dexbot 1.5.2 → 1.6.0

package/dist/modules/dexbot_cow_runtime.js

@@ -14,11 +14,12 @@ import { BroadcastUncertainError as BroadcastUncertainErrorBinding } from './dex
 const BroadcastUncertainError = BroadcastUncertainErrorBinding;
 import * as orderUtils from './order/utils/order.js';
 import { sleep } from './order/utils/system.js';
-const { buildCreateOrderArgs, buildCreateOpFingerprint, extractBatchOperationResults, formatUnmatchedChainOrder, convertToSpreadPlaceholder, toRailHolePlaceholder, buildOutsideInPairGroups, isOrderPlaced, } = orderUtils;
+const { buildCreateOrderArgs, buildCreateOpFingerprint, extractBatchOperationResults, formatUnmatchedChainOrder, convertToSpreadPlaceholder, toRailHolePlaceholder, buildOutsideInPairGroups, isOrderPlaced, chainOrderUnchangedFromCache, detectCrossedBookPlan, collectKnownOnChainOrderIds, } = orderUtils;
 import * as validate from './order/utils/validate.js';
 const { validateCreateTargetSlots, evaluateCommit, hasExecutableActions, stampGapEvacuationRotation } = validate;
 import * as math from './order/utils/math.js';
-const { validateOrderSize, findCrossedOrder, priceSlotEqual, isEvacuationRotationAllowed, isEvacuationSizeStillValid, getSellStartIdx, getPrecisionByOrderType, isSlotIndexInGapBand } = math;
+const { validateOrderSize, findCrossedOrder, priceSlotEqual, isEvacuationRotationAllowed, isEvacuationSizeStillValid, getSellStartIdx, getPrecisionByOrderType, isSlotIndexInGapBand, getAssetFeesSafe, blockchainToFloat, floatToBlockchainInt, quantizeFloat } = math;
+import { parseSlotIndex } from './order/utils/slot.js';
 /**
  * Re-verify a B-stamped gap-evacuation rotation against the LIVE committed
  * geometry (boundaryIdx/_gapSlots at execution time). The stamp freezes
@@ -48,7 +49,6 @@ export function isEvacuationStampStillValid(liveBoundary, liveGapSlots, sourceId
     const dstInRail = orderType === ORDER_TYPES.SELL ? Number(dstIdx) >= sellStartIdx : Number(dstIdx) <= b;
     return dstInRail;
 }
-import { parseSlotIndex } from './order/utils/slot.js';
 function hasSlotPriceCollision(items, targetPrice, precision, excludeId, predicate) {
     for (const it of items) {
         if (predicate && !predicate(it))
@@ -69,8 +69,6 @@ function hasSlotPriceCollision(items, targetPrice, precision, excludeId, predica
     }
     return null;
 }
-// Lazy accessor so test mocks on the math module export take effect at call time.
-function getAssetFeesSafe(...args) { return require('./order/utils/math').getAssetFeesSafe(...args); }
 import * as constantsModule from './constants.js';
 const { COW_ACTIONS, COW_PERFORMANCE, ORDER_STATES, ORDER_TYPES, REBALANCE_STATES, } = constantsModule;
 import { acquireIfNotHeld } from './order/async_lock.js';
@@ -79,8 +77,6 @@ const Format = FormatModule;
 import * as workingGridModule from './order/working_grid.js';
 const { WorkingGrid } = workingGridModule;
 import { getErrorMessage } from './utils/errors.js';
-import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
 // Maximum number of times the pre-broadcast staleness guard may re-plan the
 // batch from a fresh master before proceeding anyway. Bounded so a master
 // grid that keeps mutating (fill bursts, sync loops) can never livelock the
@@ -99,11 +95,7 @@ const SINGLE_FLIGHT_MAX_WAIT_MS = 120000;
  * @returns {Array<Array>}
  */
 function buildOutsideInPairGroupsForOrders(orders) {
-    return buildOutsideInPairGroups(orders, {
-        isValid: Boolean,
-        getType: (o) => o.type,
-        getPrice: (o) => o.price,
-    });
+    return buildOutsideInPairGroupsWithAdapter(orders, (o) => o);
 }
 /**
  * Build outside-in pair groups for create entry contexts.
@@ -111,12 +103,128 @@ function buildOutsideInPairGroupsForOrders(orders) {
  * @returns {Array<Array>}
  */
 function buildOutsideInPairGroupsForCreateEntries(createEntries) {
-    return buildOutsideInPairGroups(createEntries, {
-        isValid: (e) => Boolean(e?.context?.order),
-        getType: (e) => e.context.order.type,
-        getPrice: (e) => e.context.order.price,
+    return buildOutsideInPairGroupsWithAdapter(createEntries, (e) => e?.context?.order);
+}
+/**
+ * Shared outside-in delegation: project each item to its order, then group
+ * with the single order adapter. The ForOrders/ForCreateEntries wrappers
+ * differ only in this projection.
+ * @param {Array} items
+ * @param {Function} toOrder - Project an item to its order object
+ * @returns {Array<Array>}
+ */
+function buildOutsideInPairGroupsWithAdapter(items, toOrder) {
+    return buildOutsideInPairGroups(items, {
+        isValid: (item) => Boolean(toOrder(item)),
+        getType: (item) => toOrder(item)?.type,
+        getPrice: (item) => toOrder(item)?.price,
+    });
+}
+/**
+ * Create a create-op fingerprint for a specific slot, used for
+ * pending-broadcast matching and chain-order fingerprinting.
+ * Consolidates the fingerprint construction pattern found in
+ * recordPendingBroadcast, buildChainOrderFingerprint, findChainOrderForSlot,
+ * and verifyCreateAbsent.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Object} order - The order object
+ * @param {Object} finalInts - The final integer tuple { sell, receive, sellAssetId, receiveAssetId }
+ * @param {string} slotId - The slot identifier
+ * @returns {string|null}
+ */
+function createOpFingerprintForSlot(bot, order, finalInts, slotId) {
+    if (!order || !finalInts || !slotId)
+        return null;
+    return buildCreateOpFingerprint({
+        side: order.type,
+        assetA: bot.manager?.assets?.assetA?.id,
+        assetB: bot.manager?.assets?.assetB?.id,
+        sellInt: finalInts.sell,
+        receiveInt: finalInts.receive,
+        slotId,
+    });
+}
+/**
+ * Read the pending-broadcast entries as an array. The manager map is
+ * created lazily by recordPendingBroadcast, so every reader must guard
+ * on `instanceof Map` — this helper is the single spelling of that guard.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @returns {Array}
+ */
+function getPendingBroadcasts(bot) {
+    return (bot.manager && bot.manager._pendingBroadcasts instanceof Map)
+        ? Array.from(bot.manager._pendingBroadcasts.values())
+        : [];
+}
+/**
+ * Count pending-broadcast entries without materializing the array.
+ * Same instanceof Map guard as getPendingBroadcasts, for hot paths that
+ * only need the count (e.g. the orphan auto-cancel gate).
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @returns {number}
+ */
+function countPendingBroadcasts(bot) {
+    return (bot.manager && bot.manager._pendingBroadcasts instanceof Map)
+        ? bot.manager._pendingBroadcasts.size
+        : 0;
+}
+/**
+ * Probe the chain snapshot for a pending-broadcast entry's slot.
+ * Single spelling of the findChainOrderForSlot probe literal used by
+ * reconcile (first pass + re-read), the poll confirmer, and the
+ * create-absence verifier.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Array} chainSnapshot
+ * @param {Object} entry - Pending entry ({ slotId, finalInts, orderType, fingerprint })
+ * @returns {Object|null}
+ */
+function findChainOrderForPendingEntry(bot, chainSnapshot, entry) {
+    if (!entry?.slotId)
+        return null;
+    return findChainOrderForSlot(bot, chainSnapshot, entry.slotId, {
+        sell: entry.finalInts?.sell,
+        receive: entry.finalInts?.receive,
+        orderType: entry.orderType,
+        fingerprint: entry.fingerprint,
     });
 }
+/**
+ * Check whether a chain read is authoritative enough to make
+ * definitive absence/lPresence decisions. An authoritative read is
+ * non-empty, non-truncated, and non-null.
+ * @param {Object} readResult - The result of readOpenOrdersWithMeta
+ * @returns {boolean}
+ */
+function isAuthoritativeChainRead(readResult) {
+    if (!readResult || !Array.isArray(readResult.orders))
+        return false;
+    if (readResult.truncated)
+        return false;
+    return readResult.orders.length > 0;
+}
+/**
+ * Build a rawOnChain metadata object from final integer values.
+ * Used in processBatchResults for size-update, create, and rotation
+ * contexts to enrich order objects with on-chain identity.
+ * Returns null when the order id (or final ints) is missing: downstream
+ * chainOrderUnchangedFromCache treats a null cache as "not unchanged" and
+ * defers, which is the safer direction versus comparing an id-less object.
+ * @param {string} orderId - The on-chain order id
+ * @param {Object} finalInts - The final integer tuple
+ * @returns {Object|null}
+ */
+function rawOnChainFromInts(orderId, finalInts) {
+    if (!orderId || !finalInts)
+        return null;
+    return {
+        id: orderId,
+        for_sale: String(finalInts.sell),
+        sell_price: {
+            base: { amount: String(finalInts.sell), asset_id: finalInts.sellAssetId },
+            quote: { amount: String(finalInts.receive), asset_id: finalInts.receiveAssetId },
+        },
+    };
+}
 /**
  * Extract operation results from a batch transaction result.
  * @param {Object|Array|null} result
@@ -222,14 +330,7 @@ function recordPendingBroadcast(bot, entry) {
     if (!bot.manager._pendingBroadcasts || !(bot.manager._pendingBroadcasts instanceof Map)) {
         bot.manager._pendingBroadcasts = new Map();
     }
-    const fingerprint = buildCreateOpFingerprint({
-        side: entry.order.type,
-        assetA: bot.manager?.assets?.assetA?.id,
-        assetB: bot.manager?.assets?.assetB?.id,
-        sellInt: entry.finalInts?.sell,
-        receiveInt: entry.finalInts?.receive,
-        slotId: entry.order.id
-    });
+    const fingerprint = createOpFingerprintForSlot(bot, entry.order, entry.finalInts, entry.order.id);
     if (!fingerprint) {
         bot.manager.logger.log?.(`[COW] Skipped pending-broadcast record: could not build fingerprint for ${entry.order?.id || 'unknown'}`, 'warn');
         return;
@@ -510,72 +611,24 @@ async function reconcileAfterUncertainBroadcast(bot, err, opContexts, options =
     return acquireIfNotHeld(bot.manager?._fillProcessingLock, () => reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, options));
 }
 /**
- * Reconcile a broadcast whose chain state is unknown (implementation).
+ * Match pending broadcasts against a chain snapshot (first pass by slot
+ * probe, second pass by fingerprint across all pending slots), then
+ * re-read the chain for discarded CREATEs to close the TOCTOU window.
+ * Returns `{ adopted, discarded }`, or `{ deferred }` when the re-read
+ * is ambiguous/failed and the caller must defer (pending protection kept).
  * @param {import('./dexbot_class.js').DEXBot} bot
- * @param {BroadcastUncertainError} err
- * @param {Array<Object>} opContexts
- * @param {Object} options
- * @returns {Promise<Object>}
+ * @param {Array} pending
+ * @param {Array} chainSnapshot
+ * @param {Array} opContexts
+ * @param {*} accountRef
+ * @param {*} err
  */
-async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _options) {
-    const startedAt = Date.now();
-    const pending = (bot.manager && bot.manager._pendingBroadcasts instanceof Map)
-        ? Array.from(bot.manager._pendingBroadcasts.values())
-        : [];
-    const createContextCount = opContexts.filter((c) => c && c.kind === 'create').length;
-    const nonCreateContextCount = opContexts.length - createContextCount;
-    bot.manager.logger.log(`[COW][UNCERTAIN] batchId=${err?.batchId || 'n/a'} ops=${opContexts.length} ` +
-        `creates=${createContextCount} nonCreates=${nonCreateContextCount} ` +
-        `staleSinceMs=${err?.timeoutMs || 'n/a'}. Entering reconcile-then-decide.`, 'warn');
-    if (!chainOrders?.readOpenOrdersWithMeta) {
-        bot.manager.logger.log('[COW][UNCERTAIN] readOpenOrdersWithMeta unavailable; falling back to structural resync only.', 'error');
-        if (typeof bot.manager.requestStructuralGridResync === 'function') {
-            await bot.manager.requestStructuralGridResync('broadcast uncertain — readOpenOrders unavailable', { batchId: err?.batchId || null });
-        }
-        clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
-        return { executed: false, hadRotation: false, uncertain: true };
-    }
-    // 1. Read the chain
-    const accountRef = bot.accountId || bot.account?.id || bot.account;
-    let chainSnapshot = [];
-    let chainReadTruncated = false;
-    try {
-        const chainRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
-        chainSnapshot = chainRead.orders;
-        chainReadTruncated = chainRead.truncated;
-    }
-    catch (readErr) {
-        bot.manager.logger.log(`[COW][UNCERTAIN] readOpenOrders failed: ${readErr?.message || readErr}. ` +
-            `Falling back to structural resync.`, 'error');
-        if (typeof bot.manager.requestStructuralGridResync === 'function') {
-            await bot.manager.requestStructuralGridResync('broadcast uncertain — readOpenOrders failed', { batchId: err?.batchId || null, error: readErr?.message || String(readErr) });
-        }
-        clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
-        return { executed: false, hadRotation: false, uncertain: true };
-    }
-    // 1.5. Empty/truncated-read guard: an empty snapshot is ambiguous — the
-    // account is either genuinely empty or the node is lagging behind the
-    // just-broadcast transaction. A truncated snapshot (get_full_accounts
-    // capped limit_orders; fresh creates sort last in the by_account index
-    // and are the first entries omitted) is equally ambiguous: the batch's
-    // creates may simply be missing from the returned window. Treating every
-    // pending broadcast as discarded would clear the pending-broadcast
-    // protection and let the next cycle re-CREATE slots whose orders may
-    // actually be on chain (duplicate orders). Keep the protection and let
-    // the structural resync adopt any landed orders.
-    if (pending.length > 0 && (chainSnapshot.length === 0 || chainReadTruncated)) {
-        return await deferUncertainBroadcastRead(bot, `${chainSnapshot.length === 0 ? 'Empty' : 'Truncated'} chain read for ${pending.length} pending broadcast(s)`, '(node may be lagging or the result set capped; no discard decisions made)', 'uncertain broadcast — empty/truncated chain read', { batchId: err?.batchId || null, truncated: chainReadTruncated });
-    }
+async function matchPendingToChain(bot, pending, chainSnapshot, opContexts, accountRef, err) {
     const adopted = [];
     let discarded = [];
     // 2. For each pending broadcast, look for a chain match.
     for (const entry of pending) {
-        const match = findChainOrderForSlot(bot, chainSnapshot, entry.slotId, {
-            sell: entry.finalInts?.sell,
-            receive: entry.finalInts?.receive,
-            orderType: entry.orderType,
-            fingerprint: entry.fingerprint,
-        });
+        const match = findChainOrderForPendingEntry(bot, chainSnapshot, entry);
         if (match) {
             adopted.push({ entry, match });
         }
@@ -624,21 +677,18 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                 // protection and let the next cycle re-create (duplicate) an
                 // order that actually landed in the TOCTOU window. Keep the
                 // pending-broadcast protection and defer to a structural resync.
-                if (!freshRead || freshRead.truncated || !Array.isArray(freshRead.orders) || freshRead.orders.length === 0) {
+                if (!isAuthoritativeChainRead(freshRead)) {
                     const ambiguous = !freshRead || !Array.isArray(freshRead.orders) || freshRead.orders.length === 0;
-                    return await deferUncertainBroadcastRead(bot, `${ambiguous ? 'Empty' : 'Truncated'} re-read for ${createDiscarded.length} discarded CREATE(s)`, '(absence is not authoritative on an ambiguous re-read)', 'uncertain broadcast — ambiguous re-read for discarded creates', { batchId: err?.batchId || null, truncated: !ambiguous });
+                    return {
+                        deferred: await deferUncertainBroadcastRead(bot, `${ambiguous ? 'Empty' : 'Truncated'} re-read for ${createDiscarded.length} discarded CREATE(s)`, '(absence is not authoritative on an ambiguous re-read)', 'uncertain broadcast — ambiguous re-read for discarded creates', { batchId: err?.batchId || null, truncated: !ambiguous })
+                    };
                 }
                 const freshChain = freshRead.orders;
                 const remainingDiscarded = [];
                 for (const entry of discarded) {
                     const ctx = opContexts[entry.ctxIndex];
                     if (ctx && ctx.kind === 'create') {
-                        const match = findChainOrderForSlot(bot, freshChain, entry.slotId, {
-                            sell: entry.finalInts?.sell,
-                            receive: entry.finalInts?.receive,
-                            orderType: entry.orderType,
-                            fingerprint: entry.fingerprint,
-                        });
+                        const match = findChainOrderForPendingEntry(bot, freshChain, entry);
                         if (match) {
                             adopted.push({ entry, match });
                             bot.manager.logger.log(`[COW][UNCERTAIN] Late-adopted discarded CREATE for slot ${entry.slotId} (${match.id}) via fresh chain read`, 'info');
@@ -654,13 +704,24 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                 discarded = remainingDiscarded;
             }
             catch (reReadErr) {
-                return await deferUncertainBroadcastRead(bot, `Fresh chain read for late adoption FAILED (${getErrorMessage(reReadErr)})`, '(absence is not authoritative on a failed re-read)', 'uncertain broadcast — failed re-read for discarded creates', { batchId: err?.batchId || null });
+                return {
+                    deferred: await deferUncertainBroadcastRead(bot, `Fresh chain read for late adoption FAILED (${getErrorMessage(reReadErr)})`, '(absence is not authoritative on a failed re-read)', 'uncertain broadcast — failed re-read for discarded creates', { batchId: err?.batchId || null })
+                };
             }
         }
     }
-    // 3b. Apply decisions
+    return { adopted, discarded };
+}
+/**
+ * Adopt matched pending broadcasts into the master grid (CREATE slots
+ * synchronize with the chain) and clear their pending entries.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Array} adopted
+ * @param {Array} opContexts
+ * @returns {Promise<number>} adoptedCount
+ */
+async function adoptMatchedEntries(bot, adopted, opContexts) {
     let adoptedCount = 0;
-    let discardedCount = 0;
     for (const { entry, match } of adopted) {
         adoptedCount++;
         const plannedOpCtx = opContexts[entry.ctxIndex];
@@ -674,6 +735,7 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                     chainOrderId,
                     expectedType,
                     fee: btsFeeData?.createFee || 0,
+                    order: plannedOpCtx.order ?? entry.order ?? null,
                 }, 'createOrder');
             }
             catch (syncErr) {
@@ -685,6 +747,19 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
             bot.manager._pendingBroadcasts.delete(entry.fingerprint);
         }
     }
+    return adoptedCount;
+}
+/**
+ * Restore discarded CREATE slots to creation-uncertain state and clear
+ * their pending entries; residual pending entries that survive the
+ * decide phase are cleaned defensively.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Array} discarded
+ * @param {Array} opContexts
+ * @returns {Promise<number>} discardedCount
+ */
+async function restoreDiscardedCreates(bot, discarded, opContexts) {
+    let discardedCount = 0;
     for (const entry of discarded) {
         discardedCount++;
         const plannedOpCtx = opContexts[entry.ctxIndex];
@@ -761,12 +836,48 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
                             }
                         }
                     }
+                    else {
+                        // Slot missing from master (grid reset raced the uncertain
+                        // broadcast). Deleting the pending entry below without
+                        // restoring anything would leave a clean hole the next
+                        // cycle re-CREATEs — duplicating a possibly-landed order.
+                        // Materialize the creation-uncertain slot from the
+                        // broadcast-time descriptor so the next sync's orphan
+                        // adoption reconciles a landed order into it.
+                        const missingType = entry.order.type;
+                        if (missingType === ORDER_TYPES.BUY || missingType === ORDER_TYPES.SELL) {
+                            bot.manager.logger.log(`[COW][UNCERTAIN] Slot ${entry.order.id} missing from master after discard — materializing creation-uncertain state ` +
+                                `(type=${missingType}, size: ${entry.order.size}); next sync adoption will reconcile any landed order`, 'warn');
+                            const updates = [{
+                                    id: entry.order.id,
+                                    type: missingType,
+                                    size: entry.order.size,
+                                    price: entry.order.price,
+                                    state: ORDER_STATES.VIRTUAL,
+                                    createUncertain: true,
+                                    orderId: null,
+                                    rawOnChain: null,
+                                }];
+                            if (typeof bot.manager.applyGridUpdateBatch === 'function') {
+                                await bot.manager.applyGridUpdateBatch(updates, 'uncertain-broadcast-discard-restore');
+                            }
+                        }
+                        else {
+                            bot.manager.logger.log(`[COW][UNCERTAIN] Slot ${entry.order.id} missing from master after discard with unrecognized type ${missingType} — cannot reconstruct creation-uncertain state; next sync must adopt any landed order as an orphan`, 'error');
+                        }
+                    }
+                }
+                else {
+                    bot.manager.logger.log(`[COW][UNCERTAIN] Discarded CREATE for slot ${entry.slotId} has no usable placement descriptor (id=${entry.order?.id ?? 'none'}, size=${entry.order?.size ?? 'none'}, type=${entry.order?.type ?? 'none'}) — nothing restored; next sync must adopt any landed order as an orphan`, 'error');
                 }
             }
             catch (restoreErr) {
                 bot.manager.logger.log(`[COW][UNCERTAIN] Failed to restore slot ${entry.slotId} after discard: ${restoreErr?.message || restoreErr}`, 'error');
             }
         }
+        else {
+            bot.manager.logger.log(`[COW][UNCERTAIN] Discarded pending broadcast for slot ${entry.slotId} is not a recognizable CREATE (no create opContext, no order id/type) — skipping restore; next sync must adopt any landed order as an orphan`, 'error');
+        }
         // Remove from pending broadcasts.
         if (entry.fingerprint && bot.manager._pendingBroadcasts?.has(entry.fingerprint)) {
             bot.manager._pendingBroadcasts.delete(entry.fingerprint);
@@ -786,6 +897,101 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
         }
         bot.manager._pendingBroadcasts.clear();
     }
+    return discardedCount;
+}
+/**
+ * Request a structural resync when chain orders remain unaccounted for
+ * after the uncertain-broadcast reconciliation.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {*} err
+ * @param {Array} pending
+ * @param {Array} chainSnapshot
+ * @param {Array} adopted
+ * @param {number} adoptedCount
+ * @param {number} discardedCount
+ */
+async function resyncIfUnreconciled(bot, err, pending, chainSnapshot, adopted, adoptedCount, discardedCount) {
+    // 7. Request structural resync if any chain orders remain unaccounted for
+    // after the reconciliation, ensuring the next cycle re-plans from a clean
+    // chain snapshot.
+    const alreadyScheduled = bot._structuralGridResyncRunning || bot._structuralGridResyncTimer;
+    if (!alreadyScheduled && chainSnapshot.length > 0) {
+        const reconciledOrderIds = new Set(adopted.map((a) => a.match?.id).filter(Boolean));
+        const unreconciledCount = chainSnapshot.filter((o) => !reconciledOrderIds.has(o.id)).length;
+        if (unreconciledCount > 0) {
+            bot.manager.logger.log(`[COW][UNCERTAIN] ${unreconciledCount} chain order(s) remain unreconciled after uncertain broadcast recovery. ` +
+                `These may be legitimate pre-existing orders or leftovers from a prior cycle. Requesting structural resync.`, 'warn');
+            await requestStructuralResync(bot, 'unreconciled orders after uncertain broadcast', {
+                batchId: err?.batchId || null,
+                pendingCount: pending.length,
+                adoptedCount,
+                discardedCount,
+                unreconciledCount
+            });
+        }
+    }
+}
+/**
+ * Reconcile a broadcast whose chain state is unknown (implementation).
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {BroadcastUncertainError} err
+ * @param {Array<Object>} opContexts
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _options) {
+    const startedAt = Date.now();
+    const pending = getPendingBroadcasts(bot);
+    const createContextCount = opContexts.filter((c) => c && c.kind === 'create').length;
+    const nonCreateContextCount = opContexts.length - createContextCount;
+    bot.manager.logger.log(`[COW][UNCERTAIN] batchId=${err?.batchId || 'n/a'} ops=${opContexts.length} ` +
+        `creates=${createContextCount} nonCreates=${nonCreateContextCount} ` +
+        `staleSinceMs=${err?.timeoutMs || 'n/a'}. Entering reconcile-then-decide.`, 'warn');
+    if (!chainOrders?.readOpenOrdersWithMeta) {
+        bot.manager.logger.log('[COW][UNCERTAIN] readOpenOrdersWithMeta unavailable; falling back to structural resync only.', 'error');
+        await requestStructuralResync(bot, 'broadcast uncertain — readOpenOrders unavailable', { batchId: err?.batchId || null });
+        clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
+        return { executed: false, hadRotation: false, uncertain: true };
+    }
+    // 1. Read the chain
+    const accountRef = bot.accountId || bot.account?.id || bot.account;
+    let chainSnapshot = [];
+    let chainReadTruncated = false;
+    try {
+        const chainRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
+        chainSnapshot = chainRead.orders;
+        chainReadTruncated = chainRead.truncated;
+    }
+    catch (readErr) {
+        bot.manager.logger.log(`[COW][UNCERTAIN] readOpenOrders failed: ${readErr?.message || readErr}. ` +
+            `Falling back to structural resync.`, 'error');
+        await requestStructuralResync(bot, 'broadcast uncertain — readOpenOrders failed', { batchId: err?.batchId || null, error: readErr?.message || String(readErr) });
+        clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
+        return { executed: false, hadRotation: false, uncertain: true };
+    }
+    // 1.5. Empty/truncated-read guard: an empty snapshot is ambiguous — the
+    // account is either genuinely empty or the node is lagging behind the
+    // just-broadcast transaction. A truncated snapshot (get_full_accounts
+    // capped limit_orders; fresh creates sort last in the by_account index
+    // and are the first entries omitted) is equally ambiguous: the batch's
+    // creates may simply be missing from the returned window. Treating every
+    // pending broadcast as discarded would clear the pending-broadcast
+    // protection and let the next cycle re-CREATE slots whose orders may
+    // actually be on chain (duplicate orders). Keep the protection and let
+    // the structural resync adopt any landed orders.
+    if (pending.length > 0 && (chainSnapshot.length === 0 || chainReadTruncated)) {
+        return await deferUncertainBroadcastRead(bot, `${chainSnapshot.length === 0 ? 'Empty' : 'Truncated'} chain read for ${pending.length} pending broadcast(s)`, '(node may be lagging or the result set capped; no discard decisions made)', 'uncertain broadcast — empty/truncated chain read', { batchId: err?.batchId || null, truncated: chainReadTruncated });
+    }
+    // 2-3a. Match pending broadcasts to the chain: slot probe, fingerprint
+    // second pass, and a TOCTOU re-read for discarded CREATEs (see
+    // matchPendingToChain). A deferred re-read returns its result directly.
+    const matched = await matchPendingToChain(bot, pending, chainSnapshot, opContexts, accountRef, err);
+    if (matched.deferred)
+        return matched.deferred;
+    const { adopted, discarded } = matched;
+    // 3b. Apply decisions
+    const adoptedCount = await adoptMatchedEntries(bot, adopted, opContexts);
+    let discardedCount = await restoreDiscardedCreates(bot, discarded, opContexts);
     // 5. Log structured summary
     const elapsed = Date.now() - startedAt;
     bot.manager.logger.log(`[COW][UNCERTAIN] Reconciled: ${adoptedCount} adopted, ${discardedCount} discarded ` +
@@ -805,27 +1011,7 @@ async function reconcileAfterUncertainBroadcastImpl(bot, err, opContexts, _optio
     // 7. Request structural resync if any chain orders remain unaccounted for
     // after the reconciliation, ensuring the next cycle re-plans from a clean
     // chain snapshot.
-    const alreadyScheduled = bot._structuralGridResyncRunning || bot._structuralGridResyncTimer;
-    if (!alreadyScheduled && chainSnapshot.length > 0) {
-        const reconciledOrderIds = new Set(adopted.map((a) => a.match?.id).filter(Boolean));
-        const unreconciledCount = chainSnapshot.filter((o) => !reconciledOrderIds.has(o.id)).length;
-        if (unreconciledCount > 0) {
-            bot.manager.logger.log(`[COW][UNCERTAIN] ${unreconciledCount} chain order(s) remain unreconciled after uncertain broadcast recovery. ` +
-                `These may be legitimate pre-existing orders or leftovers from a prior cycle. Requesting structural resync.`, 'warn');
-            if (typeof bot.manager.requestStructuralGridResync === 'function') {
-                await bot.manager.requestStructuralGridResync('unreconciled orders after uncertain broadcast', {
-                    batchId: err?.batchId || null,
-                    pendingCount: pending.length,
-                    adoptedCount,
-                    discardedCount,
-                    unreconciledCount
-                });
-            }
-            else {
-                bot._warn?.('[COW][UNCERTAIN] requestStructuralGridResync unavailable; cannot schedule structural resync.');
-            }
-        }
-    }
+    await resyncIfUnreconciled(bot, err, pending, chainSnapshot, adopted, adoptedCount, discardedCount);
     return { executed: false, hadRotation: false, uncertain: true, adoptedCount, discardedCount };
 }
 /**
@@ -846,9 +1032,7 @@ async function autoCancelOneUnmatchedOrphan(bot) {
         bot._autoCancelOrphanCycleMarker = cycleId;
         bot._autoCancelOrphanSubCount = 0;
     }
-    const pending = (bot.manager && bot.manager._pendingBroadcasts instanceof Map)
-        ? bot.manager._pendingBroadcasts.size
-        : 0;
+    const pending = countPendingBroadcasts(bot);
     if (pending > 0) {
         return { cancelled: false, reason: 'pending-broadcasts-active' };
     }
@@ -864,7 +1048,7 @@ async function autoCancelOneUnmatchedOrphan(bot) {
     }
     const target = unmatched.find((u) => u && u.reason === 'price-drift-orphan');
     if (!target) {
-        return { cancelled: false, reason: 'no-price-drift-orphan', message: 'no price-drift orphan to cancel; other unmatched orders are adoptable' };
+        return { cancelled: false, reason: 'no-price-drift-orphan', message: 'no price-drift orphan to cancel; remaining unmatched orders need no cancellation (adoptable or deferred holds)' };
     }
     const orderId = target.id || target.orderId || target.chainOrderId;
     if (!orderId) {
@@ -945,14 +1129,7 @@ function verifyCreateAbsent(bot, freshChain, ctx) {
         sell: ctx.finalInts.sell,
         receive: ctx.finalInts.receive,
         orderType: ctx.order.type,
-        fingerprint: buildCreateOpFingerprint({
-            side: ctx.order.type,
-            assetA: bot.manager?.assets?.assetA?.id,
-            assetB: bot.manager?.assets?.assetB?.id,
-            sellInt: ctx.finalInts.sell,
-            receiveInt: ctx.finalInts.receive,
-            slotId: ctx.order.id
-        })
+        fingerprint: createOpFingerprintForSlot(bot, ctx.order, ctx.finalInts, ctx.order.id)
     });
     return match ? 'landed' : 'absent';
 }
@@ -1033,7 +1210,11 @@ async function executeWithRetryOnUncertain(bot, operations, opContexts) {
                     const accountRef = bot.accountId || bot.account?.id || bot.account;
                     const freshRead = await chainOrders.readOpenOrdersWithMeta(accountRef);
                     const freshChain = freshRead.orders;
-                    if (Array.isArray(freshChain) && freshChain.length > 0) {
+                    // A truncated read (get_full_accounts caps limit_orders, and
+                    // fresh creates sort last in the by_account index) omits the
+                    // very orders this batch may have landed — 'absent' is not
+                    // authoritative here, degrade to 'unknown' and defer.
+                    if (isAuthoritativeChainRead(freshRead)) {
                         absence = 'absent';
                         for (const ctx of opContexts) {
                             if (!ctx)
@@ -1045,13 +1226,6 @@ async function executeWithRetryOnUncertain(bot, operations, opContexts) {
                             }
                         }
                     }
-                    // A truncated read (get_full_accounts caps limit_orders, and
-                    // fresh creates sort last in the by_account index) omits the
-                    // very orders this batch may have landed — 'absent' is not
-                    // authoritative here, degrade to 'unknown' and defer.
-                    if (freshRead.truncated && absence === 'absent') {
-                        absence = 'unknown';
-                    }
                 }
                 catch (verifyErr) {
                     bot.manager.logger.log(`[COW] Pre-retry chain verification failed (non-fatal): ${verifyErr?.message || verifyErr}`, 'warn');
@@ -1085,31 +1259,6 @@ async function executeWithRetryOnUncertain(bot, operations, opContexts) {
         }
     }
 }
-/**
- * Whether a chain order still matches the cached pre-update state the
- * limit_order_update delta was built from. Only a provably-unchanged order
- * makes a re-broadcast of the identical delta safe (it applies to the same
- * base). Any other state (target applied, filled, resized) must defer.
- * @param {Object} chainOrder - Raw chain order object (get_full_accounts)
- * @param {Object|null} cachedRaw - The rawOnChain cache captured at build time
- * @returns {boolean}
- */
-function chainOrderUnchangedFromCache(chainOrder, cachedRaw) {
-    if (!chainOrder || !cachedRaw)
-        return false;
-    const base = chainOrder.sell_price?.base;
-    const quote = chainOrder.sell_price?.quote;
-    const cachedBase = cachedRaw.sell_price?.base?.amount;
-    const cachedQuote = cachedRaw.sell_price?.quote?.amount;
-    const cachedForSale = cachedRaw.for_sale;
-    if (base === undefined || quote === undefined)
-        return false;
-    if (cachedForSale === undefined || cachedBase === undefined || cachedQuote === undefined)
-        return false;
-    return String(base.amount ?? '') === String(cachedBase)
-        && String(quote.amount ?? '') === String(cachedQuote)
-        && String(chainOrder.for_sale ?? '') === String(cachedForSale);
-}
 /**
  * Summarize a partial (non-atomic) broadcast for the batch-failure catch log.
  * Supports both the pair-mode grouped path (groupsBroadcast/groupsTotal) and
@@ -1347,7 +1496,6 @@ function validateOperationFunds(bot, operations, assetA, assetB) {
     if (!operations || operations.length === 0) {
         return { isValid: true, summary: 'No operations to validate' };
     }
-    const { blockchainToFloat, floatToBlockchainInt, quantizeFloat } = require('./order/utils/math');
     let snap = bot.manager?.getChainFundsSnapshot?.();
     if (!snap) {
         snap = { chainFreeSell: 0, chainFreeBuy: 0 };
@@ -1842,12 +1990,21 @@ function buildCowResultFromPlan(bot, plan) {
             });
         }
     }
+    // Refill-slot wire (boundary-hold): producers attach the slot ids of
+    // hole-CREATEs that justify this plan's boundary shift; the executor
+    // holds the committed boundary when a listed refill is guard-skipped.
+    // Absent/non-array => undefined (guarded default at execution, never
+    // fail-open). Spread-correction plans never set this (disjoint bypass).
+    const refillSlotIds = Array.isArray(plan?.refillSlotIds)
+        ? plan.refillSlotIds.filter((id) => typeof id === 'string' && id.length > 0)
+        : undefined;
     return {
         workingGrid,
         workingIndexes: workingGrid.getIndexes(),
         workingBoundary,
         actions,
-        origin: plan?.origin
+        origin: plan?.origin,
+        ...(refillSlotIds !== undefined ? { refillSlotIds } : {})
     };
 }
 /**
@@ -1960,14 +2117,7 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
                     receive: ctx.finalInts.receive,
                     orderType: ctx.order.type,
                     fingerprint: createContexts.length > 0
-                        ? buildCreateOpFingerprint({
-                            side: ctx.order.type,
-                            assetA: bot.manager?.assets?.assetA?.id,
-                            assetB: bot.manager?.assets?.assetB?.id,
-                            sellInt: ctx.finalInts.sell,
-                            receiveInt: ctx.finalInts.receive,
-                            slotId: ctx.order.id
-                        })
+                        ? createOpFingerprintForSlot(bot, ctx.order, ctx.finalInts, ctx.order.id)
                         : undefined
                 });
                 if (match) {
@@ -2001,6 +2151,106 @@ async function pollChainForConfirmation(bot, opContexts, options = {}) {
         `${remaining.length} unconfirmed. Falling back to reconciliation.`, 'warn');
     return { allConfirmed: false, confirmed, unconfirmed: remaining, confirmedChainIds: [...matchedChainIds] };
 }
+/**
+ * Normalize a producer-supplied refillSlotIds wire into a Set.
+ * Absent/empty/non-array => empty (guarded default, never fail-open).
+ */
+function toRefillSlotIdSet(refillSlotIds) {
+    const set = new Set();
+    if (Array.isArray(refillSlotIds)) {
+        for (const id of refillSlotIds) {
+            if (typeof id === 'string' && id.length > 0)
+                set.add(id);
+        }
+    }
+    return set;
+}
+/**
+ * Boundary-hold decision for guard-skipped refills.
+ * When a skipped slot is one of the plan's refill slots — a hole-CREATE that
+ * justified the planned boundary shift — the committed boundary is kept: the
+ * slot was never placed (CREATE skip) or restored to master (UPDATE skip), so
+ * committing the planned boundary would strand empty rail holes past it
+ * (91->94 with 91-94 empty self-legalizes via resolveGapBand).
+ * Unrelated vetoes (skip ids outside the refill set) never pin geometry.
+ * The grid still commits; only the boundary value is held (same discipline
+ * as the overrun-hold in validateBoundaryCommit).
+ */
+function resolveRefillBoundaryHold(workingBoundary, committedBoundary, skippedUpdateSlotIds, clampedUpdateSlotIds, refillSlotIds, skippedCreateSlotIds = undefined) {
+    const refills = toRefillSlotIdSet(refillSlotIds);
+    const heldRefillSlotIds = [];
+    if (refills.size > 0) {
+        const seen = new Set();
+        const skipCollections = skippedCreateSlotIds !== undefined
+            ? [skippedUpdateSlotIds, clampedUpdateSlotIds, skippedCreateSlotIds]
+            : [skippedUpdateSlotIds, clampedUpdateSlotIds];
+        for (const coll of skipCollections) {
+            if (!coll || typeof coll[Symbol.iterator] !== 'function')
+                continue;
+            for (const id of coll) {
+                if (typeof id === 'string' && refills.has(id) && !seen.has(id)) {
+                    seen.add(id);
+                    heldRefillSlotIds.push(id);
+                }
+            }
+        }
+    }
+    return {
+        effectiveBoundary: heldRefillSlotIds.length > 0 ? committedBoundary : workingBoundary,
+        heldRefillSlotIds
+    };
+}
+/**
+ * Track consecutive boundary-hold batches on the manager (ops visibility).
+ *
+ * A single hold is normal maker discipline: the guard vetoed stale-priced
+ * refills, so the committed boundary stays instead of advancing past
+ * stranded rail holes. A growing run means the grid is trailing the market
+ * (plans keep pricing refills against a racing guard pivot, typically while
+ * fill batches run on backlogged state) and only fresh fills unstick it —
+ * worth escalating so it cannot hide inside per-batch warns.
+ *
+ * Also records a hold signature (`_lastHeldPlanSignature`) for the
+ * identical-held-plan suppression in `performSafeRebalance`, and the caller
+ * escalates a long run to a guard-aware structural re-center. A fill-less
+ * re-plan from unchanged master re-derives the identical plan and re-hits
+ * the identical guard blocks, so it is suppressed rather than re-broadcast;
+ * the heal path is a fresh fill-driven plan or the re-center.
+ * @param {any} manager - Order manager (mutable tracking fields)
+ * @param {boolean} held - Whether this batch held the boundary
+ * @param {any} keptBoundary - Committed boundary that was kept
+ * @param {any} plannedBoundary - Boundary the plan wanted
+ * @param {string[]} heldSlotIds - Refill slots skipped this batch
+ * @returns {number} Consecutive-hold count after this batch (0 when clear)
+ */
+function trackBoundaryHold(manager, held, keptBoundary, plannedBoundary, heldSlotIds) {
+    if (!manager)
+        return 0;
+    const prev = Number(manager._consecutiveBoundaryHolds) || 0;
+    const consecutive = held ? prev + 1 : 0;
+    manager._consecutiveBoundaryHolds = consecutive;
+    if (held) {
+        manager._lastBoundaryHoldInfo = {
+            at: Date.now(),
+            kept: keptBoundary,
+            planned: plannedBoundary,
+            slots: Array.isArray(heldSlotIds) ? [...heldSlotIds] : [],
+        };
+        // Signature for the identical-held-plan suppression in
+        // performSafeRebalance: a fill-less replan with the same boundary,
+        // pivot and fill timestamp can only reproduce this hold.
+        manager._lastHeldPlanSignature = {
+            boundaryIdx: keptBoundary,
+            pivot: manager._lastFilledPrice ?? null,
+            fillsAt: manager._lastFilledAt ?? 0,
+            wire: Array.isArray(heldSlotIds) ? [...heldSlotIds] : [],
+        };
+    }
+    else {
+        manager._lastHeldPlanSignature = null;
+    }
+    return consecutive;
+}
 /**
  * Restore skipped update slots in the working grid to master state.
  * @param {import('./dexbot_class.js').DEXBot} bot
@@ -2182,87 +2432,6 @@ async function waitForCowBroadcastSingleFlight(bot, label) {
  * @param {Object} [options={}] - Internal execution options (replanDepth)
  * @returns {Promise<Object>}
  */
-/**
- * PRE-BROADCAST CROSSED-BOOK ASSERT (defense-in-depth, any-writer detection).
- *
- * Simulates the post-batch book: currently placed master orders plus this
- * batch's action overlay (CREATEs add, CANCELs remove, UPDATEs reprice/move).
- * Returns a detail string when a planned BUY would price at-or-above a planned
- * SELL — a state no honest planner produces — so the caller can refuse the
- * broadcast instead of paying for adverse fills.  Placed order prices are
- * independent of grid geometry, so this catches boundary overruns regardless
- * of which writer produced them.
- *
- * Detector only: any internal failure returns null (never blocks a broadcast).
- */
-function detectCrossedBookPlan(manager, actions) {
-    try {
-        const startPrice = Number(manager?.config?.startPrice);
-        const book = new Map();
-        for (const o of Array.from(manager?.orders?.values?.() ?? [])) {
-            if (!o || !o.orderId || o.price == null)
-                continue;
-            const price = Number(o.price);
-            if (!Number.isFinite(price))
-                continue;
-            let type = o.type;
-            if (type !== ORDER_TYPES.BUY && type !== ORDER_TYPES.SELL) {
-                // Legacy SPREAD-typed placed order: derive side from the same
-                // price-vs-startPrice convention used across the codebase.
-                if (!Number.isFinite(startPrice))
-                    continue;
-                type = price < startPrice ? ORDER_TYPES.BUY : ORDER_TYPES.SELL;
-            }
-            book.set(String(o.id), { type, price });
-        }
-        for (const a of actions ?? []) {
-            const id = String(a.id ?? a.orderId ?? '');
-            if (a.type === COW_ACTIONS.CANCEL) {
-                if (id)
-                    book.delete(id);
-            }
-            else if (a.type === COW_ACTIONS.UPDATE) {
-                const newPrice = Number(a.newPrice ?? a.order?.price);
-                const newType = a.order?.type;
-                if (id && Number.isFinite(newPrice)) {
-                    const entry = book.get(id);
-                    const type = (newType === ORDER_TYPES.BUY || newType === ORDER_TYPES.SELL)
-                        ? newType
-                        : entry?.type;
-                    if (entry)
-                        book.delete(id);
-                    const key = String(a.newGridId ?? id);
-                    if (type === ORDER_TYPES.BUY || type === ORDER_TYPES.SELL) {
-                        book.set(key, { type, price: newPrice });
-                    }
-                }
-            }
-            else if (a.type === COW_ACTIONS.CREATE) {
-                const price = Number(a.order?.price);
-                const type = a.order?.type;
-                if (!Number.isFinite(price) || (type !== ORDER_TYPES.BUY && type !== ORDER_TYPES.SELL))
-                    continue;
-                if (id)
-                    book.set(id, { type, price });
-            }
-        }
-        let maxBuy = -Infinity;
-        let minSell = Infinity;
-        for (const { type, price } of book.values()) {
-            if (type === ORDER_TYPES.BUY && price > maxBuy)
-                maxBuy = price;
-            else if (type === ORDER_TYPES.SELL && price < minSell)
-                minSell = price;
-        }
-        if (Number.isFinite(maxBuy) && Number.isFinite(minSell) && minSell <= maxBuy) {
-            return `bestPlacedBuy=${maxBuy} >= bestPlacedSell=${minSell}`;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Derive an update action's planned target size (shared by the rotation and
  * plain size-update op builders).
@@ -2305,58 +2474,22 @@ function clampPostFillUpdateSize(bot, masterOrder, newSize, action) {
     }
     return target;
 }
-async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
-    const replanDepth = Number.isFinite(Number(options?.replanDepth)) ? Number(options.replanDepth) : 0;
-    bot._currentCycleId = (Number.isFinite(Number(bot._currentCycleId)) ? Number(bot._currentCycleId) : 0) + 1;
-    const { workingGrid, workingIndexes, workingBoundary, actions } = cowResult;
-    if (bot.config.dryRun) {
-        const cancelCount = actions.filter((a) => a.type === COW_ACTIONS.CANCEL).length;
-        const createCount = actions.filter((a) => a.type === COW_ACTIONS.CREATE).length;
-        const updateCount = actions.filter((a) => a.type === COW_ACTIONS.UPDATE).length;
-        if (cancelCount > 0)
-            bot.manager.logger.log(`Dry run: would cancel ${cancelCount} orders`, 'info');
-        if (createCount > 0)
-            bot.manager.logger.log(`Dry run: would place ${createCount} new orders`, 'info');
-        if (updateCount > 0)
-            bot.manager.logger.log(`Dry run: would update ${updateCount} orders`, 'info');
-        popPushedWorkingGrid(bot, cowResult);
-        return { executed: true, hadRotation: false };
-    }
-    // Single-flight COW broadcast guard (entry check): never broadcast two
-    // batches concurrently. Overlapping broadcasts plan from the same base
-    // grid version; when the first commits it bumps _gridVersion, so the
-    // second's commit is refused (base-version mismatch) -> adopt-from-chain
-    // -> snapshot reload that can drop the adopted order and produce an
-    // orphan fill. This entry wait is an optimization; the authoritative
-    // atomic check-and-set happens right before the broadcast below.
-    if (await waitForCowBroadcastSingleFlight(bot, 'entry')) {
-        popPushedWorkingGrid(bot, cowResult);
-        return { executed: false, aborted: true, reason: 'SHUTDOWN_IN_PROGRESS', hadRotation: false };
-    }
-    // DRAIN PENDING CORRECTIONS before the batch is planned/broadcast.
-    // Cancel-only corrections (duplicate-price orphans) queued by an earlier
-    // sync must not sit while batches run back-to-back (startup create
-    // groups, fill bursts) — with the open-orders sync loop disabled they
-    // would otherwise linger indefinitely, keep blocking same-level CREATEs,
-    // and risk cancelling the wrong side of a duplicate later. Draining here
-    // also keeps this batch's collision checks (chain_orphan_collision)
-    // honest: orphaned chain orders already queued for cancellation are
-    // resolved before the plan validates its CREATE targets against them.
-    const pendingCorrectionCount = Array.isArray(bot.manager?.ordersNeedingPriceCorrection)
-        ? bot.manager.ordersNeedingPriceCorrection.length
-        : 0;
-    if (pendingCorrectionCount > 0 && !bot._shuttingDown) {
-        try {
-            bot.manager.logger.log(`[COW] Draining ${pendingCorrectionCount} pending correction(s) before batch`, 'info');
-            const drainResult = await orderUtils.correctAllPriceMismatches(bot.manager, bot.account, bot.privateKey, chainOrders);
-            if (drainResult?.failed > 0) {
-                bot.manager.logger.log(`[COW] ${drainResult.failed} correction(s) failed pre-batch; remaining entries retry on next sync/maintenance tick`, 'warn');
-            }
-        }
-        catch (drainErr) {
-            bot.manager.logger.log(`[COW] Pre-batch correction drain failed: ${getErrorMessage(drainErr)}`, 'warn');
-        }
-    }
+/**
+ * Pre-broadcast guard chain for a COW batch: create-slot validation (with
+ * tolerance-violation filtering), recovery-exhausted block, pending-broadcast
+ * and unmatched-chain-order guards (with adoption sync), and the crossed-book
+ * gate. Every refusal pops the pushed working grid before returning.
+ *
+ * Mutates cowResult.actions in place (tolerance-violating CREATEs are
+ * filtered); the caller holds the same array reference.
+ *
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Object} cowResult - Rebalance/COW result carrying actions
+ * @returns {Promise<Object>} { proceed:false, result } on refusal, or
+ *   { proceed:true, crossingCandidates, intraBatchCandidates } on pass
+ */
+async function runPreBroadcastGuards(bot, cowResult) {
+    const { actions } = cowResult;
     const chainOrderCandidates = Array.isArray(bot.manager?._lastUnmatchedChainOrders)
         ? bot.manager._lastUnmatchedChainOrders
         : [];
@@ -2398,11 +2531,14 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
         if (hasHardOccupiedViolation) {
             popPushedWorkingGrid(bot, cowResult);
             return {
-                executed: false,
-                aborted: true,
-                reason: 'CREATE_SLOT_OCCUPIED',
-                violations: createSlotValidation.violations,
-                hadRotation: false
+                proceed: false,
+                result: {
+                    executed: false,
+                    aborted: true,
+                    reason: 'CREATE_SLOT_OCCUPIED',
+                    violations: createSlotValidation.violations,
+                    hadRotation: false
+                }
             };
         }
         const violatingIds = createSlotValidation.violatingTargetIds;
@@ -2424,7 +2560,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                 // returns: a pushed working grid must be popped here or the
                 // caller would leak the stack entry.
                 popPushedWorkingGrid(bot, cowResult);
-                return { executed: false, hadRotation: false };
+                return { proceed: false, result: { executed: false, hadRotation: false } };
             }
         }
     }
@@ -2436,27 +2572,29 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
             `Waiting for next fill or sync cycle to reset recovery state.`, 'warn');
         popPushedWorkingGrid(bot, cowResult);
         return {
-            executed: false,
-            aborted: true,
-            reason: 'RECOVERY_EXHAUSTED',
-            hadRotation: false
+            proceed: false,
+            result: {
+                executed: false,
+                aborted: true,
+                reason: 'RECOVERY_EXHAUSTED',
+                hadRotation: false
+            }
         };
     }
     const unmatchedChainOrders = Array.isArray(bot.manager?._lastUnmatchedChainOrders)
         ? bot.manager._lastUnmatchedChainOrders
         : [];
-    const pendingBroadcasts = (bot.manager && bot.manager._pendingBroadcasts instanceof Map)
-        ? Array.from(bot.manager._pendingBroadcasts.values())
-        : [];
-    if (hasCreateActions && (unmatchedChainOrders.length > 0 || pendingBroadcasts.length > 0)) {
+    // Out-of-grid holds are permanent by design (live orders held outside
+    // the frozen rail): they can never be adopted and collide with nothing,
+    // so they must not block CREATES — otherwise one dip-protection hold
+    // freezes the whole grid. Only adoptable/cancellable orphans block.
+    const blockingUnmatched = unmatchedChainOrders.filter((u) => !orderUtils.isNonBlockingUnmatchedOrder(u));
+    const pendingBroadcasts = getPendingBroadcasts(bot);
+    if (hasCreateActions && (blockingUnmatched.length > 0 || pendingBroadcasts.length > 0)) {
         if (pendingBroadcasts.length > 0) {
             bot.manager.logger.log(`[COW] Rejecting CREATE batch: ${pendingBroadcasts.length} pending broadcast(s) from a prior uncertain ` +
                 `broadcast. Running recovery before placing replacement orders.`, 'error');
-            if (typeof bot.manager.requestStructuralGridResync === 'function') {
-                if (bot.manager._recoveryState)
-                    bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: true };
-                await bot.manager.requestStructuralGridResync('pending broadcasts before COW create', { pendingBroadcasts: pendingBroadcasts.map((p) => p.slotId) });
-            }
+            await requestStructuralResync(bot, 'pending broadcasts before COW create', { pendingBroadcasts: pendingBroadcasts.map((p) => p.slotId) });
             try {
                 await reconcileAfterUncertainBroadcast(bot, new BroadcastUncertainError('rejected CREATE batch had pending broadcasts', {
                     operations: pendingBroadcasts.map((p) => p.order),
@@ -2471,17 +2609,20 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
             }
             popPushedWorkingGrid(bot, cowResult);
             return {
-                executed: false,
-                aborted: true,
-                reason: 'PENDING_BROADCASTS',
-                hadRotation: false
+                proceed: false,
+                result: {
+                    executed: false,
+                    aborted: true,
+                    reason: 'PENDING_BROADCASTS',
+                    hadRotation: false
+                }
             };
         }
-        const unmatchedSample = unmatchedChainOrders
+        const unmatchedSample = blockingUnmatched
             .slice(0, 3)
             .map((o) => formatUnmatchedChainOrderForLog(o))
             .join(' | ');
-        bot.manager.logger.log(`[COW] ${unmatchedChainOrders.length} unmatched chain order(s) blocking CREATES ` +
+        bot.manager.logger.log(`[COW] ${blockingUnmatched.length} unmatched chain order(s) blocking CREATES ` +
             (unmatchedSample ? `(${unmatchedSample})` : '') +
             ` — adopting via sync instead of cancelling`, 'info');
         try {
@@ -2491,8 +2632,8 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
             // freshest orders; syncing on it would virtualize live slots and
             // re-create duplicates. Defer the adoption to a clean read — the
             // unmatched orders keep blocking CREATEs until then.
-            if (freshRead.truncated) {
-                bot.manager.logger.log('[COW] Post-guard chain snapshot TRUNCATED; skipping adoption sync (partial snapshot would virtualize live slots) — unmatched chain orders keep blocking CREATEs', 'warn');
+            if (!isAuthoritativeChainRead(freshRead)) {
+                bot.manager.logger.log('[COW] Post-guard chain snapshot not authoritative; skipping adoption sync (partial snapshot would virtualize live slots) — unmatched chain orders keep blocking CREATEs', 'warn');
             }
             else if (freshRead.orders && freshRead.orders.length > 0) {
                 const freshSnapshot = freshRead.orders;
@@ -2532,18 +2673,17 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
         catch (syncErr) {
             bot.manager.logger.log(`[COW] Failed to sync/unmatched orders: ${syncErr?.message || syncErr}`, 'warn');
         }
-        if (typeof bot.manager.requestStructuralGridResync === 'function') {
-            if (bot.manager._recoveryState)
-                bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: true };
-            await bot.manager.requestStructuralGridResync('unmatched chain orders before COW create', { unmatchedChainOrders: unmatchedChainOrders });
-        }
+        await requestStructuralResync(bot, 'unmatched chain orders before COW create', { unmatchedChainOrders: unmatchedChainOrders });
         bot.manager.logger.log(`[COW] Rejecting CREATE batch after sync: working grid invalidated by master mutation`, 'info');
         popPushedWorkingGrid(bot, cowResult);
         return {
-            executed: false,
-            aborted: true,
-            reason: 'UNMATCHED_CHAIN_ORDERS',
-            hadRotation: false
+            proceed: false,
+            result: {
+                executed: false,
+                aborted: true,
+                reason: 'UNMATCHED_CHAIN_ORDERS',
+                hadRotation: false
+            }
         };
     }
     // Crossing-check candidate set (master + pending-broadcast + unmatched
@@ -2551,7 +2691,6 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
     // it reflects any sync they triggered.
     const crossingCandidates = buildCrossingCandidates(bot);
     const intraBatchCandidates = [];
-    const { assetA, assetB } = bot.manager.assets;
     // CROSSED-BOOK GATE: refuse to broadcast any batch whose simulated result
     // prices a BUY at-or-above a SELL (see detectCrossedBookPlan).
     const crossedBookDetail = detectCrossedBookPlan(bot.manager, actions);
@@ -2559,17 +2698,103 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
         bot.manager.logger.log(`[COW] Rejecting batch pre-broadcast: crossed book detected (${crossedBookDetail})`, 'error');
         popPushedWorkingGrid(bot, cowResult);
         return {
-            executed: false,
-            aborted: true,
-            reason: 'CROSSED_BOOK',
-            detail: crossedBookDetail,
-            hadRotation: false
+            proceed: false,
+            result: {
+                executed: false,
+                aborted: true,
+                reason: 'CROSSED_BOOK',
+                detail: crossedBookDetail,
+                hadRotation: false
+            }
         };
     }
+    return { proceed: true, crossingCandidates, intraBatchCandidates };
+}
+async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
+    const replanDepth = Number.isFinite(Number(options?.replanDepth)) ? Number(options.replanDepth) : 0;
+    bot._currentCycleId = (Number.isFinite(Number(bot._currentCycleId)) ? Number(bot._currentCycleId) : 0) + 1;
+    const { workingGrid, workingIndexes, workingBoundary, actions } = cowResult;
+    // Boundary-hold value: computed pre-broadcast after the skip-restore and
+    // frozen for every downstream commit path (success + uncertain-catch).
+    // workingBoundary itself stays untouched (audit trail).
+    let effectiveBoundary = workingBoundary;
+    // True when the refill hold pinned the committed boundary over the plan's
+    // target. Hoisted out of the broadcast try block: the uncertain-broadcast
+    // catch commits too, and a held boundary must keep the owed fill crawls
+    // there as well (see _commitWorkingGrid pending-crawl bookkeeping).
+    let boundaryHeld = false;
+    // Consecutive-hold re-center tuning (see the escalation block below).
+    const boundaryHoldTiming = constantsModule?.TIMING || {};
+    const holdResyncThreshold = Number(boundaryHoldTiming.BOUNDARY_HOLD_RESYNC_THRESHOLD) > 0
+        ? Number(boundaryHoldTiming.BOUNDARY_HOLD_RESYNC_THRESHOLD)
+        : 4;
+    const holdResyncCooldownMs = Number(boundaryHoldTiming.BOUNDARY_HOLD_RESYNC_COOLDOWN_MS) > 0
+        ? Number(boundaryHoldTiming.BOUNDARY_HOLD_RESYNC_COOLDOWN_MS)
+        : 5 * 60 * 1000;
+    if (bot.config.dryRun) {
+        const cancelCount = actions.filter((a) => a.type === COW_ACTIONS.CANCEL).length;
+        const createCount = actions.filter((a) => a.type === COW_ACTIONS.CREATE).length;
+        const updateCount = actions.filter((a) => a.type === COW_ACTIONS.UPDATE).length;
+        if (cancelCount > 0)
+            bot.manager.logger.log(`Dry run: would cancel ${cancelCount} orders`, 'info');
+        if (createCount > 0)
+            bot.manager.logger.log(`Dry run: would place ${createCount} new orders`, 'info');
+        if (updateCount > 0)
+            bot.manager.logger.log(`Dry run: would update ${updateCount} orders`, 'info');
+        popPushedWorkingGrid(bot, cowResult);
+        return { executed: true, hadRotation: false };
+    }
+    // Single-flight COW broadcast guard (entry check): never broadcast two
+    // batches concurrently. Overlapping broadcasts plan from the same base
+    // grid version; when the first commits it bumps _gridVersion, so the
+    // second's commit is refused (base-version mismatch) -> adopt-from-chain
+    // -> snapshot reload that can drop the adopted order and produce an
+    // orphan fill. This entry wait is an optimization; the authoritative
+    // atomic check-and-set happens right before the broadcast below.
+    if (await waitForCowBroadcastSingleFlight(bot, 'entry')) {
+        popPushedWorkingGrid(bot, cowResult);
+        return { executed: false, aborted: true, reason: 'SHUTDOWN_IN_PROGRESS', hadRotation: false };
+    }
+    // DRAIN PENDING CORRECTIONS before the batch is planned/broadcast.
+    // Cancel-only corrections (duplicate-price orphans) queued by an earlier
+    // sync must not sit while batches run back-to-back (startup create
+    // groups, fill bursts) — with the open-orders sync loop disabled they
+    // would otherwise linger indefinitely, keep blocking same-level CREATEs,
+    // and risk cancelling the wrong side of a duplicate later. Draining here
+    // also keeps this batch's collision checks (chain_orphan_collision)
+    // honest: orphaned chain orders already queued for cancellation are
+    // resolved before the plan validates its CREATE targets against them.
+    const pendingCorrectionCount = Array.isArray(bot.manager?.ordersNeedingPriceCorrection)
+        ? bot.manager.ordersNeedingPriceCorrection.length
+        : 0;
+    if (pendingCorrectionCount > 0 && !bot._shuttingDown) {
+        try {
+            bot.manager.logger.log(`[COW] Draining ${pendingCorrectionCount} pending correction(s) before batch`, 'info');
+            const drainResult = await orderUtils.correctAllPriceMismatches(bot.manager, bot.account, bot.privateKey, chainOrders);
+            if (drainResult?.failed > 0) {
+                bot.manager.logger.log(`[COW] ${drainResult.failed} correction(s) failed pre-batch; remaining entries retry on next sync/maintenance tick`, 'warn');
+            }
+        }
+        catch (drainErr) {
+            bot.manager.logger.log(`[COW] Pre-batch correction drain failed: ${getErrorMessage(drainErr)}`, 'warn');
+        }
+    }
+    // Pre-broadcast guard chain (create-slot validation, recovery-exhausted
+    // block, pending/unmatched guards, crossed-book gate) — see
+    // runPreBroadcastGuards. Refusals already popped the working grid.
+    const guards = await runPreBroadcastGuards(bot, cowResult);
+    if (!guards.proceed)
+        return guards.result;
+    const { crossingCandidates, intraBatchCandidates } = guards;
+    const { assetA, assetB } = bot.manager.assets;
     const operations = [];
     const opContexts = [];
     const skippedUpdateSlotIds = new Set();
     let skippedUpdateCount = 0;
+    // Guard-skipped CREATE slot ids (hole-refills never placed). Fed to the
+    // boundary-hold intersect alongside the UPDATE sets above — a skipped
+    // refill CREATE strands its rail hole exactly like a restored UPDATE.
+    const skippedCreateSlotIds = new Set();
     // Per-batch LAST-FILL-GUARD disposition counters. Per-action pass lines
     // would spam big batches, so the guard emits one batch summary instead
     // (see the summary after the action loop below).
@@ -2619,6 +2844,16 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
         bot._markGridActivity('batch start');
         bot.manager._setRebalanceState(REBALANCE_STATES.BROADCASTING);
         bot.manager.startBroadcasting();
+        // P3 — freeze the guard pivot once per batch: per-action refreshes
+        // mutated the pivot mid-batch (02:03 pivots drifted 0.001523→0.001529
+        // across 20 checks), so early actions were judged against a different
+        // pivot than later ones. The batch summary still reports whether this
+        // freeze moved the pivot under the plan.
+        try {
+            if (refreshLastFillPivotFromQueue(bot))
+                lastFillGuardPivotRefreshed = true;
+        }
+        catch { /* best-effort */ }
         for (const action of actions) {
             if (action.type === COW_ACTIONS.CANCEL) {
                 try {
@@ -2645,6 +2880,8 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     const sizeValidation = validateOrderSizeForExecution(bot, order.size, order.type, order, order.size);
                     if (!sizeValidation.isValid) {
                         bot.manager.logger.log(`Skipping create op for ${action.id}: ${sizeValidation.reason}`, 'warn');
+                        if (action.id)
+                            skippedCreateSlotIds.add(action.id);
                         continue;
                     }
                     const liveSlot = bot.manager.orders.get(order.id);
@@ -2669,6 +2906,8 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                             `same-batch CREATE ${batchCollision.id} already at ` +
                             `price ${Format.formatPrice6(batchCollision.order.price)}. ` +
                             `The next reconcile cycle will resolve the mismatch.`, 'warn');
+                        if (order.id)
+                            skippedCreateSlotIds.add(order.id);
                         continue;
                     }
                     // CROSSING-PLACEMENT GUARD (create variant): the batch-level
@@ -2687,6 +2926,8 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         bot.manager.logger.log(`[COW-CROSS-GUARD] Skipping CREATE for ${order.id} at ` +
                             `${Format.formatPrice6(createPrice)}: crosses live ` +
                             `${crossedOrderLabel(effectiveCrossed)}; re-planned after its cancel confirms.`, 'warn');
+                        if (order.id)
+                            skippedCreateSlotIds.add(order.id);
                         continue;
                     }
                     // LAST-FILL PRICE GUARD: pivot ± halfIncrement (BUY < pivot*(1-half), SELL > pivot*(1+half)).
@@ -2699,20 +2940,15 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         const isCorrectionCreate = actionOrigin === 'spread-correction'
                             || (actionOrigin == null && batchOrigin === 'spread-correction');
                         if (!isCorrectionCreate) {
-                            try {
-                                if (refreshLastFillPivotFromQueue(bot))
-                                    lastFillGuardPivotRefreshed = true;
-                            }
-                            catch { /* best-effort */ }
-                            const lastPrice = bot.manager?._lastFilledPrice;
-                            const lastType = bot.manager?._lastFilledType;
-                            const inc = resolveLastFillGuardIncrement(bot);
-                            const check = isLastFillGuardBlocked(createPrice, order.size, order.type, lastPrice, lastType, inc);
-                            lastFillGuardStats.checked++;
+                            const { check, refreshed } = runLastFillGuardCheck(bot, createPrice, order.size, order.type, lastFillGuardStats, true);
+                            if (refreshed)
+                                lastFillGuardPivotRefreshed = true;
                             if (check.blocked) {
                                 lastFillGuardStats.skipped++;
                                 const dir = order.type === ORDER_TYPES.BUY ? 'above' : 'below';
-                                bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${order.type} CREATE for ${order.id} at ${Format.formatPrice6(createPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)}); re-planned after market moves`, 'warn');
+                                bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${order.type} CREATE for ${order.id} at ${Format.formatPrice6(createPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)}); re-planned after market moves`, 'debug');
+                                if (order.id)
+                                    skippedCreateSlotIds.add(order.id);
                                 continue;
                             }
                             lastFillGuardStats.passed++;
@@ -2726,6 +2962,8 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     const buildResult = await chainOrders.buildCreateOrderOp(bot.account, args.amountToSell, args.sellAssetId, args.minToReceive, args.receiveAssetId, null);
                     if (!buildResult) {
                         bot.manager.logger.log(`Skipping create op for ${action.id}: amounts would round to 0 on blockchain`, 'warn');
+                        if (action.id)
+                            skippedCreateSlotIds.add(action.id);
                         continue;
                     }
                     operations.push(buildResult.op);
@@ -2779,6 +3017,15 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         }
                         const rotationSizeValidation = validateOrderSizeForExecution(bot, newSize, orderType, action.order, newSize);
                         if (!rotationSizeValidation.isValid) {
+                            // Record like every sibling skip site: the skip set
+                            // feeds both the working-grid restore and the
+                            // boundary hold (a skipped refill must not let the
+                            // committed boundary advance past its empty slot).
+                            skippedUpdateCount++;
+                            if (action.id)
+                                skippedUpdateSlotIds.add(action.id);
+                            if (action.newGridId)
+                                skippedUpdateSlotIds.add(action.newGridId);
                             bot.manager.logger.log(`Skipping rotation update ${action.id} -> ${action.newGridId}: ${rotationSizeValidation.reason}`, 'warn');
                             continue;
                         }
@@ -2928,16 +3175,9 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                 lastFillGuardStats.bypassed++;
                             }
                             else {
-                                try {
-                                    if (refreshLastFillPivotFromQueue(bot))
-                                        lastFillGuardPivotRefreshed = true;
-                                }
-                                catch { /* best-effort */ }
-                                const lastPrice = bot.manager?._lastFilledPrice;
-                                const lastType = bot.manager?._lastFilledType;
-                                const inc = resolveLastFillGuardIncrement(bot);
-                                const check = isLastFillGuardBlocked(newPrice, newSize, orderType, lastPrice, lastType, inc);
-                                lastFillGuardStats.checked++;
+                                const { check, refreshed } = runLastFillGuardCheck(bot, newPrice, newSize, orderType, lastFillGuardStats, true);
+                                if (refreshed)
+                                    lastFillGuardPivotRefreshed = true;
                                 if (check.blocked) {
                                     lastFillGuardStats.skipped++;
                                     skippedUpdateCount++;
@@ -2946,7 +3186,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                     if (action.newGridId)
                                         skippedUpdateSlotIds.add(action.newGridId);
                                     const dir = orderType === ORDER_TYPES.BUY ? 'above' : 'below';
-                                    bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${orderType} UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)})`, 'warn');
+                                    bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping ${orderType} UPDATE for ${action.id} -> ${action.newGridId} at ${Format.formatPrice6(newPrice)}: ${dir} last filled ${Format.formatPrice6(check.pivot)} (halfInc ${check.halfInc}% thr ${Format.formatPrice6(check.threshold)})`, 'debug');
                                     continue;
                                 }
                                 lastFillGuardStats.passed++;
@@ -3062,24 +3302,19 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                 }
                                 // LAST-FILL GUARD (fallback variant): this CREATE
                                 // replaces a rotation UPDATE at a repriced level,
-                                // so it obeys the same guard with a refreshed
-                                // pivot — no origin bypass, same as rotations.
+                                // so it obeys the same guard against the frozen
+                                // batch pivot — no origin bypass, same as rotations.
                                 try {
-                                    if (refreshLastFillPivotFromQueue(bot))
+                                    const { check: fbCheck, refreshed: fbRefreshed } = runLastFillGuardCheck(bot, fbPrice, fbSize, fbType, lastFillGuardStats, true);
+                                    if (fbRefreshed)
                                         lastFillGuardPivotRefreshed = true;
-                                }
-                                catch { /* best-effort */ }
-                                try {
-                                    const fbInc = resolveLastFillGuardIncrement(bot);
-                                    const fbCheck = isLastFillGuardBlocked(fbPrice, fbSize, fbType, bot.manager?._lastFilledPrice, bot.manager?._lastFilledType, fbInc);
-                                    lastFillGuardStats.checked++;
                                     if (fbCheck.blocked) {
                                         lastFillGuardStats.skipped++;
                                         const fbDir = fbType === ORDER_TYPES.BUY ? 'above' : 'below';
                                         bot.manager.logger.log(`[LAST-FILL-GUARD] Skipping CREATE fallback for ${targetSlotId} at ` +
                                             `${Format.formatPrice6(fbPrice)}: ${fbDir} last filled ` +
                                             `${Format.formatPrice6(fbCheck.pivot)} (halfInc ${fbCheck.halfInc}% thr ` +
-                                            `${Format.formatPrice6(fbCheck.threshold)}); re-planned after market moves`, 'warn');
+                                            `${Format.formatPrice6(fbCheck.threshold)}); re-planned after market moves`, 'debug');
                                         continue;
                                     }
                                     lastFillGuardStats.passed++;
@@ -3121,10 +3356,10 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
         // are what incident reconstruction needs. Origin folds in here as
         // mode=bypassed(<origin>); there is no second source of truth.
         // Cold (guard off) is warn, not info — a disabled guard must say so.
-        // pivotRefreshed surfaces whether a mid-broadcast queued fill moved the
-        // pivot under this batch's checks (the refresh itself stays debug).
-        // Note the printed pivot is end-of-batch state: when pivotRefreshed is
-        // true, early actions were checked against the older pivot.
+        // pivotRefreshed surfaces whether the batch-start freeze picked up a
+        // queued fill (the refresh itself stays debug). The pivot is frozen
+        // for the whole batch, so every action was checked against the same
+        // pivot printed here.
         try {
             const totalGuarded = lastFillGuardStats.checked + lastFillGuardStats.bypassed;
             if (totalGuarded > 0) {
@@ -3160,6 +3395,47 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
             }
             bot.manager.logger.log(`[COW] Re-synced ${clampedUpdateSlotIds.size} post-fill-clamped slot(s) from master before commit`, 'debug');
         }
+        // BOUNDARY HOLD: skipped refill slots strand empty rail holes past the
+        // planned boundary (commit gate skips empties, self-legalizing) — hold
+        // the committed boundary; intersect-only, grid still commits.
+        const refillHold = resolveRefillBoundaryHold(workingBoundary, bot.manager.boundaryIdx, skippedUpdateSlotIds, clampedUpdateSlotIds, cowResult?.refillSlotIds, skippedCreateSlotIds);
+        effectiveBoundary = refillHold.effectiveBoundary;
+        boundaryHeld = refillHold.heldRefillSlotIds.length > 0;
+        if (refillHold.heldRefillSlotIds.length > 0) {
+            bot.manager.logger.log(`[COW] Boundary hold: ${refillHold.heldRefillSlotIds.length} refill slot(s) skipped ` +
+                `(${refillHold.heldRefillSlotIds.join(', ')}) — keeping ${bot.manager.boundaryIdx} over planned ${workingBoundary}`, 'warn');
+        }
+        // Consecutive-hold tracking (INV-COW-007 visibility): escalate a
+        // growing run — the grid is trailing the market and only fresh
+        // fills unstick it. Cleared automatically on the first clean batch.
+        const consecutiveHolds = trackBoundaryHold(bot.manager, refillHold.heldRefillSlotIds.length > 0, bot.manager.boundaryIdx, workingBoundary, refillHold.heldRefillSlotIds);
+        if (consecutiveHolds >= 3) {
+            bot.manager.logger.log(`[COW] Boundary held ${consecutiveHolds} consecutive batches ` +
+                `(keeping ${bot.manager.boundaryIdx} over planned ${workingBoundary}). ` +
+                `Grid is trailing the market — refills re-price once the guard pivot settles; ` +
+                `heals on the next fill-driven plan. Investigate only if the run keeps growing without new fills.`, 'warn');
+        }
+        // Guard-aware re-center escalation (INV-COW-007 heal path): a run of
+        // holds carrying fresh fills means the grid is trailing the market and
+        // will not heal from fill-less replans (they re-derive the identical
+        // veto). Request a structural resync that re-derives centers on the
+        // live pivot; the cooldown prevents resync storms. requestStructuralGridResync
+        // re-defers while this batch is still in flight, so it runs in a clean context.
+        if (boundaryHeld && consecutiveHolds >= holdResyncThreshold) {
+            const freshFills = Array.isArray(cowResult?.fills) && cowResult.fills.length > 0;
+            const lastResyncAt = Number(bot.manager._lastBoundaryHoldResyncAt) || 0;
+            if (freshFills && (Date.now() - lastResyncAt) >= holdResyncCooldownMs) {
+                bot.manager._lastBoundaryHoldResyncAt = Date.now();
+                bot.manager.logger.log(`[COW] Boundary held ${consecutiveHolds} consecutive batches with fresh fills; ` +
+                    `requesting guard-aware structural re-center (cooldown ${Math.round(holdResyncCooldownMs / 1000)}s)`, 'warn');
+                try {
+                    void bot.manager.requestStructuralGridResync?.('boundary-hold-trailing-market', { reason: 'boundary-hold-trailing-market' });
+                }
+                catch (err) {
+                    bot.manager.logger.log(`[COW] Structural re-center request failed (non-fatal): ${getErrorMessage(err)}`, 'warn');
+                }
+            }
+        }
         if (operations.length === 0) {
             // Pop the working grid: in the re-plan recursion the fresh plan's
             // grid was pushed by performSafeRebalance, and nothing downstream
@@ -3255,14 +3531,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                                 sell: item.ctx?.finalInts?.sell,
                                 receive: item.ctx?.finalInts?.receive,
                                 orderType: item.ctx?.order?.type,
-                                fingerprint: buildCreateOpFingerprint({
-                                    side: item.ctx?.order?.type,
-                                    assetA: bot.manager?.assets?.assetA?.id,
-                                    assetB: bot.manager?.assets?.assetB?.id,
-                                    sellInt: item.ctx?.finalInts?.sell,
-                                    receiveInt: item.ctx?.finalInts?.receive,
-                                    slotId
-                                })
+                                fingerprint: createOpFingerprintForSlot(bot, item.ctx?.order, item.ctx?.finalInts, slotId)
                             });
                             if (match?.id) {
                                 workingGrid.set(slotId, { ...slot, orderId: match.id });
@@ -3305,29 +3574,17 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                 // options.result, so a later throw in this frame (e.g.
                 // processBatchResults after a successful commit) cannot pop a
                 // second time for the same grid in the batch catch below.
-                const commitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true, result: cowResult });
+                const commitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, effectiveBoundary, { skipRecalc: true, result: cowResult, boundaryHeld });
                 if (!commitOk) {
                     // Master changed during broadcast (e.g. a fill landed and was
                     // processed concurrently) so the commit was refused. The batch
                     // is on chain; adopt the placed orders from the chain so master
                     // converges instead of remaining divergent until a later sync.
-                    bot.manager.logger.log('[COW] Commit refused after broadcast; adopting placed orders from chain to keep master in sync', 'warn');
-                    const adopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW]', { placedResults: result, placedContexts: executedContexts });
-                    if (!adopted) {
-                        // Chain state unknown (empty/lagging read or sync failure):
-                        // keep the pending-broadcast protection so a later plan
-                        // cannot duplicate the placed orders, and let the structural
-                        // resync adopt them from the chain.
-                        bot.manager.logger.log('[COW] Commit refused and chain adoption unavailable; keeping pending-broadcast protection pending structural resync', 'error');
-                        await requestStructuralResync(bot, 'commit refused after broadcast (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
-                        return { executed: false, hadRotation: false, commitRefused: true, chainAdoptionPending: true };
-                    }
-                    // Deduct create fees for the placed orders (mirrors
-                    // processBatchResults, which the refused path bypasses).
-                    await applyAdoptionFeeAccounting(bot, executedContexts);
-                    await restoreBoundaryAfterAdoption(bot, workingBoundary);
-                    await persistGridAndClearPendingBroadcasts(bot, '[COW]');
-                    return { executed: false, hadRotation: false, commitRefused: true };
+                    return await recoverRefusedCommit(bot, chainOrders, '[COW]', { placedResults: result, placedContexts: executedContexts }, executedContexts, effectiveBoundary, {
+                        failureResyncReason: 'commit refused after broadcast (chain adoption unavailable)',
+                        failureLogMessage: 'Commit refused and chain adoption unavailable; keeping pending-broadcast protection pending structural resync',
+                        preAdoptLogMessage: 'Commit refused after broadcast; adopting placed orders from chain to keep master in sync',
+                    });
                 }
                 const batchResult = await processBatchResults(bot, result, executedContexts);
                 const persistResult = await bot.manager.persistGrid();
@@ -3342,10 +3599,7 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                         bot.manager.logger.log(`[COW][PERSIST-GUARD] Retry also skipped/invalid ` +
                             `(${retryResult.reason || 'no reason'}). Master grid in memory ` +
                             `is ahead of disk snapshot; structural resync requested.`, 'error');
-                        if (typeof bot.manager.requestStructuralGridResync === 'function') {
-                            bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: true };
-                            await bot.manager.requestStructuralGridResync('persistence guard triggered after COW batch', { persistReason: retryResult.reason || 'unknown' });
-                        }
+                        await requestStructuralResync(bot, 'persistence guard triggered after COW batch', { persistReason: retryResult.reason || 'unknown' });
                     }
                     else {
                         delete bot.manager._persistenceWarning;
@@ -3410,22 +3664,17 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     // _commitWorkingGrid pops on every settle path and clears
                     // the push marker via options.result, so a later throw here
                     // must not pop again in the batch catch below.
-                    const pollCommitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, workingBoundary, { skipRecalc: true, result: cowResult });
+                    const pollCommitOk = await bot.manager._commitWorkingGrid(workingGrid, workingIndexes, effectiveBoundary, { skipRecalc: true, result: cowResult, boundaryHeld });
                     if (!pollCommitOk) {
                         // Master moved while polling — same recovery as the
                         // refused-commit path: adopt from chain, keep pending
                         // protection if adoption is unavailable.
-                        bot.manager.logger.log(`[COW][UNCERTAIN] Poll-confirmed commit refused; adopting placed orders from chain`, 'warn');
-                        const pollAdopted = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds });
-                        if (!pollAdopted) {
-                            bot.manager.logger.log('[COW][UNCERTAIN] Poll-refused commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
-                            await requestStructuralResync(bot, 'poll-confirmed commit refused (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
-                            return { executed: false, hadRotation: false, commitRefused: true, chainAdoptionPending: true };
-                        }
-                        await applyAdoptionFeeAccounting(bot, opContexts);
-                        await restoreBoundaryAfterAdoption(bot, workingBoundary);
-                        await persistGridAndClearPendingBroadcasts(bot, '[COW][UNCERTAIN]');
-                        return { executed: false, hadRotation: false, commitRefused: true, uncertainResolved: true };
+                        return await recoverRefusedCommit(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds }, opContexts, effectiveBoundary, {
+                            successReturn: { executed: false, hadRotation: false, commitRefused: true, uncertainResolved: true },
+                            failureResyncReason: 'poll-confirmed commit refused (chain adoption unavailable)',
+                            failureLogMessage: 'Poll-refused commit with unavailable chain adoption; keeping pending protection pending structural resync',
+                            preAdoptLogMessage: 'Poll-confirmed commit refused; adopting placed orders from chain',
+                        });
                     }
                     // Enrich master grid with chain-assigned order IDs and amounts;
                     // accounting enabled so the adopted orders' capital is locked
@@ -3436,19 +3685,16 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
                     // on a failed adoption would let the next cycle re-create the
                     // VIRTUAL slots as duplicate on-chain orders. Keep the
                     // protection and defer to a structural resync instead.
-                    const pollAdoptedOk = await adoptPlacedBatchFromChain(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds });
-                    if (!pollAdoptedOk) {
-                        bot.manager.logger.log('[COW][UNCERTAIN] Poll-confirmed commit with unavailable chain adoption; keeping pending protection pending structural resync', 'error');
-                        await requestStructuralResync(bot, 'poll-confirmed commit (chain adoption unavailable)', { reason: 'chain-adoption-unavailable' });
-                        return { executed: false, hadRotation: false, commitRefused: false, chainAdoptionPending: true };
-                    }
                     // The commit happened without processBatchResults (no success
                     // result to extract); deduct create fees so the optimistic
-                    // balance reflects the on-chain cost.
-                    await applyAdoptionFeeAccounting(bot, opContexts);
-                    await restoreBoundaryAfterAdoption(bot, workingBoundary);
-                    await persistGridAndClearPendingBroadcasts(bot, '[COW][UNCERTAIN]');
-                    return { executed: true, hadRotation: false, uncertainResolved: true };
+                    // balance reflects the on-chain cost (shared with the
+                    // refused-commit paths via recoverRefusedCommit).
+                    return await recoverRefusedCommit(bot, chainOrders, '[COW][UNCERTAIN]', { placedContexts: opContexts, polledCreateIds: confirmation.confirmedChainIds }, opContexts, effectiveBoundary, {
+                        extraReturn: { commitRefused: false },
+                        successReturn: { executed: true, hadRotation: false, uncertainResolved: true },
+                        failureResyncReason: 'poll-confirmed commit (chain adoption unavailable)',
+                        failureLogMessage: 'Poll-confirmed commit with unavailable chain adoption; keeping pending protection pending structural resync',
+                    });
                 }
             }
             catch (pollErr) {
@@ -3502,8 +3748,10 @@ async function updateOrdersOnChainBatchCOW(bot, cowResult, options = {}) {
  * @param {Object} [details={}] - Details passed to the resync handler
  */
 async function requestStructuralResync(bot, reason, details = {}) {
-    if (typeof bot.manager?.requestStructuralGridResync !== 'function')
+    if (typeof bot.manager?.requestStructuralGridResync !== 'function') {
+        bot._warn?.(`[COW] requestStructuralGridResync unavailable; cannot schedule structural resync (reason: ${reason}).`);
         return;
+    }
     if (bot.manager._recoveryState) {
         bot.manager._recoveryState = { ...bot.manager._recoveryState, structuralResyncRequested: true };
     }
@@ -3523,91 +3771,6 @@ async function requestStructuralResync(bot, reason, details = {}) {
  * @param {string} logPrefix - Log prefix for sync failure messages
  * @returns {Promise<boolean>}
  */
-/**
- * Collect every on-chain order id master currently needs to converge against,
- * so adoption can re-read them by id (immune to the get_full_accounts window
- * truncation) instead of relying on a partial window read.
- *
- * Sources:
- *  - master's own tracked order ids (existing on-chain orders);
- *  - the batch's fresh CREATE ids extracted from the broadcast result
- *    (operation_results[i][1] aligns positionally with placedContexts[i]).
- *
- * @param {any} mgr - bot.manager
- * @param {any} placedResults - broadcast result (has operation_results); null when unavailable
- * @param {any[]} placedContexts - opContexts (aligned with operation_results); null when unavailable
- * @param {string[]|null} [extraCreateIds=null] - fresh CREATE chain ids from another
- *   authoritative source (e.g. the uncertain-broadcast poll confirmation) when
- *   no broadcast result exists; merged into createIds so the lagging-create
- *   retry guards them
- * @returns {string[]} Unique, well-formed 1.7.x order ids
- */
-function collectKnownOnChainOrderIds(mgr, placedResults, placedContexts, extraCreateIds = null) {
-    const masterIds = new Set();
-    const grid = mgr && mgr.grid;
-    if (Array.isArray(grid)) {
-        for (const slot of grid) {
-            if (slot && slot.orderId && /^1\.7\.\d+$/.test(String(slot.orderId))) {
-                masterIds.add(String(slot.orderId));
-            }
-        }
-    }
-    // Master tracked ids live in the orders Map (mgr.grid is legacy and
-    // unset on OrderManager — without this the by-id set omits every
-    // pre-existing ACTIVE order and pass-1 phantom cleanup would virtualize
-    // them as fills on a partial snapshot).
-    if (mgr && mgr.orders instanceof Map) {
-        for (const slot of mgr.orders.values()) {
-            if (slot && slot.orderId && /^1\.7\.\d+$/.test(String(slot.orderId))) {
-                masterIds.add(String(slot.orderId));
-            }
-        }
-    }
-    const createIds = new Set();
-    if (placedResults && Array.isArray(placedContexts)) {
-        const opResults = extractBatchOperationResults(placedResults);
-        if (Array.isArray(opResults)) {
-            for (let i = 0; i < placedContexts.length; i++) {
-                const ctx = placedContexts[i];
-                if (!ctx || ctx.kind !== 'create')
-                    continue;
-                const opResult = opResults[i] && opResults[i][1];
-                if (opResult && /^1\.7\.\d+$/.test(String(opResult))) {
-                    createIds.add(String(opResult));
-                }
-            }
-        }
-    }
-    if (Array.isArray(extraCreateIds)) {
-        for (const id of extraCreateIds) {
-            if (id && /^1\.7\.\d+$/.test(String(id)))
-                createIds.add(String(id));
-        }
-    }
-    // Existing chain ids referenced by non-create op contexts (cancel /
-    // rotation / size-update). Pre-existing orders whose absence is expected
-    // (cancels/fills in this batch), so they join the by-id set but never
-    // the lagging-create guard.
-    if (Array.isArray(placedContexts)) {
-        for (const ctx of placedContexts) {
-            if (!ctx || ctx.kind === 'create')
-                continue;
-            const refs = [];
-            if (ctx.kind === 'cancel' && ctx.order)
-                refs.push(ctx.order.orderId);
-            else if (ctx.kind === 'rotation' && ctx.rotation?.oldOrder)
-                refs.push(ctx.rotation.oldOrder.orderId);
-            else if (ctx.kind === 'size-update' && ctx.updateInfo?.partialOrder)
-                refs.push(ctx.updateInfo.partialOrder.orderId);
-            for (const id of refs) {
-                if (id && /^1\.7\.\d+$/.test(String(id)))
-                    masterIds.add(String(id));
-            }
-        }
-    }
-    const all = new Set([...masterIds, ...createIds]);
-    return { masterIds: [...masterIds], createIds: [...createIds], all: [...all] };
-}
 /**
  * Converge master with the chain after a COW commit was refused (master moved
  * during broadcast) or an uncertain broadcast was poll-confirmed.
@@ -3760,8 +3923,8 @@ async function adoptPlacedBatchFromChain(bot, chainOrders, logPrefix, opts = {})
         }
         // FALLBACK: window read (ambiguous when truncated).
         const freshRead = await readOpenOrdersWithMetaSafe(chainOrders, accountRef);
-        if (freshRead.truncated) {
-            bot.manager.logger.log(`${logPrefix} Chain read TRUNCATED after batch broadcast; adoption deferred (pending-broadcast protection kept)`, 'warn');
+        if (!isAuthoritativeChainRead(freshRead)) {
+            bot.manager.logger.log(`${logPrefix} Chain read ${freshRead?.truncated ? 'TRUNCATED' : 'EMPTY'} after batch broadcast; adoption deferred (pending-broadcast protection kept)`, 'warn');
             return false;
         }
         const freshChain = freshRead.orders;
@@ -3791,6 +3954,83 @@ async function persistGridAndClearPendingBroadcasts(bot, logPrefix) {
     }
     clearPendingBroadcasts(bot.manager?._pendingBroadcasts);
 }
+/**
+ * Recover from a refused commit after a COW batch broadcast.
+ * Adopts placed orders from the chain, applies fee accounting, restores
+ * the boundary, and persists. All three commit-refused paths
+ * (success-path refused, poll-refused, and poll-confirmed uncertain)
+ * share this exact sequence.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Object} chainOrders - Chain orders module
+ * @param {string} logPrefix - Log prefix for messages
+ * @param {Object} adoptOpts - Options passed to adoptPlacedBatchFromChain
+ * @param {Array} contexts - Op contexts for fee accounting
+ * @param {Object} workingBoundary - The working boundary
+ * @param {Object} [opts={}] - Named options (object form: adjacent string
+ *   options were positional before, a transposition would compile silently).
+ * @param {Object} [opts.extraReturn={}] - Extra fields merged into the failure return object
+ * @param {Object|null} [opts.successReturn=null] - Return object on successful adoption
+ *   (defaults to the commit-refused shape; the poll-confirmed path passes its
+ *   executed:true shape)
+ * @param {string} [opts.failureResyncReason='commit refused after broadcast (chain adoption unavailable)']
+ * @param {string} [opts.failureLogMessage='Commit refused and chain adoption unavailable; keeping pending-broadcast protection pending structural resync']
+ *   - Failure-path log body (prefixed with logPrefix); each call site passes
+ *   its original wording so log greps keep matching.
+ * @param {string|null} [opts.preAdoptLogMessage=null] - Optional warn logged before
+ *   the adoption attempt (the success-path and poll-refused sites log one;
+ *   the poll-confirmed site never did)
+ * @returns {Promise<Object>} The commit-refused return object
+ */
+async function recoverRefusedCommit(bot, chainOrders, logPrefix, adoptOpts, contexts, workingBoundary, opts = {}) {
+    const { extraReturn = {}, successReturn = null, failureResyncReason = 'commit refused after broadcast (chain adoption unavailable)', failureLogMessage = 'Commit refused and chain adoption unavailable; keeping pending-broadcast protection pending structural resync', preAdoptLogMessage = null, } = opts;
+    if (preAdoptLogMessage) {
+        bot.manager.logger.log(`${logPrefix} ${preAdoptLogMessage}`, 'warn');
+    }
+    const adopted = await adoptPlacedBatchFromChain(bot, chainOrders, logPrefix, adoptOpts);
+    if (!adopted) {
+        bot.manager.logger.log(`${logPrefix} ${failureLogMessage}`, 'error');
+        await requestStructuralResync(bot, failureResyncReason, { reason: 'chain-adoption-unavailable' });
+        return { executed: false, hadRotation: false, commitRefused: true, chainAdoptionPending: true, ...extraReturn };
+    }
+    await applyAdoptionFeeAccounting(bot, contexts);
+    await restoreBoundaryAfterAdoption(bot, workingBoundary);
+    await persistGridAndClearPendingBroadcasts(bot, logPrefix);
+    return successReturn ?? { executed: false, hadRotation: false, commitRefused: true, ...extraReturn };
+}
+/**
+ * Run the last-fill guard probe: optionally refresh the pivot from
+ * still-queued fills, read the durable pivot, and evaluate
+ * isLastFillGuardBlocked. Consolidates the identical probe pattern in the
+ * CREATE, UPDATE-rotation, and CREATE-fallback guards (origin bypasses and
+ * skip logging stay at the call sites, which differ per action kind).
+ * Batch callers pass skipRefresh=true: the batch-start freeze owns refreshes
+ * so every action in a batch is judged against the same pivot.
+ * @param {Object} bot
+ * @param {number} price - Target order price
+ * @param {number} size - Order size
+ * @param {string} type - ORDER_TYPES.BUY/SELL
+ * @param {Object} stats - lastFillGuardStats tracker (checked++ here)
+ * @param {boolean} [skipRefresh=false] - Skip the queued-fill pivot refresh
+ * @returns {{check: Object, refreshed: boolean}}
+ */
+function runLastFillGuardCheck(bot, price, size, type, stats, skipRefresh = false) {
+    let refreshed = false;
+    // The batch-start freeze (see broadcast loop head) owns pivot refreshes;
+    // per-action refreshes are disabled so every action in a batch is judged
+    // against the same pivot. Kept opt-in for non-batch callers.
+    if (!skipRefresh) {
+        try {
+            refreshed = !!refreshLastFillPivotFromQueue(bot);
+        }
+        catch { /* best-effort */ }
+    }
+    const lastPrice = bot.manager?._lastFilledPrice;
+    const lastType = bot.manager?._lastFilledType;
+    const inc = resolveLastFillGuardIncrement(bot);
+    const check = isLastFillGuardBlocked(price, size, type, lastPrice, lastType, inc);
+    stats.checked++;
+    return { check, refreshed };
+}
 /**
  * Apply BTS create-fee accounting for a batch that bypassed the normal
  * processBatchResults pipeline (commit refused after broadcast, or
@@ -3827,6 +4067,7 @@ async function applyAdoptionFeeAccounting(bot, contexts) {
                     isPartialPlacement: false,
                     expectedType: ctx.order.type,
                     fee: btsFeeData?.createFee || 0,
+                    order: ctx.order ?? null,
                 }, 'createOrder');
             }
             catch (feeErr) {
@@ -3866,6 +4107,22 @@ async function applyAdoptionFeeAccounting(bot, contexts) {
         }
     }
 }
+/**
+ * Table-driven optimistic fee call for processBatchResults: the cancel,
+ * size-update, and both rotation branches all invoke
+ * updateOptimisticFreeBalance(oldOrder, newOrder, context, fee, false)
+ * under the same accountant guard — one spelling instead of four.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {Object} oldOrder
+ * @param {Object} newOrder
+ * @param {string} context - Fee context ('fill-cancel' | 'order-update')
+ * @param {number} fee - BTS fee amount
+ */
+async function applyOptimisticFeeBalance(bot, oldOrder, newOrder, context, fee) {
+    if (oldOrder && newOrder && bot.manager.accountant) {
+        await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, newOrder, context, fee || 0, false);
+    }
+}
 /**
  * Process results from batch transaction execution.
  * Updates order state, synchronizes with chain, and deducts BTS fees.
@@ -3893,27 +4150,16 @@ async function processBatchResults(bot, result, opContexts) {
             bot.manager.logger.log(`Cancelled surplus order ${ctx.order.id} (${ctx.order.orderId})`, 'info');
             const oldOrder = ctx.order;
             const committedOrder = oldOrder?.id ? bot.manager.orders.get(oldOrder.id) : null;
-            if (oldOrder && committedOrder && bot.manager.accountant) {
-                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, committedOrder, 'fill-cancel', btsFeeData?.cancelFee || 0, false);
-            }
+            await applyOptimisticFeeBalance(bot, oldOrder, committedOrder, 'fill-cancel', btsFeeData?.cancelFee || 0);
         }
         else if (ctx.kind === 'size-update') {
             const oldOrder = ctx.updateInfo.partialOrder;
             const ord = bot.manager.orders.get(oldOrder.id);
-            if (oldOrder && ord && bot.manager.accountant) {
-                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0, false);
-            }
+            await applyOptimisticFeeBalance(bot, oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0);
             if (ord) {
                 const updatedSlot = { ...ord, size: ctx.updateInfo.newSize };
                 if (ctx.finalInts) {
-                    updatedSlot.rawOnChain = {
-                        id: ord.orderId,
-                        for_sale: String(ctx.finalInts.sell),
-                        sell_price: {
-                            base: { amount: String(ctx.finalInts.sell), asset_id: ctx.finalInts.sellAssetId },
-                            quote: { amount: String(ctx.finalInts.receive), asset_id: ctx.finalInts.receiveAssetId }
-                        }
-                    };
+                    updatedSlot.rawOnChain = rawOnChainFromInts(ord.orderId, ctx.finalInts);
                 }
                 updatesToApply.push({ order: updatedSlot, context: 'post-update-metadata' });
             }
@@ -3924,7 +4170,8 @@ async function processBatchResults(bot, result, opContexts) {
             const chainOrderId = res && res[1];
             if (chainOrderId) {
                 await bot.manager.synchronizeWithChain({
-                    gridOrderId: ctx.order.id, chainOrderId, expectedType: ctx.order.type, fee: btsFeeData?.createFee || 0
+                    gridOrderId: ctx.order.id, chainOrderId, expectedType: ctx.order.type, fee: btsFeeData?.createFee || 0,
+                    order: ctx.order ?? null,
                 }, 'createOrder');
                 if (ctx.finalInts) {
                     const syncedOrder = bot.manager.orders.get(ctx.order.id);
@@ -3932,14 +4179,7 @@ async function processBatchResults(bot, result, opContexts) {
                         updatesToApply.push({
                             order: {
                                 ...syncedOrder,
-                                rawOnChain: {
-                                    id: chainOrderId,
-                                    for_sale: String(ctx.finalInts.sell),
-                                    sell_price: {
-                                        base: { amount: String(ctx.finalInts.sell), asset_id: ctx.finalInts.sellAssetId },
-                                        quote: { amount: String(ctx.finalInts.receive), asset_id: ctx.finalInts.receiveAssetId }
-                                    }
-                                }
+                                rawOnChain: rawOnChainFromInts(chainOrderId, ctx.finalInts)
                             },
                             context: 'post-placement-metadata'
                         });
@@ -3969,20 +4209,11 @@ async function processBatchResults(bot, result, opContexts) {
             const { oldOrder, newPrice, newGridId, newSize, type } = rotation;
             if (!newGridId) {
                 const ord = bot.manager.orders.get(oldOrder.id || rotation.id);
-                if (oldOrder && ord && bot.manager.accountant) {
-                    await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0, false);
-                }
+                await applyOptimisticFeeBalance(bot, oldOrder, ord, 'order-update', btsFeeData?.updateFee || 0);
                 if (ord) {
                     const updatedSlot = { ...ord, size: newSize };
                     if (ctx.finalInts) {
-                        updatedSlot.rawOnChain = {
-                            id: ord.orderId,
-                            for_sale: String(ctx.finalInts.sell),
-                            sell_price: {
-                                base: { amount: String(ctx.finalInts.sell), asset_id: ctx.finalInts.sellAssetId },
-                                quote: { amount: String(ctx.finalInts.receive), asset_id: ctx.finalInts.receiveAssetId }
-                            }
-                        };
+                        updatedSlot.rawOnChain = rawOnChainFromInts(ord.orderId, ctx.finalInts);
                     }
                     updatesToApply.push({ order: updatedSlot, context: 'post-update-metadata' });
                 }
@@ -4013,18 +4244,9 @@ async function processBatchResults(bot, result, opContexts) {
                 orderId: oldOrder?.orderId || slot.orderId || null
             };
             if (ctx.finalInts) {
-                updatedSlot.rawOnChain = {
-                    id: updatedSlot.orderId,
-                    for_sale: String(ctx.finalInts.sell),
-                    sell_price: {
-                        base: { amount: String(ctx.finalInts.sell), asset_id: ctx.finalInts.sellAssetId },
-                        quote: { amount: String(ctx.finalInts.receive), asset_id: ctx.finalInts.receiveAssetId }
-                    }
-                };
-            }
-            if (oldOrder && updatedSlot && bot.manager.accountant) {
-                await bot.manager.accountant.updateOptimisticFreeBalance(oldOrder, updatedSlot, 'order-update', btsFeeData?.updateFee || 0, false);
+                updatedSlot.rawOnChain = rawOnChainFromInts(updatedSlot.orderId, ctx.finalInts);
             }
+            await applyOptimisticFeeBalance(bot, oldOrder, updatedSlot, 'order-update', btsFeeData?.updateFee || 0);
             if (oldOrder?.id && oldOrder.id !== newGridId) {
                 const currentSource = bot.manager.orders.get(oldOrder.id);
                 if (currentSource && currentSource.orderId) {
@@ -4051,7 +4273,10 @@ async function processBatchResults(bot, result, opContexts) {
         updateOperationCount
     };
 }
-export { isLastFillGuardBlocked, refreshLastFillPivotFromQueue, buildOutsideInPairGroupsForOrders, buildOutsideInPairGroupsForCreateEntries, extractOperationResults, findMissingCreateResultContexts, markMissingCreateResultsAsStructuralBlocker, formatUnmatchedChainOrderForLog, recordPendingBroadcast, clearPendingBroadcasts, clearPendingBroadcastsForSlots, popPushedWorkingGrid, buildChainOrderFingerprint, normalizeChainOrderForPendingMatch, findChainOrderForSlot, reconcileAfterUncertainBroadcast, reconcileAfterUncertainBroadcastImpl, autoCancelOneUnmatchedOrphan, shouldExecuteCreatePairMode, executeWithRetryOnUncertain, executeChunkedWithRetryOnUncertain, formatPartialBroadcastSummary, executeOperationsWithStrategy, validateOperationFunds, resolveIdealSizeForValidation, validateOrderSizeForExecution, buildActionsFromPlan, buildCowResultFromPlan, restoreSkippedUpdateSlotsInWorkingGrid, applyRotationTransitionsToWorkingGrid, pollChainForConfirmation, updateOrdersOnChainBatchCOW, processBatchResults, adoptPlacedBatchFromChain };
+export { isLastFillGuardBlocked, refreshLastFillPivotFromQueue, buildOutsideInPairGroupsForOrders, buildOutsideInPairGroupsForCreateEntries, extractOperationResults, findMissingCreateResultContexts, markMissingCreateResultsAsStructuralBlocker, formatUnmatchedChainOrderForLog, recordPendingBroadcast, clearPendingBroadcasts, clearPendingBroadcastsForSlots, popPushedWorkingGrid, buildChainOrderFingerprint, normalizeChainOrderForPendingMatch, findChainOrderForSlot, reconcileAfterUncertainBroadcast, reconcileAfterUncertainBroadcastImpl, autoCancelOneUnmatchedOrphan, shouldExecuteCreatePairMode, executeWithRetryOnUncertain, executeChunkedWithRetryOnUncertain, formatPartialBroadcastSummary, executeOperationsWithStrategy, validateOperationFunds, resolveIdealSizeForValidation, validateOrderSizeForExecution, buildActionsFromPlan, buildCowResultFromPlan, restoreSkippedUpdateSlotsInWorkingGrid, applyRotationTransitionsToWorkingGrid, pollChainForConfirmation, updateOrdersOnChainBatchCOW, processBatchResults, adoptPlacedBatchFromChain, resolveRefillBoundaryHold, toRefillSlotIdSet, trackBoundaryHold };
+// Exported for regression tests (issue #23 sibling): the uncertain-broadcast
+// discard path must never drop a placement silently when master lost the slot.
+export { restoreDiscardedCreates };
 export default {
     buildOutsideInPairGroupsForOrders,
     buildOutsideInPairGroupsForCreateEntries,
@@ -4080,6 +4305,9 @@ export default {
     buildActionsFromPlan,
     buildCowResultFromPlan,
     restoreSkippedUpdateSlotsInWorkingGrid,
+    resolveRefillBoundaryHold,
+    toRefillSlotIdSet,
+    trackBoundaryHold,
     applyRotationTransitionsToWorkingGrid,
     pollChainForConfirmation,
     updateOrdersOnChainBatchCOW,