders = await chainOrders.readOpenOrders(this.accountId);
-                    await this.manager.synchronizeWithChain(openOrders, 'readOpenOrders', { fillLockAlreadyHeld: true });
+                    await this.manager.synchronizeWithChain(openOrders, 'readOpenOrders');
                 }
                 else {
                     aborted = true;
@@ -1564,7 +1598,7 @@ class DEXBot {
                                 if (!orphanFillKey) {
                                     orphanFillKey = this._buildOrphanFillFallbackKey(fill);
                                 }
-                                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[ORPHAN-FILL]')) {
+                                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[ORPHAN-FILL]', fillOp.order_id)) {
                                     continue;
                                 }
                                 this.manager.logger.log(`[ORPHAN-FILL] Processing funds for unknown order ${fillOp.order_id} (not in grid but crediting proceeds)`, 'warn');
@@ -1594,7 +1628,7 @@ class DEXBot {
                                 requiresOpenOrdersSync = true;
                                 continue;
                             }
-                            if (!this._isNewFillKey(fillKey, processedFillKeys, '[FILL]')) {
+                            if (!this._isNewFillKey(fillKey, processedFillKeys, '[FILL]', fillOp.order_id)) {
                                 continue;
                             }
                             validFills.push(fill);
@@ -1657,7 +1691,7 @@ class DEXBot {
                             }
                             this.manager.logger.log(`Syncing ${fillsToSync.length} fill(s) (open orders mode)`, 'info');
                             const chainOpenOrders = await chainOrders.readOpenOrders(this.account);
-                            const resultOpenOrders = await this.manager.syncFromOpenOrders(chainOpenOrders, { fillLockAlreadyHeld: true });
+                            const resultOpenOrders = await this.manager.syncFromOpenOrders(chainOpenOrders);
                             // Dust is handled by post-fill detection below.
                             if (resultOpenOrders.filledOrders)
                                 resolvedOrders.push(...resultOpenOrders.filledOrders);
@@ -1790,7 +1824,6 @@ class DEXBot {
                                 const dustCancelResult = await this._cancelDustOrders({
                                     buy: healthResult.buyDustOrders,
                                     sell: healthResult.sellDustOrders,
-                                    fillLockAlreadyHeld: true,
                                 });
                                 if (dustCancelResult?.batchResult?.aborted) {
                                     abortedFillCycle = true;
@@ -1804,7 +1837,7 @@ class DEXBot {
                         // After: Grid maintenance waits for isPipelineEmpty() before structural changes
                         // Run only when the cycle contains at least one full fill.
                         if (shouldRunPostFillChecks && !abortedFillCycle) {
-                            await this._runGridMaintenance('post-fill', { fillLockAlreadyHeld: true });
+                            await this._runGridMaintenance('post-fill');
                         }
                     }
                     else if (pendingFillKeysForCurrentCycle.size > 0) {
@@ -1929,7 +1962,7 @@ class DEXBot {
                 if (!orphanFillKey) {
                     orphanFillKey = this._buildOrphanFillFallbackKey(fill);
                 }
-                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[BOOTSTRAP]')) {
+                if (orphanFillKey && !this._isNewFillKey(orphanFillKey, processedFillKeys, '[BOOTSTRAP]', fillOp.order_id)) {
                     continue;
                 }
                 this.manager.logger.log(`[BOOTSTRAP] Processing funds for unknown order ${fillOp.order_id} (not in grid but crediting proceeds)`, 'warn');
@@ -1942,7 +1975,7 @@ class DEXBot {
                 continue;
             }
             const trackedFillKey = buildFillKey(fill);
-            if (trackedFillKey && !this._isNewFillKey(trackedFillKey, processedFillKeys, '[BOOTSTRAP]')) {
+            if (trackedFillKey && !this._isNewFillKey(trackedFillKey, processedFillKeys, '[BOOTSTRAP]', fillOp.order_id)) {
                 continue;
             }
             const accountingResult = await this._applyReplaySafeTrackedFillAccounting(fill, fillOp, {
@@ -1963,7 +1996,7 @@ class DEXBot {
         if (requiresOpenOrdersSync) {
             this._log('[BOOTSTRAP] Falling back to open-orders sync for fill(s) missing replay-safe history identifiers', 'warn');
             const bootstrapChainOpenOrders = await chainOrders.readOpenOrders(this.accountId);
-            const syncResult = await this.manager.syncFromOpenOrders(bootstrapChainOpenOrders, { fillLockAlreadyHeld: true });
+            const syncResult = await this.manager.syncFromOpenOrders(bootstrapChainOpenOrders);
             if (syncResult.filledOrders?.length > 0) {
                 const queuedOrderIds = new Set(validFills.map(fill => fill?.gridOrder?.orderId).filter(Boolean));
                 for (const filledOrder of syncResult.filledOrders) {
@@ -2201,8 +2234,6 @@ class DEXBot {
             const openOrders = await chainOrders.readOpenOrders(accountRef);
             const recoveryResult = await this.manager.syncFromOpenOrders(openOrders, {
                 skipAccounting: false,
-                fillLockAlreadyHeld: true,
-                protectCommittedOrders: true
             });
             this._preserveMissingCreateBlockersAfterRecovery(preRecoveryMissingCreateBlockers, recoveryResult);
             // Persist any master grid mutations from the recovery sync. The
@@ -2546,13 +2577,10 @@ class DEXBot {
      * @returns {Promise<Object>} Result object compatible with batch return shape
      */
     async _reconcileAfterUncertainBroadcast(err, opContexts, options = {}) {
-        if (options.fillLockAlreadyHeld !== true &&
-            this.manager?._fillProcessingLock &&
-            typeof this.manager._fillProcessingLock.acquire === 'function') {
-            return this.manager._fillProcessingLock.acquire(async () => (this._reconcileAfterUncertainBroadcast(err, opContexts, {
-                ...options,
-                fillLockAlreadyHeld: true
-            })));
+        if (this.manager?._fillProcessingLock &&
+            typeof this.manager._fillProcessingLock.acquire === 'function' &&
+            !this.manager._fillProcessingLock.isReentrant()) {
+            return this.manager._fillProcessingLock.acquire(() => this._reconcileAfterUncertainBroadcast(err, opContexts, options));
         }
         return this._reconcileAfterUncertainBroadcastImpl(err, opContexts, options);
     }
@@ -2665,8 +2693,6 @@ class DEXBot {
             try {
                 await this.manager.syncFromOpenOrders(latestSnapshot, {
                     skipAccounting: true,
-                    fillLockAlreadyHeld: true,
-                    protectCommittedOrders: true
                 });
                 hadRotation = true;
             }
@@ -2678,6 +2704,15 @@ class DEXBot {
                 if (fallbackResult.success) {
                     hadRotation = true;
                 }
+                else {
+                    this.manager.logger.log(`[COW][UNCERTAIN] Persisted grid reload failed: ${fallbackResult.reason}. ` +
+                        `Escalating to structural resync.`, 'warn');
+                    if (typeof this.manager.requestStructuralGridResync === 'function') {
+                        this.manager.requestStructuralGridResync('cow-uncertain-recovery-failed', { reason: fallbackResult.reason }).catch((escalateErr) => {
+                            this.manager.logger.log(`[COW][UNCERTAIN] Escalation to structural resync failed: ${escalateErr.message}`, 'error');
+                        });
+                    }
+                }
             }
         }
         // 4. Log structured summary.
@@ -2712,9 +2747,52 @@ class DEXBot {
         catch (orphanErr) {
             this.manager.logger.log(`[COW][UNCERTAIN] Auto-cancel pass failed: ${orphanErr?.message || orphanErr}`, 'warn');
         }
+        // Boundary shift recovery: the COW batch that should have committed the
+        // boundary shift from this fill cycle failed before commit. Every planned
+        // CREATE in the batch represents a fill whose opposite-side boundary step
+        // was lost — regardless of whether the individual CREATE was later adopted
+        // on chain (adopted) or not (discarded). Manually adjust manager.boundaryIdx
+        // so the next COW cycle (triggered by the next fill or periodic maintenance)
+        // generates replacement opposite-side orders using the correct boundary.
+        //
+        // NOTE: Direct mutation of manager.boundaryIdx outside a COW commit
+        // violates the invariant stated in grid.ts:1217-1220 (boundary must only
+        // be updated atomically inside _commitWorkingGrid). This is intentional
+        // here because the COW commit already failed — the invariant was already
+        // broken by the broadcast uncertainty, and the adjustment only restores
+        // the state to what the successful commit would have produced.
+        if (hadRotation && this.manager && pending.length > 0) {
+            let boundaryShift = 0;
+            for (const entry of pending) {
+                const orderType = entry.orderType || entry.order?.type;
+                if (orderType === ORDER_TYPES.SELL) {
+                    boundaryShift--; // SELL CREATE → fill was BUY → boundary LEFT
+                }
+                else if (orderType === ORDER_TYPES.BUY) {
+                    boundaryShift++; // BUY CREATE → fill was SELL → boundary RIGHT
+                }
+            }
+            if (boundaryShift !== 0) {
+                const oldIdx = this.manager.boundaryIdx;
+                if (typeof oldIdx === 'number') {
+                    const maxIdx = Math.max(0, (this.manager.orders?.size || 1) - 1);
+                    const newIdx = Math.max(0, Math.min(maxIdx, oldIdx + boundaryShift));
+                    if (newIdx !== oldIdx) {
+                        this.manager.boundaryIdx = newIdx;
+                        this.manager.logger.log(`[COW][UNCERTAIN] Boundary adjusted by ${boundaryShift} ` +
+                            `(${adopted.length} adopted / ${discarded.length} discarded CREATE(s)): ` +
+                            `${oldIdx} → ${newIdx}. Next COW cycle will generate replacement opposite-side orders.`, 'warn');
+                        if (typeof this.manager._markGridDirty === 'function') {
+                            this.manager._markGridDirty(`boundary adjustment after ${pending.length} planned CREATE(s)`);
+                        }
+                    }
+                }
+            }
+        }
         // Persist master grid mutations from the reconciliation sync and any
         // orphan auto-cancellation that ran above. These apply outside the COW
-        // broadcast path and would otherwise be in-memory only.
+        // broadcast path and would otherwise be in-memory only. The boundary
+        // adjustment above is also persisted here.
         if (typeof this.manager?.persistGrid === 'function') {
             await this.manager.persistGrid();
         }
@@ -2852,8 +2930,6 @@ class DEXBot {
                         if (freshChain.length > 0 && this.manager?.syncFromOpenOrders) {
                             await this.manager.syncFromOpenOrders(freshChain, {
                                 skipAccounting: true,
-                                fillLockAlreadyHeld: true,
-                                protectCommittedOrders: true
                             });
                         }
                     }
@@ -3270,7 +3346,7 @@ class DEXBot {
             this._resumeGridPersistenceAfterCredentialRecovery('credential recovery started');
             const runRecovery = async () => {
                 await this._triggerStateRecoverySync('credential daemon restored');
-                await this._runGridMaintenance('credential-recovery', { fillLockAlreadyHeld: true });
+                await this._runGridMaintenance('credential-recovery');
             };
             if (this.manager?._fillProcessingLock) {
                 await this.manager._fillProcessingLock.acquire(runRecovery);
@@ -3609,6 +3685,22 @@ class DEXBot {
             };
         }
         const hasCreateActions = actions.some(action => action.type === COW_ACTIONS.CREATE);
+        // Gap 5: Recovery exhausted — block all CREATES. The bot has exhausted
+        // its recovery attempt budget and needs a fill or sync cycle to reset.
+        // Existing orders remain active and are monitored, but no new orders
+        // are placed until recovery resets.
+        if (hasCreateActions && this.manager?._recoveryExhaustedAt) {
+            const exhaustedAge = Date.now() - this.manager._recoveryExhaustedAt;
+            this.manager.logger.log?.(`[RECOVERY-EXHAUSTED] Blocking ${actions.filter(a => a.type === COW_ACTIONS.CREATE).length} CREATE(s) ` +
+                `(exhausted ${(exhaustedAge / 1000).toFixed(0)}s ago). ` +
+                `Waiting for next fill or sync cycle to reset recovery state.`, 'warn');
+            return {
+                executed: false,
+                aborted: true,
+                reason: 'RECOVERY_EXHAUSTED',
+                hadRotation: false
+            };
+        }
         const unmatchedChainOrders = Array.isArray(this.manager?._lastUnmatchedChainOrders)
             ? this.manager._lastUnmatchedChainOrders
             : [];
@@ -3654,7 +3746,7 @@ class DEXBot {
                             this.manager.logger.log(`[COW] Failed to cancel unmatched chain order: ${r.reason?.message || r.reason}`, 'warn');
                     }
                 }
-                if (cancelledUnmatched >= cancelable.length) {
+                if (cancelable.length > 0 && cancelledUnmatched >= cancelable.length) {
                     this.manager.logger.log(`[COW] Cancelled all ${cancelledUnmatched} unmatched chain order(s); proceeding with CREATE batch.`, 'warn');
                     // Optimistic clear: the cancel txs are sent but not yet
                     // confirmed. If a cancel silently fails on chain, the
@@ -3663,7 +3755,7 @@ class DEXBot {
                     // is idempotent and the re-detection is non-blocking.
                     this.manager._lastUnmatchedChainOrders = [];
                 }
-                else {
+                else if (cancelable.length > 0) {
                     this.manager.logger.log(`[COW] Cancelled ${cancelledUnmatched}/${cancelable.length} unmatched chain order(s); ` +
                         `remaining must be handled by structural reconciliation.`, 'warn');
                 }
@@ -3711,7 +3803,7 @@ class DEXBot {
                             batchId: this._currentBatchId || null,
                             payload: null,
                             timeoutMs: null
-                        }), [], { fillLockAlreadyHeld: true });
+                        }), []);
                     }
                     catch (recoverErr) {
                         this.manager.logger.log(`[COW] Recovery from pending broadcasts failed: ${recoverErr?.message || recoverErr}`, 'error');
@@ -4071,7 +4163,7 @@ class DEXBot {
             // throwing would re-enter the catch loop on the next attempt and
             // potentially double-publish.
             if (err instanceof BroadcastUncertainError) {
-                return await this._reconcileAfterUncertainBroadcast(err, opContexts, { fillLockAlreadyHeld: true });
+                return await this._reconcileAfterUncertainBroadcast(err, opContexts);
             }
             // Handle hard abort
             const hardAbortResult = await this._handleBatchHardAbort(err, 'COW batch processing', operations.length);
@@ -4377,6 +4469,10 @@ class DEXBot {
      */
     async _runStartupSequence() {
         try {
+            if (this.config.creditOnly) {
+                await this._runCreditOnlyStartup();
+                return;
+            }
             const startupState = await this._initializeStartupState();
             await this._finishStartupSequence(startupState);
         }
@@ -4386,13 +4482,20 @@ class DEXBot {
             throw err;
         }
     }
+    async _runCreditOnlyStartup() {
+        await this._setupCreditRuntime();
+        await this._refreshAndSyncCreditRuntime();
+        await this._runCreditRuntimeMaintenance('startup');
+        this._setupCreditWatchdogInterval();
+        this._setupCredentialDaemonWatchdogInterval();
+        this._log('DEXBot started (credit-only mode)');
+    }
     /**
      * Perform periodic grid checks: fund thresholds, spread condition, grid health.
      * Called by the periodic blockchain fetch interval to check if grid needs updates.
      *
      * IMPORTANT: This method MUST only be called from within _fillProcessingLock.acquire()
-     * (specifically from _setupBlockchainFetchInterval). It passes fillLockAlreadyHeld
-     * to avoid deadlock with _consumeFillQueue which uses the same lock ordering.
+     * (specifically from _setupBlockchainFetchInterval).
      *
      * @private
      */
@@ -4539,14 +4642,17 @@ class DEXBot {
             return { skipped: true, reason: 'grid resync unavailable' };
         }
         const message = reason ? `[CR-RESET] ${reason}` : '[CR-RESET] grid reset requested';
-        // Manual/programmatic resets should advance the persisted center baseline
-        // before rebuilding the grid, unless a caller explicitly disables it.
         this._log(`${message}; rebuilding grid from fresh on-chain state`, 'info');
         const resetOptions = {
             ...options,
             refreshCenterPrice: options.refreshCenterPrice !== false,
         };
-        if (options.fillLockAlreadyHeld || !this.manager._fillProcessingLock) {
+        // Skip acquire if no lock exists (no fill processing to serialize against)
+        // or if the caller already holds the lock (re-entrant). In the latter case
+        // the lock's isReentrant() check prevents queueing and runs inline.
+        // Otherwise, wait on the queue — this is the intended path for callers
+        // outside the fill-processing context that need exclusive access.
+        if (!this.manager._fillProcessingLock || this.manager._fillProcessingLock.isReentrant()) {
             return this._performGridResync(resetOptions);
         }
         return this.manager._fillProcessingLock.acquire(async () => this._performGridResync(resetOptions));
@@ -4616,6 +4722,7 @@ class DEXBot {
             fillProcessingLockActive: this.manager?._fillProcessingLock?.isLocked() || false,
             divergenceLockActive: this.manager?._divergenceLock?.isLocked() || false,
             shadowLocksActive: this.manager?.shadowOrderIds?.size || 0,
+            recoveryExhaustedAt: this.manager?._recoveryExhaustedAt || null,
             recentFillsTracked: this._recentlyProcessedFills.size
         };
     }
@@ -4657,12 +4764,12 @@ class DEXBot {
      * Cancel dust partial orders immediately — no maps, no timers, no delay.
      * Each dust order is cancelled on chain and its slot rotated through the
      * synthetic-fill pipeline.
-     * @param {{ buy: Array, sell: Array, fillLockAlreadyHeld?: boolean }} options
+     * @param {{ buy: Array, sell: Array }} options
      * @returns {Promise<{cancelledCount: number, batchResult: {aborted: boolean}|null}>}
      * @private
      */
-    async _cancelDustOrders({ buy: buyDust = [], sell: sellDust = [], fillLockAlreadyHeld = false } = {}) {
-        return DexbotMaintenanceRuntime.cancelDustOrders(this, { buy: buyDust, sell: sellDust, fillLockAlreadyHeld });
+    async _cancelDustOrders({ buy: buyDust = [], sell: sellDust = [] } = {}) {
+        return DexbotMaintenanceRuntime.cancelDustOrders(this, { buy: buyDust, sell: sellDust });
     }
     /**
      * Set up the periodic dust health check interval.
@@ -4687,7 +4794,6 @@ class DEXBot {
                         await this._cancelDustOrders({
                             buy: health.buyDustOrders,
                             sell: health.sellDustOrders,
-                            fillLockAlreadyHeld: true,
                         });
                     });
                 }
@@ -4713,7 +4819,6 @@ class DEXBot {
      *
      * LOCK ORDERING:
      * - Canonical order: _fillProcessingLock → _divergenceLock
-     * - This function handles lock acquisition based on fillLockAlreadyHeld parameter
      * - When called from post-fill context, fill lock is already held
      * - When called from periodic context, both locks must be acquired
      * - Matches the order used in _consumeFillQueue to prevent deadlocks