dexbot 1.5.0 → 1.5.2

package/dist/modules/dexbot_cow_runtime.js

@@ -14,11 +14,41 @@ import { BroadcastUncertainError as BroadcastUncertainErrorBinding } from './dex
 const BroadcastUncertainError = BroadcastUncertainErrorBinding;
 import * as orderUtils from './order/utils/order.js';
 import { sleep } from './order/utils/system.js';
-const { buildCreateOrderArgs, buildCreateOpFingerprint, extractBatchOperationResults, formatUnmatchedChainOrder, convertToSpreadPlaceholder, buildOutsideInPairGroups, isOrderPlaced, } = orderUtils;
+const { buildCreateOrderArgs, buildCreateOpFingerprint, extractBatchOperationResults, formatUnmatchedChainOrder, convertToSpreadPlaceholder, toRailHolePlaceholder, buildOutsideInPairGroups, isOrderPlaced, } = orderUtils;
 import * as validate from './order/utils/validate.js';
-const { validateCreateTargetSlots, evaluateCommit, hasExecutableActions } = validate;
+const { validateCreateTargetSlots, evaluateCommit, hasExecutableActions, stampGapEvacuationRotation } = validate;
 import * as math from './order/utils/math.js';
-const { validateOrderSize, findCrossedOrder, priceSlotEqual } = math;
+const { validateOrderSize, findCrossedOrder, priceSlotEqual, isEvacuationRotationAllowed, isEvacuationSizeStillValid, getSellStartIdx, getPrecisionByOrderType, isSlotIndexInGapBand } = math;
+/**
+ * Re-verify a B-stamped gap-evacuation rotation against the LIVE committed
+ * geometry (boundaryIdx/_gapSlots at execution time). The stamp freezes
+ * plan-build geometry, but a boundary commit can land between plan-build and
+ * execution; when the live geometry is finite and the source is no longer
+ * in-band (or the dest no longer rail), the stamp is stale and the rotation
+ * must be re-proven by the unstamped live probe instead of bypassing the
+ * last-fill guard. Non-finite live geometry cannot disprove the stamp and
+ * keeps the plan-build authority (fail-open to the stamp, never to the guard).
+ */
+export function isEvacuationStampStillValid(liveBoundary, liveGapSlots, sourceId, destId, orderType) {
+    const b = Number(liveBoundary);
+    const g = Number(liveGapSlots);
+    if (orderType !== ORDER_TYPES.BUY && orderType !== ORDER_TYPES.SELL)
+        return false;
+    if (!Number.isFinite(b) || !Number.isFinite(g) || g < 0)
+        return true;
+    const srcIdx = parseSlotIndex(sourceId);
+    const dstIdx = parseSlotIndex(destId);
+    if (srcIdx === null || srcIdx === undefined || dstIdx === null || dstIdx === undefined)
+        return false;
+    if (!isSlotIndexInGapBand(srcIdx, b, g))
+        return false;
+    if (isSlotIndexInGapBand(dstIdx, b, g))
+        return false;
+    const sellStartIdx = getSellStartIdx(b, g);
+    const dstInRail = orderType === ORDER_TYPES.SELL ? Number(dstIdx) >= sellStartIdx : Number(dstIdx) <= b;
+    return dstInRail;
+}
+import { parseSlotIndex } from './order/utils/slot.js';
 function hasSlotPriceCollision(items, targetPrice, precision, excludeId, predicate) {
     for (const it of items) {
         if (predicate && !predicate(it))
@@ -250,28 +280,18 @@ function crossedOrderLabel(crossed) {
  * an UPDATE-only rotation batch can re-price across an un-adopted chain
  * order that master-grid-only checks cannot see (the pending/unmatched
  * batch guards fire only for CREATE batches).
+ *
+ * Delegates to the shared order-utils builder so every crossing guard (COW
+ * create/rotation/fallback, startup reconcile placement, price-correction)
+ * sees the same set. Pending entries are pushed as wrappers (slotId +
+ * order): their inner order has no chain id yet, so orderId-only
+ * predicates would blind the guard to them — the shared
+ * isCrossingCheckCandidate predicate accepts slot-id-only wrappers.
  * @param {Object} bot
  * @returns {any[]}
  */
 function buildCrossingCandidates(bot) {
-    const mgr = bot?.manager;
-    if (!mgr)
-        return [];
-    const candidates = mgr.orders instanceof Map ? [...mgr.orders.values()] : [];
-    if (mgr._pendingBroadcasts instanceof Map) {
-        for (const entry of mgr._pendingBroadcasts.values()) {
-            const o = entry?.order;
-            if (o && o.type != null && o.price != null)
-                candidates.push(o);
-        }
-    }
-    if (Array.isArray(mgr._lastUnmatchedChainOrders)) {
-        for (const o of mgr._lastUnmatchedChainOrders) {
-            if (o && o.type != null && o.price != null)
-                candidates.push(o);
-        }
-    }
-    return candidates;
+    return orderUtils.buildCrossingCheckCandidates(bot?.manager);
 }
 /**
  * Drop only the pending-broadcast entries for the given CREATE slots.
@@ -1446,7 +1466,13 @@ function validateOrderSizeForExecution(bot, size, type, orderLike = null, fallba
  *  last fill @x with increment i: BUY < x*(1 - i/2/100), SELL > x*(1 + i/2/100)
  *  e.g. x=1000, i=0.5% => BUY < 997.5, SELL > 1002.5
  * Cold (pivot null or lastType null) => disabled. Spread-correction CREATES
- * bypass per-action (see broadcast sites); rotations never bypass.
+ * bypass per-action (see broadcast sites); gap-evacuation rotation UPDATEs
+ * bypass only via the violation-reducing allowance (origin='gap-evacuation',
+ * UPDATE-only, frozen B-stamp or live-proven isEvacuationRotationAllowed) —
+ * see the UPDATE rotation guard block.
+ * The pivot is the latest fill of either side and is never expired: it stays
+ * the durable mark (last sold level floors new sells; buy fills pull it down
+ * and re-open the sell side, buy-below-sell is never gated).
  * @param {number} price - Target order price
  * @param {number} size - Order size (unused, kept for compat)
  * @param {string} type - ORDER_TYPES.BUY/SELL
@@ -1612,7 +1638,49 @@ function buildActionsFromPlan(_bot, plan) {
     // inherit the spread-correction bypass. Actions built outside this helper
     // carry no origin and default to guarded (safe default).
     const planOrigin = normalizedPlan?.origin;
-    const withOrigin = (action) => (planOrigin ? { ...action, origin: planOrigin } : action);
+    // B-stamp inputs: the plan-level boundary + gap width frozen AT
+    // PLAN-BUILD TIME. The stamp carries this geometry so the execution
+    // guard can bypass on it — and re-verifies it against the LIVE
+    // committed geometry at execution time (isEvacuationStampStillValid),
+    // downgrading stale stamps to the live probe.
+    const frozenBoundaryRaw = Number(normalizedPlan?.boundaryIdx ?? _bot?.manager?.boundaryIdx);
+    const frozenGapRaw = Number(normalizedPlan?.gapSlots ?? _bot?.manager?._gapSlots);
+    const hasFrozenGeometry = Number.isFinite(frozenBoundaryRaw) && Number.isFinite(frozenGapRaw) && frozenGapRaw >= 0;
+    const withOrigin = (action, sourceMaster = null) => {
+        if (!planOrigin)
+            return action;
+        // Origin only rides UPDATEs (where the guard reads it). Gap-plan
+        // CREATEs carry a provably dead origin — the spread-correction
+        // CREATE check falls back to the batch origin, so dropping the
+        // per-action origin there is safe. Other plan origins keep riding
+        // non-UPDATE actions unchanged.
+        if (action?.type !== COW_ACTIONS.UPDATE) {
+            return planOrigin === 'gap-evacuation' ? { ...action } : { ...action, origin: planOrigin };
+        }
+        if (planOrigin !== 'gap-evacuation')
+            return { ...action, origin: planOrigin };
+        if (!hasFrozenGeometry)
+            return { ...action, origin: planOrigin };
+        // Route through the real stampler: geometry (source in-band, dest
+        // rail), bit-exact non-growing size (side precision) and outward
+        // repricing must all PROVE — a plan-level origin alone never grants
+        // the bypass. Without a source master the proof is impossible, so
+        // the action stays unstamped (the live probe at execution can still
+        // re-prove it from the master grid).
+        const base = { ...action, origin: planOrigin };
+        if (!sourceMaster)
+            return { ...base, origin: undefined };
+        // The stampler wants the ORDER type (SELL/BUY), which rides on
+        // action.order.type — action.type is the COW action kind ('update').
+        const rotOrderType = action?.order?.type ?? action?.type;
+        const proved = stampGapEvacuationRotation(base, sourceMaster, action.newPrice, action.newSize, rotOrderType, frozenBoundaryRaw, frozenGapRaw, _bot?.manager?.assets);
+        // Proof refused: strip the origin so the action is exactly an
+        // unstamped rotation (never an origin claim without a stamp).
+        if (!proved?.evacBoundary && !proved?.evacGapSlots) {
+            proved.origin = undefined;
+        }
+        return proved;
+    };
     const actions = [];
     for (const o of ordersToCancel) {
         if (o?.orderId) {
@@ -1646,7 +1714,7 @@ function buildActionsFromPlan(_bot, plan) {
                 price: newPrice,
                 size: newSize
             }
-        }));
+        }, oldOrder));
     }
     for (const o of ordersToUpdate) {
         const partialOrder = o?.partialOrder || o;
@@ -1697,12 +1765,31 @@ function buildCowResultFromPlan(bot, plan) {
         ? requestedBoundary
         : bot.manager.boundaryIdx;
     const actions = buildActionsFromPlan(bot, plan);
+    // Rail-aware hole projection (Phase 2): a cleared in-rail slot stays a
+    // rail-typed VIRTUAL hole with its booked size preserved (rotation
+    // sources keep the remainder the guard/plan must see); only true
+    // gap-band slots become side-neutral SPREAD holes.
+    const toWorkingHole = (slot) => {
+        try {
+            const idx = parseSlotIndex(slot?.id);
+            const b = Number(workingBoundary);
+            const gapSlots = Number(bot?.manager?._gapSlots);
+            if (idx !== null && idx !== undefined && Number.isFinite(b) && Number.isFinite(gapSlots) && gapSlots >= 0) {
+                if (Number(idx) <= b)
+                    return toRailHolePlaceholder(slot, ORDER_TYPES.BUY);
+                if (Number(idx) >= getSellStartIdx(b, gapSlots))
+                    return toRailHolePlaceholder(slot, ORDER_TYPES.SELL);
+            }
+        }
+        catch { /* fall through to SPREAD */ }
+        return convertToSpreadPlaceholder(slot);
+    };
     for (const action of actions) {
         if (action.type === COW_ACTIONS.CANCEL) {
             const current = workingGrid.get(action.id);
             if (!current)
                 continue;
-            workingGrid.set(action.id, convertToSpreadPlaceholder(current));
+            workingGrid.set(action.id, toWorkingHole(current));
         }
         else if (action.type === COW_ACTIONS.CREATE) {
             if (!action.id || !action.order)
@@ -1720,7 +1807,7 @@ function buildCowResultFromPlan(bot, plan) {
             if (action.newGridId && action.newGridId !== action.id) {
                 const current = workingGrid.get(action.id);
                 if (current) {
-                    workingGrid.set(action.id, convertToSpreadPlaceholder(current));
+                    workingGrid.set(action.id, toWorkingHole(current));
                 }
                 const targetId = action.newGridId;
                 const targetCurrent = workingGrid.get(targetId) || { id: targetId };
@@ -1781,7 +1868,11 @@ function applyRotationTransitionsToWorkingGrid(bot, workingGrid, executedContext
             continue;
         const { rotation } = ctx;
         const { oldOrder, newGridId, newPrice, newSize, type } = rotation;
-        // Source slot → VIRTUAL (if it's a different slot)
+        // Source slot → VIRTUAL (if it's a different slot). Phase 2: the
+        // source stays a RAIL-TYPED hole with its booked size preserved —
+        // only state/orderId/rawOnChain are cleared, never type or size
+        // (no SPREAD retype, no zeroing). In-rail sources must remain
+        // visible to candidate-selection and evacuation geometry.
         if (oldOrder?.id && oldOrder.id !== newGridId) {
             const sourceSlot = workingGrid.get(oldOrder.id);
             if (sourceSlot && sourceSlot.orderId) {
@@ -1834,10 +1925,14 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
     // Only CREATE operations can be confirmed by polling (they appear as new orders on chain)
     const createContexts = opContexts.filter((ctx) => ctx && ctx.kind === 'create' && ctx.finalInts && ctx.order);
     if (createContexts.length === 0) {
-        return { allConfirmed: false, confirmed: [], unconfirmed: [...opContexts] };
+        return { allConfirmed: false, confirmed: [], unconfirmed: [...opContexts], confirmedChainIds: [] };
     }
     const accountRef = bot.accountId || bot.account?.id || bot.account;
     let remaining = [...createContexts];
+    // Chain ids of the poll-matched fresh creates. Retained (not just
+    // logged) so the poll-confirmed adoption path can re-read them BY ID —
+    // the window fallback cannot prove a lagging node has them yet.
+    const matchedChainIds = [];
     for (let attempt = 1; attempt <= maxPollRetries; attempt++) {
         try {
             const chainRead = await readOpenOrdersWithMetaSafe(chainOrders, accountRef);
@@ -1877,6 +1972,8 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
                 });
                 if (match) {
                     bot.manager.logger.log(`[COW][POLL] Confirmed CREATE for slot ${ctx.order.id} on chain as ${match.id}`, 'debug');
+                    if (match.id && /^1\.7\.\d+$/.test(String(match.id)))
+                        matchedChainIds.push(String(match.id));
                 }
                 else {
                     stillUnconfirmed.push(ctx);
@@ -1885,7 +1982,7 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
             if (stillUnconfirmed.length === 0) {
                 const confirmed = createContexts;
                 bot.manager.logger.log(`[COW][POLL] All ${confirmed.length} CREATE(s) confirmed on chain after ${attempt} poll(s)`, 'info');
-                return { allConfirmed: true, confirmed, unconfirmed: [] };
+                return { allConfirmed: true, confirmed, unconfirmed: [], confirmedChainIds: [...matchedChainIds] };
             }
             remaining = stillUnconfirmed;
             if (attempt < maxPollRetries) {
@@ -1902,7 +1999,7 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
     const confirmed = createContexts.filter((ctx) => !remaining.includes(ctx));
     bot.manager.logger.log(`[COW][POLL] ${confirmed.length}/${createContexts.length} CREATE(s) confirmed after ${maxPollRetries} polls; ` +
         `${remaining.length} unconfirmed. Falling back to reconciliation.`, 'warn');
-    return { allConfirmed: false, confirmed, unconfirmed: remaining };
+    return { allConfirmed: false, confirmed, unconfirmed: remaining, confirmedChainIds: [...matchedChainIds] };
 }
 /**
  * Restore skipped update slots in the working grid to master state.
@@ -2277,6 +2374,12 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                 case 'chain_orphan_collision':
                     reason = `unmatched on-chain order ${violation.currentOrderId} at same price`;
                     break;
+                case 'same_batch_price_duplicate':
+                    reason = `another CREATE in the same batch at same broadcast price (duplicate of ${violation.duplicateOf})`;
+                    break;
+                case 'create_price_invalid':
+                    reason = `broadcast price is not a finite number`;
+                    break;
                 default:
                     reason = `existing orderId=${violation.currentOrderId}`;
             }
@@ -2577,10 +2680,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     // an opposite-side order cancelled in a later chunk would
                     // otherwise coexist with this create mid-broadcast and
                     // self-trade (production incident class).
-                    const createCrossed = findCrossedOrder(crossingCandidates, createPrice, order.type, bot.manager.assets, (o) => {
-                        const oid = o?.orderId || o?.chainOrderId;
-                        return o && oid && !cancelOpIndexByOrderId.has(oid);
-                    });
+                    const createCrossed = findCrossedOrder(crossingCandidates, createPrice, order.type, bot.manager.assets, (o) => orderUtils.isCrossingCheckCandidate(o, null, cancelOpIndexByOrderId));
                     const intraBatchCrossed = createCrossed ? null : findCrossedOrder(intraBatchCandidates, createPrice, order.type, bot.manager.assets);
                     const effectiveCrossed = createCrossed || intraBatchCrossed;
                     if (effectiveCrossed) {
@@ -2694,13 +2794,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         // fatal fund assert). Skipping is safe: the slot keeps its
                         // old commitment and the next plan re-evaluates once
                         // the crossed order's cancel confirms.
-                        const crossedOrder = findCrossedOrder([...crossingCandidates, ...intraBatchCandidates], newPrice, orderType, bot.manager.assets, (o) => {
-                            const oid = o?.orderId || o?.chainOrderId;
-                            return o
-                                && oid
-                                && oid !== action.orderId
-                                && !cancelOpIndexByOrderId.has(oid);
-                        });
+                        const crossedOrder = findCrossedOrder([...crossingCandidates, ...intraBatchCandidates], newPrice, orderType, bot.manager.assets, (o) => orderUtils.isCrossingCheckCandidate(o, action.orderId, cancelOpIndexByOrderId));
                         if (crossedOrder) {
                             skippedUpdateCount++;
                             if (action.id)
@@ -2712,35 +2806,151 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                 `${crossedOrderLabel(crossedOrder)}; re-planned after its cancel confirms.`, 'warn');
                             continue;
                         }
-                        // LAST-FILL PRICE GUARD (UPDATE rotation): pivot ± halfIncrement — same as CREATE.
-                        // No origin bypass here, ever: a rotation reprices, so it always obeys the guard —
-                        // even if a future correction plan carries rotation entries (per-action scoping).
+                        // LAST-FILL PRICE GUARD (UPDATE rotation): pivot ± halfIncrement — same as CREATE,
+                        // plus the GAP-EVACUATION ALLOWANCE (violation-reducing): a rotation stamped
+                        // origin='gap-evacuation' at plan-build moves a live order OUT of the gap band
+                        // onto its rail with bit-exact non-growing size — it shrinks the violation
+                        // surface instead of adding exposure, so it bypasses the guard. The bypass
+                        // is UPDATE-only (CREATEs carry no source slot and can never qualify) and
+                        // honors the frozen B-stamp (evacBoundary/evacGapSlots captured when the
+                        // plan was built — never re-derived here, since plans can validate against
+                        // a later-committed boundary):
+                        // - B-stamped: plan-build geometry already proved the evacuation; bypass
+                        //   outright (logged + counted as bypassed).
+                        // - Unstamped gap-evacuation: prove it live from oldPrice/oldSize read
+                        //   off the MASTER grid above (bot.manager.orders.get, before rotation
+                        //   pre-application virtualizes sources — after that the lookup lies);
+                        //   fail closed (block) when unresolvable; otherwise run the pure
+                        //   isEvacuationRotationAllowed decision and bypass only on allow.
+                        // Everything else obeys the guard (per-action scoping: a rotation entry
+                        // merged into another plan inherits no bypass).
                         // The pivot is refreshed from still-queued fills first: fills detected mid-broadcast
                         // sit in _incomingFillQueue until the fill cycle ends, and without this the later
                         // chunks of a long broadcast would be checked against a stale pivot.
                         try {
-                            try {
-                                if (refreshLastFillPivotFromQueue(bot))
-                                    lastFillGuardPivotRefreshed = true;
+                            let bypassedEvacuation = false;
+                            const rotationOrigin = action?.origin;
+                            if (rotationOrigin === 'gap-evacuation') {
+                                const frozenB = Number(action?.evacBoundary);
+                                const frozenG = Number(action?.evacGapSlots);
+                                let stampUsable = Number.isFinite(frozenB) && Number.isFinite(frozenG);
+                                if (stampUsable) {
+                                    // Stale-stamp check: the stamp froze PLAN-BUILD
+                                    // geometry; if a boundary commit landed between
+                                    // plan-build and execution and the source is no
+                                    // longer in-band (or dest no longer rail) under
+                                    // the LIVE geometry, re-prove via the unstamped
+                                    // live probe below instead of bypassing outright.
+                                    const stampValid = isEvacuationStampStillValid(bot.manager?.boundaryIdx, bot.manager?._gapSlots, action.id, action.newGridId, orderType);
+                                    if (!stampValid) {
+                                        stampUsable = false;
+                                        bot.manager.logger.log(`[LAST-FILL-GUARD] Stamped evacuation for ${action.id} -> ${action.newGridId} is stale under live ` +
+                                            `boundary ${bot.manager?.boundaryIdx}/gap ${bot.manager?._gapSlots} — re-proving live`, 'warn');
+                                    }
+                                }
+                                if (stampUsable) {
+                                    // Stamped-size re-proof: the stamp proved the
+                                    // plan-time size, but an unprocessed fill can
+                                    // land between plan-build and execution and
+                                    // shrink the booked remaining below the
+                                    // planned size (the PARTIAL-only growth guard
+                                    // above misses it when the slot is not yet
+                                    // PARTIAL). Re-prove against the LIVE master
+                                    // size; invalidating the stamp routes into
+                                    // the unstamped probe below, whose
+                                    // isEvacuationRotationAllowed also rejects
+                                    // growth and then falls through to the
+                                    // normal last-fill guard.
+                                    let stampPrecision = null;
+                                    try {
+                                        stampPrecision = getPrecisionByOrderType(bot.manager.assets, orderType);
+                                    }
+                                    catch {
+                                        stampPrecision = null;
+                                    }
+                                    if (!isEvacuationSizeStillValid(newSize, Number(masterOrder?.size), stampPrecision)) {
+                                        stampUsable = false;
+                                        bot.manager.logger.log(`[LAST-FILL-GUARD] Stamped evacuation for ${action.id} -> ${action.newGridId} lost its size cover: ` +
+                                            `planned ${Format.formatAmount(newSize)} exceeds booked remaining ${Format.formatAmount(Number(masterOrder?.size))} — re-proving live`, 'warn');
+                                    }
+                                }
+                                if (stampUsable) {
+                                    bypassedEvacuation = true;
+                                    bot.manager.logger.log(`[LAST-FILL-GUARD] Allowing ${orderType} evacuation UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ` +
+                                        `gap-evacuation stamped at plan-build (boundary ${frozenB}, gap ${frozenG})`, 'warn');
+                                }
+                                else {
+                                    // Unstamped: prove violation-reducing live. masterOrder was
+                                    // captured from the master grid before any rotation
+                                    // pre-application — it must NOT be re-read afterwards.
+                                    const oldPrice = Number(masterOrder?.price);
+                                    const oldSize = Number(masterOrder?.size);
+                                    if (!Number.isFinite(oldPrice) || !(oldPrice > 0) || !Number.isFinite(oldSize) || !(oldSize > 0)) {
+                                        lastFillGuardStats.checked++;
+                                        lastFillGuardStats.skipped++;
+                                        skippedUpdateCount++;
+                                        if (action.id)
+                                            skippedUpdateSlotIds.add(action.id);
+                                        if (action.newGridId)
+                                            skippedUpdateSlotIds.add(action.newGridId);
+                                        bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${orderType} UPDATE for ${action.id} -> ${action.newGridId}: ` +
+                                            `gap-evacuation source unresolvable from master grid (fail-closed)`, 'warn');
+                                        continue;
+                                    }
+                                    let sidePrecision = null;
+                                    try {
+                                        sidePrecision = getPrecisionByOrderType(bot.manager.assets, orderType);
+                                    }
+                                    catch {
+                                        sidePrecision = null;
+                                    }
+                                    // Geometry re-proof under the LIVE boundary: if the
+                                    // source is no longer in-band (or dest no longer rail),
+                                    // this is not an evacuation anymore — fall through to
+                                    // the normal guard instead of bypassing via the probe.
+                                    // Non-finite live geometry cannot disprove; probe proceeds.
+                                    if (isEvacuationStampStillValid(bot.manager?.boundaryIdx, bot.manager?._gapSlots, action.id, action.newGridId, orderType)) {
+                                        const evacCheck = isEvacuationRotationAllowed(oldPrice, oldSize, newPrice, newSize, orderType, sidePrecision);
+                                        if (evacCheck.allowed) {
+                                            bypassedEvacuation = true;
+                                            bot.manager.logger.log(`[LAST-FILL-GUARD] Allowing ${orderType} evacuation UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ` +
+                                                `${evacCheck.reason} (probed live: ${Format.formatPrice6(oldPrice)} -> ${Format.formatPrice6(newPrice)})`, 'warn');
+                                        }
+                                    }
+                                    else {
+                                        bot.manager.logger.log(`[LAST-FILL-GUARD] Unstamped evacuation probe for ${action.id} -> ${action.newGridId} rejected: ` +
+                                            `source/dest no longer evacuation geometry under live boundary ${bot.manager?.boundaryIdx}/gap ${bot.manager?._gapSlots} — normal guard applies`, 'warn');
+                                    }
+                                    // Not allowed: fall through to the normal guard below.
+                                }
                             }
-                            catch { /* best-effort */ }
-                            const lastPrice = bot.manager?._lastFilledPrice;
-                            const lastType = bot.manager?._lastFilledType;
-                            const inc = resolveLastFillGuardIncrement(bot);
-                            const check = isLastFillGuardBlocked(newPrice, newSize, orderType, lastPrice, lastType, inc);
-                            lastFillGuardStats.checked++;
-                            if (check.blocked) {
-                                lastFillGuardStats.skipped++;
-                                skippedUpdateCount++;
-                                if (action.id)
-                                    skippedUpdateSlotIds.add(action.id);
-                                if (action.newGridId)
-                                    skippedUpdateSlotIds.add(action.newGridId);
-                                const dir = orderType === ORDER_TYPES.BUY ? 'above' : 'below';
-                                bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${orderType} UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)})`, 'warn');
-                                continue;
+                            if (bypassedEvacuation) {
+                                lastFillGuardStats.bypassed++;
+                            }
+                            else {
+                                try {
+                                    if (refreshLastFillPivotFromQueue(bot))
+                                        lastFillGuardPivotRefreshed = true;
+                                }
+                                catch { /* best-effort */ }
+                                const lastPrice = bot.manager?._lastFilledPrice;
+                                const lastType = bot.manager?._lastFilledType;
+                                const inc = resolveLastFillGuardIncrement(bot);
+                                const check = isLastFillGuardBlocked(newPrice, newSize, orderType, lastPrice, lastType, inc);
+                                lastFillGuardStats.checked++;
+                                if (check.blocked) {
+                                    lastFillGuardStats.skipped++;
+                                    skippedUpdateCount++;
+                                    if (action.id)
+                                        skippedUpdateSlotIds.add(action.id);
+                                    if (action.newGridId)
+                                        skippedUpdateSlotIds.add(action.newGridId);
+                                    const dir = orderType === ORDER_TYPES.BUY ? 'above' : 'below';
+                                    bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${orderType} UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)})`, 'warn');
+                                    continue;
+                                }
+                                lastFillGuardStats.passed++;
                             }
-                            lastFillGuardStats.passed++;
                         }
                         catch (_e) { /* best-effort */ }
                         const { amountToSell, minToReceive } = buildCreateOrderArgs({ type: orderType, size: newSize, price: newPrice }, assetA, assetB);
@@ -2843,10 +3053,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                 // replaces — no crossing of an opposite-side
                                 // live order whose cancel is not already
                                 // queued at an earlier op position.
-                                const fbCrossed = findCrossedOrder(crossingCandidates, fbPrice, fbType, bot.manager.assets, (o) => {
-                                    const oid = o?.orderId || o?.chainOrderId;
-                                    return o && oid && !cancelOpIndexByOrderId.has(oid);
-                                });
+                                const fbCrossed = findCrossedOrder(crossingCandidates, fbPrice, fbType, bot.manager.assets, (o) => orderUtils.isCrossingCheckCandidate(o, null, cancelOpIndexByOrderId));
                                 if (fbCrossed) {
                                     bot.manager.logger.log(`[COW-CROSS-GUARD] Skipping CREATE fallback for ${targetSlotId} at ` +
                                         `${Format.formatPrice6(fbPrice)}: new ${fbType} crosses live ` +
@@ -3209,7 +3416,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         // refused-commit path: adopt from chain, keep pending
                         // protection if adoption is unavailable.
                         bot.manager.logger.log(`[COW][UNCERTAIN] Poll-confirmed commit refused; adopting placed orders from chain`, 'warn');
-                        const pollAdopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]');
+                        const pollAdopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds });
                         if (!pollAdopted) {
                             bot.manager.logger.log('[COW][UNCERTAIN] Poll-refused commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
                             await requestStructuralResync(bot, 'poll-confirmed commit refused (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
@@ -3229,7 +3436,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     // on a failed adoption would let the next cycle re-create the
                     // VIRTUAL slots as duplicate on-chain orders. Keep the
                     // protection and defer to a structural resync instead.
-                    const pollAdoptedOk = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]');
+                    const pollAdoptedOk = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds });
                     if (!pollAdoptedOk) {
                         bot.manager.logger.log('[COW][UNCERTAIN] Poll-confirmed commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
                         await requestStructuralResync(bot, 'poll-confirmed commit (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
@@ -3329,9 +3536,13 @@ async function requestStructuralResync(bot, reason, details = {}) {
  * @param {any} mgr - bot.manager
  * @param {any} placedResults - broadcast result (has operation_results); null when unavailable
  * @param {any[]} placedContexts - opContexts (aligned with operation_results); null when unavailable
+ * @param {string[]|null} [extraCreateIds=null] - fresh CREATE chain ids from another
+ *   authoritative source (e.g. the uncertain-broadcast poll confirmation) when
+ *   no broadcast result exists; merged into createIds so the lagging-create
+ *   retry guards them
  * @returns {string[]} Unique, well-formed 1.7.x order ids
  */
-function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts) {
+function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts, extraCreateIds = null) {
     const masterIds = new Set();
     const grid = mgr && mgr.grid;
     if (Array.isArray(grid)) {
@@ -3341,6 +3552,17 @@ function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts) {
             }
         }
     }
+    // Master tracked ids live in the orders Map (mgr.grid is legacy and
+    // unset on OrderManager — without this the by-id set omits every
+    // pre-existing ACTIVE order and pass-1 phantom cleanup would virtualize
+    // them as fills on a partial snapshot).
+    if (mgr && mgr.orders instanceof Map) {
+        for (const slot of mgr.orders.values()) {
+            if (slot && slot.orderId && /^1\.7\.\d+$/.test(String(slot.orderId))) {
+                masterIds.add(String(slot.orderId));
+            }
+        }
+    }
     const createIds = new Set();
     if (placedResults && Array.isArray(placedContexts)) {
         const opResults = extractBatchOperationResults(placedResults);
@@ -3356,6 +3578,33 @@ function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts) {
             }
         }
     }
+    if (Array.isArray(extraCreateIds)) {
+        for (const id of extraCreateIds) {
+            if (id && /^1\.7\.\d+$/.test(String(id)))
+                createIds.add(String(id));
+        }
+    }
+    // Existing chain ids referenced by non-create op contexts (cancel /
+    // rotation / size-update). Pre-existing orders whose absence is expected
+    // (cancels/fills in this batch), so they join the by-id set but never
+    // the lagging-create guard.
+    if (Array.isArray(placedContexts)) {
+        for (const ctx of placedContexts) {
+            if (!ctx || ctx.kind === 'create')
+                continue;
+            const refs = [];
+            if (ctx.kind === 'cancel' && ctx.order)
+                refs.push(ctx.order.orderId);
+            else if (ctx.kind === 'rotation' && ctx.rotation?.oldOrder)
+                refs.push(ctx.rotation.oldOrder.orderId);
+            else if (ctx.kind === 'size-update' && ctx.updateInfo?.partialOrder)
+                refs.push(ctx.updateInfo.partialOrder.orderId);
+            for (const id of refs) {
+                if (id && /^1\.7\.\d+$/.test(String(id)))
+                    masterIds.add(String(id));
+            }
+        }
+    }
     const all = new Set([...masterIds, ...createIds]);
     return { masterIds: [...masterIds], createIds: [...createIds], all: [...all] };
 }
@@ -3382,6 +3631,10 @@ function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts) {
  * @param {Object} [opts]
  * @param {any} [opts.placedResults] - broadcast result carrying operation_results
  * @param {any[]} [opts.placedContexts] - opContexts aligned with operation_results
+ * @param {string[]} [opts.polledCreateIds] - fresh CREATE chain ids confirmed by
+ *   the uncertain-broadcast poll (no broadcast result exists on that path);
+ *   routes the poll call sites through the by-id path with its lagging-create
+ *   retry instead of the unguarded window fallback
  * @returns {Promise<boolean>} true if master was adopted from the chain
  */
 /**
@@ -3414,16 +3667,20 @@ async function restoreBoundaryAfterAdoption(bot, workingBoundary) {
     }
 }
 async function adoptPlacedBatchFromChain(bot, chainOrders, logPrefix, opts = {}) {
-    const { placedResults = null, placedContexts = null } = opts || {};
+    const { placedResults = null, placedContexts = null, polledCreateIds = null } = opts || {};
     try {
         const mgr = bot.manager;
         const accountRef = bot.accountId || bot.account?.id || bot.account;
-        // PREFERRED: re-read the exact placed/existing orders by id. Only when we
-        // have the broadcast result (so the set includes the freshest CREATE ids);
-        // without it the by-id set would be incomplete and would wrongly sync
-        // master against a partial picture.
-        const { all: knownIds, createIds } = placedResults
-            ? collectKnownOnChainOrderIds(mgr, placedResults, placedContexts)
+        // PREFERRED: re-read the exact placed/existing orders by id. The by-id
+        // set needs the broadcast result (freshest CREATE ids), the
+        // poll-confirmed CREATE ids, or at minimum the contexts referencing
+        // existing chain orders — without any id hints the set would be
+        // incomplete and would wrongly sync master against a partial picture.
+        const haveIdHints = Boolean(placedResults)
+            || (Array.isArray(placedContexts) && placedContexts.length > 0)
+            || (Array.isArray(polledCreateIds) && polledCreateIds.length > 0);
+        const { all: knownIds, createIds } = haveIdHints
+            ? collectKnownOnChainOrderIds(mgr, placedResults, placedContexts, polledCreateIds)
             : { all: [], createIds: [] };
         if (knownIds.length > 0 && typeof chainOrders.batchReadOrders === 'function') {
             // Retry/backoff (fix #6): a fresh CREATE absent from the first read