dexbot 1.5.3 → 1.6.1

package/dist/modules/order/manager.js

@@ -27,9 +27,9 @@ import SyncEngine from './sync_engine.js';
 import { calculateCurrentSpread, checkSpreadCondition, checkGridHealth } from './grid.js';
 import * as Format from './format.js';
 import { ORDER_TYPES, ORDER_STATES, REBALANCE_STATES, DEFAULT_CONFIG, TIMING, LOG_LEVEL, PIPELINE_TIMING, COW_PERFORMANCE, COW_ACTIONS, GRID_LIMITS } from '../constants.js';
-import { getMinOrderSize, computeChainFundTotals, hasValidAccountTotals, resolveConfigValueWithRegistry, isExplicitZeroAllocation, floatToBlockchainInt, validateBoundaryCommit, resolveGapSlots } from './utils/math.js';
+import { getMinOrderSize, computeChainFundTotals, hasValidAccountTotals, resolveConfigValueWithRegistry, isExplicitZeroAllocation, floatToBlockchainInt, validateBoundaryCommit, resolveGapSlots, resolveGapBand, isSlotInRail } from './utils/math.js';
 import { validateOrder, validateGridForPersistence, validateWorkingGridFunds, checkFundDrift, reconcileGrid, optimizeRebalanceActions, projectTargetToWorkingGrid, buildStateUpdates, buildAbortedResult, buildSuccessResult, evaluateCommit } from './utils/validate.js';
-import { resolveSpreadOrderSide, parseSlotIndex, parseChainOrder, geometryTypeForSlotIndex, isOrderOnChain } from './utils/order.js';
+import { resolveSpreadOrderSide, parseSlotIndex, parseChainOrder, geometryTypeForSlotIndex, isOrderOnChain, resolveReserveCount, resolveLiveReserveEdgeAnchorPrice, compareReserveEdge, collectRefillSlotIds } from './utils/order.js';
 import { getErrorMessage } from '../utils/errors.js';
 const { toFiniteNumber } = Format;
 // ===============================================================================
@@ -133,7 +133,7 @@ class COWRebalanceEngine {
         this.assets = deps.assets;
         this.config = deps.config;
     }
-    async execute({ masterGrid, gridVersion, boundaryIdx, funds, fills = [], excludeIds = new Set(), gapSlots = null, evacStreaks = null }) {
+    async execute({ masterGrid, gridVersion, boundaryIdx, funds, fills = [], excludeIds = new Set(), gapSlots = null, evacStreaks = null, reserveEdgeAnchors = null }) {
         const startTime = Date.now();
         const workingGrid = new WorkingGrid(masterGrid, { baseVersion: gridVersion });
         const strategyParams = {
@@ -146,6 +146,27 @@ class COWRebalanceEngine {
             currentBoundaryIdx: boundaryIdx
         };
         const { targetGrid, boundaryIdx: targetBoundary } = this.strategy.calculateTargetGrid(strategyParams);
+        // P4 / unanchored plan: the strategy returns a null boundary paired
+        // with an EMPTY target grid only when no numeric center exists to
+        // recover from (e.g. GRID-LOAD rejected the persisted boundary AND
+        // startPrice is an unresolved mode string). Planning rotations here
+        // would fabricate rail-edge geometry — dust-cancel fills included,
+        // even though they deliberately carry isDelayedRotationTrigger when
+        // the boundary is known. Route to a structural resync instead of
+        // broadcasting. (A null boundary with a non-empty target is a
+        // hand-built/boundary-less plan — e.g. unit mocks — and proceeds.)
+        if ((targetBoundary === null || targetBoundary === undefined) && targetGrid.size === 0) {
+            // A genuinely empty grid (no master orders, no fills) has nothing
+            // to heal — plain abort. Anything else is stranded without an
+            // anchor and needs a rebuild.
+            const needsHeal = (masterGrid?.size ?? 0) > 0 || (fills?.length ?? 0) > 0;
+            this.logger?.log('[COW] Plan skipped: boundary unrecoverable (no numeric center)' + (needsHeal ? '; requesting structural resync' : ''), 'warn');
+            return {
+                ...buildAbortedResult('boundary-unrecoverable'),
+                evacReady: [],
+                ...(needsHeal ? { needsResync: true, resyncReason: 'boundary-unrecoverable' } : {}),
+            };
+        }
         let dustThresholdPercent = this.config?.gridLimits?.PARTIAL_DUST_THRESHOLD_PERCENTAGE;
         const reconcileResult = reconcileGrid(masterGrid, targetGrid, targetBoundary, {
             logger: (msg, level) => this.logger?.log(msg, level),
@@ -194,14 +215,33 @@ class COWRebalanceEngine {
             optimizedActions.length = 0;
             optimizedActions.push(...guarded);
         }
+        // Rail-edge truncation telemetry: when the planned window runs off
+        // the rail (sellStart past the last slot), one side can never place
+        // — the Sep-10 signature (boundary 209 on a 216-slot rail left 2
+        // sell slots, and the ordinal pairing then teleported the buy rail
+        // 113 slots). Warn only: the cross-guard, fund validation and
+        // boundary-hold still judge the plan; no geometry is refused here.
+        {
+            const railSize = targetGrid?.size ?? 0;
+            const gap = Number(gapSlots) || 0;
+            const sellStart = Number(targetBoundary) + gap + 1;
+            if (Number.isFinite(sellStart) && railSize > 0 && sellStart >= railSize) {
+                this.logger?.log(`[COW] Rail-edge plan: boundary=${targetBoundary} gap=${gap} rail=${railSize} (sellStart=${sellStart}); window truncated, guards still apply`, 'warn');
+            }
+        }
         // Refill-slot wire (boundary-hold): surviving hole-CREATEs justify this
         // plan's boundary shift (folded CANCEL+CREATE pairs already became
         // stamped UPDATEs above; stale-dropped placements are excluded — a
         // deferred placement justifies nothing). The executor holds the
         // committed boundary when a listed refill is guard-skipped.
-        const refillSlotIds = optimizedActions
-            .filter((a) => a?.type === COW_ACTIONS.CREATE && typeof a?.id === 'string' && a.id.length > 0)
-            .map((a) => a.id);
+        // Reserve-ladder CREATEs are excluded (collectRefillSlotIds): reserves
+        // are static edge insurance and their fills never crawl, so a skipped
+        // reserve must not pin geometry either.
+        const refillSlotIds = collectRefillSlotIds(optimizedActions, {
+            config: this.config,
+            slots: masterGrid,
+            edgeAnchors: reserveEdgeAnchors
+        });
         projectTargetToWorkingGrid(workingGrid, targetGrid, { actions: optimizedActions });
         const precisions = {
             buyPrecision: this.assets?.assetB?.precision,
@@ -380,12 +420,20 @@ class OrderManager {
     _gridDirtyAt;
     _lastStaleTotalsWarnAt;
     _orphanFillsCreditedAt;
+    _fundDriftLedger;
     _pendingRecovery;
+    _pendingFillCrawls;
     _recentFillKeysSnapshot;
     _lastFilledBuyPrice;
     _lastFilledSellPrice;
     _lastFilledPrice;
     _lastFilledType;
+    _lastFilledAt;
+    _deferredRebalanceAt;
+    _lastHeldPlanSignature;
+    _heldPlanSuppressionCount;
+    _onBroadcastRegionEndListeners;
+    _lastBoundaryHoldResyncAt;
     _gapEvacStreaks;
     _gapEvacCancelQueued;
     // anchor fields removed
@@ -493,13 +541,21 @@ class OrderManager {
         this._gapSlots = 0;
         this._gridDirtyAt = null;
         this._orphanFillsCreditedAt = null;
+        this._fundDriftLedger = null;
         this._pendingRecovery = null;
+        this._pendingFillCrawls = [];
         this._recentFillKeysSnapshot = null;
         this._lastStaleTotalsWarnAt = {};
         this._lastFilledBuyPrice = null;
         this._lastFilledSellPrice = null;
         this._lastFilledPrice = null;
         this._lastFilledType = null;
+        this._lastFilledAt = 0;
+        this._deferredRebalanceAt = 0;
+        this._lastHeldPlanSignature = null;
+        this._heldPlanSuppressionCount = 0;
+        this._onBroadcastRegionEndListeners = [];
+        this._lastBoundaryHoldResyncAt = 0;
         this._gapEvacStreaks = new Map();
         this._gapEvacCancelQueued = new Set();
         this._metrics = {
@@ -645,6 +701,11 @@ class OrderManager {
                 // The caller is released from the refcount contract.
                 this._broadcastingFlag = 0;
                 this._broadcastingStartedAt = 0;
+                // A leaked flag never reaches stopBroadcasting, so wake the same
+                // region-end listeners it would have: without this, fills
+                // enqueued during the hung region are stranded until the next
+                // fill event even though the flag is now clear.
+                this._fireBroadcastRegionEnd();
             }
         }
     }
@@ -717,8 +778,57 @@ class OrderManager {
             // this flag is held and its defer branch returns without
             // rescheduling, so fills enqueued during a long region would
             // starve indefinitely. Fire once when the last region ends.
+            this._fireBroadcastRegionEnd();
+        }
+    }
+    /**
+     * Notify runtime listeners that the last broadcast/placement region ended.
+     * Called from stopBroadcasting (refcount -> 0) and the stale-flag watchdog
+     * (a leaked flag hard-reset to 0). The fill consumer's defer branch returns
+     * without rescheduling, so this is the only wake-up for fills enqueued
+     * during a region; the watchdog path must fire it too or a hung broadcast's
+     * queued fills wait for the next fill event.
+     * Fans out to the legacy single listener plus every registered listener
+     * (see addBroadcastRegionEndListener): a second wirer must never silently
+     * displace the fill-queue drain. Guarded so a listener error never escapes
+     * into a finally/watchdog frame.
+     * @returns {void}
+     */
+    _fireBroadcastRegionEnd() {
+        try {
             this._onBroadcastRegionEnd?.();
         }
+        catch (err) {
+            this.logger?.log?.(`[BROADCAST] Region-end hook failed: ${err?.message || err}`, 'warn');
+        }
+        const listeners = this._onBroadcastRegionEndListeners;
+        if (Array.isArray(listeners)) {
+            for (const listener of listeners) {
+                try {
+                    listener?.();
+                }
+                catch (err) {
+                    this.logger?.log?.(`[BROADCAST] Region-end listener failed: ${err?.message || err}`, 'warn');
+                }
+            }
+        }
+    }
+    /**
+     * Register an additional broadcast-region-end listener without displacing
+     * the legacy single listener or previously registered ones. Duplicate
+     * registrations of the same function reference are ignored.
+     * @param {() => void} listener
+     * @returns {void}
+     */
+    addBroadcastRegionEndListener(listener) {
+        if (typeof listener !== 'function')
+            return;
+        if (!Array.isArray(this._onBroadcastRegionEndListeners)) {
+            this._onBroadcastRegionEndListeners = [];
+        }
+        const listeners = this._onBroadcastRegionEndListeners;
+        if (!listeners.includes(listener))
+            listeners.push(listener);
     }
     /**
      * Reset funds structure to zeroed values. Acquires _fundLock so the
@@ -1147,7 +1257,14 @@ class OrderManager {
         if (options === null || typeof options !== 'object' || Array.isArray(options)) {
             throw new TypeError('Commit options must be an object');
         }
-        return { skipRecalc: options.skipRecalc === true };
+        return {
+            skipRecalc: options.skipRecalc === true,
+            // Set by the COW refill hold: the boundary passed to this commit is
+            // the COMMITTED value, not the plan's target, so nothing was
+            // derived into it and owed fill crawls must survive (see the
+            // pending-crawl bookkeeping in _commitWorkingGrid).
+            boundaryHeld: options.boundaryHeld === true
+        };
     }
     async _updateOrder(order, context = 'updateOrder', options = {}) {
         const updateOptions = this._normalizeOrderUpdateOptions(options);
@@ -1354,14 +1471,23 @@ class OrderManager {
      * @param {Object} [options]
      * @returns {Promise<any>}
      */
-    async processFilledOrders(orders, excl, _options) {
+    async processFilledOrders(orders, excl, options = {}) {
         // Step 1: Handle Fills (Accounting & State Updates)
         await this.strategy.processFillsOnly(orders, excl);
         // Step 2: Trigger Safe Rebalance only for actual fills.
         const triggerFills = orders.filter((f) => !f.isPartial || f.isDelayedRotationTrigger);
         const shouldRebalance = triggerFills.length > 0;
         if (shouldRebalance) {
-            const rebalanceResult = await this.performSafeRebalance(orders, excl);
+            // deferIfBroadcasting: fill processing runs under
+            // _fillProcessingLock, and _awaitBroadcastIdle can sleep 30s —
+            // beyond the lock's 20s acquisition timeout. Defer the rebalance
+            // instead of waiting in-lock; processFillsOnly already recorded
+            // the boundary crawls, so a later derivation applies them. The
+            // region-end hook schedules the deferred rebalance.
+            const rebalanceResult = await this.performSafeRebalance(orders, excl, {
+                ...(options || {}),
+                deferIfBroadcasting: true
+            });
             // Carry the fill set + exclusions on the result so the COW batch
             // executor can re-plan once from fresh master if the plan goes
             // stale between planning and broadcast.
@@ -1396,11 +1522,21 @@ class OrderManager {
         const buyPrecision = this.assets?.assetB?.precision;
         const minSellSizeInt = floatToBlockchainInt(minSellSize, sellPrecision);
         const minBuySizeInt = floatToBlockchainInt(minBuySize, buyPrecision);
+        // Rail membership by geometry (shared isSlotInRail), mirroring the
+        // reconcile pickers (_pickVirtualSlotsToActivate / _pickEdgeReserveSlots).
+        // A freshly generated grid's roles never need this, but the gate keeps
+        // the startup placement path and the runtime activation path from
+        // diverging: a slot whose stored type is stale relative to the current
+        // boundary must not be placed on the wrong rail.
+        const resolved = resolveGapBand(this);
+        const inRailFor = (type, o) => isSlotInRail(resolved.boundaryIdx, resolved.gapSlots, type, o);
         // Get closest virtual sells (lowest prices first = closest to market),
         // selecting up to sellCount orders that pass the minimum-size filter.
         // Scan the full sorted rail instead of slicing first so sub-min slots
         // don't consume activation budget (mirrors _pickVirtualSlotsToActivate).
         const sellsClosestFirst = this.getOrdersByTypeAndState(ORDER_TYPES.SELL, ORDER_STATES.VIRTUAL)
+            .filter((o) => inRailFor(ORDER_TYPES.SELL, o))
+            .filter((o) => parseSlotIndex(o?.id) !== null)
             .sort((a, b) => a.price - b.price);
         const validSells = [];
         for (const o of sellsClosestFirst) {
@@ -1415,6 +1551,8 @@ class OrderManager {
         // Get closest virtual buys (highest prices first = closest to market),
         // selecting up to buyCount orders that pass the minimum-size filter.
         const buysClosestFirst = this.getOrdersByTypeAndState(ORDER_TYPES.BUY, ORDER_STATES.VIRTUAL)
+            .filter((o) => inRailFor(ORDER_TYPES.BUY, o))
+            .filter((o) => parseSlotIndex(o?.id) !== null)
             .sort((a, b) => b.price - a.price);
         const validBuys = [];
         for (const o of buysClosestFirst) {
@@ -1426,7 +1564,37 @@ class OrderManager {
         }
         // Reverse for placement order (lowest first)
         validBuys.sort((a, b) => a.price - b.price);
-        return [...validSells, ...validBuys];
+        // Reserve ladder: edge-pinned orders activate alongside the window
+        // without consuming its budget. Buys pin at the floor (lowest first),
+        // sells at the ceiling (highest first). Same min-size gate as the window.
+        const pickEdgeReserves = (orderType, count, windowed, precision, minSizeInt, ascending) => {
+            const picked = [];
+            if (count <= 0)
+                return picked;
+            const windowedIds = new Set(windowed.map((o) => o.id));
+            // Both edges anchor at the live grid's own edge (ladder/rail extreme).
+            const edgeAnchor = resolveLiveReserveEdgeAnchorPrice(this, ascending ? 'buy' : 'sell');
+            const edge = ascending ? 'floor' : 'ceiling';
+            const edgeFirst = this.getOrdersByTypeAndState(orderType, ORDER_STATES.VIRTUAL)
+                .filter((o) => inRailFor(orderType, o))
+                .filter((o) => parseSlotIndex(o.id) !== null)
+                .sort((a, b) => compareReserveEdge(a, b, edge, edgeAnchor));
+            for (const o of edgeFirst) {
+                if (picked.length >= count)
+                    break;
+                if (windowedIds.has(o.id))
+                    continue;
+                if (floatToBlockchainInt(o.size, precision) >= minSizeInt) {
+                    picked.push(o);
+                    windowedIds.add(o.id);
+                }
+            }
+            picked.sort((a, b) => ascending ? a.price - b.price : b.price - a.price);
+            return picked;
+        };
+        const reserveBuys = pickEdgeReserves(ORDER_TYPES.BUY, resolveReserveCount(this.config, 'buy'), validBuys, buyPrecision, minBuySizeInt, true);
+        const reserveSells = pickEdgeReserves(ORDER_TYPES.SELL, resolveReserveCount(this.config, 'sell'), validSells, sellPrecision, minSellSizeInt, false);
+        return [...validSells, ...reserveSells, ...validBuys, ...reserveBuys];
     }
     /**
      * Get orders matching the specified type and state.
@@ -1479,6 +1647,34 @@ class OrderManager {
         this.boundaryIdx = newIdx;
         this._logBoundaryDebug('restore', newIdx);
     }
+    /**
+     * Drop owed fill-crawl records (boundary bookkeeping).
+     *
+     * Records are pushed per shift-eligible fill at intake and consumed when a
+     * derivation commits them. They must be dropped only when the crawl they
+     * encode has been applied — an accepted commit that used the PLAN's target
+     * boundary (or an absolute fill anchor that subsumes every owed delta).
+     * A held boundary (refill guard skip), a gate-rejected boundary, and a
+     * null boundary all leave the records owed, so they are not dropped there.
+     *
+     * Also used when the boundary is (re)anchored outside the fill path (grid
+     * reset / recenter / rejected-snapshot rebuild): those records belong to
+     * the previous generation, and applying their relative deltas onto a fresh
+     * anchor would double-count movement the anchor already contains.
+     *
+     * Marks the grid dirty so the cleared array reaches disk even on paths
+     * that do not otherwise persist.
+     *
+     * @param {string} reason - Log/debug label for the drop
+     */
+    _clearPendingFillCrawls(reason = 'unspecified') {
+        if (!Array.isArray(this._pendingFillCrawls) || this._pendingFillCrawls.length === 0)
+            return;
+        const count = this._pendingFillCrawls.length;
+        this._pendingFillCrawls = [];
+        this._markGridDirty();
+        this.logger?.log?.(`[BOUNDARY] Dropped ${count} owed fill crawl(s) (${reason})`, 'debug');
+    }
     /**
      * Observability (fix #4, docs/CONSOLIDATED_ORPHAN_FIX_SUMMARY.md §2): emit the live
      * boundary whenever roles are (re)assigned, so a silent boundary crawl that
@@ -1549,6 +1745,7 @@ class OrderManager {
                 this._lastFilledBuyPrice = price;
             else if (f.type === ORDER_TYPES.SELL)
                 this._lastFilledSellPrice = price;
+            this._lastFilledAt = Date.now();
             recorded++;
             lastKind = f?.isPartial === true ? 'partial' : (f?.isPartial === false ? 'full' : 'unknown');
             lastPriceSrc = priceSrc;
@@ -1912,12 +2109,60 @@ class OrderManager {
      */
     async performSafeRebalance(fills = [], excludeIds = new Set(), options = {}) {
         this.logger.log("[SAFE-REBALANCE] Starting with COW...", "info");
+        // A fresh fill set re-enables planning and ends any held-plan
+        // suppression run counted below; the next fill-less streak counts
+        // from zero. Reset on entry (even for broadcast-deferred calls):
+        // the fills arrived, so the identical-plan assumption is void.
+        if (fills.length > 0 && (this._heldPlanSuppressionCount || 0) > 0) {
+            this._heldPlanSuppressionCount = 0;
+        }
         if (!options?.skipBroadcastWait) {
-            const idle = await this._awaitBroadcastIdle();
-            if (idle.shutdown || this._shuttingDown) {
+            // Shutdown guard applies to every path here (including the
+            // deferIfBroadcasting defer path, which never reaches
+            // _awaitBroadcastIdle): a rebalance must not plan/broadcast while
+            // the bot is shutting down. _awaitBroadcastIdle returns
+            // shutdown:true for this, so keep it explicit when skipping it.
+            if (this._shuttingDown) {
                 this.logger.log('[SAFE-REBALANCE] Aborting rebalance: shutdown in progress', 'warn');
                 return buildAbortedResult('Shutdown in progress — safe rebalance aborted');
             }
+            // Never sleep on the broadcast flag while holding
+            // _fillProcessingLock (the lock's acquisition timeout is 20s; the
+            // wait is 30s). A fill-driven rebalance defers instead, leaving
+            // the crawls recorded by processFillsOnly for a later derivation.
+            if (options?.deferIfBroadcasting && this.isBroadcastingActive()) {
+                this.logger.log('[SAFE-REBALANCE] Deferred: broadcast/placement activity active; rebalance retries after the region ends', 'info');
+                this._deferredRebalanceAt = Date.now();
+                return { ...buildAbortedResult('broadcast-active-deferred'), deferred: true };
+            }
+            // Identical-held-plan suppression: a fill-less replan whose
+            // boundary, guard pivot and fill timestamp are unchanged since the
+            // last hold can only reproduce the same vetoed plan (INV-COW-007).
+            // Defer instead of spending another broadcast region re-deriving
+            // it; a fresh fill changes _lastFilledAt and re-enables planning.
+            const heldSig = this._lastHeldPlanSignature;
+            if (fills.length === 0 && heldSig
+                && Number(this.boundaryIdx) === Number(heldSig.boundaryIdx)
+                && Number(this._lastFilledPrice) === Number(heldSig.pivot)
+                && Number(this._lastFilledAt) === Number(heldSig.fillsAt)) {
+                // Counted visibility: a fill-less replan is suppressed until a
+                // fresh fill arrives, so a stale grid that produces no fills
+                // can sit in this branch forever. The spread-correction path
+                // (independent of this suppression) and the out-of-spread
+                // persistence watchdog are the heal paths — surface the run
+                // instead of hiding it at debug.
+                this._heldPlanSuppressionCount = (Number(this._heldPlanSuppressionCount) || 0) + 1;
+                const n = this._heldPlanSuppressionCount;
+                this.logger.log(`[SAFE-REBALANCE] Deferred: identical held plan (no new fills since last hold; suppression #${n}); a fill-driven plan will re-derive`, (n === 1 || n % 10 === 0) ? 'warn' : 'debug');
+                return { ...buildAbortedResult('held-plan-unchanged-deferred'), deferred: true };
+            }
+            if (!options?.deferIfBroadcasting) {
+                const idle = await this._awaitBroadcastIdle();
+                if (idle.shutdown || this._shuttingDown) {
+                    this.logger.log('[SAFE-REBALANCE] Aborting rebalance: shutdown in progress', 'warn');
+                    return buildAbortedResult('Shutdown in progress — safe rebalance aborted');
+                }
+            }
         }
         return await this._gridLock.acquire(async () => {
             return await this._applySafeRebalanceCOW(fills, excludeIds);
@@ -1933,6 +2178,13 @@ class OrderManager {
             this._gapEvacStreaks = new Map();
         if (!(this._gapEvacCancelQueued instanceof Set))
             this._gapEvacCancelQueued = new Set();
+        // Live reserve edge anchors, resolved once and shared with the engine's
+        // refill wire so a reserve-ladder CREATE can never be classified as a
+        // hole refill (which would let a skipped reserve pin the boundary).
+        const reserveEdgeAnchors = {
+            buy: resolveLiveReserveEdgeAnchorPrice(this, 'buy'),
+            sell: resolveLiveReserveEdgeAnchorPrice(this, 'sell')
+        };
         const result = await cowEngine.execute({
             masterGrid: this.orders,
             gridVersion: this._gridVersion,
@@ -1941,7 +2193,8 @@ class OrderManager {
             fills,
             excludeIds,
             gapSlots: this._gapSlots,
-            evacStreaks: this._gapEvacStreaks
+            evacStreaks: this._gapEvacStreaks,
+            reserveEdgeAnchors
         });
         // Phase 3 safety net: act on stuck in-band orders regardless of the
         // plan outcome — a plan that aborted for unrelated reasons must not
@@ -2011,7 +2264,7 @@ class OrderManager {
             }
         };
         try {
-            const { skipRecalc: skipRecalcOpt } = this._normalizeCommitOptions(options);
+            const { skipRecalc: skipRecalcOpt, boundaryHeld } = this._normalizeCommitOptions(options);
             skipRecalc = skipRecalcOpt;
             const stats = workingGrid.getMemoryStats();
             try {
@@ -2074,6 +2327,22 @@ class OrderManager {
                 }
                 this.orders = Object.freeze(finalMap);
                 this._setBoundary(commitBoundary);
+                // Pending-crawl bookkeeping: an accepted non-null commit
+                // incorporates (incremental derivation) or subsumes (absolute
+                // recovery anchor) every fill recorded so far, so all pending
+                // crawl entries are consumed here. A gate-rejected commit keeps
+                // the previous boundary — nothing was derived into it — so
+                // pending entries survive for the next derivation. A null
+                // commit likewise consumes nothing, and neither does a HELD
+                // boundary (boundaryHeld): the refill hold deliberately keeps
+                // the committed boundary over the plan's target, so the shift
+                // those records encode was never applied and must stay owed —
+                // clearing here lost the crawl permanently (no fill evidence
+                // left for the next derivation, holes refilled same-side).
+                if (boundaryCheck.ok && commitBoundary !== null && commitBoundary !== undefined
+                    && boundaryHeld !== true) {
+                    this._clearPendingFillCrawls('boundary commit');
+                }
                 this._gridVersion++;
                 committed = true;
                 // Track orderIds from successful COW commits for recovery sync protection.