dexbot 1.4.24 → 1.5.0

package/dist/modules/dexbot_maintenance_runtime.js

@@ -7,7 +7,6 @@ const __dirname = _esmDirname(__filename);
 const require = createRequire(import.meta.url);
 import fs from 'node:fs';
 import { spawn } from 'node:child_process';
-import { createHash } from './crypto/sync.js';
 import { nowIso } from './order/utils/system.js';
 import { path } from './path_api.js';
 import * as chainOrders from './chain_orders.js';
@@ -27,6 +26,7 @@ import { BroadcastUncertainError } from './dexbot_credential_client.js';
 import * as configModule from './config.js';
 const { Config } = configModule;
 import { getErrorMessage } from './utils/errors.js';
+import { isSameBotName } from './utils/sanitize_key.js';
 import { usesAmaGridPrice } from './grid_price_source.js';
 function hasOpenOrdersSyncLoopMsSet(...args) { return require('./config').hasOpenOrdersSyncLoopMsSet(...args); }
 function getOpenOrdersSyncLoopMs(...args) { return require('./config').getOpenOrdersSyncLoopMs(...args); }
@@ -41,6 +41,8 @@ function loadAmaCenterSnapshot(...args) { return require('./order/utils/system')
 function sleep(...args) { return require('./order/utils/system').sleep(...args); }
 function parseJsonWithComments(...args) { return require('./order/utils/system').parseJsonWithComments(...args); }
 function isPm2Runtime(...args) { return require('./order/logger').isPm2Runtime(...args); }
+function isWrapperAdapterOwner(...args) { return require('./launcher/adapter_requirement').isWrapperAdapterOwner(...args); }
+function readAdapterRequirement(...args) { return require('./launcher/adapter_requirement').readAdapterRequirement(...args); }
 function getSharedMarketAdapterRuntime(...args) { return require('./launcher/market_adapter_runtime').getSharedMarketAdapterRuntime(...args); }
 function resetMarketAdapterWhitelistCache(...args) { return require('./market_adapter_whitelist').resetMarketAdapterWhitelistCache(...args); }
 function isBotDynamicWeightWhitelisted(...args) { return require('./market_adapter_whitelist').isBotDynamicWeightWhitelisted(...args); }
@@ -51,6 +53,9 @@ function calculateSwapInAmount(...args) { return require('./order/utils/math').c
 function floatToBlockchainInt(...args) { return require('./order/utils/math').floatToBlockchainInt(...args); }
 function blockchainToFloat(...args) { return require('./order/utils/math').blockchainToFloat(...args); }
 function updateDynamicGridSnapshotSync(...args) { return require('../market_adapter/utils/dynamic_grid_snapshot').updateDynamicGridSnapshotSync(...args); }
+// Lazy require: dexbot_fill_runtime imports this module, so a static import
+// would be circular; at call time both modules are fully loaded.
+function scheduleFillConsumerRestartFn(...args) { return require('./dexbot_fill_runtime').scheduleFillConsumerRestart(...args); }
 function reconcileGridOrders(...args) { return require('./order/grid_reconcile').reconcileGridOrders(...args); }
 function formatUnmatchedChainOrder(...args) { return require('./order/utils/order').formatUnmatchedChainOrder(...args); }
 function getSideBudget(...args) { return require('./order/utils/order').getSideBudget(...args); }
@@ -94,7 +99,7 @@ const GRID_RESYNC_REASONS = Object.freeze({
     ...MARKET_ADAPTER_TRIGGER_RESETS,
     manual_grid_resync: MANUAL_TRIGGER_METADATA,
     rms_structural_grid_resync: {
-        shouldRefreshCenterPrice: true,
+        shouldRefreshCenterPrice: false,
         centerRefreshContext: 'RMS structural grid resync',
         centerRefreshLabel: 'RMS structural grid resync',
     },
@@ -252,37 +257,13 @@ async function maybeRunTargetedDriftReconciliation(bot, context) {
 }
 /**
  * Load and fingerprint the bots.json configuration file.
+ * Delegates to the canonical launcher/adapter_requirement helper so the
+ * fingerprint is semantic (AMA-relevant changes only) and identical to the
+ * unlock wrapper watchdog's view of the same file.
  * @returns {any} Snapshot with exists flag, fingerprint, active bots list, and adapter requirement
  */
 function loadBotsConfigSnapshot() {
-    if (!storage.exists(PROFILES_BOTS_FILE)) {
-        return {
-            exists: false,
-            fingerprint: null,
-            activeBots: [],
-            needsMarketAdapter: false,
-        };
-    }
-    const raw = storage.readFile(PROFILES_BOTS_FILE);
-    if (!raw || !raw.trim()) {
-        return {
-            exists: false,
-            fingerprint: null,
-            activeBots: [],
-            needsMarketAdapter: false,
-        };
-    }
-    const fingerprint = createHash('sha1').update(raw).digest('hex');
-    const parsed = parseJsonWithComments(raw);
-    const bots = Array.isArray(parsed?.bots) ? parsed.bots.filter(Boolean) : [];
-    const activeBots = bots.filter((bot) => bot.active !== false);
-    return {
-        exists: true,
-        fingerprint,
-        config: parsed,
-        activeBots,
-        needsMarketAdapter: activeBots.some(usesAmaGridPrice),
-    };
+    return readAdapterRequirement(PROFILES_BOTS_FILE);
 }
 /**
  * Parse PM2 jlist command output to extract process names.
@@ -376,6 +357,16 @@ async function syncMarketAdapterOnPeriodicConfigCheck(bot, context = 'periodic')
     if (typeof bot._syncMarketAdapterHook === 'function') {
         return await bot._syncMarketAdapterHook(context);
     }
+    // Centralized ownership: in monolithic mode the unlock wrapper watchdog
+    // (shared 1min tick) is the sole market-adapter spawner. A per-bot sync here would
+    // re-read bots.json and re-drive the adapter N times (once per bot) and
+    // fight the wrapper over the adapter child, so bots skip it entirely and
+    // act as pure adapter-output consumers. Wrapper-less modes (dexbot test
+    // one-shot, isolated supervisor, PM2) keep the in-bot fallback below.
+    // Checked before any file I/O so the skip also removes the duplicate read.
+    if (!isPm2Runtime() && isWrapperAdapterOwner()) {
+        return { skipped: true, reason: 'wrapper-owned' };
+    }
     if (bot._marketAdapterWatchdogInFlight) {
         return { skipped: true, reason: 'in-flight' };
     }
@@ -384,7 +375,19 @@ async function syncMarketAdapterOnPeriodicConfigCheck(bot, context = 'periodic')
         const snapshot = typeof bot._loadBotsConfigSnapshot === 'function'
             ? await bot._loadBotsConfigSnapshot()
             : loadBotsConfigSnapshot();
-        const previousFingerprint = bot._marketAdapterWatchdogFingerprint || null;
+        // Corrupt/unreadable bots.json must not move the adapter: previously
+        // the parse/read throw aborted the check and left the adapter alone.
+        // Keep that behavior by skipping the sync without touching the stored
+        // fingerprint, so the next tick re-evaluates once the file is valid.
+        if (snapshot.corrupt || snapshot.readError) {
+            const reason = snapshot.corrupt ? 'corrupt-config' : 'unreadable-config';
+            const detail = snapshot.corrupt ? 'corrupt' : 'unreadable';
+            bot._warn(`Ignoring ${detail} bots.json during ${context}; keeping previous market adapter state.`);
+            return { skipped: true, reason };
+        }
+        // ?? (not ||): the semantic fingerprint is legitimately '' when no
+        // active AMA bot exists, and '' must compare equal to a stored ''.
+        const previousFingerprint = bot._marketAdapterWatchdogFingerprint ?? null;
         const changed = snapshot.fingerprint !== previousFingerprint;
         bot._marketAdapterWatchdogFingerprint = snapshot.fingerprint;
         if (changed) {
@@ -739,7 +742,7 @@ function performGridResync(bot, options = {}) {
                 const content = storage.readFile(PROFILES_BOTS_FILE);
                 const allBotsConfig = parseJsonWithComments(content).bots || [];
                 const myName = self.config.name;
-                const updatedBot = allBotsConfig.find((b) => b.name === myName);
+                const updatedBot = allBotsConfig.find((b) => isSameBotName(b.name, myName));
                 if (updatedBot) {
                     self._log(`Reloaded configuration for bot '${myName}'`);
                     const oldKey = self.config.botKey;
@@ -782,14 +785,38 @@ function performGridResync(bot, options = {}) {
             // of virtualizing live ACTIVE slots; the trigger file is retained
             // so the resync retries on a clean read.
             let resyncReadAmbiguous = false;
+            const readOpenOrdersForResync = (label) => readOpenOrdersGuarded(chainOrders, self.accountId, {
+                log: (message, level) => self._log(message, level),
+                label,
+                detail: 'trigger-file resync',
+            });
+            // Empty-read confirm guard: an EMPTY read during a trigger reset is
+            // only accepted after one confirming re-read. A single 0-order
+            // snapshot from a lagging/partial node must never wipe a live grid
+            // and rebuild over existing orders (phantom reset — duplicated
+            // price levels and mis-tracked orders). A contradicted re-read
+            // (non-empty) feeds the fresh snapshot to the resync so the rebuild
+            // reconciles against the real chain state instead of overwriting it.
             const readFn = async () => {
-                const orders = await readOpenOrdersGuarded(chainOrders, self.accountId, {
-                    log: (message, level) => self._log(message, level),
-                    label: 'GRID-RESYNC',
-                    detail: 'trigger-file resync',
-                });
-                if (orders === null)
+                const orders = await readOpenOrdersForResync('GRID-RESYNC');
+                if (orders === null) {
+                    resyncReadAmbiguous = true;
+                    return orders;
+                }
+                if (orders.length > 0)
+                    return orders;
+                await sleep(TIMING.SYNC_EMPTY_READ_CONFIRM_DELAY_MS);
+                const confirmed = await readOpenOrdersForResync('GRID-RESYNC-CONFIRM');
+                if (confirmed === null) {
                     resyncReadAmbiguous = true;
+                    return orders;
+                }
+                if (confirmed.length > 0) {
+                    self._log(`[GRID-RESYNC] Empty open-order read contradicted by confirm re-read ` +
+                        `(${confirmed.length} order(s) present) — using fresh non-empty snapshot`, 'warn');
+                    return confirmed;
+                }
+                self._log('[GRID-RESYNC] Empty open-order read confirmed by re-read — accepting empty account', 'info');
                 return orders;
             };
             await recalculateGrid(self.manager, {
@@ -861,8 +888,11 @@ async function handlePendingTriggerReset(bot) {
     bot._log('Pending trigger file detected. Processing reset before startup...');
     const triggerInfo = readTriggerMetadata(bot.triggerFile);
     let resetSucceeded = false;
+    // skipIdle: a pending trigger is an explicit reset command that must run
+    // before the startup sequence. The idle gate can block it indefinitely
+    // when the fill queue never drains, which would silently drop the reset.
     await bot.manager._fillProcessingLock.acquire(async () => {
-        resetSucceeded = await performGridResync(bot, buildGridResyncOptions(triggerInfo));
+        resetSucceeded = await performGridResync(bot, { ...buildGridResyncOptions(triggerInfo), skipIdle: true });
     });
     if (!resetSucceeded) {
         bot._warn('Pending trigger reset failed. Continuing with normal startup path.');
@@ -907,7 +937,13 @@ async function setupTriggerFileDetection(bot) {
                             bot.manager._fillProcessingLock.acquire(async () => {
                                 if (bot._shuttingDown)
                                     return;
-                                const ok = await performGridResync(bot, buildGridResyncOptions(triggerInfo));
+                                // skipIdle: a trigger file is an explicit reset command.
+                                // Deferring it behind the idle cooldown can loop forever
+                                // when grid activity is continuous (fills arriving during
+                                // placement batches refresh the settle window); the fill
+                                // lock below already serializes the reset with in-flight
+                                // batches.
+                                const ok = await performGridResync(bot, { ...buildGridResyncOptions(triggerInfo), skipIdle: true });
                                 if (!ok) {
                                     bot._warn('Runtime trigger reset failed; retaining existing grid state.');
                                 }
@@ -1003,7 +1039,7 @@ function startOpenOrdersSyncLoop(bot) {
                                 if (syncResult?.filledOrders && syncResult.filledOrders.length > 0) {
                                     bot._log(`Open-orders sync loop: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
                                     bot._markGridActivity?.('open-orders sync fill');
-                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'open-orders sync fill rebalance');
+                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'open-orders sync fill rebalance', { isReplay: true });
                                     if (!batchResult?.aborted) {
                                         await bot.manager.persistGrid();
                                     }
@@ -1134,7 +1170,7 @@ function setupBlockchainFetchInterval(bot) {
                                 if (syncResult.filledOrders && syncResult.filledOrders.length > 0) {
                                     bot._log(`Periodic sync: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
                                     bot._markGridActivity?.('periodic sync fill rebalance');
-                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'periodic sync fill rebalance');
+                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'periodic sync fill rebalance', { isReplay: true });
                                     if (!batchResult?.aborted) {
                                         await bot.manager.persistGrid();
                                     }
@@ -1180,6 +1216,83 @@ function stopBlockchainFetchInterval(bot) {
         bot._log('Stopped periodic blockchain fetch interval');
     }
 }
+/**
+ * Set up the periodic bots.json fingerprint poll interval.
+ * Fallback config-change detector for wrapper-less modes (dexbot test
+ * one-shot, isolated supervisor, PM2): decoupled from the heavy blockchain
+ * fetch interval (default 240min) so config changes are visible within
+ * BOTS_CONFIG_POLL_INTERVAL_MS (default 1min, shared with the wrapper
+ * watchdog interval).
+ * In monolithic mode the unlock wrapper watchdog already polls bots.json
+ * on the same shared interval as the sole adapter owner, so no per-bot poll
+ * is created here.
+ * Uses the shared fingerprint via syncMarketAdapterOnPeriodicConfigCheck so
+ * the market adapter start/stop logic stays in one place.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ */
+function setupBotsConfigPollInterval(bot) {
+    // Allow per-bot timing override (e.g. tests or per-bot tuning)
+    let intervalMs = bot.config?.timing?.BOTS_CONFIG_POLL_INTERVAL_MS;
+    if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+        intervalMs = Number(TIMING.BOTS_CONFIG_POLL_INTERVAL_MS);
+    }
+    if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+        bot._log(`Bots-config poll interval disabled (value: ${intervalMs}). Fingerprint changes will only be seen on blockchain fetch ticks.`);
+        return;
+    }
+    if (!isPm2Runtime() && isWrapperAdapterOwner()) {
+        bot._log('Bots-config poll disabled (market adapter owned by unlock wrapper).');
+        return;
+    }
+    // Ensure the fingerprint exists before the first interval fires.
+    // setupBlockchainFetchInterval already fires syncMarketAdapterOnPeriodicConfigCheck
+    // at startup, so this is a fallback for bots that never run the blockchain interval
+    // (e.g. dryRun or accountId missing). Gate on === null (never checked):
+    // '' is a valid checked steady-state and must not re-trigger the pre-seed.
+    if (bot._marketAdapterWatchdogFingerprint === null || bot._marketAdapterWatchdogFingerprint === undefined) {
+        syncMarketAdapterOnPeriodicConfigCheck(bot, 'startup bots-config poll setup').catch((err) => {
+            bot._warn(`Bots-config poll setup failed: ${getErrorMessage(err)}`);
+        });
+    }
+    if (bot._botsConfigPollInterval !== null && bot._botsConfigPollInterval !== undefined) {
+        stopBotsConfigPollInterval(bot);
+    }
+    bot._botsConfigPollInterval = setInterval(async () => {
+        if (bot._shuttingDown)
+            return;
+        // Coalesce with the blockchain-fetch tick: if its tick is already
+        // driving the watchdog, skip to avoid double PM2 queries.
+        if (bot._marketAdapterWatchdogInFlight)
+            return;
+        if (bot._botsConfigPollInFlight)
+            return;
+        bot._botsConfigPollInFlight = true;
+        try {
+            await syncMarketAdapterOnPeriodicConfigCheck(bot, 'bots-config poll');
+        }
+        catch (err) {
+            bot._warn(`Bots-config poll failed: ${getErrorMessage(err)}`);
+        }
+        finally {
+            bot._botsConfigPollInFlight = false;
+        }
+    }, intervalMs);
+    if (typeof bot._botsConfigPollInterval.unref === 'function') {
+        bot._botsConfigPollInterval.unref();
+    }
+    bot._log(`Started bots-config poll interval: every ${Math.round(intervalMs / 1000)}s (fingerprint check)`);
+}
+/**
+ * Stop the periodic bots.json fingerprint poll interval.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ */
+function stopBotsConfigPollInterval(bot) {
+    if (bot._botsConfigPollInterval !== null && bot._botsConfigPollInterval !== undefined) {
+        clearInterval(bot._botsConfigPollInterval);
+        bot._botsConfigPollInterval = null;
+        bot._log('Stopped bots-config poll interval');
+    }
+}
 /**
  * Release the market adapter runtime for a bot.
  * In PM2 mode this is a no-op; in direct mode it calls the shared runtime's releaseBot.
@@ -1417,7 +1530,13 @@ async function executeMaintenanceLogic(bot, context) {
     if (pendingCorrections > 0) {
         const correctionResult = await correctAllPriceMismatches(bot.manager, bot.account, bot.privateKey, chainOrders);
         if (correctionResult.failed > 0) {
-            bot._warn(`[MAINT] ${correctionResult.failed}/${pendingCorrections} price correction(s) failed`);
+            const failedDetails = (correctionResult.results || [])
+                .filter((r) => !(r.result && r.result.success))
+                .slice(0, 3)
+                .map((r) => `${r.chainOrderId ?? '?'}: ${r.result?.error ?? 'unknown'}`)
+                .join(' | ');
+            bot._warn(`[MAINT] ${correctionResult.failed}/${pendingCorrections} price correction(s) failed` +
+                (failedDetails ? ` — ${failedDetails}` : ''));
         }
     }
     // Dust detection runs before the pipeline gate. Cancellation is immediate
@@ -1532,12 +1651,27 @@ async function executeMaintenanceLogic(bot, context) {
             // committed boundary, and re-plans on fund change, so this tick is
             // race-safe whenever it does run.
             if (!boundaryShiftPending) {
-                const spreadResult = await bot.manager.checkSpreadCondition(BitShares, bot.updateOrdersOnChainPlan.bind(bot));
-                if (await bot._abortFlowIfIllegalState(`${context} spread check`))
-                    return;
-                if (spreadResult && spreadResult.ordersPlaced > 0) {
-                    bot._log(`✓ Spread correction during ${context}: ${spreadResult.ordersPlaced} order(s) placed`);
-                    await bot._persistAndRecoverIfNeeded();
+                // Re-check the fill queue: fills may have arrived during this
+                // tick's earlier phases (health check, dust cancels, divergence
+                // corrections), after the pipeline gate above passed. Sizing a
+                // correction from pre-fill budgets would under/over-fund the
+                // repair — defer to the next tick so the fill cycle runs first
+                // and side choice + sizing read fresh funds.
+                const queuedFills = Array.isArray(bot?._incomingFillQueue)
+                    ? bot._incomingFillQueue.length
+                    : 0;
+                if (queuedFills > 0) {
+                    bot._log(`[SPREAD] Deferring spread check: ${queuedFills} fill(s) queued since pipeline gate; ` +
+                        `processing fills first for fresh funds`, 'debug');
+                }
+                else {
+                    const spreadResult = await bot.manager.checkSpreadCondition(BitShares, bot.updateOrdersOnChainPlan.bind(bot));
+                    if (await bot._abortFlowIfIllegalState(`${context} spread check`))
+                        return;
+                    if (spreadResult && spreadResult.ordersPlaced > 0) {
+                        bot._log(`✓ Spread correction during ${context}: ${spreadResult.ordersPlaced} order(s) placed`);
+                        await bot._persistAndRecoverIfNeeded();
+                    }
                 }
             }
         }
@@ -1652,7 +1786,7 @@ async function cancelDustOrders(bot, { buy: buyDust = [], sell: sellDust = [] }
     }
     if (syntheticFills.length === 0)
         return { cancelledCount: 0, batchResult: null };
-    const result = await bot._processFillsWithBatching(syntheticFills, new Set(), `dust cancel [${syntheticFills.map((o) => o.id).join(', ')}]`);
+    const result = await bot._processFillsWithBatching(syntheticFills, new Set(), `dust cancel [${syntheticFills.map((o) => o.id).join(', ')}]`, { skipAnchorUpdate: true });
     if (!result.aborted) {
         await bot.manager.persistGrid();
     }
@@ -1896,6 +2030,32 @@ function setupDustHealthCheckInterval(bot) {
         bot._dustHealthCheckTimer.unref();
     }
 }
+/**
+ * Retrigger the fill consumer once the recovery/pipeline window has fully
+ * cleared. The consumer's defer branch (batchInFlight / recoverySyncInFlight /
+ * broadcasting) returns WITHOUT rescheduling, so fills enqueued during a long
+ * window would otherwise sit in the queue forever — which also keeps the
+ * maintenance idle gate shut (queue-length check returns the full settle
+ * delay) and blocks deferred grid resyncs and periodic maintenance.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ */
+function drainFillQueueAfterPipelineClear(bot) {
+    try {
+        if (!bot || bot._shuttingDown)
+            return;
+        if ((bot._recoverySyncInFlight || 0) > 0)
+            return;
+        if ((bot._batchInFlight || 0) > 0)
+            return;
+        if (bot.manager?.isBroadcastingActive?.())
+            return;
+        if (!bot._incomingFillQueue || bot._incomingFillQueue.length === 0)
+            return;
+        bot._log(`[FILL-QUEUE] Pipeline cleared; draining ${bot._incomingFillQueue.length} deferred fill(s).`, 'info');
+        scheduleFillConsumerRestartFn(bot, chainOrders);
+    }
+    catch { }
+}
 /**
  * Request a full grid reset from fresh on-chain state.
  * @param {import('./dexbot_class.js').DEXBot} bot
@@ -1930,6 +2090,8 @@ async function requestGridReset(bot, reason = 'structural change', options = {})
         }
         finally {
             bot._recoverySyncInFlight = Math.max(0, (bot._recoverySyncInFlight || 0) - 1);
+            if ((bot._recoverySyncInFlight || 0) === 0)
+                drainFillQueueAfterPipelineClear(bot);
         }
     }
     return bot.manager._fillProcessingLock.acquire(async () => performGridResync(bot, resetOptions));
@@ -1943,14 +2105,21 @@ function wireStructuralGridResyncRequest(bot) {
         return;
     bot.manager.requestStructuralGridResync = async (reason = 'structural recovery', details = {}) => {
         if (bot._shuttingDown) {
+            bot._warn(`[RECOVERY] Structural resync skip (shutting down): ${reason}`);
             return { skipped: true, reason: 'shutting down' };
         }
         if (bot._structuralGridResyncRunning || bot._structuralGridResyncTimer) {
-            return { skipped: true, reason: 'structural grid resync already scheduled' };
+            const why = bot._structuralGridResyncRunning ? 'already running' : 'already scheduled';
+            bot._warn(`[RECOVERY] Structural resync skip (${why}): ${reason}`);
+            return { skipped: true, reason: `structural grid resync ${why}` };
         }
         const unmatchedCount = Array.isArray(details?.unmatchedChainOrders)
             ? details.unmatchedChainOrders.length
             : 0;
+        // P5 max-defer: cap batchInFlight re-arm so a fill storm cannot starve
+        // the resync forever (a fill-storm defer loop once kept the flag armed
+        // indefinitely). After the cap, the resync forces instead of re-arming.
+        const STRUCTURAL_RESYNC_MAX_DEFER_MS = 30000;
         const runStructuralResync = async () => {
             bot._structuralGridResyncTimer = null;
             if (bot._shuttingDown)
@@ -1962,8 +2131,36 @@ function wireStructuralGridResyncRequest(bot) {
             // completes; the fill consumer is already gated on _batchInFlight,
             // so this only blocks the recovery itself, never new fills.
             if (bot._batchInFlight > 0) {
-                bot._structuralGridResyncTimer = setTimeout(runStructuralResync, TIMING.LOCK_REFRESH_MIN_MS);
-                return;
+                const now = Date.now();
+                if (!bot._structuralGridResyncDeferStartedAt) {
+                    bot._structuralGridResyncDeferStartedAt = now;
+                    bot._structuralGridResyncDeferCount = 0;
+                }
+                bot._structuralGridResyncDeferCount = (bot._structuralGridResyncDeferCount || 0) + 1;
+                const deferredMs = now - bot._structuralGridResyncDeferStartedAt;
+                if (deferredMs >= STRUCTURAL_RESYNC_MAX_DEFER_MS) {
+                    bot._warn(`[RECOVERY] Structural resync max-defer reached (${deferredMs}ms, cap ${STRUCTURAL_RESYNC_MAX_DEFER_MS}ms, deferred ${bot._structuralGridResyncDeferCount}x) — forcing despite _batchInFlight=${bot._batchInFlight}: ${reason}`);
+                    bot._structuralGridResyncDeferStartedAt = null;
+                    bot._structuralGridResyncDeferCount = 0;
+                }
+                else {
+                    // Fix #7 (docs/CONSOLIDATED_ORPHAN_FIX_SUMMARY.md §2): throttle the defer log to the
+                    // first occurrence per cap window (a fill storm can emit hundreds of
+                    // defer lines in seconds); count the rest and surface them only in
+                    // the final forced message.
+                    if (bot._structuralGridResyncDeferCount === 1) {
+                        bot._warn(`[RECOVERY] Structural resync defer (batchInFlight=${bot._batchInFlight}, deferred ${deferredMs}ms/${STRUCTURAL_RESYNC_MAX_DEFER_MS}ms): ${reason}`);
+                    }
+                    else {
+                        bot.manager?.logger?.log?.(`[RECOVERY] Structural resync defer (suppressed; count=${bot._structuralGridResyncDeferCount}, deferred ${deferredMs}ms/${STRUCTURAL_RESYNC_MAX_DEFER_MS}ms): ${reason}`, 'debug');
+                    }
+                    bot._structuralGridResyncTimer = setTimeout(runStructuralResync, TIMING.LOCK_REFRESH_MIN_MS);
+                    return;
+                }
+            }
+            else {
+                bot._structuralGridResyncDeferStartedAt = null;
+                bot._structuralGridResyncDeferCount = 0;
             }
             bot._structuralGridResyncRunning++;
             try {
@@ -1989,14 +2186,30 @@ function wireStructuralGridResyncRequest(bot) {
                 }
                 const suffix = unmatchedCount > 0 ? ` (${unmatchedCount} unmatched chain order(s))` : '';
                 bot._warn(`[RECOVERY] Running structural full grid resync for ${reason}${suffix}`);
-                const resetResult = await bot.requestGridReset('rms_structural_grid_resync', {
-                    refreshCenterPrice: true,
-                    // Structural resync is a chain-read/rebuild; do not let a
-                    // fill storm starve it behind the idle cooldown or the
-                    // fill-processing lock.
-                    skipIdle: true,
-                    skipFillLock: true,
-                });
+                // Same protection as the persisted-grid reload above: the
+                // reset's reconcile Phase-2 placement runs for minutes; a
+                // fill arriving mid-reset must not start a COW batch whose
+                // broadcast overlaps it (commit refusal + duplicate
+                // generation orphans). _recoverFromPersistedGrid already
+                // incremented and released the counter; increment again
+                // for the full-resync branch.
+                bot._recoverySyncInFlight = (bot._recoverySyncInFlight || 0) + 1;
+                let resetResult;
+                try {
+                    resetResult = await bot.requestGridReset('rms_structural_grid_resync', {
+                        refreshCenterPrice: false,
+                        // Structural resync is a chain-read/rebuild; do not let a
+                        // fill storm starve it behind the idle cooldown or the
+                        // fill-processing lock.
+                        skipIdle: true,
+                        skipFillLock: true,
+                    });
+                }
+                finally {
+                    bot._recoverySyncInFlight = Math.max(0, (bot._recoverySyncInFlight || 0) - 1);
+                    if ((bot._recoverySyncInFlight || 0) === 0)
+                        drainFillQueueAfterPipelineClear(bot);
+                }
                 if (resetResult && bot.manager?._recoveryState) {
                     bot.manager._recoveryState = { ...bot.manager._recoveryState, attemptCount: 0, lastAttemptAt: 0, lastFailureAt: 0 };
                 }
@@ -2101,7 +2314,7 @@ async function syncOpenOrdersAndProcessFillsImpl(bot, tag) {
         if (syncResult?.filledOrders?.length > 0) {
             bot._refreshDynamicWeightDistribution(`${tag} sync-fill`);
             bot._log(`[SYNC-CHAIN] ${syncResult.filledOrders.length} filled order(s) found during ${tag}`, 'info');
-            const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), `${tag} sync-fill`);
+            const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), `${tag} sync-fill`, { isReplay: true });
             if (!batchResult?.aborted) {
                 // Reassign the returned snapshot to the post-fill re-read: the
                 // caller feeds openOrders into reconcileGridOrders, which must
@@ -2128,9 +2341,10 @@ async function syncOpenOrdersAndProcessFillsImpl(bot, tag) {
         return { syncResult: null, aborted: true, hasUnmatched: -1, openOrders: null };
     }
 }
-export { loadBotsConfigSnapshot, refreshDynamicWeightDistribution, performGridResync, updateBotGridResetMetadata, handlePendingTriggerReset, setupTriggerFileDetection, performPeriodicGridChecks, isOpenOrdersSyncLoopEnabled, startOpenOrdersSyncLoop, stopOpenOrdersSyncLoop, setupBlockchainFetchInterval, stopBlockchainFetchInterval, executeMaintenanceLogic, cancelDustOrders, isOrderDoesNotExistError, runGridMaintenance, stopMarketAdapterPm2, releaseMarketAdapterRuntime, syncMarketAdapterOnPeriodicConfigCheck, findSnapshotBotForRuntimeConfig, runtimeConfigNeedsMarketAdapter, usesAmaGridPrice, checkBtsBalanceAndAcquire, acquireBts, runDustHealthCheck, setupDustHealthCheckInterval, requestGridReset, wireStructuralGridResyncRequest, getPipelineSignals, markGridActivity, getMetrics, syncOpenOrdersAndProcessFills };
+export { loadBotsConfigSnapshot, isWrapperAdapterOwner, refreshDynamicWeightDistribution, performGridResync, updateBotGridResetMetadata, handlePendingTriggerReset, setupTriggerFileDetection, performPeriodicGridChecks, isOpenOrdersSyncLoopEnabled, startOpenOrdersSyncLoop, stopOpenOrdersSyncLoop, setupBlockchainFetchInterval, stopBlockchainFetchInterval, setupBotsConfigPollInterval, stopBotsConfigPollInterval, executeMaintenanceLogic, cancelDustOrders, isOrderDoesNotExistError, runGridMaintenance, stopMarketAdapterPm2, releaseMarketAdapterRuntime, syncMarketAdapterOnPeriodicConfigCheck, findSnapshotBotForRuntimeConfig, runtimeConfigNeedsMarketAdapter, usesAmaGridPrice, checkBtsBalanceAndAcquire, acquireBts, runDustHealthCheck, setupDustHealthCheckInterval, requestGridReset, wireStructuralGridResyncRequest, getPipelineSignals, markGridActivity, getMetrics, syncOpenOrdersAndProcessFills };
 export default {
     loadBotsConfigSnapshot,
+    isWrapperAdapterOwner,
     refreshDynamicWeightDistribution,
     performGridResync,
     updateBotGridResetMetadata,
@@ -2142,6 +2356,8 @@ export default {
     stopOpenOrdersSyncLoop,
     setupBlockchainFetchInterval,
     stopBlockchainFetchInterval,
+    setupBotsConfigPollInterval,
+    stopBotsConfigPollInterval,
     executeMaintenanceLogic,
     cancelDustOrders,
     isOrderDoesNotExistError,