dexbot 1.4.7 → 1.4.9

package/dist/modules/dexbot_maintenance_runtime.d.ts

@@ -114,6 +114,7 @@ declare function updateBotGridResetMetadata(botKey: any, options?: {
  * recalculate the grid, persist, and record reset metadata.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {import('./types').GridResyncOptions} [options] - Grid resync options
+ * @param {boolean} [options.skipIdle=false] - Skip the idle-cooldown deferral
  * @returns {Promise<boolean>} True if resync succeeded
  */
 declare function performGridResync(bot: any, options?: {
@@ -121,6 +122,7 @@ declare function performGridResync(bot: any, options?: {
     centerRefreshContext?: string;
     centerRefreshLabel?: string;
     resetSource?: string;
+    skipIdle?: boolean;
 }): Promise<boolean>;
 /**
  * Handle a pending trigger file detected at startup or during runtime.
@@ -259,11 +261,13 @@ declare function setupDustHealthCheckInterval(bot: any): void;
  * Request a full grid reset from fresh on-chain state.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {string} [reason='structural change']
- * @param {{refreshCenterPrice?: boolean}} [options={}]
+ * @param {{refreshCenterPrice?: boolean, skipIdle?: boolean, skipFillLock?: boolean}} [options={}]
  * @returns {Promise<Object>}
  */
 declare function requestGridReset(bot: any, reason?: any, options?: {
     refreshCenterPrice?: boolean;
+    skipIdle?: boolean;
+    skipFillLock?: boolean;
 }): Promise<any>;
 /**
  * Wire the structural grid resync request handler on the manager.

package/dist/modules/dexbot_maintenance_runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dexbot_maintenance_runtime.d.ts","sourceRoot":"","sources":["../../modules/dexbot_maintenance_runtime.ts"],"names":[],"mappings":"AA6FA;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,WAGjC;AAED;;;;;;GAMG;AACH,iBAAS,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAalE;AAED;;;;;GAKG;AACH,iBAAS,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,WAMlE;AA6HD;;;GAGG;AACH,iBAAS,sBAAsB;;;;;;;;;;;;EAgC9B;AAuGD;;;GAGG;AACH,iBAAe,oBAAoB,kBAElC;AAED;;;;;;GAMG;AACH,iBAAe,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,GAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4IxF;AAED;;;;;;GAMG;AACH,iBAAS,gCAAgC,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,GAAe;;;;;;;;;;EA+D3E;AAyHD;;;;;;;GAOG;AACH,iBAAS,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,OA0BxG;AAED;;;;;;GAMG;AACH,iBAAS,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE;IAC1C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACnB,oBAwHL;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,oBAkBhD;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAiDhD;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAMhD;AAED;;;;GAIG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,WAK5C;AAED;;;;GAIG;AACH,iBAAS,uBAAuB,CAAC,GAAG,EAAE,GAAG,QA0DxC;AAED;;;;GAIG;AACH,iBAAe,sBAAsB,CAAC,GAAG,EAAE,GAAG,iBAK7C;AAED;;;;GAIG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,QAuH7C;AAED;;;GAGG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,QAM5C;AAED;;;;;;;GAOG;AACH,iBAAe,2BAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,GAAgB,gBAiB1F;AAID;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,WAY3D;AAiGD;;;;;;;GAOG;AACH,iBAAe,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBA2N5D;AA2CD;;;;;;;;;;GAUG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,OAAY,EAAE,IAAI,EAAE,QAAa,EAAE,GAAE,GAAQ;;;;;;;;GAyC7F;AAED;;;;;;;;GAQG;AACH,iBAAe,kBAAkB,CAC7B,GAAG,EAAE,GAAG,EACR,OAAO,GAAE,GAAgB,EACzB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,iBAmCvC;AAID;;;;;;GAMG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAoDhD;AAED;;;;;;GAMG;AACH,iBAAe,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBAmF/C;AAED;;;GAGG;AACH,iBAAe,kBAAkB,CAAC,GAAG,EAAE,GAAG,iBAkCzC;AAED;;;GAGG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,QAO7C;AAED;;;;;;GAMG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAyB,EAAE,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAO,gBAiB1H;AAED;;;GAGG;AACH,iBAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,QAiDhD;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG;;;;;;EASnC;AAED;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAgB,QAG3D;AAED;;;;GAIG;AACH,iBAAS,UAAU,CAAC,GAAG,EAAE,GAAG,OAW3B;AAED;;;;;GAKG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;;;;;GAgC9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,kBAiCE"}
+{"version":3,"file":"dexbot_maintenance_runtime.d.ts","sourceRoot":"","sources":["../../modules/dexbot_maintenance_runtime.ts"],"names":[],"mappings":"AA6FA;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,WAGjC;AAED;;;;;;GAMG;AACH,iBAAS,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAalE;AAED;;;;;GAKG;AACH,iBAAS,+BAA+B,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,WAMlE;AA6HD;;;GAGG;AACH,iBAAS,sBAAsB;;;;;;;;;;;;EAgC9B;AAuGD;;;GAGG;AACH,iBAAe,oBAAoB,kBAElC;AAED;;;;;;GAMG;AACH,iBAAe,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,GAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4IxF;AAED;;;;;;GAMG;AACH,iBAAS,gCAAgC,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE,GAAe;;;;;;;;;;EA+D3E;AAyHD;;;;;;;GAOG;AACH,iBAAS,0BAA0B,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,OA0BxG;AAED;;;;;;;GAOG;AACH,iBAAS,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,GAAE;IAC1C,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACjB,oBA8IL;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,oBAkBhD;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAiDhD;AAED;;;;;GAKG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAMhD;AAED;;;;GAIG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,WAK5C;AAED;;;;GAIG;AACH,iBAAS,uBAAuB,CAAC,GAAG,EAAE,GAAG,QA2ExC;AAED;;;;GAIG;AACH,iBAAe,sBAAsB,CAAC,GAAG,EAAE,GAAG,iBAK7C;AAED;;;;GAIG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,QAkI7C;AAED;;;GAGG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,QAM5C;AAED;;;;;;;GAOG;AACH,iBAAe,2BAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,GAAgB,gBAiB1F;AAID;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,WAY3D;AAiGD;;;;;;;GAOG;AACH,iBAAe,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBAoQ5D;AA+BD;;;;;;;;;;GAUG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,OAAY,EAAE,IAAI,EAAE,QAAa,EAAE,GAAE,GAAQ;;;;;;;;GAwD7F;AAED;;;;;;;;GAQG;AACH,iBAAe,kBAAkB,CAC7B,GAAG,EAAE,GAAG,EACR,OAAO,GAAE,GAAgB,EACzB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,iBAmCvC;AAID;;;;;;GAMG;AACH,iBAAe,yBAAyB,CAAC,GAAG,EAAE,GAAG,iBAoDhD;AAED;;;;;;GAMG;AACH,iBAAe,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,iBAmF/C;AAED;;;GAGG;AACH,iBAAe,kBAAkB,CAAC,GAAG,EAAE,GAAG,iBAkCzC;AAED;;;GAGG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,QAO7C;AAED;;;;;;GAMG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAyB,EAAE,OAAO,GAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,gBA6BtK;AAED;;;GAGG;AACH,iBAAS,+BAA+B,CAAC,GAAG,EAAE,GAAG,QA8EhD;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG;;;;;;EASnC;AAED;;;;GAIG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAgB,QAG3D;AAED;;;;GAIG;AACH,iBAAS,UAAU,CAAC,GAAG,EAAE,GAAG,OAW3B;AAED;;;;;GAKG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;;;;;GAsD9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,kBAiCE"}

package/dist/modules/dexbot_maintenance_runtime.js

@@ -5,6 +5,7 @@ const fs = require('fs');
 const { path } = require('./path_api');
 const { spawn } = require('child_process');
 const chainOrders = require('./chain_orders');
+const { readOpenOrdersGuarded } = require('./chain_orders');
 const grid = require('./order/grid');
 const { ORDER_STATES, ORDER_TYPES, TIMING, BTS_PRECISION, NATIVE_CLIENT } = require('./constants');
 const { PATHS } = require('./paths');
@@ -15,7 +16,6 @@ const fundRegistry = require('./fund_registry');
 const { BitShares } = require('./bitshares_client');
 const { BroadcastUncertainError } = require('./dexbot_credential_client');
 const { Config } = require('./config');
-function getNodeManager(...args) { return require('./bitshares_client').getNodeManager(...args); }
 function hasOpenOrdersSyncLoopMsSet(...args) { return require('./config').hasOpenOrdersSyncLoopMsSet(...args); }
 function getOpenOrdersSyncLoopMs(...args) { return require('./config').getOpenOrdersSyncLoopMs(...args); }
 function isGridBloated(...args) { return grid.isGridBloated(...args); }
@@ -706,6 +706,7 @@ function updateBotGridResetMetadata(botKey, options = {}) {
  * recalculate the grid, persist, and record reset metadata.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {import('./types').GridResyncOptions} [options] - Grid resync options
+ * @param {boolean} [options.skipIdle=false] - Skip the idle-cooldown deferral
  * @returns {Promise<boolean>} True if resync succeeded
  */
 function performGridResync(bot, options = {}) {
@@ -715,8 +716,9 @@ function performGridResync(bot, options = {}) {
     const centerRefreshContext = options.centerRefreshContext || (refreshCenterPrice ? 'grid reset recenter' : 'grid resync');
     const centerRefreshLabel = options.centerRefreshLabel || (refreshCenterPrice ? 'grid reset' : 'grid resync');
     const resetSource = options.resetSource || (refreshCenterPrice ? 'manual_grid_resync' : 'dexbot_grid_resync');
+    const skipIdle = options.skipIdle === true;
     const idleDelayMs = getMaintenanceIdleDelayMs(self);
-    if (idleDelayMs > 0) {
+    if (!skipIdle && idleDelayMs > 0) {
         self._log(`[MAINT-IDLE] Deferring grid resync until bot is idle` +
             ` (next check in ${Math.ceil(idleDelayMs / TIMING.MILLISECONDS_PER_SECOND)}s)`, 'info');
         scheduleDeferredGridResync(self, options);
@@ -767,7 +769,22 @@ function performGridResync(bot, options = {}) {
                 // fresh weights so cancelDustOrders uses live distribution (Issue M).
                 refreshDynamicWeightDistribution(self, 'grid resync');
             }
-            const readFn = () => chainOrders.readOpenOrders(self.accountId);
+            // Truncated-read guard: recalculateGrid's readOpenOrdersFn drives
+            // syncFromOpenOrders absence decisions (pass-1 phantom cleanup).
+            // A partial get_full_accounts window must abort the resync instead
+            // of virtualizing live ACTIVE slots; the trigger file is retained
+            // so the resync retries on a clean read.
+            let resyncReadAmbiguous = false;
+            const readFn = async () => {
+                const orders = await readOpenOrdersGuarded(chainOrders, self.accountId, {
+                    log: (message, level) => self._log(message, level),
+                    label: 'GRID-RESYNC',
+                    detail: 'trigger-file resync',
+                });
+                if (orders === null)
+                    resyncReadAmbiguous = true;
+                return orders;
+            };
             await recalculateGrid(self.manager, {
                 readOpenOrdersFn: readFn,
                 chainOrders,
@@ -775,7 +792,13 @@ function performGridResync(bot, options = {}) {
                 privateKey: self.privateKey,
                 config: self.config,
             });
-            self.manager.funds.btsFeesOwed = 0;
+            if (resyncReadAmbiguous) {
+                self._warn('[GRID-RESYNC] Aborted trigger-file resync: open-order read ambiguous (truncated); retaining trigger file for retry.');
+                return false;
+            }
+            await self.manager._fundLock.acquire(async () => {
+                self.manager.funds.btsFeesOwed = 0;
+            });
             await self.manager.persistGrid();
             success = true;
             if (updateBotGridResetMetadata(self.config?.botKey, {
@@ -942,22 +965,39 @@ function startOpenOrdersSyncLoop(bot) {
     }
     bot._mainLoopActive = true;
     bot._log(`Open-orders sync loop started (every ${loopDelayMs}ms, dryRun=${!!bot.config.dryRun})`);
-    const readOpenOrdersFn = chainOrders.readOpenOrders;
     bot._mainLoopPromise = (async () => {
         while (bot._mainLoopActive && !bot._shuttingDown) {
             try {
                 if (bot.manager && bot.accountId && !bot.config.dryRun) {
-                    if (!bot.manager._fillProcessingLock.isLocked() &&
+                    // Skip while a structural recovery reload is in flight:
+                    // _recoverFromPersistedGrid runs WITHOUT the fill lock, so
+                    // the lock gate alone would let this loop synchronizeWithChain
+                    // (and even fire a rebalance broadcast) into a half-rebuilt
+                    // grid. Same isolation the fill consumer gets via
+                    // _recoverySyncInFlight.
+                    if (!bot._recoverySyncInFlight &&
+                        !bot.manager._fillProcessingLock.isLocked() &&
                         bot.manager._fillProcessingLock.getQueueLength() === 0) {
                         await bot.manager._fillProcessingLock.acquire(async () => {
-                            const chainOpenOrders = await readOpenOrdersFn.call(chainOrders, bot.accountId);
-                            const syncResult = await bot.manager.synchronizeWithChain(chainOpenOrders, 'readOpenOrders');
-                            if (syncResult?.filledOrders && syncResult.filledOrders.length > 0) {
-                                bot._log(`Open-orders sync loop: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
-                                bot._markGridActivity?.('open-orders sync fill');
-                                const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'open-orders sync fill rebalance');
-                                if (!batchResult?.aborted) {
-                                    await bot.manager.persistGrid();
+                            // Truncated-read guard: syncing on a partial
+                            // get_full_accounts window would virtualize live
+                            // ACTIVE slots (pass-1 phantom cleanup) and
+                            // re-create them as duplicates. Defer to a clean
+                            // read — fill subscription events keep the bot
+                            // responsive in the meantime.
+                            const chainOpenOrders = await readOpenOrdersGuarded(chainOrders, bot.accountId, {
+                                log: (message, level) => bot._log(message, level),
+                                label: 'OPEN-ORDERS-SYNC',
+                            });
+                            if (chainOpenOrders !== null) {
+                                const syncResult = await bot.manager.synchronizeWithChain(chainOpenOrders, 'readOpenOrders');
+                                if (syncResult?.filledOrders && syncResult.filledOrders.length > 0) {
+                                    bot._log(`Open-orders sync loop: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
+                                    bot._markGridActivity?.('open-orders sync fill');
+                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'open-orders sync fill rebalance');
+                                    if (!batchResult?.aborted) {
+                                        await bot.manager.persistGrid();
+                                    }
                                 }
                             }
                             // Run grid health / dust detection after every sync tick so
@@ -1068,23 +1108,34 @@ function setupBlockchainFetchInterval(bot) {
                     let chainOpenOrders = [];
                     if (!bot.config.dryRun) {
                         try {
-                            chainOpenOrders = await chainOrders.readOpenOrders(bot.accountId);
-                            const syncResult = await bot.manager.synchronizeWithChain(chainOpenOrders, 'periodicBlockchainFetch');
-                            if (syncResult.filledOrders && syncResult.filledOrders.length > 0) {
-                                bot._log(`Periodic sync: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
-                                bot._markGridActivity?.('periodic sync fill rebalance');
-                                const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'periodic sync fill rebalance');
-                                if (!batchResult?.aborted) {
-                                    await bot.manager.persistGrid();
+                            // Truncated-read guard: a partial get_full_accounts
+                            // window would make synchronizeWithChain's pass-1
+                            // virtualize live ACTIVE slots that are simply missing
+                            // from the window (then re-create them as duplicates).
+                            // Defer the sync to a clean read; fills are still
+                            // caught by subscription events and the next cycle.
+                            chainOpenOrders = await readOpenOrdersGuarded(chainOrders, bot.accountId, {
+                                log: (message, level) => bot._log(message, level),
+                                label: 'PERIODIC-SYNC',
+                            });
+                            if (chainOpenOrders !== null) {
+                                const syncResult = await bot.manager.synchronizeWithChain(chainOpenOrders, 'periodicBlockchainFetch');
+                                if (syncResult.filledOrders && syncResult.filledOrders.length > 0) {
+                                    bot._log(`Periodic sync: ${syncResult.filledOrders.length} grid order(s) found filled on-chain. Triggering rebalance.`, 'info');
+                                    bot._markGridActivity?.('periodic sync fill rebalance');
+                                    const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), 'periodic sync fill rebalance');
+                                    if (!batchResult?.aborted) {
+                                        await bot.manager.persistGrid();
+                                    }
+                                }
+                                if (syncResult.unmatchedChainOrders && syncResult.unmatchedChainOrders.length > 0) {
+                                    const sample = syncResult.unmatchedChainOrders
+                                        .slice(0, 3)
+                                        .map(formatUnmatchedChainOrder)
+                                        .join(' | ');
+                                    bot._log(`Periodic sync: ${syncResult.unmatchedChainOrders.length} chain order(s) not in grid ` +
+                                        `(surplus/divergence)${sample ? `: ${sample}` : ''}`, 'warn');
                                 }
-                            }
-                            if (syncResult.unmatchedChainOrders && syncResult.unmatchedChainOrders.length > 0) {
-                                const sample = syncResult.unmatchedChainOrders
-                                    .slice(0, 3)
-                                    .map(formatUnmatchedChainOrder)
-                                    .join(' | ');
-                                bot._log(`Periodic sync: ${syncResult.unmatchedChainOrders.length} chain order(s) not in grid ` +
-                                    `(surplus/divergence)${sample ? `: ${sample}` : ''}`, 'warn');
                             }
                         }
                         catch (err) {
@@ -1311,30 +1362,43 @@ async function executeMaintenanceLogic(bot, context) {
     // LIGHTWEIGHT_SYNC_CHECK_INTERVAL_MS to limit blockchain query load.
     // Skip if the COW pipeline has active CREATEs in flight to avoid racing
     // with batch broadcasts — transient mismatches are expected during a COW cycle.
-    if (!bot._batchInFlight &&
+    // Also skip while a structural recovery reload is in flight (it runs without
+    // the fill lock, so this check must gate on the recovery flag explicitly).
+    if (!bot._recoverySyncInFlight &&
+        !bot._batchInFlight &&
         !(bot.manager?._pendingBroadcasts?.size > 0) &&
         (bot._lightweightSyncCheckAt == null || Date.now() - bot._lightweightSyncCheckAt >= TIMING.LIGHTWEIGHT_SYNC_CHECK_INTERVAL_MS)) {
         bot._lightweightSyncCheckAt = Date.now();
         try {
-            const chainOpenOrdersResult = await chainOrders.readOpenOrders(bot.accountId);
-            const assets = bot.manager?.assets;
-            if (!assets) {
-                bot._log('[LIGHTWEIGHT-SYNC] Skipped: manager assets not available', 'debug');
-            }
-            else {
-                const chainOrdersCount = chainOpenOrdersResult.filter((o) => parseChainOrder(o, assets) !== null).length;
-                const gridActive = Array.from(bot.manager.orders.values()).filter((o) => isOrderOnChain(o)).length;
-                const diff = Math.abs(chainOrdersCount - gridActive);
-                if (diff > 2) {
-                    bot._log(`[LIGHTWEIGHT-SYNC] Order count mismatch: chain=${chainOrdersCount}, grid=${gridActive} ` +
-                        `(diff=${diff}). Triggering targeted sync to reconcile.`, 'warn');
-                    if (bot.manager?.synchronizeWithChain) {
-                        await bot.manager.synchronizeWithChain(chainOpenOrdersResult, 'readOpenOrders');
-                    }
+            // Truncated-read guard: a partial window undercounts the chain
+            // order count, which would fabricate a divergence and trigger a
+            // full synchronizeWithChain on a partial snapshot (pass-1 phantom
+            // virtualization). Defer to a clean read.
+            const chainOpenOrdersResult = await readOpenOrdersGuarded(chainOrders, bot.accountId, {
+                log: (message, level) => bot._log(message, level),
+                label: 'LIGHTWEIGHT-SYNC',
+                skipMessage: (kind) => `[LIGHTWEIGHT-SYNC] Open-order read ${kind}; skipping consistency check (partial snapshot cannot drive count comparisons)`,
+            });
+            if (chainOpenOrdersResult !== null) {
+                const assets = bot.manager?.assets;
+                if (!assets) {
+                    bot._log('[LIGHTWEIGHT-SYNC] Skipped: manager assets not available', 'debug');
                 }
-                else if (diff > 0) {
-                    bot._log(`[LIGHTWEIGHT-SYNC] Order count mismatch: chain=${chainOrdersCount}, grid=${gridActive} ` +
-                        `(diff=${diff}). Minor divergence — expected during normal operation.`, 'debug');
+                else {
+                    const chainOrdersCount = chainOpenOrdersResult.filter((o) => parseChainOrder(o, assets) !== null).length;
+                    const gridActive = Array.from(bot.manager.orders.values()).filter((o) => isOrderOnChain(o)).length;
+                    const diff = Math.abs(chainOrdersCount - gridActive);
+                    if (diff > 2) {
+                        bot._log(`[LIGHTWEIGHT-SYNC] Order count mismatch: chain=${chainOrdersCount}, grid=${gridActive} ` +
+                            `(diff=${diff}). Triggering targeted sync to reconcile.`, 'warn');
+                        if (bot.manager?.synchronizeWithChain) {
+                            await bot.manager.synchronizeWithChain(chainOpenOrdersResult, 'readOpenOrders');
+                        }
+                    }
+                    else if (diff > 0) {
+                        bot._log(`[LIGHTWEIGHT-SYNC] Order count mismatch: chain=${chainOrdersCount}, grid=${gridActive} ` +
+                            `(diff=${diff}). Minor divergence — expected during normal operation.`, 'debug');
+                    }
                 }
             }
         }
@@ -1361,13 +1425,23 @@ async function executeMaintenanceLogic(bot, context) {
         return;
     const pipelineStatus = bot.manager.isPipelineEmpty(bot._getPipelineSignals());
     if (pipelineStatus.isEmpty) {
-        const repairedFromChain = await maybeRunTargetedDriftReconciliation(bot, context);
-        if (repairedFromChain) {
+        const repairedFromTarget = await maybeRunTargetedDriftReconciliation(bot, context);
+        if (repairedFromTarget) {
             const freshHealth = await bot.manager.checkGridHealth(bot.updateOrdersOnChainPlan.bind(bot));
             if (await bot._abortFlowIfIllegalState(`${context} post-reconcile health check`))
                 return;
             healthResult = freshHealth;
         }
+        if (!repairedFromTarget) {
+            const autoCancelResult = await bot._autoCancelOneUnmatchedOrphan();
+            if (autoCancelResult?.cancelled) {
+                bot._log(`[MAINT] Auto-cancelled unmatched price-drift orphan ${autoCancelResult.orderId} during ${context} ` +
+                    `(unblocking CREATE pipeline that targeted-drift reconcile could not adopt).`, 'warn');
+            }
+            else if (autoCancelResult?.reason) {
+                bot._log(`[MAINT] Skipped unmatched-orphan auto-cancel during ${context}: ${autoCancelResult.reason}`, 'debug');
+            }
+        }
         refreshDynamicWeightDistribution(bot, context);
         const dustCancelResult = await cancelDustOrders(bot, {
             buy: healthResult.buyDustOrders,
@@ -1419,11 +1493,20 @@ async function executeMaintenanceLogic(bot, context) {
                 // immediately instead of patching master types.  The retry re-fetches
                 // blockchain state and re-derives the boundary with consistent data.
                 // Skip spread correction this tick — the retry will handle it.
-                if (dcResult && !dcResult.committed && dcResult.boundaryChanged) {
+                // EXCEPTION: a RECOVERY_EXHAUSTED abort means CREATEs are blocked until
+                // the next fill or sync cycle (see recovery-exhausted reset logic), so an
+                // immediate retry can never make progress and would spin the loop,
+                // producing unbounded log volume.  Defer to the normal cycle instead.
+                if (dcResult && !dcResult.committed && dcResult.boundaryChanged &&
+                    dcResult.reason !== 'RECOVERY_EXHAUSTED') {
                     bot._log(`[DIVERGENCE-COW] Commit failed with boundary shift; ` +
                         `scheduling immediate retry instead of patching master`, 'warn');
                     setTimeout(() => runGridMaintenance(bot, 'failed-commit-retry', { skipIdle: true }), 0);
                 }
+                else if (dcResult && !dcResult.committed && dcResult.boundaryChanged) {
+                    bot._log(`[DIVERGENCE-COW] Boundary-shift commit blocked (reason=${dcResult.reason}); ` +
+                        `deferring retry to next fill/sync cycle`, 'warn');
+                }
                 else {
                     const spreadResult = await bot.manager.checkSpreadCondition(BitShares, bot.updateOrdersOnChainPlan.bind(bot));
                     if (await bot._abortFlowIfIllegalState(`${context} spread check`))
@@ -1448,13 +1531,14 @@ async function executeMaintenanceLogic(bot, context) {
     }
 }
 /**
- * Cancel a single order, retrying on alternate BitShares nodes when the
- * credential daemon reports BROADCAST_DEADLINE.  The daemon already retries
- * 3× internally against its own node list; if it still hits the deadline
- * the node itself may be unhealthy.  We hand the full healthy-node list
- * (excluding the primary) to the credential client, which cycles through
- * the fallbacks with a 1 s gap and raises the last BroadcastUncertainError
- * only when all nodes are exhausted.
+ * Cancel a single order, deferring on an uncertain daemon broadcast.
+ * The credential daemon retries internally only failures that provably never
+ * reached the chain (pre-transmit connect/send errors); on BROADCAST_DEADLINE
+ * (or any uncertain outcome) it never re-signs, and the credential client
+ * propagates a BroadcastUncertainError — the outcome is unknown and re-sending
+ * could duplicate a landed cancel. No node is blacklisted here: without an
+ * explicit nodeUrl the daemon chose the node, so there is no single node to
+ * blame. The next dust-detection cycle re-attempts.
  *
  * The daemon's session is validated early in processRequest (before the
  * broadcast), so a BROADCAST_DEADLINE reply cannot be caused by an expired
@@ -1464,23 +1548,13 @@ async function executeMaintenanceLogic(bot, context) {
  * @param {import('./types').Order} order
  * @returns {Promise<*>} Result from chainOrders.cancelOrder
  */
-async function cancelOrderWithNodeFallback(bot, order) {
+async function cancelOrderDeferredOnUncertain(bot, order) {
     try {
-        const nodeManager = getNodeManager();
-        const nodes = nodeManager?.getHealthyNodes() ?? [];
-        const fallbackNodes = nodes.length > 1 ? nodes.slice(1) : undefined;
-        return await chainOrders.cancelOrder(bot.account, bot.privateKey, order.orderId, fallbackNodes
-            ? {
-                fallbackNodes,
-                onNodeFailed: (nodeUrl) => {
-                    nodeManager.reportNodeFailure(nodeUrl, 'BROADCAST_DEADLINE', 'broadcast');
-                },
-            }
-            : {});
+        return await chainOrders.cancelOrder(bot.account, bot.privateKey, order.orderId);
     }
     catch (err) {
         if (err instanceof BroadcastUncertainError) {
-            bot._warn(`[DUST] All nodes exhausted for ${order.id} (${order.orderId})`);
+            bot._warn(`[DUST] Broadcast uncertain for ${order.id} (${order.orderId}); outcome deferred to chain verification`);
         }
         throw err;
     }
@@ -1505,12 +1579,27 @@ async function cancelDustOrders(bot, { buy: buyDust = [], sell: sellDust = [] }
         if (!order.orderId)
             continue;
         try {
-            const cancelResult = await cancelOrderWithNodeFallback(bot, order);
+            const cancelResult = await cancelOrderDeferredOnUncertain(bot, order);
             try {
                 if (cancelResult?.verifiedAfterFailure) {
                     const accountRef = bot.accountId || bot.account;
-                    const chainOpenOrders = await chainOrders.readOpenOrders(accountRef);
-                    await bot.manager.synchronizeWithChain(chainOpenOrders, 'readOpenOrders');
+                    // The cancel was verified absent on an authoritative
+                    // (non-empty, non-truncated) read inside cancelOrder, so an
+                    // ambiguous refetch must not run the full sync: the snapshot
+                    // omits the freshest orders and pass-1 phantom cleanup could
+                    // virtualize live slots. Fall back to the local cancel sync.
+                    const freshOrders = await readOpenOrdersGuarded(chainOrders, accountRef, {
+                        log: (message) => bot._warn(message),
+                        label: 'DUST',
+                        deferEmpty: true,
+                        skipMessage: (kind) => `[DUST] Chain refetch after verified cancel is ${kind}; applying local cancel sync for ${order.id}`,
+                    });
+                    if (freshOrders === null) {
+                        await bot.manager.synchronizeWithChain({ orderId: order.orderId, clearSize: true }, 'cancelOrder');
+                    }
+                    else {
+                        await bot.manager.synchronizeWithChain(freshOrders, 'readOpenOrders');
+                    }
                 }
                 else {
                     await bot.manager.synchronizeWithChain({ orderId: order.orderId, clearSize: true }, 'cancelOrder');
@@ -1781,7 +1870,7 @@ function setupDustHealthCheckInterval(bot) {
  * Request a full grid reset from fresh on-chain state.
  * @param {import('./dexbot_class').DEXBot} bot
  * @param {string} [reason='structural change']
- * @param {{refreshCenterPrice?: boolean}} [options={}]
+ * @param {{refreshCenterPrice?: boolean, skipIdle?: boolean, skipFillLock?: boolean}} [options={}]
  * @returns {Promise<Object>}
  */
 async function requestGridReset(bot, reason = 'structural change', options = {}) {
@@ -1794,8 +1883,21 @@ async function requestGridReset(bot, reason = 'structural change', options = {})
         ...options,
         refreshCenterPrice: options.refreshCenterPrice !== false,
     };
-    if (!bot.manager._fillProcessingLock || bot.manager._fillProcessingLock.isReentrant()) {
-        return performGridResync(bot, resetOptions);
+    // Structural recovery resyncs are chain-read/rebuild operations that do not
+    // mutate order state in place; running them behind the fill-processing lock
+    // lets a fill storm starve recovery indefinitely. Skip the lock when the
+    // caller explicitly requests it (structural resync wiring). While the
+    // rebuild runs unlocked, raise _recoverySyncInFlight so the fill consumer
+    // defers fills entirely (no concurrent mutation race) instead of racing
+    // them behind a lock.
+    if (options.skipFillLock === true || !bot.manager._fillProcessingLock || bot.manager._fillProcessingLock.isReentrant()) {
+        bot._recoverySyncInFlight = (bot._recoverySyncInFlight || 0) + 1;
+        try {
+            return await performGridResync(bot, resetOptions);
+        }
+        finally {
+            bot._recoverySyncInFlight = Math.max(0, (bot._recoverySyncInFlight || 0) - 1);
+        }
     }
     return bot.manager._fillProcessingLock.acquire(async () => performGridResync(bot, resetOptions));
 }
@@ -1816,13 +1918,36 @@ function wireStructuralGridResyncRequest(bot) {
         const unmatchedCount = Array.isArray(details?.unmatchedChainOrders)
             ? details.unmatchedChainOrders.length
             : 0;
-        bot._structuralGridResyncTimer = setTimeout(async () => {
+        const runStructuralResync = async () => {
             bot._structuralGridResyncTimer = null;
             if (bot._shuttingDown)
                 return;
+            // A COW batch can be mid-broadcast (its broadcast phase holds no
+            // grid lock, only the commit does). Reloading the persisted grid
+            // underneath it would race the commit and force an avoidable
+            // commit refusal + re-adoption cycle. Defer until the batch
+            // completes; the fill consumer is already gated on _batchInFlight,
+            // so this only blocks the recovery itself, never new fills.
+            if (bot._batchInFlight > 0) {
+                bot._structuralGridResyncTimer = setTimeout(runStructuralResync, TIMING.LOCK_REFRESH_MIN_MS);
+                return;
+            }
             bot._structuralGridResyncRunning++;
             try {
-                const persistedResult = await bot._recoverFromPersistedGrid();
+                // The reload runs without the fill lock, so raise the
+                // recovery-in-flight flag for its whole duration: the fill
+                // consumer defers (dexbot_fill_runtime gates on it), which
+                // prevents a fill arriving mid-reload from starting a new COW
+                // batch whose broadcast would overlap the reload and force an
+                // avoidable commit refusal + re-adoption cycle.
+                bot._recoverySyncInFlight = (bot._recoverySyncInFlight || 0) + 1;
+                let persistedResult;
+                try {
+                    persistedResult = await bot._recoverFromPersistedGrid();
+                }
+                finally {
+                    bot._recoverySyncInFlight = Math.max(0, (bot._recoverySyncInFlight || 0) - 1);
+                }
                 if (persistedResult.success) {
                     if (bot.manager?._recoveryState) {
                         bot.manager._recoveryState = { ...bot.manager._recoveryState, attemptCount: 0, lastAttemptAt: 0, lastFailureAt: 0 };
@@ -1833,6 +1958,11 @@ function wireStructuralGridResyncRequest(bot) {
                 bot._warn(`[RECOVERY] Running structural full grid resync for ${reason}${suffix}`);
                 const resetResult = await bot.requestGridReset('rms_structural_grid_resync', {
                     refreshCenterPrice: true,
+                    // Structural resync is a chain-read/rebuild; do not let a
+                    // fill storm starve it behind the idle cooldown or the
+                    // fill-processing lock.
+                    skipIdle: true,
+                    skipFillLock: true,
                 });
                 if (resetResult && bot.manager?._recoveryState) {
                     bot.manager._recoveryState = { ...bot.manager._recoveryState, attemptCount: 0, lastAttemptAt: 0, lastFailureAt: 0 };
@@ -1847,7 +1977,8 @@ function wireStructuralGridResyncRequest(bot) {
                     bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: false };
                 }
             }
-        }, 0);
+        };
+        bot._structuralGridResyncTimer = setTimeout(runStructuralResync, 0);
         return { scheduled: true };
     };
 }
@@ -1903,7 +2034,19 @@ async function syncOpenOrdersAndProcessFills(bot, tag) {
         return { syncResult: null, aborted: false, hasUnmatched: 0, openOrders: null };
     }
     try {
-        let openOrders = await chainOrders.readOpenOrders(bot.accountId);
+        // Truncated-read guard: syncing on a partial get_full_accounts window
+        // would virtualize live ACTIVE slots (pass-1 phantom cleanup) and
+        // re-create them as duplicates. Defer to a clean read — fill
+        // subscription events keep the bot responsive in the meantime.
+        const firstRead = await readOpenOrdersGuarded(chainOrders, bot.accountId, {
+            log: (message, level) => bot._log(message, level),
+            label: 'SYNC-CHAIN',
+            detail: `during ${tag}`,
+        });
+        if (firstRead === null) {
+            return { syncResult: null, aborted: false, hasUnmatched: 0, openOrders: null };
+        }
+        let openOrders = firstRead;
         const syncResult = await bot.manager.synchronizeWithChain(openOrders, 'readOpenOrders');
         let aborted = false;
         if (syncResult?.filledOrders?.length > 0) {
@@ -1911,8 +2054,18 @@ async function syncOpenOrdersAndProcessFills(bot, tag) {
             bot._log(`[SYNC-CHAIN] ${syncResult.filledOrders.length} filled order(s) found during ${tag}`, 'info');
             const batchResult = await bot._processFillsWithBatching(syncResult.filledOrders, new Set(), `${tag} sync-fill`);
             if (!batchResult?.aborted) {
-                openOrders = await chainOrders.readOpenOrders(bot.accountId);
-                await bot.manager.synchronizeWithChain(openOrders, 'readOpenOrders');
+                // Reassign the returned snapshot to the post-fill re-read: the
+                // caller feeds openOrders into reconcileGridOrders, which must
+                // see the freshest chain state, not the pre-fill first read.
+                const reReadOrders = await readOpenOrdersGuarded(chainOrders, bot.accountId, {
+                    log: (message, level) => bot._log(message, level),
+                    label: 'SYNC-CHAIN',
+                    detail: `post-fill re-read during ${tag}`,
+                });
+                if (reReadOrders !== null) {
+                    openOrders = reReadOrders;
+                    await bot.manager.synchronizeWithChain(openOrders, 'readOpenOrders');
+                }
             }
             else {
                 aborted = true;