dexbot 1.4.7 → 1.4.8

package/dist/modules/dexbot_cow_runtime.js

@@ -9,16 +9,23 @@
  * the same pattern as dexbot_fill_runtime.ts.
  */
 const chainOrders = require('./chain_orders');
+const { readOpenOrdersWithMetaSafe, readOpenOrdersGuarded } = require('./chain_orders');
 const { BroadcastUncertainError } = require('./dexbot_credential_client');
 const { buildCreateOrderArgs, buildCreateOpFingerprint, extractBatchOperationResults, formatUnmatchedChainOrder, convertToSpreadPlaceholder, buildOutsideInPairGroups, isOrderPlaced, } = require('./order/utils/order');
-const { validateCreateTargetSlots } = require('./order/utils/validate');
+const { validateCreateTargetSlots, evaluateCommit, hasExecutableActions } = require('./order/utils/validate');
 const { validateOrderSize, findPriceCollision } = require('./order/utils/math');
 // Lazy accessor so test mocks on the math module export take effect at call time.
-function getAssetFees(...args) { return require('./order/utils/math').getAssetFees(...args); }
+function getAssetFeesSafe(...args) { return require('./order/utils/math').getAssetFeesSafe(...args); }
 const { COW_ACTIONS, ORDER_STATES, ORDER_TYPES, REBALANCE_STATES, } = require('./constants');
 const Format = require('./order/format');
 const { WorkingGrid } = require('./order/working_grid');
 const { getErrorMessage } = require('./utils/errors');
+// Maximum number of times the pre-broadcast staleness guard may re-plan the
+// batch from a fresh master before proceeding anyway. Bounded so a master
+// grid that keeps mutating (fill bursts, sync loops) can never livelock the
+// pipeline: after one re-plan the batch is shipped regardless, and the
+// commit-time guard + post-refused-commit chain adoption close divergence.
+const STALE_PLAN_REPLAN_LIMIT = 1;
 /**
  * Group orders into outside-in pairs for atomic create execution.
  * @param {Array} orders
@@ -104,7 +111,19 @@ async function recoverAfterMissingCreateResults(bot, reason = 'missing create op
                 .filter((order) => order?.reason === 'missing-create-result')
                 .map((order) => ({ ...order }))
             : [];
-        const openOrders = await chainOrders.readOpenOrders(accountRef);
+        // Truncated-read guard: the freshest CREATEs sort last and are exactly
+        // the orders a partial get_full_accounts window omits — syncing would
+        // virtualize them (phantom cleanup). Defer; blockers stay registered
+        // so the COW guard retries the recovery on a clean read.
+        const openOrders = await readOpenOrdersGuarded(chainOrders, accountRef, {
+            log: (message, level) => bot.manager?.logger?.log?.(message, level),
+            label: 'COW',
+            detail: `recovery sync after ${reason}`,
+        });
+        if (openOrders === null) {
+            bot.manager?.logger?.log?.(`[COW] Deferring recovery sync after ${reason}: open-order read ambiguous (truncated); blockers retained for retry.`, 'warn');
+            return;
+        }
         const recoveryResult = await bot.manager.syncFromOpenOrders(openOrders, {
             skipAccounting: false,
         });
@@ -255,6 +274,69 @@ function clearPendingBroadcasts(pendingBroadcasts) {
         pendingBroadcasts.clear();
     }
 }
+/**
+ * Drop only the pending-broadcast entries for the given CREATE slots.
+ *
+ * Used by the re-plan path: the original plan's ops are abandoned with its
+ * working grid, so their pending entries must not trip the recursion's own
+ * pending-broadcast guard. Entries recorded by an EARLIER unresolved batch
+ * (different slots) are KEPT — clearing them here would let the fresh plan
+ * re-create slots whose earlier uncertain broadcast may have landed
+ * (duplicate orders). The batch-entry guard only fires for batches WITH
+ * CREATE actions, so a create-less batch can reach the re-plan path while
+ * earlier entries are still live.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Array} actions - The abandoned batch's actions (COW_ACTIONS)
+ */
+function clearPendingBroadcastsForSlots(bot, actions) {
+    if (!(bot.manager?._pendingBroadcasts instanceof Map) || !Array.isArray(actions))
+        return;
+    const slotIds = new Set(actions
+        .filter((a) => a?.type === COW_ACTIONS.CREATE)
+        .map((a) => a?.id)
+        .filter(Boolean));
+    if (slotIds.size === 0)
+        return;
+    for (const [fp, entry] of bot.manager._pendingBroadcasts) {
+        if (entry?.slotId && slotIds.has(entry.slotId)) {
+            bot.manager._pendingBroadcasts.delete(fp);
+        }
+    }
+}
+/**
+ * Pop a pushed working-grid stack entry exactly once, guarded on the push
+ * marker (manager-owned discipline — see OrderManager._pushWorkingGridRef /
+ * _popWorkingGridRef). Results that were never pushed (aborted plans,
+ * no-trigger processFilledOrders outputs, updateOrdersOnChainPlan cowResults,
+ * reconcileGridOrders null results) leave the stack untouched — an unmatched
+ * pop could steal a nested grid's entry.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Object} cowResult - Rebalance/COW result carrying _workingGridPushed
+ */
+function popPushedWorkingGrid(bot, cowResult) {
+    bot.manager?._popWorkingGridRef?.(cowResult);
+}
+/**
+ * Defer an uncertain-broadcast reconciliation on an ambiguous chain read
+ * (empty/truncated/failed). An empty snapshot may be a node lagging behind
+ * the just-broadcast transaction and a truncated get_full_accounts window
+ * omits the freshest orders (exactly the batch's creates), so absence is
+ * never authoritative: the pending-broadcast protection is kept and a
+ * structural resync is requested so the next cycle adopts any landed orders.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {string} detail - The failure detail (before the common suffix)
+ * @param {string} suffix - Parenthetical explanation appended to the message
+ * @param {string} resyncReason - Reason string passed to the structural resync
+ * @param {Object} [resyncOptions={}] - Extra resync context (batchId, truncated...)
+ * @returns {Object} Ambiguous-read reconciliation result
+ */
+async function deferUncertainBroadcastRead(bot, detail, suffix, resyncReason, resyncOptions = {}) {
+    bot.manager.logger.log(`[COW][UNCERTAIN] ${detail}; keeping pending-broadcast protection and requesting structural resync ${suffix}`, 'warn');
+    if (typeof bot.manager.requestStructuralGridResync === 'function') {
+        await bot.manager.requestStructuralGridResync(resyncReason, resyncOptions);
+    }
+    return { executed: false, hadRotation: false, uncertain: true, ambiguousRead: true };
+}
 /**
  * Build a fingerprint for an on-chain order so it can be matched against
  * the pending-broadcast cache.
@@ -417,8 +499,8 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
     bot.manager.logger.log(`[COW][UNCERTAIN] batchId=${err?.batchId || 'n/a'} ops=${opContexts.length} ` +
         `creates=${createContextCount} nonCreates=${nonCreateContextCount} ` +
         `staleSinceMs=${err?.timeoutMs || 'n/a'}. Entering reconcile-then-decide.`, 'warn');
-    if (!chainOrders?.readOpenOrders) {
-        bot.manager.logger.log('[COW][UNCERTAIN] readOpenOrders unavailable; falling back to structural resync only.', 'error');
+    if (!chainOrders?.readOpenOrdersWithMeta) {
+        bot.manager.logger.log('[COW][UNCERTAIN] readOpenOrdersWithMeta unavailable; falling back to structural resync only.', 'error');
         if (typeof bot.manager.requestStructuralGridResync === 'function') {
             await bot.manager.requestStructuralGridResync('broadcast uncertain — readOpenOrders unavailable', { batchId: err?.batchId || null });
         }
@@ -428,8 +510,11 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
     // 1. Read the chain
     const accountRef = bot.accountId || bot.account?.id || bot.account;
     let chainSnapshot = [];
+    let chainReadTruncated = false;
     try {
-        chainSnapshot = await chainOrders.readOpenOrders(accountRef);
+        const chainRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
+        chainSnapshot = chainRead.orders;
+        chainReadTruncated = chainRead.truncated;
     }
     catch (readErr) {
         bot.manager.logger.log(`[COW][UNCERTAIN] readOpenOrders failed: ${readErr?.message || readErr}. ` +
@@ -440,6 +525,19 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
         clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
         return { executed: false, hadRotation: false, uncertain: true };
     }
+    // 1.5. Empty/truncated-read guard: an empty snapshot is ambiguous — the
+    // account is either genuinely empty or the node is lagging behind the
+    // just-broadcast transaction. A truncated snapshot (get_full_accounts
+    // capped limit_orders; fresh creates sort last in the by_account index
+    // and are the first entries omitted) is equally ambiguous: the batch's
+    // creates may simply be missing from the returned window. Treating every
+    // pending broadcast as discarded would clear the pending-broadcast
+    // protection and let the next cycle re-CREATE slots whose orders may
+    // actually be on chain (duplicate orders). Keep the protection and let
+    // the structural resync adopt any landed orders.
+    if (pending.length > 0 && (chainSnapshot.length === 0 || chainReadTruncated)) {
+        return await deferUncertainBroadcastRead(bot, `${chainSnapshot.length === 0 ? 'Empty' : 'Truncated'} chain read for ${pending.length} pending broadcast(s)`, '(node may be lagging or the result set capped; no discard decisions made)', 'uncertain broadcast — empty/truncated chain read', { batchId: err?.batchId || null, truncated: chainReadTruncated });
+    }
     const adopted = [];
     let discarded = [];
     // 2. For each pending broadcast, look for a chain match.
@@ -488,7 +586,21 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
         });
         if (createDiscarded.length > 0) {
             try {
-                const freshChain = await chainOrders.readOpenOrders(accountRef);
+                const freshRead = await readOpenOrdersWithMetaSafe(chainOrders, accountRef);
+                // An empty/truncated re-read is as ambiguous as the initial
+                // read: a truncated get_full_accounts window omits the freshest
+                // creates (exactly the discarded ones being re-verified), and an
+                // empty snapshot may be a node lagging behind the just-broadcast
+                // transaction. Absence in either case is NOT authoritative —
+                // discarding here would free the slot + clear the pending
+                // protection and let the next cycle re-create (duplicate) an
+                // order that actually landed in the TOCTOU window. Keep the
+                // pending-broadcast protection and defer to a structural resync.
+                if (!freshRead || freshRead.truncated || !Array.isArray(freshRead.orders) || freshRead.orders.length === 0) {
+                    const ambiguous = !freshRead || !Array.isArray(freshRead.orders) || freshRead.orders.length === 0;
+                    return await deferUncertainBroadcastRead(bot, `${ambiguous ? 'Empty' : 'Truncated'} re-read for ${createDiscarded.length} discarded CREATE(s)`, '(absence is not authoritative on an ambiguous re-read)', 'uncertain broadcast — ambiguous re-read for discarded creates', { batchId: err?.batchId || null, truncated: !ambiguous });
+                }
+                const freshChain = freshRead.orders;
                 const remainingDiscarded = [];
                 for (const entry of discarded) {
                     const ctx = opContexts[entry.ctxIndex];
@@ -513,8 +625,8 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                 }
                 discarded = remainingDiscarded;
             }
-            catch {
-                bot.manager.logger.log('[COW][UNCERTAIN] Fresh chain read for late adoption failed; proceeding with original discard decisions.', 'warn');
+            catch (reReadErr) {
+                return await deferUncertainBroadcastRead(bot, `Fresh chain read for late adoption FAILED (${getErrorMessage(reReadErr)})`, '(absence is not authoritative on a failed re-read)', 'uncertain broadcast — failed re-read for discarded creates', { batchId: err?.batchId || null });
             }
         }
     }
@@ -528,12 +640,12 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
             const chainOrderId = match.id;
             const expectedType = plannedOpCtx.order?.type || entry.orderType;
             try {
-                const btsFeeData = getAssetFees('BTS');
+                const btsFeeData = getAssetFeesSafe('BTS');
                 await bot.manager.synchronizeWithChain({
                     gridOrderId: plannedOpCtx.order?.id || entry.slotId,
                     chainOrderId,
                     expectedType,
-                    fee: btsFeeData.createFee,
+                    fee: btsFeeData?.createFee || 0,
                 }, 'createOrder');
             }
             catch (syncErr) {
@@ -558,14 +670,52 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                 if (entry.order?.id && entry.order?.size && entry.order?.type) {
                     const slot = bot.manager.orders.get(entry.order.id);
                     if (slot) {
-                        bot.manager.logger.log(`[COW][UNCERTAIN] Restored target size for discarded CREATE slot ${entry.slotId} (size: ${entry.order.size})`, 'debug');
-                        const updates = [{
-                                ...slot,
-                                size: entry.order.size,
-                                price: entry.order.price,
-                            }];
-                        if (typeof bot.manager.applyGridUpdateBatch === 'function') {
-                            await bot.manager.applyGridUpdateBatch(updates, 'uncertain-broadcast-discard-restore');
+                        const plannedType = entry.order.type;
+                        if (plannedType === ORDER_TYPES.BUY || plannedType === ORDER_TYPES.SELL) {
+                            // Creation-uncertain state: the broadcast MAY have
+                            // landed on chain even though no match was found yet.
+                            // Keep the planned type and size on the slot (VIRTUAL)
+                            // instead of restoring the SPREAD placeholder, whose
+                            // size is normalized to 0 by the SPREAD invariant.
+                            // A possibly-landed order must never be released as a
+                            // clean hole — that frees the slot for a duplicate
+                            // CREATE and later orphan adoption double-commits the
+                            // funds. The next sync's orphan adoption reconciles a
+                            // landed order into this slot cleanly.
+                            bot.manager.logger.log(`[COW][UNCERTAIN] Restored creation-uncertain state for slot ${entry.slotId} ` +
+                                `(type=${plannedType}, size: ${entry.order.size}); next sync adoption will reconcile any landed order`, 'warn');
+                            const updates = [{
+                                    ...slot,
+                                    type: plannedType,
+                                    size: entry.order.size,
+                                    price: entry.order.price,
+                                    state: ORDER_STATES.VIRTUAL,
+                                    // Clear any stale order identity: the broadcast
+                                    // MAY have landed, but the slot must look like a
+                                    // clean adoption target (no orderId/rawOnChain)
+                                    // so the next sync's orphan adoption can reconcile
+                                    // a landed order into it. A retained orderId would
+                                    // make pass-2 adoption skip the slot (it requires
+                                    // !adoptedSlot.orderId), leaving the landed order
+                                    // unmatched and auto-cancelled; a stale rawOnChain
+                                    // would feed a bogus drift signal.
+                                    orderId: null,
+                                    rawOnChain: null,
+                                }];
+                            if (typeof bot.manager.applyGridUpdateBatch === 'function') {
+                                await bot.manager.applyGridUpdateBatch(updates, 'uncertain-broadcast-discard-restore');
+                            }
+                        }
+                        else {
+                            bot.manager.logger.log(`[COW][UNCERTAIN] Restored target size for discarded CREATE slot ${entry.slotId} (size: ${entry.order.size})`, 'debug');
+                            const updates = [{
+                                    ...slot,
+                                    size: entry.order.size,
+                                    price: entry.order.price,
+                                }];
+                            if (typeof bot.manager.applyGridUpdateBatch === 'function') {
+                                await bot.manager.applyGridUpdateBatch(updates, 'uncertain-broadcast-discard-restore');
+                            }
                         }
                     }
                 }
@@ -718,8 +868,102 @@ function shouldExecuteCreatePairMode(_bot, opContexts) {
     }
     return false;
 }
+/**
+ * Verify one op context against a fresh chain snapshot for pre-retry
+ * re-broadcast safety. Verdicts per kind (see the kind-specific verifiers):
+ *  - 'absent'  → provably never transmitted → retry safe
+ *  - 'landed'  → provably applied on chain → must defer
+ *  - 'unknown' → chain state unverifiable → must defer
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Array} freshChain - Non-empty, non-truncated chain snapshot
+ * @param {Object} ctx - Operation context (kind: create/cancel/size-update/rotation)
+ * @returns {'absent' | 'landed' | 'unknown'}
+ */
+function verifyOpAgainstChain(bot, freshChain, ctx) {
+    if (ctx.kind === 'create')
+        return verifyCreateAbsent(bot, freshChain, ctx);
+    if (ctx.kind === 'cancel')
+        return verifyCancelLanded(freshChain, ctx);
+    if (ctx.kind === 'size-update' || ctx.kind === 'rotation')
+        return verifyUpdateUnapplied(freshChain, ctx);
+    return 'unknown';
+}
+/**
+ * CREATE verify: 'absent' only when the batch's creates are found NOWHERE in
+ * the snapshot (fingerprint/near-match) — never transmitted → retry safe.
+ * Any match means the broadcast landed ('landed'). A create without
+ * fingerprint data cannot match anything, so it is treated as absent
+ * (original semantics).
+ */
+function verifyCreateAbsent(bot, freshChain, ctx) {
+    if (!ctx.finalInts || !ctx.order)
+        return 'absent';
+    const match = findChainOrderForSlot(bot, freshChain, ctx.order.id, {
+        sell: ctx.finalInts.sell,
+        receive: ctx.finalInts.receive,
+        orderType: ctx.order.type,
+        fingerprint: buildCreateOpFingerprint({
+            side: ctx.order.type,
+            assetA: bot.manager?.assets?.assetA?.id,
+            assetB: bot.manager?.assets?.assetB?.id,
+            sellInt: ctx.finalInts.sell,
+            receiveInt: ctx.finalInts.receive,
+            slotId: ctx.order.id
+        })
+    });
+    return match ? 'landed' : 'absent';
+}
+/**
+ * CANCEL verify: the order still present → the cancel never landed ('absent',
+ * retry safe). Absent from a live snapshot → the cancel landed ('landed').
+ * No orderId → unverifiable ('unknown').
+ */
+function verifyCancelLanded(freshChain, ctx) {
+    const chainOrderId = ctx.order?.orderId;
+    if (!chainOrderId)
+        return 'unknown';
+    if (!freshChain.some((o) => String(o?.id ?? '') === String(chainOrderId))) {
+        return 'landed';
+    }
+    return 'absent';
+}
+/**
+ * UPDATE verify (size-update/rotation): limit_order_update ops are DELTAS, so
+ * a landed broadcast double-applies the size change on re-broadcast. Retry
+ * ('absent') only when the chain order is provably UNCHANGED from the
+ * pre-update cache (the update never applied). Target applied, partially
+ * filled after a landed update, or the order missing (filled/cancelled
+ * concurrently) → 'unknown' (defer).
+ */
+function verifyUpdateUnapplied(freshChain, ctx) {
+    const chainOrderId = ctx.kind === 'size-update'
+        ? ctx.updateInfo?.partialOrder?.orderId
+        : ctx.rotation?.oldOrder?.orderId;
+    const cachedRaw = ctx.kind === 'size-update'
+        ? ctx.updateInfo?.partialOrder?.rawOnChain
+        : ctx.rotation?.oldOrder?.rawOnChain;
+    if (!chainOrderId)
+        return 'unknown';
+    const chainOrder = freshChain.find((o) => String(o?.id ?? '') === String(chainOrderId));
+    if (!chainOrder)
+        return 'unknown';
+    if (!chainOrderUnchangedFromCache(chainOrder, cachedRaw))
+        return 'unknown';
+    return 'absent';
+}
 /**
  * Execute operations with retry on BroadcastUncertainError.
+ *
+ * Never re-broadcasts blindly: an uncertain broadcast may have landed, and
+ * re-sending the same ops would duplicate on-chain orders. A retry is only
+ * allowed on AUTHORITATIVE ABSENCE — a successful non-empty, non-truncated
+ * chain read where every op verifies 'absent' (see verifyOpAgainstChain). An
+ * empty read (node may be lagging), a truncated read (get_full_accounts
+ * capped the result set; fresh creates sort last and are the first entries
+ * omitted), or any 'landed'/'unknown' verdict defers to the post-broadcast
+ * reconciliation machinery (pollChainForConfirmation +
+ * reconcileAfterUncertainBroadcast), which verifies inclusion and adopts
+ * landed orders before the next cycle.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {Array} operations
  * @param {Array} opContexts
@@ -736,26 +980,93 @@ async function executeWithRetryOnUncertain(bot, operations, opContexts) {
                 && !err.partialOnChainState
                 && attempt <= MAX_RETRIES;
             if (isRetriable) {
-                bot.manager.logger.log(`[COW] Broadcast uncertain (attempt ${attempt}/${MAX_RETRIES + 1}), retrying...`, 'warn');
-                await bot._ensureCredentialDaemonWritable('COW batch retry');
+                // Verify per operation kind against a live snapshot before
+                // re-broadcasting (see verifyOpAgainstChain): only a provably
+                // unapplied batch may be retried; a truncated or empty read is
+                // never authoritative (nodes lag / get_full_accounts caps the
+                // window) → defer.
+                let absence = 'unknown';
                 try {
                     const accountRef = bot.accountId || bot.account?.id || bot.account;
-                    const freshChain = await chainOrders.readOpenOrders(accountRef);
-                    if (freshChain.length > 0 && bot.manager?.syncFromOpenOrders) {
-                        await bot.manager.syncFromOpenOrders(freshChain, {
-                            skipAccounting: true,
-                        });
+                    const freshRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
+                    const freshChain = freshRead.orders;
+                    if (Array.isArray(freshChain) && freshChain.length > 0) {
+                        absence = 'absent';
+                        for (const ctx of opContexts) {
+                            if (!ctx)
+                                continue;
+                            const verdict = verifyOpAgainstChain(bot, freshChain, ctx);
+                            if (verdict !== 'absent') {
+                                absence = verdict;
+                                break;
+                            }
+                        }
+                    }
+                    // A truncated read (get_full_accounts caps limit_orders, and
+                    // fresh creates sort last in the by_account index) omits the
+                    // very orders this batch may have landed — 'absent' is not
+                    // authoritative here, degrade to 'unknown' and defer.
+                    if (freshRead.truncated && absence === 'absent') {
+                        absence = 'unknown';
                     }
                 }
-                catch (syncErr) {
-                    bot.manager.logger.log(`[COW] Pre-retry sync failed (non-fatal): ${syncErr?.message || syncErr}`, 'warn');
+                catch (verifyErr) {
+                    bot.manager.logger.log(`[COW] Pre-retry chain verification failed (non-fatal): ${verifyErr?.message || verifyErr}`, 'warn');
                 }
-                continue;
+                if (absence === 'absent') {
+                    bot.manager.logger.log(`[COW] Broadcast uncertain (attempt ${attempt}/${MAX_RETRIES + 1}); verified unapplied on chain, retrying...`, 'warn');
+                    // The CREATE prep recorded pending-broadcast entries for this
+                    // batch; re-entering executeOperationsWithStrategy would hit the
+                    // PENDING_BROADCASTS guard and fall back to structural resync
+                    // instead of re-broadcasting. We have just PROVEN this batch is
+                    // absent on chain (authoritative read), so dropping this batch's
+                    // own entries is safe and lets the intended re-broadcast happen.
+                    // Only THIS batch's slots are dropped; entries from other
+                    // unresolved batches are preserved (their broadcasts may have
+                    // landed, so clearing them could re-create duplicates).
+                    const retriedCreateSlots = (opContexts || [])
+                        .filter((ctx) => ctx && ctx.kind === 'create')
+                        .map((ctx) => ({ type: COW_ACTIONS.CREATE, id: ctx.id }));
+                    if (retriedCreateSlots.length > 0) {
+                        clearPendingBroadcastsForSlots(bot, retriedCreateSlots);
+                    }
+                    await bot._ensureCredentialDaemonWritable('COW batch retry');
+                    continue;
+                }
+                bot.manager.logger.log(`[COW] Broadcast uncertain (attempt ${attempt}/${MAX_RETRIES + 1}); ` +
+                    `${absence === 'landed' ? 'operation(s) confirmed applied on chain' : 'chain state unverifiable (empty/truncated/lagging read)'} — ` +
+                    `deferring to post-broadcast reconciliation (no blind re-broadcast)`, 'warn');
+                throw err;
             }
             throw err;
         }
     }
 }
+/**
+ * Whether a chain order still matches the cached pre-update state the
+ * limit_order_update delta was built from. Only a provably-unchanged order
+ * makes a re-broadcast of the identical delta safe (it applies to the same
+ * base). Any other state (target applied, filled, resized) must defer.
+ * @param {Object} chainOrder - Raw chain order object (get_full_accounts)
+ * @param {Object|null} cachedRaw - The rawOnChain cache captured at build time
+ * @returns {boolean}
+ */
+function chainOrderUnchangedFromCache(chainOrder, cachedRaw) {
+    if (!chainOrder || !cachedRaw)
+        return false;
+    const base = chainOrder.sell_price?.base;
+    const quote = chainOrder.sell_price?.quote;
+    const cachedBase = cachedRaw.sell_price?.base?.amount;
+    const cachedQuote = cachedRaw.sell_price?.quote?.amount;
+    const cachedForSale = cachedRaw.for_sale;
+    if (base === undefined || quote === undefined)
+        return false;
+    if (cachedForSale === undefined || cachedBase === undefined || cachedQuote === undefined)
+        return false;
+    return String(base.amount ?? '') === String(cachedBase)
+        && String(quote.amount ?? '') === String(cachedQuote)
+        && String(chainOrder.for_sale ?? '') === String(cachedForSale);
+}
 /**
  * Execute blockchain operations with appropriate strategy (single batch or pair mode).
  * @param {import('./dexbot_class').DEXBot} bot
@@ -1050,7 +1361,7 @@ function buildCowResultFromPlan(bot, plan) {
                 ...action.order,
                 id: action.id,
                 state: ORDER_STATES.VIRTUAL,
-                orderId: null
+                orderId: null,
             });
         }
         else if (action.type === COW_ACTIONS.UPDATE) {
@@ -1074,9 +1385,8 @@ function buildCowResultFromPlan(bot, plan) {
                     size: rotatedSize,
                     price: rotatedPrice,
                     state: ORDER_STATES.VIRTUAL,
-                    orderId: null
+                    orderId: null,
                 });
-                continue;
             }
             const current = workingGrid.get(action.id);
             if (!current)
@@ -1089,7 +1399,7 @@ function buildCowResultFromPlan(bot, plan) {
                 ...(action.order || {}),
                 id: action.id,
                 orderId: action.orderId || current.orderId,
-                size: newSize
+                size: newSize,
             });
         }
     }
@@ -1133,7 +1443,7 @@ function applyRotationTransitionsToWorkingGrid(bot, workingGrid, executedContext
                     ...sourceSlot,
                     state: ORDER_STATES.VIRTUAL,
                     orderId: null,
-                    rawOnChain: null
+                    rawOnChain: null,
                 });
                 bot.manager.logger.log(`[COW] Pre-applied rotation: source ${oldOrder.id} → VIRTUAL (order ${sourceSlot.orderId} moved to ${newGridId})`, 'debug');
             }
@@ -1154,7 +1464,7 @@ function applyRotationTransitionsToWorkingGrid(bot, workingGrid, executedContext
                 // already held a prior committed ID (e.g. a partial commit
                 // left a stale reference).  The source-of-truth is always the
                 // original order being rotated.
-                orderId: oldOrder?.orderId || destSlot.orderId || null
+                orderId: oldOrder?.orderId || destSlot.orderId || null,
             });
             bot.manager.logger.log(`[COW] Pre-applied rotation: dest ${newGridId} → ACTIVE (orderId=${oldOrder?.orderId || destSlot.orderId || 'none'})`, 'debug');
         }
@@ -1190,7 +1500,18 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
     let remaining = [...createContexts];
     for (let attempt = 1; attempt <= maxPollRetries; attempt++) {
         try {
-            const chainSnapshot = await chainOrders.readOpenOrders(accountRef);
+            const chainRead = await readOpenOrdersWithMetaSafe(chainOrders, accountRef);
+            const chainSnapshot = chainRead.orders;
+            // A truncated read omits the freshest orders — the exact CREATEs
+            // this poll is trying to confirm — so absence cannot be
+            // distinguished from window truncation. Fall back to the
+            // reconciliation machinery immediately instead of burning the
+            // remaining polls.
+            if (chainRead.truncated) {
+                bot.manager.logger.log(`[COW][POLL] Chain read TRUNCATED (account exceeds the get_full_accounts window); ` +
+                    `fresh creates cannot be confirmed — deferring to reconciliation`, 'warn');
+                break;
+            }
             if (!Array.isArray(chainSnapshot) || chainSnapshot.length === 0) {
                 if (attempt < maxPollRetries) {
                     await sleep(pollIntervalMs);
@@ -1255,13 +1576,129 @@ function restoreSkippedUpdateSlotsInWorkingGrid(bot, workingGrid, skippedSlotIds
     }
     bot.manager.logger.log(`[COW] Restored ${skippedSlotIds.size} slot(s) after ${skippedCount} skipped update action(s).`, 'debug');
 }
+/**
+ * Bounded re-plan for a stale pre-broadcast plan (regression-safe policy).
+ *
+ * Policy (bounded re-plan + proceed):
+ *   * First staleness hit → re-plan ONCE from fresh master using the same
+ *     fills; the recursion re-runs this guard against the fresh plan. A
+ *     re-plan with no executable actions means the grid is already consistent
+ *     post-fills — the stale plan must NOT ship.
+ *   * Still stale (master kept mutating), or no fill context to re-plan with
+ *     → PROCEED with the plan anyway and request a structural resync. Never
+ *     hard-abort on staleness: an abort would silently drop the fill set that
+ *     triggered this rebalance (_processFillsWithBatching only hard-aborts on
+ *     illegal-state or accounting failures), and the post-broadcast commit
+ *     guard + chain adoption below close any residual divergence.
+ *
+ * Stack discipline: the original plan's grid is popped before the fresh
+ * re-plan pushes (LIFO order); when the re-plan fails/aborts, the original
+ * grid is pushed back (marker restored) so the later commit/catch pop sites
+ * release exactly the entry they were pushed with, instead of underflowing
+ * or stealing a nested grid's entry.
+ *
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Object} cowResult - The stale plan result
+ * @param {number} replanDepth - Recursion depth (0 = first attempt)
+ * @param {Object} preBroadcastGuard - The failed evaluateCommit result
+ * @returns {Promise<{handled: boolean, result?: Object}>} handled=true when the
+ *   batch was resolved by the re-plan (fresh plan executed, or stale plan
+ *   skipped as already-consistent); handled=false when the caller must proceed
+ *   with the original plan.
+ */
+async function replanStaleBatch(bot, cowResult, replanDepth, preBroadcastGuard) {
+    const canReplan = replanDepth < STALE_PLAN_REPLAN_LIMIT
+        && Array.isArray(cowResult.fills) && cowResult.fills.length > 0;
+    if (!canReplan) {
+        bot.manager.logger.log(`[COW] Plan stale pre-broadcast (${preBroadcastGuard.reason}); ` +
+            (replanDepth >= STALE_PLAN_REPLAN_LIMIT
+                ? 'still stale after re-plan — proceeding with plan (commit guard + chain adoption close divergence)'
+                : 'no fill context for re-plan — proceeding with plan (commit guard + chain adoption close divergence)'), 'warn');
+        await requestStructuralResync(bot, 'plan stale pre-broadcast (proceeding with plan)', { reason: preBroadcastGuard.reason });
+        return { handled: false };
+    }
+    bot.manager.logger.log(`[COW] Plan stale pre-broadcast (${preBroadcastGuard.reason}); re-planning once from fresh master`, 'warn');
+    // Abandon the original plan's working grid: it can no longer commit. Pop
+    // it so the rebalance stack stays balanced — the fresh plan's grid (pushed
+    // by performSafeRebalance below) is popped by the recursion's own
+    // commit/cleanup path. Guarded on the push marker (plan-path calls never
+    // pushed a grid); the marker is cleared so a later throw in this frame
+    // (e.g. the recursion) cannot pop the entry a second time.
+    const hadPushedGrid = cowResult?._workingGridPushed === true;
+    popPushedWorkingGrid(bot, cowResult);
+    let replanned = null;
+    try {
+        // Restore the boundary-shift budget consumed by the abandoned plan:
+        // it was built from the same fills and never shipped, so the re-plan
+        // must derive from the FULL batch budget — not the leftover. Without
+        // the restore, each stale-plan re-plan spends the budget twice and
+        // drifts conservative (boundary under-shift).
+        if (bot.manager?._boundaryShiftBudgetBase != null) {
+            bot.manager._boundaryShiftBudget = bot.manager._boundaryShiftBudgetBase;
+        }
+        if (typeof bot.manager.performSafeRebalance === 'function') {
+            replanned = await bot.manager.performSafeRebalance(cowResult.fills, cowResult.excludeIds || new Set());
+        }
+    }
+    catch (replanErr) {
+        bot.manager.logger.log(`[COW] Re-plan failed: ${getErrorMessage(replanErr)}; proceeding with original plan`, 'warn');
+    }
+    if (replanned && !replanned.aborted) {
+        if (hasExecutableActions(replanned)) {
+            // The original plan's ops are abandoned with its working grid;
+            // drop THEIR pending-broadcast entries only, or the recursion's
+            // own pending-broadcast guard would reject the fresh plan's
+            // CREATEs. Entries from an earlier unresolved batch are
+            // deliberately KEPT: the entry guard only covers CREATE batches,
+            // so a create-less batch can reach this path while earlier
+            // entries are still live — clearing them here would let the fresh
+            // plan re-create slots whose earlier broadcast may have landed
+            // (duplicate orders). The recursion's guard will then abort +
+            // reconcile instead.
+            clearPendingBroadcastsForSlots(bot, cowResult.actions);
+            return {
+                handled: true,
+                result: await updateOrdersOnChainBatchCOW(bot, replanned, {
+                    replanDepth: replanDepth + 1
+                }),
+            };
+        }
+        // Re-plan confirms the grid is already consistent post-fills; the
+        // stale original plan must NOT ship. Pop the fresh plan's grid too
+        // (it was never committed).
+        popPushedWorkingGrid(bot, replanned);
+        clearPendingBroadcastsForSlots(bot, cowResult.actions);
+        bot.manager.logger.log('[COW] Re-plan produced no executable actions; grid is already consistent post-fills, skipping stale plan', 'info');
+        return { handled: true, result: { executed: false, hadRotation: false, skippedStalePlan: true } };
+    }
+    // Re-plan failed or aborted — the original plan proceeds after all. Its
+    // grid was popped above to keep the stack LIFO-balanced for the fresh
+    // plan; push it back (marker restored) so the broadcast commit / catch
+    // pop sites release exactly the entry they were pushed with, instead of
+    // underflowing or stealing a nested grid's entry.
+    if (hadPushedGrid && cowResult.workingGrid) {
+        if (typeof bot.manager._pushWorkingGridRef === 'function') {
+            bot.manager._pushWorkingGridRef(cowResult.workingGrid, cowResult);
+        }
+        else {
+            bot.manager._currentWorkingGridStack?.push?.(cowResult.workingGrid);
+            bot.manager._resetRebalanceStateToDepth?.();
+            cowResult._workingGridPushed = true;
+        }
+    }
+    bot.manager.logger.log('[COW] Re-plan unavailable; proceeding with original plan (commit guard + chain adoption close divergence)', 'warn');
+    await requestStructuralResync(bot, 're-plan unavailable (proceeding with original plan)', { reason: preBroadcastGuard.reason });
+    return { handled: false };
+}
 /**
  * COW broadcast: Execute blockchain operations and commit working grid on success.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {Object} cowResult
+ * @param {Object} [options={}] - Internal execution options (replanDepth)
  * @returns {Promise<Object>}
  */
-async function updateOrdersOnChainBatchCOW(bot, cowResult) {
+async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
+    const replanDepth = Number.isFinite(Number(options?.replanDepth)) ? Number(options.replanDepth) : 0;
     bot._currentCycleId = (Number.isFinite(Number(bot._currentCycleId)) ? Number(bot._currentCycleId) : 0) + 1;
     const { workingGrid, workingIndexes, workingBoundary, actions } = cowResult;
     if (bot.config.dryRun) {
@@ -1274,6 +1711,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             bot.manager.logger.log(`Dry run: would place ${createCount} new orders`, 'info');
         if (updateCount > 0)
             bot.manager.logger.log(`Dry run: would update ${updateCount} orders`, 'info');
+        popPushedWorkingGrid(bot, cowResult);
         return { executed: true, hadRotation: false };
     }
     const chainOrderCandidates = Array.isArray(bot.manager?._lastUnmatchedChainOrders)
@@ -1309,6 +1747,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
         //     (valid CREATEs, CANCELs, UPDATEs) still proceeds.
         const hasHardOccupiedViolation = createSlotValidation.violations.some((v) => v.reason === 'slot_occupied');
         if (hasHardOccupiedViolation) {
+            popPushedWorkingGrid(bot, cowResult);
             return {
                 executed: false,
                 aborted: true,
@@ -1332,6 +1771,10 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             `${actions.length} action(s) remaining in batch`, 'warn');
         if (!actions.some((action) => action.type === COW_ACTIONS.CREATE)) {
             if (actions.length === 0) {
+                // Same exactly-once marker discipline as the other early
+                // returns: a pushed working grid must be popped here or the
+                // caller would leak the stack entry.
+                popPushedWorkingGrid(bot, cowResult);
                 return { executed: false, hadRotation: false };
             }
         }
@@ -1342,6 +1785,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
         bot.manager.logger.log?.(`[RECOVERY-EXHAUSTED] Blocking ${actions.filter((a) => a.type === COW_ACTIONS.CREATE).length} CREATE(s) ` +
             `(exhausted ${(exhaustedAge / 1000).toFixed(0)}s ago). ` +
             `Waiting for next fill or sync cycle to reset recovery state.`, 'warn');
+        popPushedWorkingGrid(bot, cowResult);
         return {
             executed: false,
             aborted: true,
@@ -1376,6 +1820,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             catch (recoverErr) {
                 bot.manager.logger.log(`[COW] Recovery from pending broadcasts failed: ${recoverErr?.message || recoverErr}`, 'error');
             }
+            popPushedWorkingGrid(bot, cowResult);
             return {
                 executed: false,
                 aborted: true,
@@ -1392,10 +1837,24 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             ` — adopting via sync instead of cancelling`, 'info');
         try {
             const accountRef = bot.account;
-            const freshSnapshot = await chainOrders.readOpenOrders(accountRef);
-            if (freshSnapshot && freshSnapshot.length > 0) {
+            const freshRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
+            // Truncated-read guard: a partial get_full_accounts window omits the
+            // freshest orders; syncing on it would virtualize live slots and
+            // re-create duplicates. Defer the adoption to a clean read — the
+            // unmatched orders keep blocking CREATEs until then.
+            if (freshRead.truncated) {
+                bot.manager.logger.log('[COW] Post-guard chain snapshot TRUNCATED; skipping adoption sync (partial snapshot would virtualize live slots) — unmatched chain orders keep blocking CREATEs', 'warn');
+            }
+            else if (freshRead.orders && freshRead.orders.length > 0) {
+                const freshSnapshot = freshRead.orders;
                 const syncResult = await bot.manager.syncFromOpenOrders(freshSnapshot, {
-                    skipAccounting: true,
+                    // Accounting enabled: the adopted chain orders were never
+                    // registered in master (they are unmatched/orphan), so the
+                    // adoption must lock their capital. skipAccounting:true would
+                    // leave the optimistic balances drifted until the next fetch
+                    // — inconsistent with the open-orders loop convention
+                    // ('readOpenOrders' → skipAccounting:false).
+                    skipAccounting: false,
                 });
                 if (syncResult && Array.isArray(syncResult.unmatchedChainOrders)) {
                     const processed = (syncResult.filledOrders?.length || 0) +
@@ -1430,6 +1889,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             await bot.manager.requestStructuralGridResync('unmatched chain orders before COW create', { unmatchedChainOrders: unmatchedChainOrders });
         }
         bot.manager.logger.log(`[COW] Rejecting CREATE batch after sync: working grid invalidated by master mutation`, 'info');
+        popPushedWorkingGrid(bot, cowResult);
         return {
             executed: false,
             aborted: true,
@@ -1673,16 +2133,41 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
             restoreSkippedUpdateSlotsInWorkingGrid(bot, workingGrid, skippedUpdateSlotIds, skippedUpdateCount);
         }
         if (operations.length === 0) {
-            bot.manager._resetRebalanceStateToDepth();
+            // Pop the working grid: in the re-plan recursion the fresh plan's
+            // grid was pushed by performSafeRebalance, and nothing downstream
+            // will commit it — leaving it on the stack would stick the manager
+            // in REBALANCING permanently (the outer frame already popped its
+            // own grid before recursing). Guarded on the push marker so plan
+            // path calls (never pushed) cannot pop an unrelated entry.
+            popPushedWorkingGrid(bot, cowResult);
             return { executed: false, hadRotation: false };
         }
         const validation = validateOperationFunds(bot, operations, assetA, assetB);
         bot.manager.logger.log(validation.summary, validation.isValid ? 'info' : 'warn');
         if (!validation.isValid) {
             bot.manager.logger.log(`Skipping batch broadcast: ${validation.violations.length} fund violation(s) detected`, 'warn');
-            bot.manager._resetRebalanceStateToDepth();
+            popPushedWorkingGrid(bot, cowResult);
             return { executed: false, hadRotation: false };
         }
+        // Refuse stale plans BEFORE broadcasting: a master-grid change during
+        // planning (fills, syncs) makes the working grid invalid. Broadcasting
+        // anyway would place orders the commit will refuse to register, leaving
+        // on-chain state ahead of the grid.
+        // NOTE: the commit-time evaluateCommit also rejects empty deltas; here
+        // (pre-broadcast) that case is already covered by the operations.length
+        // guard above, so only staleness and version-mismatch are checked.
+        const preBroadcastGuard = evaluateCommit(workingGrid, {
+            hasLock: false,
+            currentVersion: bot.manager._gridVersion
+        });
+        if (!preBroadcastGuard.canCommit) {
+            // Bounded re-plan + proceed — policy documented on replanStaleBatch.
+            const replan = await replanStaleBatch(bot, cowResult, replanDepth, preBroadcastGuard);
+            if (replan.handled) {
+                return replan.result;
+            }
+            // Fall through: proceed with the current plan (bounded policy).
+        }
         await bot._ensureCredentialDaemonWritable('COW batch broadcast');
         bot.manager.logger.log(`[COW] Broadcasting batch with ${operations.length} operations...`, 'info');
         bot._lastBroadcastHeartbeatAt = Date.now();
@@ -1701,7 +2186,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
                         .join(', ');
                     bot.manager.logger.log(`[COW] Refusing to commit working grid: ${missingCreateResults.length} CREATE op(s) ` +
                         `returned no chainOrderId (${missingSlots}). Discarding working grid and syncing from chain.`, 'error');
-                    bot.manager._clearWorkingGridRef();
+                    popPushedWorkingGrid(bot, cowResult);
                     markMissingCreateResultsAsStructuralBlocker(bot, missingCreateResults);
                     await recoverAfterMissingCreateResults(bot, 'missing create operation results');
                     return {
@@ -1720,7 +2205,34 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
                 // that depends on broadcast result data.
                 applyRotationTransitionsToWorkingGrid(bot, workingGrid, executedContexts);
                 bot.manager.logger.log('[COW] Blockchain success - committing working grid to master', 'info');
-                await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true });
+                // _commitWorkingGrid releases the stack entry on every settle
+                // path (return or throw) and clears the push marker via
+                // options.result, so a later throw in this frame (e.g.
+                // processBatchResults after a successful commit) cannot pop a
+                // second time for the same grid in the batch catch below.
+                const commitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true, result: cowResult });
+                if (!commitOk) {
+                    // Master changed during broadcast (e.g. a fill landed and was
+                    // processed concurrently) so the commit was refused. The batch
+                    // is on chain; adopt the placed orders from the chain so master
+                    // converges instead of remaining divergent until a later sync.
+                    bot.manager.logger.log('[COW] Commit refused after broadcast; adopting placed orders from chain to keep master in sync', 'warn');
+                    const adopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW]');
+                    if (!adopted) {
+                        // Chain state unknown (empty/lagging read or sync failure):
+                        // keep the pending-broadcast protection so a later plan
+                        // cannot duplicate the placed orders, and let the structural
+                        // resync adopt them from the chain.
+                        bot.manager.logger.log('[COW] Commit refused and chain adoption unavailable; keeping pending-broadcast protection pending structural resync', 'error');
+                        await requestStructuralResync(bot, 'commit refused after broadcast (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
+                        return { executed: false, hadRotation: false, commitRefused: true, chainAdoptionPending: true };
+                    }
+                    // Deduct create fees for the placed orders (mirrors
+                    // processBatchResults, which the refused path bypasses).
+                    await applyAdoptionFeeAccounting(bot, executedContexts);
+                    await persistGridAndClearPendingBroadcasts(bot, '[COW]');
+                    return { executed: false, hadRotation: false, commitRefused: true };
+                }
                 const batchResult = await processBatchResults(bot, result, executedContexts);
                 const persistResult = await bot.manager.persistGrid();
                 if (persistResult && (persistResult.skipped || persistResult.isValid === false)) {
@@ -1747,13 +2259,12 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
                     delete bot.manager._persistenceWarning;
                 }
                 bot._metrics.batchesExecuted++;
-                bot.manager._clearWorkingGridRef();
                 clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
                 return { ...batchResult, executed: true, hadRotation: true };
             }
             else {
                 bot.manager.logger.log('[COW] Blockchain failed - working grid discarded, master unchanged', 'warn');
-                bot.manager._clearWorkingGridRef();
+                popPushedWorkingGrid(bot, cowResult);
                 clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
                 return { ...result, executed: false, hadRotation: false };
             }
@@ -1799,21 +2310,46 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
                         bot.manager.logger.log(`[COW][UNCERTAIN] Chain polling confirmed all ${createCount} CREATE(s) on chain. Committing working grid directly.`, 'info');
                     }
                     applyRotationTransitionsToWorkingGrid(bot, workingGrid, opContexts);
-                    await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true });
-                    // Enrich master grid with chain-assigned order IDs and amounts
-                    try {
-                        const accountRef = bot.accountId || bot.account?.id || bot.account;
-                        const freshChain = await chainOrders.readOpenOrders(accountRef);
-                        if (freshChain.length > 0 && typeof bot.manager.syncFromOpenOrders === 'function') {
-                            await bot.manager.syncFromOpenOrders(freshChain, { skipAccounting: true });
+                    // Same exactly-once discipline as the success path:
+                    // _commitWorkingGrid pops on every settle path and clears
+                    // the push marker via options.result, so a later throw here
+                    // must not pop again in the batch catch below.
+                    const pollCommitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true, result: cowResult });
+                    if (!pollCommitOk) {
+                        // Master moved while polling — same recovery as the
+                        // refused-commit path: adopt from chain, keep pending
+                        // protection if adoption is unavailable.
+                        bot.manager.logger.log(`[COW][UNCERTAIN] Poll-confirmed commit refused; adopting placed orders from chain`, 'warn');
+                        const pollAdopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]');
+                        if (!pollAdopted) {
+                            bot.manager.logger.log('[COW][UNCERTAIN] Poll-refused commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
+                            await requestStructuralResync(bot, 'poll-confirmed commit refused (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
+                            return { executed: false, hadRotation: false, commitRefused: true, chainAdoptionPending: true };
                         }
+                        await applyAdoptionFeeAccounting(bot, opContexts);
+                        await persistGridAndClearPendingBroadcasts(bot, '[COW][UNCERTAIN]');
+                        return { executed: false, hadRotation: false, commitRefused: true, uncertainResolved: true };
                     }
-                    catch (syncErr) {
-                        bot.manager.logger.log(`[COW][UNCERTAIN] Chain sync after poll-confirmed commit failed: ${getErrorMessage(syncErr)}`, 'warn');
+                    // Enrich master grid with chain-assigned order IDs and amounts;
+                    // accounting enabled so the adopted orders' capital is locked
+                    // and any cancelled orders release theirs. The adoption result
+                    // is authoritative: a truncated read right after the confirming
+                    // poll can omit the batch's own fresh creates (they sort last
+                    // in the by_account index), so clearing the pending protection
+                    // on a failed adoption would let the next cycle re-create the
+                    // VIRTUAL slots as duplicate on-chain orders. Keep the
+                    // protection and defer to a structural resync instead.
+                    const pollAdoptedOk = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]');
+                    if (!pollAdoptedOk) {
+                        bot.manager.logger.log('[COW][UNCERTAIN] Poll-confirmed commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
+                        await requestStructuralResync(bot, 'poll-confirmed commit (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
+                        return { executed: false, hadRotation: false, commitRefused: false, chainAdoptionPending: true };
                     }
-                    await bot.manager.persistGrid();
-                    bot.manager._clearWorkingGridRef();
-                    clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
+                    // The commit happened without processBatchResults (no success
+                    // result to extract); deduct create fees so the optimistic
+                    // balance reflects the on-chain cost.
+                    await applyAdoptionFeeAccounting(bot, opContexts);
+                    await persistGridAndClearPendingBroadcasts(bot, '[COW][UNCERTAIN]');
                     return { executed: true, hadRotation: false, uncertainResolved: true };
                 }
             }
@@ -1821,7 +2357,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
                 bot.manager.logger.log(`[COW][UNCERTAIN] Chain polling threw unexpectedly: ${getErrorMessage(pollErr)}. Falling back to reconciliation.`, 'error');
             }
         }
-        bot.manager._clearWorkingGridRef();
+        popPushedWorkingGrid(bot, cowResult);
         if (err instanceof BroadcastUncertainError) {
             return await reconcileAfterUncertainBroadcast(bot, err, opContexts);
         }
@@ -1857,6 +2393,152 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
         }
     }
 }
+/**
+ * Request a structural grid resync with the recovery-state flag raised, so a
+ * later plan cannot duplicate orders placed by a batch whose chain adoption is
+ * pending. No-op when the manager has no structural-resync handler.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {string} reason - Human-readable resync reason
+ * @param {Object} [details={}] - Details passed to the resync handler
+ */
+async function requestStructuralResync(bot, reason, details = {}) {
+    if (typeof bot.manager?.requestStructuralGridResync !== 'function')
+        return;
+    if (bot.manager._recoveryState) {
+        bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: true };
+    }
+    await bot.manager.requestStructuralGridResync(reason, details);
+}
+/**
+ * Adopt a batch's placed orders from the chain after the commit was refused
+ * or after a poll-confirmed uncertain commit. The batch ops are already on
+ * chain but never reached master, so a full chain sync with accounting
+ * enabled locks the placed orders' capital and releases any cancelled ones.
+ * Returns true when the adoption sync ran; false when the chain state could
+ * not be read (empty/lagging read, truncated read, or sync failure) — the
+ * caller then keeps the pending-broadcast protection and defers adoption to
+ * a structural resync.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Object} chainOrders - Chain orders module
+ * @param {string} logPrefix - Log prefix for sync failure messages
+ * @returns {Promise<boolean>}
+ */
+async function adoptPlacedBatchFromChain(bot, chainOrders, logPrefix) {
+    try {
+        const accountRef = bot.accountId || bot.account?.id || bot.account;
+        const freshRead = await readOpenOrdersWithMetaSafe(chainOrders, accountRef);
+        // A truncated read (get_full_accounts caps the limit_orders window and
+        // fresh creates sort last) omits the very orders this batch just
+        // broadcast — the adoption sync could not register them, and clearing
+        // the pending-broadcast protection would let the next cycle re-create
+        // them as duplicates on chain. Treat truncated like an unreadable
+        // chain state: keep the protection and defer to a structural resync.
+        if (freshRead.truncated) {
+            bot.manager.logger.log(`${logPrefix} Chain read TRUNCATED after batch broadcast; adoption deferred (pending-broadcast protection kept)`, 'warn');
+            return false;
+        }
+        const freshChain = freshRead.orders;
+        if (freshChain.length > 0 && typeof bot.manager.syncFromOpenOrders === 'function') {
+            await bot.manager.syncFromOpenOrders(freshChain, { skipAccounting: false });
+            return true;
+        }
+    }
+    catch (syncErr) {
+        bot.manager.logger.log(`${logPrefix} Chain sync after batch broadcast failed: ${getErrorMessage(syncErr)}`, 'error');
+    }
+    return false;
+}
+/**
+ * Persist the master grid after a chain adoption and clear the pending
+ * broadcast protection. Persist failures are logged, not thrown — the
+ * in-memory master is authoritative and the next sync/persist converges disk.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {string} logPrefix - Log prefix for persist failure messages
+ */
+async function persistGridAndClearPendingBroadcasts(bot, logPrefix) {
+    try {
+        await bot.manager.persistGrid();
+    }
+    catch (persistErr) {
+        bot.manager.logger.log(`${logPrefix} Persist after chain adoption failed: ${getErrorMessage(persistErr)}`, 'error');
+    }
+    clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
+}
+/**
+ * Apply BTS create-fee accounting for a batch that bypassed the normal
+ * processBatchResults pipeline (commit refused after broadcast, or
+ * poll-confirmed uncertain commit). Mirrors the create branch of
+ * processBatchResults using master-grid state after chain adoption, so the
+ * optimistic balance reflects the on-chain create cost.
+ *
+ * Safe on adopted/committed slots only: the slot must already carry its
+ * orderId, so the transition old(ACTIVE)→new(ACTIVE) is delta-zero and only
+ * the fee is applied — no double capital commitment. Cancel/rotation fee
+ * accounting is intentionally skipped: the chain sync already performed the
+ * capital release for cancelled orders (diff-based, applying it again would
+ * double-release), and rotations without a committed destination cannot be
+ * accounted locally.
+ * @param {import('./dexbot_class').DEXBot} bot
+ * @param {Array<Object>} contexts - Executed op contexts (create/rotation/cancel)
+ */
+async function applyAdoptionFeeAccounting(bot, contexts) {
+    if (!bot.manager?.accountant || !Array.isArray(contexts) || contexts.length === 0)
+        return;
+    const btsFeeData = getAssetFeesSafe('BTS');
+    const btsSide = (typeof bot.manager.accountant._getBtsOrderType === 'function')
+        ? bot.manager.accountant._getBtsOrderType()
+        : null;
+    for (const ctx of contexts) {
+        if (ctx?.kind === 'create') {
+            const slot = ctx.order?.id ? bot.manager.orders.get(ctx.order.id) : null;
+            if (!slot?.orderId)
+                continue;
+            try {
+                await bot.manager.synchronizeWithChain({
+                    gridOrderId: ctx.order.id,
+                    chainOrderId: slot.orderId,
+                    isPartialPlacement: false,
+                    expectedType: ctx.order.type,
+                    fee: btsFeeData?.createFee || 0,
+                }, 'createOrder');
+            }
+            catch (feeErr) {
+                bot.manager.logger.log(`[COW] Adoption fee accounting failed for create slot ${ctx.order.id}: ${getErrorMessage(feeErr)}`, 'warn');
+            }
+        }
+        else if (ctx?.kind === 'cancel') {
+            // The cancel landed but the commit was refused / the adoption path
+            // bypassed processBatchResults. Master still holds the slot; the
+            // next sync's phantom cleanup releases its commitment with fee 0 —
+            // charge the cancel fee here so the optimistic BTS balance reflects
+            // the on-chain cost exactly once (mirrors the sync's
+            // 'cancel-order-unmatched-fee' pattern; the deferred-fee refund is
+            // reconciled by the next sync's fill/cancel processing).
+            if (btsSide && btsFeeData?.cancelFee > 0) {
+                try {
+                    await bot.manager.accountant.adjustTotalBalance(btsSide, -btsFeeData.cancelFee, 'cancel-adopt-fee');
+                }
+                catch (feeErr) {
+                    bot.manager.logger.log(`[COW] Adoption fee accounting failed for cancel ${ctx.order?.orderId}: ${getErrorMessage(feeErr)}`, 'warn');
+                }
+            }
+        }
+        else if (ctx?.kind === 'size-update' || ctx?.kind === 'rotation') {
+            // Same reasoning as cancels: the update landed but its fee was never
+            // charged on this path; the next sync's size reconciliation applies
+            // the chain state without an update fee (fee 0), so charge it once
+            // here to prevent optimistic BTS drift.
+            if (btsSide && btsFeeData?.updateFee > 0) {
+                try {
+                    await bot.manager.accountant.adjustTotalBalance(btsSide, -btsFeeData.updateFee, 'update-adopt-fee');
+                }
+                catch (feeErr) {
+                    bot.manager.logger.log(`[COW] Adoption fee accounting failed for update ${ctx.kind === 'size-update' ? ctx.updateInfo?.partialOrder?.orderId : ctx.rotation?.oldOrder?.orderId}: ${getErrorMessage(feeErr)}`, 'warn');
+                }
+            }
+        }
+    }
+}
 /**
  * Process results from batch transaction execution.
  * Updates order state, synchronizes with chain, and deducts BTS fees.
@@ -1867,7 +2549,13 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult) {
  */
 async function processBatchResults(bot, result, opContexts) {
     const results = extractOperationResults(result, 'processBatchResults', bot.manager?.logger?.log?.bind(bot.manager?.logger));
-    const btsFeeData = getAssetFees('BTS');
+    // Safe variant: this runs AFTER the working grid committed, so a throw
+    // here (fee cache unset) would hard-fail the whole batch post-commit and
+    // land in the executor catch, where the stack-entry marker is already
+    // cleared — leaving the grid committed but its post-commit processing
+    // (fee deduction, metadata) silently skipped. Zero-fee fallback keeps the
+    // accounting close; the next sync converges the residual.
+    const btsFeeData = getAssetFeesSafe('BTS');
     let hadRotation = false;
     let updateOperationCount = 0;
     const updatesToApply = [];
@@ -1886,7 +2574,7 @@ async function processBatchResults(bot, result, opContexts) {
             const oldOrder = ctx.updateInfo.partialOrder;
             const ord = bot.manager.orders.get(oldOrder.id);
             if (oldOrder && ord && bot.manager.accountant) {
-                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData.updateFee, false);
+                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0, false);
             }
             if (ord) {
                 const updatedSlot = { ...ord, size: ctx.updateInfo.newSize };
@@ -1909,7 +2597,7 @@ async function processBatchResults(bot, result, opContexts) {
             const chainOrderId = res && res[1];
             if (chainOrderId) {
                 await bot.manager.synchronizeWithChain({
-                    gridOrderId: ctx.order.id, chainOrderId, expectedType: ctx.order.type, fee: btsFeeData.createFee
+                    gridOrderId: ctx.order.id, chainOrderId, expectedType: ctx.order.type, fee: btsFeeData?.createFee || 0
                 }, 'createOrder');
                 if (ctx.finalInts) {
                     const syncedOrder = bot.manager.orders.get(ctx.order.id);
@@ -1950,7 +2638,7 @@ async function processBatchResults(bot, result, opContexts) {
             if (!newGridId) {
                 const ord = bot.manager.orders.get(oldOrder.id || rotation.id);
                 if (oldOrder && ord && bot.manager.accountant) {
-                    await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData.updateFee, false);
+                    await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0, false);
                 }
                 if (ord) {
                     const updatedSlot = { ...ord, size: newSize };
@@ -2003,7 +2691,7 @@ async function processBatchResults(bot, result, opContexts) {
                 };
             }
             if (oldOrder && updatedSlot && bot.manager.accountant) {
-                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, updatedSlot, 'order-update', btsFeeData.updateFee, false);
+                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, updatedSlot, 'order-update', btsFeeData?.updateFee || 0, false);
             }
             if (oldOrder?.id && oldOrder.id !== newGridId) {
                 const currentSource = bot.manager.orders.get(oldOrder.id);
@@ -2042,6 +2730,8 @@ module.exports = {
     formatUnmatchedChainOrderForLog,
     recordPendingBroadcast,
     clearPendingBroadcasts,
+    clearPendingBroadcastsForSlots,
+    popPushedWorkingGrid,
     buildChainOrderFingerprint,
     normalizeChainOrderForPendingMatch,
     findChainOrderForSlot,