dexbot 1.4.19 → 1.4.21

package/dist/modules/order/grid.js

@@ -111,7 +111,7 @@ function _snapshotFundState(manager) {
         sellLocked: Number(manager.accountTotals?.sellLocked || 0),
     };
 }
-import { floatToBlockchainInt, getPrecisionByOrderType, getPrecisionsForManager, calculateOrderCreationFees, calculateOrderSizes, calculateRotationOrderSizes, calculateAvailableFundsValue, calculateGridSideDivergenceMetric, getPrecisionSlack, getMinOrderSize, getSingleDustThreshold, getGridBestPrices, calculateSpreadFromOrders, allocateFundsByWeights, calculateGapSlots as _mathGapSlots, findPriceCollision, getBtsSide, getSellStartIdx, resolveGapBand, countGapBandSpread, adjustBudgetForBtsFees, clamp, } from './utils/math.js';
+import { floatToBlockchainInt, getPrecisionByOrderType, getPrecisionsForManager, calculateOrderCreationFees, calculateOrderSizes, calculateRotationOrderSizes, calculateAvailableFundsValue, calculateGridSideDivergenceMetric, getPrecisionSlack, getMinOrderSize, getSingleDustThreshold, getGridBestPrices, calculateSpreadFromOrders, allocateFundsByWeights, calculateGapSlots as _mathGapSlots, findPriceCollision, getBtsSide, getSellStartIdx, resolveGapBand, countGapBandSpread, validatePersistedBoundary, adjustBudgetForBtsFees, clamp, } from './utils/math.js';
 import { filterOrdersByType, checkSizesBeforeMinimum, checkSizeThreshold, resolveConfiguredPriceBound, shouldFlagOutOfSpread, isOrderHealthy, isPhantomOrder, isSlotAvailable, isOrderOnChain, isOrderPlaced, hasOnChainId, isEmptyGridSlot, parseSlotIndex, calculateIdealBoundary, assignGridRoles, resolveOnChainRetypeType } from './utils/order.js';
 import { loadAmaCenterPrice, loadAmaCenterSnapshot, withBlockchainRetry } from './utils/system.js';
 import { derivePriceWithPoolRef } from './utils/withPoolRef.js';
@@ -468,10 +468,57 @@ export async function loadGrid(manager, grid, boundaryIdx = null) {
             await manager.resetFunds();
             manager.funds.btsFeesOwed = savedBtsFeesOwed;
         });
+        // RESTORE-TIME BOUNDARY GATE: a persisted boundary is untrusted
+        // disk state.  Any writer bug that committed AND persisted an
+        // overrun boundary (e.g. the pre-5eb3ca7 promotion path) would
+        // otherwise legalize itself on every restart: resolveGapBand
+        // re-derives sellStartIdx from whatever value is restored, and
+        // none of the runtime gates (commit gate, detectors) run before
+        // this point.  Validate against the snapshot BEFORE restoring;
+        // on failure attempt to repair by re-deriving the structural
+        // center boundary from slot prices, falling back to "no boundary"
+        // (callers sync against chain right after load either way).
+        const loadGapSlots = calculateGapSlots(manager.config?.incrementPercent, manager.config?.targetSpreadPercent, manager.config?.gridLimits);
+        let restoredBoundary = typeof boundaryIdx === 'number' ? boundaryIdx : null;
+        if (restoredBoundary !== null) {
+            const check = validatePersistedBoundary(restoredBoundary, grid, loadGapSlots);
+            if (!check.ok) {
+                manager.logger?.log?.(`[GRID-LOAD] Persisted boundary rejected (${check.reason}): ${check.detail}. ` +
+                    `Attempting re-derivation from slot prices.`, 'error');
+                restoredBoundary = null;
+                const startPrice = Number(manager.config?.startPrice);
+                if (Number.isFinite(startPrice) && Array.isArray(grid) && grid.length > 0) {
+                    const priceSorted = [...grid].sort((a, b) => Number(a.price) - Number(b.price));
+                    const derived = calculateIdealBoundary(priceSorted.map((s) => ({ price: s.price })), startPrice, loadGapSlots);
+                    if (Number.isInteger(derived) && derived >= 0
+                        && validatePersistedBoundary(derived, priceSorted, loadGapSlots).ok) {
+                        // boundaryIdx indexes the STORED array ordering, not
+                        // the price-sorted copy — map the anchor slot back
+                        // so the repair stays correct even if a snapshot is
+                        // not price-sorted (the honest-load path assumes it;
+                        // the repair path must not inherit that silently).
+                        const anchorSlot = priceSorted[derived];
+                        let mappedIdx = grid.indexOf(anchorSlot);
+                        if (mappedIdx === -1 && anchorSlot?.id != null) {
+                            mappedIdx = grid.findIndex((s) => s && s.id === anchorSlot.id);
+                        }
+                        if (mappedIdx >= 0) {
+                            restoredBoundary = mappedIdx;
+                            manager.logger?.log?.(`[GRID-LOAD] Persisted boundary repaired: ${boundaryIdx} -> ${mappedIdx} ` +
+                                `(re-derived from slot prices, sorted idx ${derived}).`, 'warn');
+                        }
+                    }
+                }
+                if (restoredBoundary === null) {
+                    manager.logger?.log?.(`[GRID-LOAD] Could not re-derive a safe boundary; continuing without one. ` +
+                        `The next sync cycle will reconcile grid geometry against the chain.`, 'error');
+                }
+            }
+        }
         // Restore boundary index for StrategyEngine
-        if (typeof boundaryIdx === 'number') {
-            manager._restoreBoundary(boundaryIdx);
-            manager.logger?.log?.(`Restored boundary index: ${boundaryIdx}`, 'info');
+        if (restoredBoundary !== null) {
+            manager._restoreBoundary(restoredBoundary);
+            manager.logger?.log?.(`Restored boundary index: ${restoredBoundary}`, 'info');
         }
         // Reassign slot types based on current boundary.
         // Every slot's type must match its position in the price-sorted rail
@@ -479,11 +526,11 @@ export async function loadGrid(manager, grid, boundaryIdx = null) {
         // split spread zones and ILLEGAL_SPREAD_STATE errors.  The subsequent
         // sync will detect type mismatches with chain orders (e.g. a BUY-zone
         // slot holding a SELL chain order) and auto-cancel + recreate them.
-        if (typeof boundaryIdx === 'number') {
-            const gapSlots = calculateGapSlots(manager.config?.incrementPercent, manager.config?.targetSpreadPercent, manager.config?.gridLimits);
+        if (restoredBoundary !== null) {
+            const gapSlots = loadGapSlots;
             manager._gapSlots = gapSlots;
-            const buyEndIdx = boundaryIdx;
-            const sellStartIdx = getSellStartIdx(boundaryIdx, gapSlots);
+            const buyEndIdx = restoredBoundary;
+            const sellStartIdx = getSellStartIdx(restoredBoundary, gapSlots);
             let reassignCount = 0;
             grid = grid.map((slot, i) => {
                 const correctType = (i <= buyEndIdx)
@@ -535,7 +582,7 @@ export async function loadGrid(manager, grid, boundaryIdx = null) {
                 return slot;
             });
             if (reassignCount > 0) {
-                manager.logger?.log?.(`[GRID-TYPE-CORRECT] Reassigned ${reassignCount} stale slot type(s) based on boundary ${boundaryIdx}`, 'warn');
+                manager.logger?.log?.(`[GRID-TYPE-CORRECT] Reassigned ${reassignCount} stale slot type(s) based on boundary ${restoredBoundary}`, 'warn');
             }
         }
         // Gap 6: Grid size cap — validate grid slot count against expected maximum.
@@ -1986,29 +2033,53 @@ export function determineOrderSideByFunds(manager, currentMarketPrice) {
     }
     return { side, reason: side ? `Choosing ${side}` : 'Insufficient funds or committed inventory' };
 }
+/**
+ * Resolve the MIN_SPREAD_ORDERS gap reserve used by boundary promotion.
+ * Promotion may never consume the last `reserve` empty slots of the gap
+ * band — this is the floor that keeps the spread from being zeroed.
+ */
+function resolveMinSpreadOrdersReserve(manager) {
+    const raw = Number(manager?.config?.gridLimits?.MIN_SPREAD_ORDERS ?? GRID_LIMITS.MIN_SPREAD_ORDERS);
+    return (Number.isFinite(raw) && raw >= 0) ? Math.floor(raw) : GRID_LIMITS.MIN_SPREAD_ORDERS;
+}
 // Collect contiguous empty gap-band slots adjacent to a rail edge for boundary
 // promotion.  BUY walks upward from the boundary into the gap, SELL walks
 // downward from the sell start; both stop at the first unavailable slot.
 // Mirrors are collapsed into one directional walk (step +/- 1).
 //
-// NOTE: the promotion cap is the OPPOSITE RAIL's span, NOT the gap-band size.
-// SELL promotion moves the boundary down by the promoted count (boundary =
-// buyEndIdx - count), so capping at buyEndIdx keeps it >= 0.  BUY promotion
-// moves the boundary up; capping at the SELL rail size (maxIdx+1-sellStartIdx)
-// keeps the promoted boundary at or below the last placed slot.  The walk's
-// own idx < sellStartIdx / idx > buyEndIdx bounds already limit promotion to
-// the band, so this cap only binds when the opposite rail is smaller than the
-// band — i.e. an empty opposite rail (cap 0) blocks promotion entirely.
-function _collectPromotableBoundarySlots(allSlotsByPrice, railType, buyEndIdx, sellStartIdx, quota) {
+// PROMOTION CAP (gap-band geometry): promotion may consume at most
+// bandSize − MIN_SPREAD_ORDERS slots, where bandSize = sellStartIdx −
+// buyEndIdx − 1.  The previous cap (the OPPOSITE RAIL's span) constrained
+// nothing: for BUY it was the sell rail's length and for SELL the buy
+// rail's length, so a single correction could promote every gap slot and
+// zero the spread.  Reserving MIN_SPREAD_ORDERS empty slots guarantees the
+// gap never closes within this path regardless of quota.
+//
+// DEFENSE-IN-DEPTH WALK BOUNDS: the loop itself also stops
+// MIN_SPREAD_ORDERS short of the opposite rail edge (idx <= sellStartIdx−1−
+// reserve for BUY / idx >= buyEndIdx+1+reserve for SELL), so even if the
+// cap above is ever miscomputed the walk cannot consume the reserved gap.
+// When bandSize <= reserve the bound disables promotion entirely.
+function _collectPromotableBoundarySlots(allSlotsByPrice, railType, buyEndIdx, sellStartIdx, quota, spreadReserve, maxDepth) {
     const isBuy = railType === ORDER_TYPES.BUY;
-    const maxIdx = allSlotsByPrice.length - 1;
-    const maxPromotable = isBuy
-        ? Math.max(0, maxIdx + 1 - sellStartIdx)
-        : Math.max(0, buyEndIdx);
-    const promotionQuota = Math.min(quota, maxPromotable);
+    const bandSize = Math.max(0, sellStartIdx - buyEndIdx - 1);
+    // Depth is bounded by three independent caps (defense-in-depth):
+    //   reserve cap  — keep MIN_SPREAD_ORDERS empties in the band
+    //   stranding cap— the boundary slide must never move a placed
+    //                  opposite-rail order into the implied spread band;
+    //                  constraining DEPTH here (not clamping the derived
+    //                  boundary afterwards) keeps the promoted slots'
+    //                  classification consistent with the new geometry
+    //   walk bounds  — hard stop short of the opposite rail edge, even if
+    //                  both caps above were ever miscomputed
+    const maxPromotable = Math.max(0, bandSize - spreadReserve);
+    const promotionQuota = Math.min(quota, maxPromotable, Math.max(0, maxDepth));
     const promoted = [];
     const step = isBuy ? 1 : -1;
-    for (let idx = isBuy ? buyEndIdx + 1 : sellStartIdx - 1; promoted.length < promotionQuota && (isBuy ? idx < sellStartIdx : idx > buyEndIdx); idx += step) {
+    for (let idx = isBuy ? buyEndIdx + 1 : sellStartIdx - 1; promoted.length < promotionQuota
+        && (isBuy
+            ? idx <= sellStartIdx - 1 - spreadReserve
+            : idx >= buyEndIdx + 1 + spreadReserve); idx += step) {
         const slot = allSlotsByPrice[idx];
         if (!slot || !isSlotAvailable(slot))
             break;
@@ -2130,9 +2201,37 @@ export async function prepareSpreadCorrectionOrders(manager, preferredSide, outO
     // fiction.  Without promotion there is nothing to commit, so falling
     // back to the pre-existing candidate paths is safe.
     const promotedCandidates = [];
+    const spreadReserve = resolveMinSpreadOrdersReserve(manager);
+    // STRANDING DEPTH CAP: the post-commit geometry re-derives the band
+    // from the new boundary, sliding it over opposite-rail slots.  A
+    // slide may never swallow an already-PLACED order into that band, so
+    // promotion depth is capped up-front — constraining depth keeps the
+    // derived boundary consistent with every promoted slot's placement;
+    // clamping the boundary afterwards would not.
+    let maxPromotionDepth = Infinity;
+    if (railType === ORDER_TYPES.BUY) {
+        for (let idx = Math.max(sellStartIdx, 0); idx < allSlotsByPrice.length; idx++) {
+            if (allSlotsByPrice[idx]?.orderId) {
+                // Implied sell zone must start at/below the lowest placed
+                // sell: B' + gapSlots + 1 <= idx  =>  depth <= idx − G − 1 − B.
+                maxPromotionDepth = idx - gapSlots - 1 - buyEndIdx;
+                break;
+            }
+        }
+    }
+    else {
+        for (let idx = Math.min(buyEndIdx, allSlotsByPrice.length - 1); idx >= 0; idx--) {
+            if (allSlotsByPrice[idx]?.orderId) {
+                // Boundary may not drop below the highest placed buy:
+                // B' = B − depth >= idx  =>  depth <= B − idx.
+                maxPromotionDepth = buyEndIdx - idx;
+                break;
+            }
+        }
+    }
     if (boundaryKnown && orphanedVirtualCandidates.length + typedSpreadCandidates.length < missingSlots) {
         const rawQuota = missingSlots - orphanedVirtualCandidates.length - typedSpreadCandidates.length;
-        promotedCandidates.push(..._collectPromotableBoundarySlots(allSlotsByPrice, railType, buyEndIdx, sellStartIdx, rawQuota));
+        promotedCandidates.push(..._collectPromotableBoundarySlots(allSlotsByPrice, railType, buyEndIdx, sellStartIdx, rawQuota, spreadReserve, maxPromotionDepth));
         if (promotedCandidates.length > 0) {
             manager.logger?.log?.(`[SPREAD-CORRECTION] ${promotedCandidates.length} gap slot(s) available for boundary promotion on ${sideName}`, 'info');
         }
@@ -2316,15 +2415,30 @@ export async function prepareSpreadCorrectionOrders(manager, preferredSide, outO
             boundaryIdx = railType === ORDER_TYPES.BUY
                 ? buyEndIdx + maxDist
                 : buyEndIdx - maxDist;
+            // PROMOTION BOUNDARY BACKSTOP (refusal-only): the boundary is
+            // DERIVED from the placed promoted set (buyEndIdx ± maxDist),
+            // so shifting it here would silently strand those fresh orders
+            // inside the implied band.  All real constraints — the
+            // MIN_SPREAD_ORDERS reserve and opposite-rail stranding — are
+            // enforced UPSTREAM as walk-depth caps.  This backstop only
+            // verifies array limits plus the reserve ceiling; any
+            // violation signals an internal inconsistency, so promotion is
+            // refused loudly instead of silently re-geometried.
             const maxIdx = allSlotsByPrice.length - 1;
-            const clamped = clamp(boundaryIdx, 0, maxIdx);
-            if (clamped !== boundaryIdx) {
-                manager.logger?.log?.(`[SPREAD-CORRECTION] Boundary promotion clamped on ${sideName}: ` +
-                    `${boundaryIdx} -> ${clamped}`, 'warn');
-                boundaryIdx = clamped;
+            const lo = 0;
+            const hi = railType === ORDER_TYPES.BUY
+                ? Math.min(maxIdx, sellStartIdx - 1 - spreadReserve)
+                : maxIdx;
+            if (lo > hi || boundaryIdx < lo || boundaryIdx > hi) {
+                manager.logger?.log?.(`[SPREAD-CORRECTION] Boundary promotion refused on ${sideName}: ` +
+                    `derived boundary ${boundaryIdx} violates safe range [${lo}, ${hi}] ` +
+                    `(band ${buyEndIdx + 1}..${sellStartIdx - 1})`, 'warn');
+                boundaryIdx = undefined;
+            }
+            else {
+                manager.logger?.log?.(`[SPREAD-CORRECTION] Boundary promotion on ${sideName}: ` +
+                    `${buyEndIdx} -> ${boundaryIdx} (${placedPromotedIds.size} placed, maxDist ${maxDist})`, 'info');
             }
-            manager.logger?.log?.(`[SPREAD-CORRECTION] Boundary promotion on ${sideName}: ` +
-                `${buyEndIdx} -> ${boundaryIdx} (${placedPromotedIds.size} placed, maxDist ${maxDist})`, 'info');
         }
         else {
             boundaryIdx = undefined;