dexbot 1.5.3 → 1.6.1

package/dist/modules/dexbot_fill_runtime.d.ts

@@ -188,6 +188,46 @@ declare function maxConsecutiveFillConsumerFailures(bot: any): any;
  * @returns {number} Delay in milliseconds before the next retry.
  */
 declare function computeFillConsumerBackoffMs(bot: any, failures: any): number;
+/**
+ * Consume the deferred-drain marker at the start of a fill cycle.
+ *
+ * When fills were parked by the consumer's broadcast/order-pipeline deferral
+ * (or by a region-end / pipeline-clear drain), the cycle that finally runs
+ * them deals with ledger deltas that interacted with mid-rebalance grid
+ * state. Mirror the orphan-fill credit treatment: stamp
+ * manager._orphanFillsCreditedAt so the fund-invariant tolerance is widened
+ * (×5) for this cycle only — the drain itself must not trip the invariant.
+ * Idempotent: returns true only when a marker was actually consumed.
+ * @param {any} bot
+ * @returns {boolean} true when the drain marker was consumed (tolerance widened)
+ */
+export declare function consumeDeferredDrainMarker(bot: any): boolean;
+/**
+ * Decide whether the fill consumer must defer because a broadcast region is
+ * active — WITHOUT acquiring _fillProcessingLock first.
+ *
+ * Background: a fill-driven rebalance waits up to 30s for broadcast idle
+ * INSIDE _fillProcessingLock (20s acquisition timeout). While it sleeps,
+ * every concurrent consumer queues as a lock waiter and dies at the 20s
+ * timeout ("Error processing fills: Lock acquisition timeout"), cascading
+ * under backlog. Deferring before the acquire avoids the sleep entirely:
+ * the broadcast's finally plus the region-end hook reschedule the consumer,
+ * so freshness is preserved without the wait.
+ *
+ * Bounded: deferral longer than TIMING.FILL_BROADCAST_DEFER_MAX_MS falls
+ * through ({ defer: false, stuckFallback: true }) to the legacy path whose
+ * in-lock wait still caps at 30s and proceeds — a leaked flag can delay
+ * fills, never starve them. The marker resets whenever the consumer
+ * proceeds, so only continuous deferral counts toward the bound.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {number} [nowMs] - Clock override (tests)
+ * @returns {{ defer: boolean; stuckFallback: boolean }} defer=true means the
+ *   caller must return without acquiring the lock.
+ */
+declare function shouldDeferFillForBroadcast(bot: any, nowMs?: number): {
+    defer: boolean;
+    stuckFallback: boolean;
+};
 /**
  * Schedule a fill consumer restart with exponential backoff when the
  * failure budget is exhausted, or immediate retry via setImmediate when
@@ -204,6 +244,31 @@ declare function scheduleFillConsumerRestart(bot: any, chainOrders: any): void;
  * @returns {Promise<void>}
  */
 declare function processFillsWithBootstrapMode(bot: any, chainOrders: any): Promise<void>;
+/**
+ * Park fills deferred on a stale accountTotals refresh for a bounded retry.
+ *
+ * Background: syncFromFillHistory(Batch) returns { deferred: true } when the
+ * accountTotals refresh fails — accounting is NOT applied. The old code
+ * dropped those fills (already spliced from the queue) while their dedupe
+ * keys stayed marked processed: silent fund loss with a "retrying next
+ * cycle" comment, but the next cycle only exists with backlog.
+ *
+ * Parked fills are held OUTSIDE the live queue (so the maintenance idle gate
+ * keeps working) and re-queued on a backoff timer (FILL_TOTALS_RETRY_BASE_MS,
+ * doubling, capped at FILL_TOTALS_RETRY_MAX_MS). The retry re-runs the same
+ * idempotent sync — safe because nothing was applied and the keys were
+ * released. Retries never stop (attempt counter resets on the first cycle
+ * with no deferrals); the parked array is capped at MAX_INCOMING_FILL_QUEUE
+ * with a critical log as a catastrophic backstop.
+ * @param {any} bot
+ * @param {Object} chainOrders - Chain orders module for blockchain operations
+ * @param {any[]} fills - Raw fill events to park
+ * @param {Object} [options]
+ * @param {number} [options.retryDelayMs] - Override the computed backoff (tests)
+ */
+export declare function parkFillsForTotalsRetry(bot: any, chainOrders: any, fills: any[], options?: {
+    retryDelayMs?: number;
+}): void;
 /**
  * Consume queued fills from incomingFillQueue and rebalance.
  * Deduplicates fills against already-processed set (replay-safe), syncs filled
@@ -214,5 +279,5 @@ declare function processFillsWithBootstrapMode(bot: any, chainOrders: any): Prom
  * @param {Object} chainOrders - Chain orders module for blockchain operations
  */
 declare function consumeFillQueue(bot: any, chainOrders: any): Promise<void>;
-export { wireProcessedFillTracking, flushProcessedFillPersistence, flushProcessedFillPersistenceForKeys, buildOrphanFillFallbackKey, applyReplaySafeFillAccounting, applyReplaySafeTrackedFillAccounting, applyReplaySafeOrphanFillAccounting, processSweepOrphanFill, createFillCallback, maxConsecutiveFillConsumerFailures, computeFillConsumerBackoffMs, scheduleFillConsumerRestart, consumeFillQueue, processFillsWithBootstrapMode };
+export { wireProcessedFillTracking, flushProcessedFillPersistence, flushProcessedFillPersistenceForKeys, buildOrphanFillFallbackKey, applyReplaySafeFillAccounting, applyReplaySafeTrackedFillAccounting, applyReplaySafeOrphanFillAccounting, processSweepOrphanFill, createFillCallback, maxConsecutiveFillConsumerFailures, computeFillConsumerBackoffMs, scheduleFillConsumerRestart, shouldDeferFillForBroadcast, consumeFillQueue, processFillsWithBootstrapMode };
 //# sourceMappingURL=dexbot_fill_runtime.d.ts.map

package/dist/modules/dexbot_fill_runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dexbot_fill_runtime.d.ts","sourceRoot":"","sources":["../../modules/dexbot_fill_runtime.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF,UAAU,sBAAsB;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;CACvB;AAmED;;;;;;;;;;;;;;;;;GAiBG;AACH,iBAAe,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiCnJ;AAED,iBAAS,yBAAyB,CAAC,GAAG,EAAE,GAAG,QAW1C;AAsCD;;;;;;GAMG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAc,EAAE,OAAO,GAAE,GAAQ,iBAG/F;AAED;;;;;;;GAOG;AACH,iBAAe,oCAAoC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAE,GAAuB,EAAE,OAAO,GAAE,GAAQ,iBAG9H;AAED;;;;;;GAMG;AACH,iBAAS,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,iBAsBtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAC3E,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,MAA4B,EAC5B,eAAwB,EACxB,gBAAyB,EACzB,WAAqB,EACrB,eAA4D,EAC5D,sBAA8B,EACjC,GAAE;IACC,iBAAiB,CAAC,EAAE,GAAG,CAAC;IACxB,kBAAkB,CAAC,EAAE,GAAG,CAAC;IACzB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC/B;;;;;;;;;;;;;;;GAoCL;AAED;;;;;;;;;;;;GAYG;AACH,iBAAe,oCAAoC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAClF,OAAO,EACP,MAA4B,EAC5B,aAAa,EACb,eAA0D,EAC7D,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACpB;;;;;;;;;;;;;;;GAQL;AAED;;;;;;;;;;;;GAYG;AACH,iBAAe,mCAAmC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EACjF,OAAO,EACP,MAA4B,EAC5B,aAAa,EACb,eAA0D,EAC7D,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACpB;;;;;;;;;;;;;;;GAUL;AAED;;;;;;GAMG;AACH,iBAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IACpC,OAAO,GAAG,mBAmB3B;AAED;;;;GAIG;AACH,iBAAS,kCAAkC,CAAC,GAAG,EAAE,GAAG,OAEnD;AAED;;;;;;;;GAQG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAM5D;AAED;;;;;;GAMG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,QA4D9D;AAED;;;;;;GAMG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,iBA0GtE;AAED;;;;;;;;GAQG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,iBA4czD;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAA"}
+{"version":3,"file":"dexbot_fill_runtime.d.ts","sourceRoot":"","sources":["../../modules/dexbot_fill_runtime.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF,UAAU,sBAAsB;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;CACvB;AA8ED;;;;;;;;;;;;;;;;;GAiBG;AACH,iBAAe,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiCnJ;AAED,iBAAS,yBAAyB,CAAC,GAAG,EAAE,GAAG,QAW1C;AAsCD;;;;;;GAMG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,GAAE,GAAc,EAAE,OAAO,GAAE,GAAQ,iBAG/F;AAED;;;;;;;GAOG;AACH,iBAAe,oCAAoC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAE,GAAuB,EAAE,OAAO,GAAE,GAAQ,iBAG9H;AAED;;;;;;GAMG;AACH,iBAAS,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,iBAsBtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAC3E,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,MAA4B,EAC5B,eAAwB,EACxB,gBAAyB,EACzB,WAAqB,EACrB,eAA4D,EAC5D,sBAA8B,EACjC,GAAE;IACC,iBAAiB,CAAC,EAAE,GAAG,CAAC;IACxB,kBAAkB,CAAC,EAAE,GAAG,CAAC;IACzB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC/B;;;;;;;;;;;;;;;GAoCL;AAED;;;;;;;;;;;;GAYG;AACH,iBAAe,oCAAoC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAClF,OAAO,EACP,MAA4B,EAC5B,aAAa,EACb,eAA0D,EAC7D,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACpB;;;;;;;;;;;;;;;GAQL;AAED;;;;;;;;;;;;GAYG;AACH,iBAAe,mCAAmC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EACjF,OAAO,EACP,MAA4B,EAC5B,aAAa,EACb,eAA0D,EAC7D,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,eAAe,CAAC,EAAE,GAAG,CAAC;CACpB;;;;;;;;;;;;;;;GAUL;AAED;;;;;;GAMG;AACH,iBAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IACpC,OAAO,GAAG,mBAmB3B;AAED;;;;GAIG;AACH,iBAAS,kCAAkC,CAAC,GAAG,EAAE,GAAG,OAEnD;AAED;;;;;;;;GAQG;AACH,iBAAS,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,UAM5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAO5D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAoBzG;AAED;;;;;;GAMG;AACH,iBAAS,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,QA4D9D;AAED;;;;;;GAMG;AACH,iBAAe,6BAA6B,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,iBA0GtE;AAwBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,QAyFxH;AAED;;;;;;;;GAQG;AACH,iBAAe,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,iBAiiBzD;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,oCAAoC,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAA"}

package/dist/modules/dexbot_fill_runtime.js

@@ -6,7 +6,7 @@ import { PROCESSED_FILL_PERSISTENCE_MODES } from './order/processed_fill_store.j
 import { NATIVE_CLIENT, FILL_PROCESSING, TIMING, MAINTENANCE, ORDER_TYPES } from './constants.js';
 import { getErrorMessage } from './utils/errors.js';
 import { isOrderDoesNotExistError } from './dexbot_maintenance_runtime.js';
-import { slotIndexForPrice, isSlotInRail } from './order/utils/math.js';
+import { slotIndexForPrice, isChainPriceOutOfGrid, isSlotInRail } from './order/utils/math.js';
 import { ORDER_STATES } from './constants.js';
 function buildFillKey(...args) { return require('./order/utils/order').buildFillKey(...args); }
 function correctAllPriceMismatches(...args) { return require('./order/utils/order').correctAllPriceMismatches(...args); }
@@ -54,6 +54,18 @@ async function isUnknownFillOrderAdoptable(bot, fillOp) {
         if (genesis && Array.isArray(genesis.priceLevels) && genesis.priceLevels.length > 0) {
             try {
                 const idx = slotIndexForPrice(price, genesis);
+                // Out-of-grid hold (mirror of the sync Pass-2 guard): the
+                // clamp onto edge slot 0/N-1 is not a real match. An
+                // out-of-grid live order is not adoptable here — fall
+                // through to the credit path instead of deferring credit
+                // to an adoption sync that must not adopt it.
+                {
+                    const precision = parsed.type === ORDER_TYPES.SELL
+                        ? bot.manager?.assets?.assetA?.precision
+                        : bot.manager?.assets?.assetB?.precision;
+                    if (isChainPriceOutOfGrid(price, genesis, precision))
+                        return false;
+                }
                 const slotId = `slot-${idx}`;
                 const slot = bot.manager.orders.get(slotId);
                 if (!slot)
@@ -376,6 +388,76 @@ function computeFillConsumerBackoffMs(bot, failures) {
     const stepAfterMax = Math.max(0, failures - maxConsecutiveFillConsumerFailures(bot));
     return Math.min(max, initial * Math.pow(2, stepAfterMax));
 }
+/**
+ * Consume the deferred-drain marker at the start of a fill cycle.
+ *
+ * When fills were parked by the consumer's broadcast/order-pipeline deferral
+ * (or by a region-end / pipeline-clear drain), the cycle that finally runs
+ * them deals with ledger deltas that interacted with mid-rebalance grid
+ * state. Mirror the orphan-fill credit treatment: stamp
+ * manager._orphanFillsCreditedAt so the fund-invariant tolerance is widened
+ * (×5) for this cycle only — the drain itself must not trip the invariant.
+ * Idempotent: returns true only when a marker was actually consumed.
+ * @param {any} bot
+ * @returns {boolean} true when the drain marker was consumed (tolerance widened)
+ */
+export function consumeDeferredDrainMarker(bot) {
+    if (bot && bot._deferredFillsPending) {
+        bot._deferredFillsPending = false;
+        if (bot.manager)
+            bot.manager._orphanFillsCreditedAt = Date.now();
+        return true;
+    }
+    return false;
+}
+/**
+ * Decide whether the fill consumer must defer because a broadcast region is
+ * active — WITHOUT acquiring _fillProcessingLock first.
+ *
+ * Background: a fill-driven rebalance waits up to 30s for broadcast idle
+ * INSIDE _fillProcessingLock (20s acquisition timeout). While it sleeps,
+ * every concurrent consumer queues as a lock waiter and dies at the 20s
+ * timeout ("Error processing fills: Lock acquisition timeout"), cascading
+ * under backlog. Deferring before the acquire avoids the sleep entirely:
+ * the broadcast's finally plus the region-end hook reschedule the consumer,
+ * so freshness is preserved without the wait.
+ *
+ * Bounded: deferral longer than TIMING.FILL_BROADCAST_DEFER_MAX_MS falls
+ * through ({ defer: false, stuckFallback: true }) to the legacy path whose
+ * in-lock wait still caps at 30s and proceeds — a leaked flag can delay
+ * fills, never starve them. The marker resets whenever the consumer
+ * proceeds, so only continuous deferral counts toward the bound.
+ * @param {import('./dexbot_class.js').DEXBot} bot
+ * @param {number} [nowMs] - Clock override (tests)
+ * @returns {{ defer: boolean; stuckFallback: boolean }} defer=true means the
+ *   caller must return without acquiring the lock.
+ */
+function shouldDeferFillForBroadcast(bot, nowMs) {
+    const now = Number.isFinite(Number(nowMs)) ? Number(nowMs) : Date.now();
+    let active = false;
+    try {
+        active = bot?.manager?.isBroadcastingActive?.() === true;
+    }
+    catch {
+        active = false;
+    }
+    if (!active) {
+        if (bot?._fillBroadcastDeferSince)
+            bot._fillBroadcastDeferSince = 0;
+        return { defer: false, stuckFallback: false };
+    }
+    const deferMaxMs = Number(TIMING?.FILL_BROADCAST_DEFER_MAX_MS) > 0
+        ? Number(TIMING.FILL_BROADCAST_DEFER_MAX_MS)
+        : 60000;
+    const since = Number(bot?._fillBroadcastDeferSince) || 0;
+    if (!since)
+        bot._fillBroadcastDeferSince = now;
+    if (since && (now - since) >= deferMaxMs) {
+        bot._fillBroadcastDeferSince = 0;
+        return { defer: false, stuckFallback: true };
+    }
+    return { defer: true, stuckFallback: false };
+}
 /**
  * Schedule a fill consumer restart with exponential backoff when the
  * failure budget is exhausted, or immediate retry via setImmediate when
@@ -536,6 +618,135 @@ async function processFillsWithBootstrapMode(bot, chainOrders) {
         bot.manager.logger.log(`[BOOTSTRAP] Fill error: ${getErrorMessage(err)}`, 'error');
     }
 }
+/**
+ * Release replay-safety dedupe keys consumed by _isNewFillKey for fills that
+ * are NOT being processed after all (stale-totals deferral). Without this, a
+ * re-queued fill is skipped as a duplicate within _fillDedupeWindowMs — the
+ * deferral would credit nothing AND poison the retry. Mirrors the
+ * orphan-adoption release in processSweepOrphanFill.
+ * @param {any} bot
+ * @param {Set<any>} processedFillKeys - Per-cycle key set to release from
+ * @param {any[]} fills - Raw fill events whose keys were consumed
+ */
+function releaseFillDedupeKeys(bot, processedFillKeys, fills) {
+    if (!bot || !processedFillKeys || !Array.isArray(fills))
+        return;
+    for (const fill of fills) {
+        try {
+            const key = buildFillKey(fill);
+            if (!key)
+                continue;
+            processedFillKeys.delete(key);
+            bot._recentlyQueuedFills?.delete?.(key);
+        }
+        catch { /* best-effort */ }
+    }
+}
+/**
+ * Park fills deferred on a stale accountTotals refresh for a bounded retry.
+ *
+ * Background: syncFromFillHistory(Batch) returns { deferred: true } when the
+ * accountTotals refresh fails — accounting is NOT applied. The old code
+ * dropped those fills (already spliced from the queue) while their dedupe
+ * keys stayed marked processed: silent fund loss with a "retrying next
+ * cycle" comment, but the next cycle only exists with backlog.
+ *
+ * Parked fills are held OUTSIDE the live queue (so the maintenance idle gate
+ * keeps working) and re-queued on a backoff timer (FILL_TOTALS_RETRY_BASE_MS,
+ * doubling, capped at FILL_TOTALS_RETRY_MAX_MS). The retry re-runs the same
+ * idempotent sync — safe because nothing was applied and the keys were
+ * released. Retries never stop (attempt counter resets on the first cycle
+ * with no deferrals); the parked array is capped at MAX_INCOMING_FILL_QUEUE
+ * with a critical log as a catastrophic backstop.
+ * @param {any} bot
+ * @param {Object} chainOrders - Chain orders module for blockchain operations
+ * @param {any[]} fills - Raw fill events to park
+ * @param {Object} [options]
+ * @param {number} [options.retryDelayMs] - Override the computed backoff (tests)
+ */
+export function parkFillsForTotalsRetry(bot, chainOrders, fills, options = {}) {
+    if (!bot || !Array.isArray(fills) || fills.length === 0)
+        return;
+    if (!Array.isArray(bot._fillTotalsParkedFills))
+        bot._fillTotalsParkedFills = [];
+    const parked = bot._fillTotalsParkedFills;
+    const maxParked = Number(NATIVE_CLIENT?.SUBSCRIPTIONS?.MAX_INCOMING_FILL_QUEUE) > 0
+        ? Number(NATIVE_CLIENT.SUBSCRIPTIONS.MAX_INCOMING_FILL_QUEUE)
+        : 1000;
+    if (parked.length + fills.length > maxParked) {
+        // Cap overflow: drop OLDEST first (parked front, then incoming front)
+        // so the surviving set reflects the most current chain state. Either
+        // direction is fund-loss without the fund-drift backstop; newest-wins
+        // is the safer choice because stale fills are the most likely to have
+        // been superseded on-chain.
+        const overflow = parked.length + fills.length - maxParked;
+        const dropped = [];
+        let remaining = overflow;
+        if (parked.length > 0 && remaining > 0) {
+            const take = Math.min(parked.length, remaining);
+            dropped.push(...parked.splice(0, take));
+            remaining -= take;
+        }
+        if (remaining > 0) {
+            dropped.push(...fills.splice(0, remaining));
+        }
+        bot.manager?.logger?.log?.(`[FILL] Totals-refresh retry park overflow (cap ${maxParked}): dropping ${dropped.length} oldest fill(s) ` +
+            `(${dropped.map((f) => f?.op?.[1]?.order_id ?? '?').join(',')}); fund-drift detection is the backstop`, 'error');
+        if (fills.length === 0)
+            return;
+    }
+    parked.push(...fills);
+    // A retry is already scheduled — it picks these up; one timer at a time.
+    if (bot._fillTotalsRetryTimer)
+        return;
+    const attempt = Number(bot._fillTotalsRetryAttempt) || 0;
+    const baseMs = Number(TIMING?.FILL_TOTALS_RETRY_BASE_MS) > 0
+        ? Number(TIMING.FILL_TOTALS_RETRY_BASE_MS)
+        : 10000;
+    const maxMs = Number(TIMING?.FILL_TOTALS_RETRY_MAX_MS) > 0
+        ? Number(TIMING.FILL_TOTALS_RETRY_MAX_MS)
+        : 60000;
+    const delayMs = options?.retryDelayMs
+        ?? Math.min(baseMs * Math.pow(2, Math.min(attempt, 3)), maxMs);
+    bot.manager?.logger?.log?.(`[FILL] Parked ${fills.length} fill(s) on totals-refresh failure ` +
+        `(parked=${parked.length}, attempt=${attempt + 1}, retry in ${Math.round(delayMs / 1000)}s); accounting not yet applied`, 'warn');
+    bot._fillTotalsRetryTimer = setTimeout(() => {
+        bot._fillTotalsRetryTimer = null;
+        if (bot._shuttingDown) {
+            bot.manager?.logger?.log?.(`[FILL] Shutdown with ${bot._fillTotalsParkedFills?.length || 0} totals-parked fill(s) unprocessed; grid persistence snapshot is the backstop`, 'error');
+            return;
+        }
+        // Re-read the attempt counter fresh at fire time (do NOT reuse the
+        // `attempt` captured at park time): a clean cycle may have reset
+        // _fillTotalsRetryAttempt to 0 while this timer was pending, and
+        // writing back the stale captured value would spuriously inflate the
+        // backoff chain. Fresh-read self-corrects; the next park recomputes
+        // the delay from the current counter.
+        const freshAttempt = Number(bot._fillTotalsRetryAttempt) || 0;
+        bot._fillTotalsRetryAttempt = freshAttempt + 1;
+        const due = Array.isArray(bot._fillTotalsParkedFills)
+            ? bot._fillTotalsParkedFills.splice(0)
+            : [];
+        if (due.length === 0)
+            return;
+        // NOTE: this unshift runs BEFORE _consumeFillQueue acquires
+        // _fillProcessingLock. Interleaving with an in-flight cycle is benign
+        // by design: the in-flight run already snapshotted its batch, so the
+        // re-queued fills are simply picked up one cycle later (worst case),
+        // and _deferredFillsPending widens the invariant tolerance for that
+        // drain. Do not move the unshift inside the lock without re-checking
+        // the single-flight / bootstrap branches in consumeFillQueue.
+        bot._incomingFillQueue.unshift(...due);
+        bot._deferredFillsPending = true;
+        bot.manager?.logger?.log?.(`[FILL] Retrying ${due.length} totals-parked fill(s) (attempt ${freshAttempt + 1})`, 'warn');
+        const consume = typeof bot._consumeFillQueue === 'function'
+            ? () => bot._consumeFillQueue(chainOrders)
+            : () => consumeFillQueue(bot, chainOrders);
+        consume().catch((err) => {
+            bot._warn?.(`Totals-parked fill retry failed: ${getErrorMessage(err)}`);
+        });
+    }, delayMs);
+}
 /**
  * Consume queued fills from incomingFillQueue and rebalance.
  * Deduplicates fills against already-processed set (replay-safe), syncs filled
@@ -552,6 +763,13 @@ async function consumeFillQueue(bot, chainOrders) {
             bot._consumeFailureFirstAt = 0;
         }
     };
+    // Deferral marks the queue as a "drain residue": the fills that finally
+    // run were parked while the order pipeline / broadcast mutated grid
+    // state, so their optimistic ledger interacts with mid-rebalance
+    // geometry. The flag is consumed at lock acquire to widen the invariant
+    // tolerance like an orphan credit (×5) for that drain cycle only — the
+    // drain itself must not trip the fund invariant.
+    const markDeferredDrain = () => { bot._deferredFillsPending = true; };
     if (bot._incomingFillQueue.length === 0) {
         resetFailureWatchdogIfSet();
         return;
@@ -563,10 +781,29 @@ async function consumeFillQueue(bot, chainOrders) {
     }
     if (bot._batchInFlight || bot._recoverySyncInFlight) {
         bot.manager?.logger?.log?.(`Fill processing deferred: order pipeline active (${bot._incomingFillQueue.length} queued)`, 'debug');
+        markDeferredDrain();
         resetFailureWatchdogIfSet();
         return;
     }
+    // Broadcast pre-check (lock-timeout robustness — see
+    // shouldDeferFillForBroadcast): never acquire the fill lock just to
+    // sleep in the 30s broadcast wait while concurrent consumers pile up as
+    // lock waiters and time out. The broadcast's finally + region-end hook
+    // reschedule this consumer when the region ends.
+    const broadcastDefer = shouldDeferFillForBroadcast(bot);
+    if (broadcastDefer.defer) {
+        bot.manager?.logger?.log?.(`Fill processing deferred: broadcast active (${bot._incomingFillQueue.length} queued)`, 'debug');
+        markDeferredDrain();
+        resetFailureWatchdogIfSet();
+        return;
+    }
+    if (broadcastDefer.stuckFallback) {
+        bot.manager?.logger?.log?.('Fill processing proceeding despite stuck broadcast flag (deferral bound exceeded; in-lock wait still applies)', 'warn');
+    }
     let pendingFillKeysForCurrentCycle = new Set();
+    // Set when this run parked totals-deferred fills: the retry-attempt
+    // backoff counter only resets on runs with no deferrals.
+    let parkedTotalsRetryThisRun = false;
     try {
         if (bot.manager.isBootstrapping()) {
             let bootstrapSkipped = false;
@@ -582,13 +819,29 @@ async function consumeFillQueue(bot, chainOrders) {
             }
             return;
         }
-        if (bot.manager._fillProcessingLock.getQueueLength() > 0) {
+        // Single-flight: getQueueLength() counts WAITERS, not the active
+        // holder — without isLocked() every concurrent consumer queues behind
+        // a long batch (e.g. a broadcast wait) and dies at the 20s
+        // acquisition timeout. The holder's while-loop drains late arrivals
+        // (splice-all per iteration + non-empty tail reschedule), so a second
+        // consumer is purely redundant — return instead of queueing.
+        const fillLock = bot.manager._fillProcessingLock;
+        const lockBusy = (typeof fillLock?.isLocked === 'function' && fillLock.isLocked())
+            || (typeof fillLock?.getQueueLength === 'function' && fillLock.getQueueLength() > 0);
+        if (lockBusy) {
             bot._metrics.lockContentionEvents++;
             resetFailureWatchdogIfSet();
             return;
         }
         await bot.manager._fillProcessingLock.acquire(async () => {
             bot.manager._orphanFillsCreditedAt = null;
+            // Deferred-drain residue tolerance: fills that were parked while a
+            // broadcast/order pipeline held the queue are now running against
+            // post-rebalance grid state. Mirror the orphan-fill treatment —
+            // widen the invariant tolerance for this cycle so the drain itself
+            // does not fire a fund-invariant violation. Bounded: cleared at the
+            // next cycle start or by the next fresh chain fetch.
+            consumeDeferredDrainMarker(bot);
             while (bot._incomingFillQueue.length > 0) {
                 const batchStartTime = Date.now();
                 bot._metrics.maxQueueDepth = Math.max(bot._metrics.maxQueueDepth, bot._incomingFillQueue.length);
@@ -674,6 +927,10 @@ async function consumeFillQueue(bot, chainOrders) {
                 let allFilledOrders = [];
                 let ordersNeedingCorrection = [];
                 const residualCancels = [];
+                // Fills deferred on a stale accountTotals refresh: accounting
+                // NOT applied. Collected here, keys released, parked for a
+                // bounded retry after the block loop (never dropped).
+                const deferredRefills = [];
                 const processValidFills = async (fillsToSync) => {
                     let resolvedOrders = [];
                     {
@@ -683,10 +940,15 @@ async function consumeFillQueue(bot, chainOrders) {
                                 persistenceMode: PROCESSED_FILL_PERSISTENCE_MODES.BATCHED
                             });
                             if (batchResult.deferred) {
-                                // Deferred: stale accountTotals refresh failed.
-                                // Do NOT mark the fills processed — they will be
-                                // re-read and re-processed on the next cycle.
-                                bot.manager.logger.log(`[FILL] Deferred ${fillsToSync.length} fill(s) (stale accountTotals, refresh failed); retrying next cycle.`, 'warn');
+                                // Deferred: stale accountTotals refresh failed —
+                                // accounting NOT applied. Release the consumed
+                                // dedupe keys and park for a bounded retry.
+                                // (The old code returned here: the fills were
+                                // already spliced from the queue and their keys
+                                // stayed marked processed — silent fund loss.)
+                                releaseFillDedupeKeys(bot, processedFillKeys, fillsToSync);
+                                deferredRefills.push(...fillsToSync);
+                                bot.manager.logger.log(`[FILL] Deferred ${fillsToSync.length} fill(s) (stale accountTotals, refresh failed); parking for retry.`, 'warn');
                                 return resolvedOrders;
                             }
                             for (const fill of fillsToSync) {
@@ -716,7 +978,11 @@ async function consumeFillQueue(bot, chainOrders) {
                                     historyId: fill?.id
                                 });
                                 if (resultHistory.deferred) {
-                                    bot.manager.logger.log(`[FILL] Deferred fill (stale accountTotals, refresh failed); retrying next cycle.`, 'warn');
+                                    // Same totals-refresh deferral as the batch
+                                    // path: release keys, park for retry.
+                                    releaseFillDedupeKeys(bot, processedFillKeys, [fill]);
+                                    deferredRefills.push(fill);
+                                    bot.manager.logger.log(`[FILL] Deferred fill (stale accountTotals, refresh failed); parking for retry.`, 'warn');
                                     continue;
                                 }
                                 if (fillKey)
@@ -793,6 +1059,10 @@ async function consumeFillQueue(bot, chainOrders) {
                         accumulatedOrders.push(...fallbackOrders);
                     }
                     allFilledOrders = accumulatedOrders;
+                    if (deferredRefills.length > 0) {
+                        parkedTotalsRetryThisRun = true;
+                        parkFillsForTotalsRetry(bot, chainOrders, deferredRefills);
+                    }
                     if (ordersNeedingCorrection.length > 0) {
                         const correctionResult = await correctAllPriceMismatches(bot.manager, bot.account, bot.privateKey, chainOrders);
                         if (correctionResult.failed > 0)
@@ -806,6 +1076,18 @@ async function consumeFillQueue(bot, chainOrders) {
                 if (allFilledOrders.length > 0) {
                     const result = await bot._processFillsWithBatching(allFilledOrders, null, 'fill set');
                     let abortedFillCycle = result.aborted;
+                    const deferredFillCycle = result?.deferred === true;
+                    if (deferredFillCycle) {
+                        // Accounting + crawls are applied; only the broadcast was
+                        // deferred to avoid sleeping in-lock on the broadcast
+                        // flag. Post-fill maintenance would immediately attempt
+                        // the same blocked broadcasts, so skip it here:
+                        // _processFillsWithBatching already scheduled the
+                        // no-fill rebalance that applies the owed boundary
+                        // shift once the pipeline is clear (same idempotent
+                        // scheduler the region-end hook uses).
+                        bot.manager?.logger?.log?.('[FILL-QUEUE] Fill rebalance deferred (broadcast active); post-fill maintenance deferred to region end', 'debug');
+                    }
                     if (!abortedFillCycle) {
                         const batchFillKeys = new Set(allFilledOrders.map((filledOrder) => buildFillKey({
                             orderId: filledOrder?.orderId,
@@ -827,8 +1109,8 @@ async function consumeFillQueue(bot, chainOrders) {
                     }
                     const fullFillCount = allFilledOrders.filter((o) => o && o.isPartial !== true).length;
                     const hasAnyFills = allFilledOrders.some((o) => o);
-                    const shouldRunPostFillChecks = !abortedFillCycle && fullFillCount > 0;
-                    const shouldRunDustDetection = !abortedFillCycle && hasAnyFills;
+                    const shouldRunPostFillChecks = !abortedFillCycle && !deferredFillCycle && fullFillCount > 0;
+                    const shouldRunDustDetection = !abortedFillCycle && !deferredFillCycle && hasAnyFills;
                     if (shouldRunDustDetection) {
                         const healthResult = await bot.manager.checkGridHealth(bot.updateOrdersOnChainPlan.bind(bot));
                         const allDust = [
@@ -896,6 +1178,9 @@ async function consumeFillQueue(bot, chainOrders) {
                 }
             }
             bot._markGridActivity('fill processing end');
+            // A run with no totals-deferrals breaks the retry backoff chain.
+            if (!parkedTotalsRetryThisRun)
+                bot._fillTotalsRetryAttempt = 0;
             bot._consecutiveConsumeFailures = 0;
             bot._consumeFailureFirstAt = 0;
         });
@@ -933,5 +1218,5 @@ async function consumeFillQueue(bot, chainOrders) {
         scheduleFillConsumerRestart(bot, chainOrders);
     }
 }
-export { wireProcessedFillTracking, flushProcessedFillPersistence, flushProcessedFillPersistenceForKeys, buildOrphanFillFallbackKey, applyReplaySafeFillAccounting, applyReplaySafeTrackedFillAccounting, applyReplaySafeOrphanFillAccounting, processSweepOrphanFill, createFillCallback, maxConsecutiveFillConsumerFailures, computeFillConsumerBackoffMs, scheduleFillConsumerRestart, consumeFillQueue, processFillsWithBootstrapMode };
+export { wireProcessedFillTracking, flushProcessedFillPersistence, flushProcessedFillPersistenceForKeys, buildOrphanFillFallbackKey, applyReplaySafeFillAccounting, applyReplaySafeTrackedFillAccounting, applyReplaySafeOrphanFillAccounting, processSweepOrphanFill, createFillCallback, maxConsecutiveFillConsumerFailures, computeFillConsumerBackoffMs, scheduleFillConsumerRestart, shouldDeferFillForBroadcast, consumeFillQueue, processFillsWithBootstrapMode };
 //# sourceMappingURL=dexbot_fill_runtime.js.map