outcometick 1.5.2 → 1.6.1

package/index.d.ts

@@ -132,10 +132,37 @@ export interface Ctx<P = Record<string, unknown>> {
   assert_outcome(market: unknown, outcome: Side): void;
 }
 
-export interface OrderInit {
+/**
+ * Size an order in contracts, or in money.
+ *
+ * A union rather than two optional fields, so `{ size, notional }` together is
+ * a compile error rather than a run-time rejection: they answer the same
+ * question two ways and there is no sensible reading of both.
+ */
+export type OrderSizing =
+  | {
+    /** Contracts. Must be positive. */
+    size: number;
+    notional?: never;
+  }
+  | {
+    size?: never;
+    /**
+     * Spend at most this much, converted to contracts as
+     * `floor(notional / limit)`.
+     *
+     * REQUIRES `limit`, which is why this arm makes it non-optional: a
+     * contract costs whatever it fills at and a marketable order walks the
+     * book, so dividing by the current best price overspends the moment there
+     * is any slippage. The limit is the price you have already said you will
+     * not exceed, which is what makes "at most" true.
+     */
+    notional: number;
+    limit: number;
+  };
+
+export type OrderInit = OrderSizing & {
   side: Side;
-  /** Contracts. Must be positive. */
-  size: number;
   /**
    * A bound in whichever direction protects you: a ceiling when opening, a
    * floor when reducing. Must be within [0, 1] — a binary outcome token
@@ -149,7 +176,7 @@ export interface OrderInit {
   /** Only 'ioc' is modelled; anything else is rejected at construction. */
   tif?: 'ioc';
   tag?: string | null;
-}
+};
 
 /**
  * An order a hook returns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "outcometick",
-  "version": "1.5.2",
+  "version": "1.6.1",
   "description": "Strategy SDK and CLI for outcometick prediction-market backtests",
   "type": "module",
   "license": "MIT",

package/runner/archive.mjs

@@ -123,10 +123,26 @@ function csvField(v) {
 }
 
 /** Rows to CSV with a fixed column order, so a diff between runs is meaningful. */
+/**
+ * A UTF-8 byte-order mark.
+ *
+ * Excel opens a .csv as the system ANSI code page unless the file says
+ * otherwise, and the only thing it accepts as saying otherwise is this. The
+ * symptom was a calibration bucket reading `0.30 釴?0.40` — an en dash, three
+ * UTF-8 bytes, read as GBK. That is not a Chinese-locale problem: it is every
+ * non-ASCII byte in every one of these files, including the `tag` a strategy
+ * puts on its own fills, which we do not control at all.
+ *
+ * Parsers that do not expect it see one stray character on the first header;
+ * `encoding='utf-8-sig'` is the standard remedy. A spreadsheet that mangles
+ * the whole file is the worse failure, and it is the one that was happening.
+ */
+const BOM = '\uFEFF';
+
 export function toCsv(rows, columns) {
   const out = [columns.join(',')];
   for (const row of rows) out.push(columns.map((c) => csvField(row[c])).join(','));
-  return `${out.join('\n')}\n`;
+  return `${BOM}${out.join('\n')}\n`;
 }
 
 const TRADE_COLUMNS = [
@@ -141,14 +157,17 @@ const FILL_COLUMNS = [
 /**
  * Assemble the archive a customer downloads.
  *
- * The submitted source goes IN, deliberately: a report that cannot be tied back
- * to the exact code that produced it is not reproducible, and "which version of
- * my strategy was this?" is the first question anyone asks a week later.
+ * THE SOURCE IS NOT IN IT. It used to be, so that a report could be tied back
+ * to the exact code that produced it — "which version of my strategy was
+ * this?" is the first question anyone asks a week later. That question is now
+ * answered by `source_sha256` in report.json instead: the same identification,
+ * without handing back a copy of the code. Shipping the strategy inside the
+ * deliverable made a report something you cannot forward to anyone.
  *
  * sha256sums.txt covers every other entry, so the whole thing is verifiable
  * without trusting the transport.
  */
-export async function buildArchive({ runId, report, trades, fills, logs, source }) {
+export async function buildArchive({ runId, report, trades, fills, logs }) {
   const entries = [
     { name: 'report.json', data: `${JSON.stringify(report, null, 2)}\n` },
     { name: 'trades.csv', data: toCsv(trades, TRADE_COLUMNS) },
@@ -158,18 +177,10 @@ export async function buildArchive({ runId, report, trades, fills, logs, source
       name: 'calibration.csv',
       data: toCsv(report.calibration ?? [], ['bucket', 'implied', 'realized', 'edge_cents', 'trades']),
     },
-    {
-      name: 'latency.csv',
-      data: toCsv(report.latency ?? [], ['label', 'delay_ms', 'net_pnl', 'ratio', 'unprofitable']),
-    },
     { name: 'coverage.json', data: `${JSON.stringify(report.coverage ?? {}, null, 2)}\n` },
     { name: 'logs.txt', data: logs ?? '' },
   ];
 
-  for (const f of source ?? []) {
-    entries.push({ name: `strategy/${f.name}`, data: f.content });
-  }
-
   // Checksums last, over everything above.
   const sums = entries
     .map(({ name, data }) => {

package/runner/engine/book.mjs

@@ -209,7 +209,18 @@ export function matchOrder(book, order) {
   const quotedPx = ladder.best();
 
   const { fills, remaining, notional } = ladder.take(size, order.limit ?? null);
-  const filled = size - remaining;
+  // SUMMED FROM WHAT WAS TAKEN, not derived as `size - remaining`.
+  //
+  // `remaining` is the requested size with each level's depth subtracted from
+  // it, and at IEEE-754 precision `1e308 - 1000` is still `1e308`. So a huge
+  // but finite order consumed the whole ladder while reporting `filled: 0` —
+  // no position, no cash, no trade row, and an empty book for every order
+  // after it in that market. The report said nothing happened; the book said
+  // otherwise.
+  //
+  // Adding up the levels actually taken cannot drift from what was removed,
+  // because it IS what was removed. otengine.py mirrors this.
+  const filled = fills.reduce((a, f) => a + f.size, 0);
 
   return {
     fills,

package/runner/engine/feed.mjs

@@ -0,0 +1,116 @@
+// Point-in-time views over an out-of-band series.
+//
+// `ctx.ref(name)` and `ctx.ext(name)` both call `feed.viewAt(ctx.now)` and hand
+// the result to the strategy. Until now nothing implemented `viewAt`: the
+// manifest validator accepted `reference` and `series`, the run was queued and
+// billed, and the strategy crashed on its first `ctx.ref(...)` with a message
+// claiming the feed had not been declared — which it had.
+//
+// Two properties this file exists to guarantee:
+//
+//   1. NOTHING STAMPED AFTER ctx.now IS REACHABLE. Not filtered on the way out
+//      — the cursor never advances past `now`, so a later row is not something
+//      the strategy can ask for. That is the same promise the event replay
+//      makes, and a reference feed is exactly where it would otherwise leak:
+//      the whole point of an outside series is that we hold all of it up front.
+//
+//   2. WHAT THE STRATEGY GETS IS A COPY. `ctx.book()` and `ctx.history()` were
+//      both caught handing out live objects a strategy could rewrite, and a
+//      rewritten reference row would poison every later window() over it.
+//
+// `lagMs` models publication delay: a row is not visible until ts_ms + lagMs,
+// which is how you backtest a signal you could not have had instantly.
+
+/** Frozen, prototype-less copy of one row. */
+function freezeRow(row) {
+  const out = Object.create(null);
+  for (const k of Object.keys(row)) out[k] = row[k];
+  return Object.freeze(out);
+}
+
+export class PointInTimeFeed {
+  /**
+   * @param rows   ascending by ts_ms. Not copied — this class owns them and
+   *               never hands one out directly.
+   * @param lagMs  publication delay; a row becomes visible at ts_ms + lagMs.
+   */
+  constructor(rows, { lagMs = 0 } = {}) {
+    this.rows = rows;
+    this.lagMs = Number(lagMs) || 0;
+    // Monotone cursor: the replay only ever moves forward, so the whole feed is
+    // walked once across a market-day rather than binary-searched per call.
+    // `ctx.now` never goes backwards within a market — but a fresh feed is
+    // built per market, so this is not an assumption about the strategy.
+    this.cursor = 0;
+  }
+
+  /** Index one past the last row visible at `now`. */
+  _visibleCount(now) {
+    const limit = now - this.lagMs;
+    while (this.cursor < this.rows.length && this.rows[this.cursor].ts_ms <= limit) {
+      this.cursor += 1;
+    }
+    // Defensive: if time moved backwards, do not report rows from the future.
+    if (this.cursor > 0 && this.rows[this.cursor - 1].ts_ms > limit) {
+      let i = this.cursor;
+      while (i > 0 && this.rows[i - 1].ts_ms > limit) i -= 1;
+      return i;
+    }
+    return this.cursor;
+  }
+
+  viewAt(now) {
+    const n = this._visibleCount(now);
+    const rows = this.rows;
+    // Captured, not read off `this`: the object below is what the strategy
+    // holds, so `this` inside its methods is that frozen view — `this.lagMs`
+    // was undefined there and turned the clamp into NaN, which made at() return
+    // null for every timestamp.
+    const { lagMs } = this;
+    const horizon = now - lagMs;
+    return Object.freeze({
+      /** The most recent row at or before now, or null. */
+      get last() { return n > 0 ? freezeRow(rows[n - 1]) : null; },
+
+      /** The last `k` visible rows, oldest first. Never more than exist. */
+      window(k) {
+        const want = Math.max(0, Math.min(Number(k) || 0, n));
+        const out = [];
+        for (let i = n - want; i < n; i += 1) out.push(freezeRow(rows[i]));
+        return out;
+      },
+
+      /**
+       * The row in effect at `ts`. Clamped to now: asking for a later
+       * timestamp cannot reach a later row.
+       */
+      at(ts) {
+        const asked = Number(ts);
+        const t = Number.isFinite(asked) ? Math.min(asked, horizon) : horizon;
+        let lo = 0;
+        let hi = n - 1;
+        let found = -1;
+        while (lo <= hi) {
+          const mid = (lo + hi) >> 1;
+          if (rows[mid].ts_ms <= t) { found = mid; lo = mid + 1; } else { hi = mid - 1; }
+        }
+        return found >= 0 ? freezeRow(rows[found]) : null;
+      },
+    });
+  }
+}
+
+/**
+ * Build the feeds a run declared, keyed by the name the strategy will ask for.
+ *
+ * @param declared  manifest names, e.g. ['binance:btcusdt:spot:1s']
+ * @param rowsByName  name -> ascending rows
+ * @param lagByName   name -> publication lag in ms
+ */
+export function buildFeeds(declared, rowsByName, lagByName = {}) {
+  const out = new Map();
+  for (const name of declared ?? []) {
+    out.set(name, new PointInTimeFeed(rowsByName[name] ?? [], { lagMs: lagByName[name] ?? 0 }));
+  }
+  return out;
+}

package/runner/engine/portfolio.mjs

@@ -129,8 +129,74 @@ export class Portfolio {
     if (!isSide(order?.side)) { this.rejected += 1; return null; }
 
     const leg = this.#legs(marketId)[order.side];
-    let size = Number(order.size);
-    if (!(size > 0)) { this.rejected += 1; return null; }
+
+    // ONE PLACE THAT DECIDES WHETHER AN ORDER IS USABLE.
+    //
+    // This was three separate checks bolted on one at a time, and each time a
+    // new shape of bad input walked past the ones already there — an infinite
+    // notional, then a size and a notional together, then a bad `limit` on a
+    // plain size order. Whack-a-mole on a consumption point is how you end up
+    // with an engine that rejects what it happens to have been asked about.
+    //
+    // Every unusable order is COUNTED AND RETURNS NULL. Never thrown: a bad
+    // order is one order, and otengine.py raising ValueError/OverflowError on
+    // the same input turned "reject one order" into "fail the whole run" —
+    // same input, two different outcomes, in a product whose whole promise is
+    // that the two engines are the same engine. That mirror is held to this
+    // table by runner/conformance.
+    // A NUMBER, not something Number() is willing to turn into one.
+    //
+    // Coercion is not validation: `Number('10')` is 10, `Number([10])` is 10,
+    // `Number(true)` is 1. Python's `float()` agrees about the string and the
+    // bool and RAISES on the list — so `{ size: [10] }` filled ten contracts
+    // in JS and was rejected in Python, from one strategy, on one input.
+    //
+    // The SDK's Order requires a number and the docs say a number. Anything
+    // else is a mistake in the strategy, and a mistake that fills is worse
+    // than one that is counted.
+    const finite = (v) => (
+      typeof v === 'number' && Number.isFinite(v) ? v : null
+    );
+
+    const hasSize = order.size != null;
+    const hasNotional = order.notional != null;
+    // Contradictory instructions. Choosing one silently would trade a contract
+    // count while the author believed they had set a spending cap.
+    if (hasSize === hasNotional) { this.rejected += 1; return null; }
+
+    // A limit is optional, but a limit that is PRESENT must be a price: an
+    // outcome token trades in [0, 1], and `limit: 2` or `limit: Infinity`
+    // means "pay anything" — which is what it silently did.
+    let limit = null;
+    if (order.limit != null) {
+      limit = finite(order.limit);
+      if (limit == null || limit < 0 || limit > 1) { this.rejected += 1; return null; }
+    }
+
+    let size;
+    if (hasNotional) {
+      // MONEY -> CONTRACTS, here rather than in the SDK's Order constructor:
+      // a hook may return a plain object literal — most of the JS examples do
+      // — and one that never passed through `new Order()` would carry a
+      // `notional` nobody converted.
+      //
+      // The divisor is the limit, never the current best price: a contract
+      // costs whatever it fills at and a marketable order walks the book, so
+      // dividing by the touch overspends the moment there is any slippage.
+      const budget = finite(order.notional);
+      if (budget == null || budget <= 0 || limit == null || limit <= 0) {
+        this.rejected += 1; return null;
+      }
+      // The QUOTIENT can overflow from two finite inputs: 1e308 / 0.01 is
+      // Infinity. Checked before the floor, because that is where Python
+      // raises.
+      const q = budget / limit;
+      if (!Number.isFinite(q)) { this.rejected += 1; return null; }
+      size = Math.floor(q);
+    } else {
+      size = finite(order.size);
+    }
+    if (size == null || !(size > 0)) { this.rejected += 1; return null; }
 
     // reduce_only is clamped to what is open. A strategy asking to close more
     // than it holds must not accidentally open the other way.
@@ -139,9 +205,15 @@ export class Portfolio {
       if (!(size > EPS)) { this.rejected += 1; return null; }
     }
 
-    const res = matchOrder(book, { ...order, size });
+    // ONE effective order from here on: the derived size has to reach the fill
+    // row as well as the match. It did not, and the row's `requested` came out
+    // as NaN for a notional-only order — the fill was executed (the fee was
+    // identical) but the ROW was rejected by the parser and never emitted, so
+    // the run silently lost its fill log. otengine.py does the same.
+    const eff = { ...order, size, limit };
+    const res = matchOrder(book, eff);
     if (res.filled <= 0) {
-      this.fills.push(this.#fillRow({ ts, marketId, order, res, tag, realised: 0, fee: 0 }));
+      this.fills.push(this.#fillRow({ ts, marketId, order: eff, res, tag, realised: 0, fee: 0 }));
       return res;
     }
 
@@ -177,7 +249,7 @@ export class Portfolio {
       this.cash -= res.notional + fee;
     }
 
-    this.fills.push(this.#fillRow({ ts, marketId, order, res, tag, realised, fee }));
+    this.fills.push(this.#fillRow({ ts, marketId, order: eff, res, tag, realised, fee }));
     return res;
   }
 

package/runner/engine/replay.mjs

@@ -15,25 +15,50 @@
 import { Book } from './book.mjs';
 import { Portfolio } from './portfolio.mjs';
 
+
+// Mirrors LIMITS.logLineChars / LIMITS.logBytesPerRun, and does NOT import
+// them. This file is baked into the sandbox image, which contains runner/ and
+// nothing else — an import of api/ resolves fine on a developer's machine and
+// on the worker, and then fails inside every container with
+// ERR_MODULE_NOT_FOUND. otreplay.py mirrors the same two numbers for the same
+// reason. replay-limits.test.mjs asserts both copies still equal the contract.
+const LOG_LINE_CHARS = 512;
+const LOG_BYTES_PER_RUN = 2 * 1024 * 1024;
+
+// A settlement recompute is a once-per-market claim, so these are generous.
+// They exist because `crosschecks` rides the same result line as everything
+// else: unbounded, it is an output channel with no budget. Mirrored in
+// otreplay.py.
+const MAX_CROSSCHECKS_PER_MARKET = 16;
+const CROSSCHECK_CLAIMED_CHARS = 32;
+
+
 /** Event kinds the loop understands, in the order they dispatch. */
 export const EVENT_KINDS = Object.freeze(['tick', 'book', 'trade']);
 
 /**
  * Per-event budget.
  *
- * Measured over the strategy's own hook, not the loop around it. A p99 breach
- * kills the shard rather than the run: one pathological market must not cost
- * the customer the other 719.
+ * Measured over the strategy's own hook, not the loop around it. Sustained cost
+ * over budget kills the shard rather than the run: one pathological market must
+ * not cost the customer the other 719.
  */
 export class BudgetMonitor {
-  constructor({ limitMicros = 400, sampleFloor = 200, tolerance = 0.01 } = {}) {
+  constructor({ limitMicros = 400, sampleFloor = 2000 } = {}) {
     this.limitMicros = limitMicros;
     this.sampleFloor = sampleFloor;
-    this.tolerance = tolerance;
     this.count = 0;
     this.breaches = 0;
     this.maxMicros = 0;
     this.totalMicros = 0;
+    // The most recent `sampleFloor` events, as a ring. One monitor covers the
+    // WHOLE run, so a lifetime mean is diluted by however much came before: a
+    // strategy that runs 18,000 events at 8us and then 2,000 at 2,000us has a
+    // lifetime mean of 207us and passes, while its last 2,000 events are
+    // continuously 5x over budget. The window is what makes "sustained" local.
+    this.window = new Float64Array(sampleFloor);
+    this.windowSum = 0;
+    this.windowAt = 0;
   }
 
   record(micros) {
@@ -41,14 +66,64 @@ export class BudgetMonitor {
     this.totalMicros += micros;
     if (micros > this.maxMicros) this.maxMicros = micros;
     if (micros > this.limitMicros) this.breaches += 1;
+    this.windowSum += micros - this.window[this.windowAt];
+    this.window[this.windowAt] = micros;
+    this.windowAt = (this.windowAt + 1) % this.window.length;
+  }
+
+  /** Mean of the most recent `sampleFloor` events. Zero until the window fills. */
+  get windowMicros() {
+    return this.count >= this.sampleFloor ? this.windowSum / this.window.length : 0;
   }
 
   /**
-   * A single slow event is not a breach — a JIT warm-up or a GC pause is not
-   * the strategy's fault. Sustained breach past the p99 tolerance is.
+   * SUSTAINED cost, which is what the limit is for and what customers are told
+   * it means ("sustained breach kills the shard"): the mean of the most recent
+   * `sampleFloor` events, not the tail and not the lifetime.
+   *
+   * This judged the breach RATE against a 1% tolerance, and it was measuring
+   * the wrong machine. The budget brackets each hook with two wall-clock reads,
+   * on a 2-core box where the worker is decompressing and feeding stdin the
+   * whole time and the sandbox holds one vCPU — so an event that gets
+   * descheduled is recorded as an event the strategy spent 4ms in. Measured
+   * inside the real image: the same strategy on an idle host averages 7.8us
+   * with a 766us worst case, and under contention averages 20.9us with a 4090us
+   * worst case. Nothing about the strategy changed.
+   *
+   * The page's own sample was rejected in production at avg 72us — a fifth of
+   * its 400us budget — because 1.1% of its events had been interrupted. The
+   * breaches were not even front-loaded, so a longer warm-up floor could never
+   * have fixed it: measured in-image they land at events 171, 2368, 3201 and so
+   * on, which is the shape of GC and scheduling, not of a slow strategy.
+   *
+   * The mean is what actually predicts the thing this protects — the 20-minute
+   * wall clock is mean times event count — and it is not fooled by a machine
+   * that takes the CPU away. A strategy that really is slow raises the mean; an
+   * interrupted one does not. A single hook that never returns is still caught,
+   * by the run deadline, which is where that belongs.
+   *
+   * WINDOWED, NOT LIFETIME. One monitor covers the whole run, so a lifetime
+   * mean lets a cheap prefix pay for an expensive phase: 18,000 events at 8us
+   * followed by 2,000 at 2,000us averages 207us and passes, while the strategy
+   * has been 5x over budget for its last two thousand events. The window is
+   * what makes "sustained" mean sustained rather than "on average, eventually".
+   *
+   * `breaches` and `max_micros` stay in the summary. They are good diagnostics.
+   * They are not a verdict.
+   *
+   * KNOWN AND DELIBERATE GAP: a low-frequency, very heavy event slips through.
+   * One 500ms hook among 2,000 events at 8us is a window mean of 258us, inside
+   * budget; it would take 800ms to trip on its own. A per-hook hard cap would
+   * close it, and it is not being added, because this limit has now been wrong
+   * twice and BOTH times the same way — a one-off cost judged as a sustained
+   * one, killing a strategy that was fine. Building an index on the first tick
+   * is a legitimate 300ms hook. The wall clock already bounds total resource
+   * use, so the cap would buy protection against a failure nobody has seen at
+   * the cost of the exact mistake already made twice. Add it when a real run
+   * demonstrates the need, not before.
    */
   get breached() {
-    return this.count >= this.sampleFloor && this.breaches / this.count > this.tolerance;
+    return this.count >= this.sampleFloor && this.windowMicros > this.limitMicros;
   }
 
   get avgMicros() { return this.count ? this.totalMicros / this.count : 0; }
@@ -59,6 +134,10 @@ export class BudgetMonitor {
       breaches: this.breaches,
       breach_rate: this.count ? this.breaches / this.count : 0,
       avg_micros: this.avgMicros,
+      // The number the verdict is actually made on. Without it a rejection
+      // shows a lifetime average comfortably inside budget and reads as a lie.
+      window_micros: this.windowMicros,
+      window_events: this.sampleFloor,
       max_micros: this.maxMicros,
       limit_micros: this.limitMicros,
     };
@@ -124,7 +203,7 @@ function bookView(book) {
   });
 }
 
-function createCtx({ params, portfolio, marketId, market, logLimit, references, series, rng }) {
+function createCtx({ params, portfolio, marketId, market, logBudget, references, series, rng }) {
   const history = [];
   const logs = [];
   const crosschecks = [];
@@ -171,8 +250,20 @@ function createCtx({ params, portfolio, marketId, market, logLimit, references,
     },
 
     log(msg) {
-      if (logs.length >= logLimit) { logTruncated = true; return; }
-      logs.push(`${now} ${String(msg)}`);
+      // BYTES FOR THE WHOLE RUN, not lines per market. The old shape — 10,000
+      // lines per market, no length cap — let a run emit the archive it had
+      // just paid a market-day for into a file the customer downloads. See
+      // LIMITS.logBytesPerRun for the arithmetic that picks these numbers.
+      if (logBudget.spent >= logBudget.bytes) { logTruncated = true; return; }
+      const line = `${now} ${String(msg)}`.slice(0, logBudget.lineChars);
+      // BYTES, not string length. logs.txt is UTF-8, and `.length` counts
+      // UTF-16 units — so a run logging Chinese spent a third of what it
+      // wrote, and the archive could reach three times the 2 MB this budget
+      // advertises. The line cap stays in characters because it is about
+      // being readable; the run cap is about how much data leaves with the
+      // customer, and that is measured in bytes.
+      logBudget.spent += Buffer.byteLength(line, 'utf8') + 1;
+      logs.push(line);
     },
 
     /** Seeded generator — the only randomness available, and it is recorded. */
@@ -240,9 +331,19 @@ function createCtx({ params, portfolio, marketId, market, logLimit, references,
       // recompute match that never happened. The cross-check panel's whole
       // value is that it is the ARCHIVE's answer, not the strategy's.
       const official = market?.outcome ?? null;
+      // BOUNDED, for the same reason ctx.log is. `outcome` is whatever the
+      // strategy passed and this can be called on every event, so an unbounded
+      // push here is an unmetered output channel wearing a different name: the
+      // whole array is serialised onto the authenticated result line, sent,
+      // and parsed by the worker before anything downstream gets to ignore it.
+      // The panel only ever shows an aggregate, so nothing of value is lost by
+      // capping — a settlement recompute is a once-per-market claim.
+      if (crosschecks.length >= MAX_CROSSCHECKS_PER_MARKET) return;
       crosschecks.push({
         market_id: marketId,
-        claimed: outcome,
+        claimed: typeof outcome === 'string'
+          ? outcome.slice(0, CROSSCHECK_CLAIMED_CHARS)
+          : String(outcome).slice(0, CROSSCHECK_CLAIMED_CHARS),
         official,
         match: official === outcome,
       });
@@ -293,11 +394,32 @@ const HOOK_FOR = { tick: 'on_tick', book: 'on_book', trade: 'on_trade' };
  *   decision. Zero is "as captured"; the latency panel is this same replay at
  *   100ms, 250ms, 500ms, 1s and 2s.
  */
+/**
+ * A log allowance for one run.
+ *
+ * Bytes, not lines, and shared by every market in the run — see
+ * LIMITS.logBytesPerRun for why those two choices are the whole fix.
+ */
+export function makeLogBudget({
+  bytes = LOG_BYTES_PER_RUN,
+  lineChars = LOG_LINE_CHARS,
+} = {}) {
+  return { bytes, lineChars, spent: 0 };
+}
+
 export function replayMarket({
   market, events, strategy, hooks,
   portfolio = null,
   fillDelayMs = 0,
-  logLimit = 10_000,
+  /**
+   * The run's remaining log allowance, SHARED ACROSS MARKETS.
+   *
+   * Passed in rather than created here, because a per-market allowance is what
+   * the old limit was and what made the log channel an export route: 386
+   * markets a day each got their own budget. One object for the whole run is
+   * the fix — the harness makes it once and hands the same one to every market.
+   */
+  logBudget = null,
   budget = null,
   references = null,
   series = null,
@@ -338,7 +460,7 @@ export function replayMarket({
     portfolio: pf,
     marketId,
     market: engineMarket,
-    logLimit,
+    logBudget: logBudget ?? makeLogBudget(),
     references,
     series,
     rng: makeRng(seed),