outcometick 1.5.2 → 1.6.2

package/cli/local-data.mjs

@@ -14,12 +14,19 @@
 import { createReadStream } from 'node:fs';
 import { readdir, stat } from 'node:fs/promises';
 import { createInterface } from 'node:readline';
+import { pipeline } from 'node:stream/promises';
 import { createGunzip } from 'node:zlib';
 import path from 'node:path';
 
 import { classifyPath } from '../api/lib/data-taxonomy.mjs';
-import { archiveDatasetsFor, fileMatchesRun } from '../api/lib/backtest-datasets.mjs';
-import { indexMarkets, eventsFromRow, finaliseMarket, parseRow } from '../runner/events.mjs';
+import {
+  archiveDatasetsFor, fileMatchesRun, normalizeIntervals, settlementPathsFor, orderedFeed,
+} from '../api/lib/backtest-datasets.mjs';
+import {
+  indexMarkets, eventsFromRow, finaliseMarket, parseRow, buildSlugIndex, marketUnusable,
+  sortMarketsForReplay,
+  makeBookThrottle,
+} from '../runner/events.mjs';
 
 /**
  * Every file under a directory, as archive-relative paths.
@@ -59,7 +66,23 @@ async function walk(root, prefix = '', depth = 0) {
 async function* readRows(root, rel) {
   const full = path.join(root, rel);
   const raw = createReadStream(full);
-  const stream = rel.endsWith('.gz') ? raw.pipe(createGunzip()) : raw;
+  // `pipeline`, not `raw.pipe(...)`, for the same reason the queue's reader
+  // uses it: `.pipe()` does not forward errors, so a failure on `raw` — a
+  // truncated file, a disk that went away mid-read — emits 'error' on a stream
+  // nobody is listening to, which in Node is process death rather than an
+  // exception. That exact shape killed the worker in production; the risk is
+  // lower on a local file, but the wrong pattern is not worth keeping a second
+  // copy of.
+  let stream = raw;
+  if (rel.endsWith('.gz')) {
+    const gunzip = createGunzip();
+    stream = gunzip;
+    pipeline(raw, gunzip).catch((err) => {
+      if (!gunzip.destroyed) gunzip.destroy(err);
+    });
+  } else {
+    raw.on('error', () => {});
+  }
   const rl = createInterface({ input: stream, crlfDelay: Infinity });
 
   const isCsv = rel.includes('.csv');
@@ -91,11 +114,15 @@ export function dayOfPath(rel) {
  * Returns the same shape fetchMarketDays does, so `ot run` and the worker feed
  * the harness identically.
  */
-export async function loadLocalDay({ root, day, venue, assets, datasets }) {
+export async function loadLocalDay({ root, day, venue, assets, datasets, intervals, throttle = null }) {
   const archiveDatasets = archiveDatasetsFor({ datasets, venue, from: day, to: day });
+  // Same normalisation, same default, same two filters as the queue. `ot run`
+  // promises the identical files and checksums; an interval narrowing applied
+  // on one side only would break that on the very first 15m market.
+  const wantIntervals = normalizeIntervals(intervals ?? null);
   const all = await walk(root);
   const wanted = all.filter((rel) => dayOfPath(rel) === day
-    && fileMatchesRun(rel, { venue, assets, archiveDatasets }));
+    && fileMatchesRun(rel, { venue, assets, archiveDatasets, intervals: wantIntervals }));
 
   if (wanted.length === 0) {
     return { markets: [], reason: `no files for ${day} under ${root}` };
@@ -107,16 +134,36 @@ export async function loadLocalDay({ root, day, venue, assets, datasets }) {
   for (const rel of wanted.filter((r) => classifyPath(r).dataset === 'markets')) {
     for await (const row of readRows(root, rel)) marketRows.push(row);
   }
-  const markets = indexMarkets(marketRows);
+  // Same normalisation the queue uses. `ot run` promising "the identical files,
+  // same checksums" only holds while both sides decode the archive identically,
+  // so the venue has to reach the decoder here too.
+  const indexed = indexMarkets(marketRows, { venue });
+  const inScope = new Set((assets ?? []).map((a) => String(a).toUpperCase()));
+  const wantIv = new Set(wantIntervals.map(String));
+  const markets = new Map();
+  for (const [id, m] of indexed) {
+    if (m.asset && inScope.size && !inScope.has(String(m.asset).toUpperCase())) continue;
+    if (m.interval && wantIv.size && !wantIv.has(String(m.interval))) continue;
+    markets.set(id, m);
+  }
   if (markets.size === 0) {
     return { markets: [], reason: `no market metadata for ${day}` };
   }
+  const bySlug = buildSlugIndex(markets);
+
+  // The settlement files these markets need, from the SAME function the queue
+  // uses. Selecting them here separately is how "it runs locally but not in the
+  // queue" happens — and it had already happened: without this, a strategy
+  // asking for `prices` read nothing at all locally while the queue produced a
+  // report, off the identical archive.
+  const feed = orderedFeed([...wanted, ...settlementPathsFor(markets.values(),
+    all.filter((rel) => dayOfPath(rel) === day), { venue, assets, already: wanted })]);
 
   const byMarket = new Map();
-  for (const rel of wanted) {
+  for (const rel of feed) {
     if (classifyPath(rel).dataset === 'markets') continue;
     for await (const row of readRows(root, rel)) {
-      for (const [id, ev] of eventsFromRow(rel, row, markets)) {
+      for (const [id, ev] of eventsFromRow(rel, row, markets, bySlug, throttle)) {
         if (!markets.has(id)) continue;
         let list = byMarket.get(id);
         if (!list) { list = []; byMarket.set(id, list); }
@@ -126,13 +173,27 @@ export async function loadLocalDay({ root, day, venue, assets, datasets }) {
   }
 
   const out = [];
-  for (const [marketId, events] of byMarket) {
+  const unusable = [];
+  // EVERY market in the metadata, exactly as the worker does. Iterating only
+  // the ones that produced events skipped the emptiest case — a market that
+  // exists in the archive and decodes to nothing — which is precisely the gap
+  // this is here to expose, and skipping it locally would put the divergence
+  // back after it had just been removed.
+  for (const marketId of markets.keys()) {
     const market = markets.get(marketId);
-    // Fail-closed, exactly as the worker does: a market whose settlement stream
-    // we cannot read is dropped, not guessed at.
-    if (!market || market.stream == null) continue;
-    const { events: inWindow, up_px, down_px } = finaliseMarket(events, market);
-    if (inWindow.length === 0) continue;
+    const events = byMarket.get(marketId) ?? [];
+    const { events: inWindow, up_px, down_px } = market
+      ? finaliseMarket(events, market)
+      : { events: [], up_px: null, down_px: null };
+    // THE SAME predicate the queue applies, not a local copy of it. A rule that
+    // lives in one reader and not the other is how `ot run` ends up replaying a
+    // market the queue drops — and a market-making strategy, which never reads
+    // the settlement price, is precisely the case that would never notice.
+    const why = marketUnusable(market, inWindow);
+    if (why) {
+      unusable.push({ market_id: marketId, asset: market?.asset ?? null, day, why });
+      continue;
+    }
     out.push({
       market: {
         market_id: market.market_id,
@@ -150,7 +211,17 @@ export async function loadLocalDay({ root, day, venue, assets, datasets }) {
       down_px,
     });
   }
-  return { markets: out, reason: null };
+  return {
+    // THE SAME ORDER THE QUEUE FEEDS — see sortMarketsForReplay. A local replay
+    // that emitted its logs in a different order than the queue would break the
+    // one promise `ot run` makes: the identical files from the identical
+    // archive.
+    markets: sortMarketsForReplay(out),
+    unusable,
+    reason: out.length === 0 && unusable.length
+      ? `${unusable.length} market(s) unusable: ${unusable[0].why}`
+      : null,
+  };
 }
 
 /** Days a local archive appears to hold, sorted. */

package/cli/ot.mjs

@@ -35,9 +35,16 @@ const USAGE = `ot ${SDK_VERSION} — outcometick strategy tools
   ot run <dir> --data <archive> [--date <YYYY-MM-DD>] [--out <file>]
       Replay locally against a cloned sample archive, using the same engine
       the queue uses. Writes a report archive.
+      Refused if the manifest declares a reference feed: those come from an
+      archive held on the worker, so a local replay would hand your strategy
+      empty ones. Your own CSV series work locally.
 
   ot submit <dir> --assets btc,eth --from <day> --to <day> [--venue polymarket]
       Send it to the queue. Needs OT_BACKTEST_KEY.
+      --email <address>   have the finished report emailed to you. Without it
+                          the run is only reachable from 'ot status', which
+                          means remembering the id — and a queued run outlives
+                          the terminal you started it from.
 
   ot status <run_id>
       Where a submitted run got to, and what it cost. Needs OT_BACKTEST_KEY.
@@ -96,8 +103,15 @@ export async function readSubmission(dir) {
       if (!/\.(py|mjs|js|json|csv)$/.test(e.name)) continue;
       const full = path.join(dir, name);
       const s = await stat(full);
-      if (s.size > LIMITS.maxTotalSourceBytes) {
-        throw new Error(`${name} is ${s.size} bytes, over the ${LIMITS.maxTotalSourceBytes} byte submission limit`);
+      // The ceiling for ANY one file is the series limit, not the source limit:
+      // a CSV series is allowed to be much larger than the code, and the shared
+      // validator is what enforces which budget a given file falls under.
+      // Refusing a 1MB CSV here meant `ot check` rejected a submission the API
+      // accepts — and "a local pass is not rejected on submit" is a promise the
+      // docs make.
+      const ceiling = Math.max(LIMITS.maxTotalSourceBytes, LIMITS.maxSeriesBytes);
+      if (s.size > ceiling) {
+        throw new Error(`${name} is ${s.size} bytes, over the ${ceiling} byte limit for a single file`);
       }
       out.push({ name, content: await readFile(full, 'utf8') });
     }
@@ -153,10 +167,19 @@ async function cmdCheck({ dir, flags }) {
   process.stdout.write(`\n  ok — ${manifest.language}, entry ${manifest.entry.file}:${manifest.entry.className}\n`);
   process.stdout.write(`  hooks     ${Object.entries(res.hookNames).map(([k, v]) => `${k} → ${v}`).join(', ')}\n`);
   process.stdout.write(`  datasets  ${manifest.datasets.join(', ')}\n`);
+  // Both of these change what comes back, so `ot check` has to show them:
+  // this command exists to say what the queue will do with this submission,
+  // and a run narrowed to 5m at a 250ms fill delay is a different answer to
+  // the same strategy.
+  process.stdout.write(`  intervals ${manifest.intervals.join(', ')}\n`);
+  process.stdout.write(`  delay     ${manifest.latency ? `${manifest.latency} ms` : 'none'}\n`);
   if (manifest.reference.length) process.stdout.write(`  reference ${manifest.reference.join(', ')}\n`);
   process.stdout.write(`  files     ${res.files.length} / ${LIMITS.maxFiles} · ${(res.totalBytes / 1024).toFixed(1)} / ${LIMITS.maxTotalSourceBytes / 1024} KB\n`);
   if (manifest.mode === 'session') {
-    process.stdout.write('  mode      session — bills at 3× the market-day rate\n');
+    // NOT "3x the market-day rate". That multiplier was deleted, and this was
+    // its third hiding place after both i18n dictionaries — the guard that
+    // caught the other two only scans lib/backtest-i18n.ts.
+    process.stdout.write('  mode      session — same price as market mode\n');
   }
   process.stdout.write('\n');
   return 0;

package/index.d.ts

@@ -132,10 +132,37 @@ export interface Ctx<P = Record<string, unknown>> {
   assert_outcome(market: unknown, outcome: Side): void;
 }
 
-export interface OrderInit {
+/**
+ * Size an order in contracts, or in money.
+ *
+ * A union rather than two optional fields, so `{ size, notional }` together is
+ * a compile error rather than a run-time rejection: they answer the same
+ * question two ways and there is no sensible reading of both.
+ */
+export type OrderSizing =
+  | {
+    /** Contracts. Must be positive. */
+    size: number;
+    notional?: never;
+  }
+  | {
+    size?: never;
+    /**
+     * Spend at most this much, converted to contracts as
+     * `floor(notional / limit)`.
+     *
+     * REQUIRES `limit`, which is why this arm makes it non-optional: a
+     * contract costs whatever it fills at and a marketable order walks the
+     * book, so dividing by the current best price overspends the moment there
+     * is any slippage. The limit is the price you have already said you will
+     * not exceed, which is what makes "at most" true.
+     */
+    notional: number;
+    limit: number;
+  };
+
+export type OrderInit = OrderSizing & {
   side: Side;
-  /** Contracts. Must be positive. */
-  size: number;
   /**
    * A bound in whichever direction protects you: a ceiling when opening, a
    * floor when reducing. Must be within [0, 1] — a binary outcome token
@@ -149,7 +176,7 @@ export interface OrderInit {
   /** Only 'ioc' is modelled; anything else is rejected at construction. */
   tif?: 'ioc';
   tag?: string | null;
-}
+};
 
 /**
  * An order a hook returns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "outcometick",
-  "version": "1.5.2",
+  "version": "1.6.2",
   "description": "Strategy SDK and CLI for outcometick prediction-market backtests",
   "type": "module",
   "license": "MIT",

package/runner/archive.mjs

@@ -123,10 +123,26 @@ function csvField(v) {
 }
 
 /** Rows to CSV with a fixed column order, so a diff between runs is meaningful. */
+/**
+ * A UTF-8 byte-order mark.
+ *
+ * Excel opens a .csv as the system ANSI code page unless the file says
+ * otherwise, and the only thing it accepts as saying otherwise is this. The
+ * symptom was a calibration bucket reading `0.30 釴?0.40` — an en dash, three
+ * UTF-8 bytes, read as GBK. That is not a Chinese-locale problem: it is every
+ * non-ASCII byte in every one of these files, including the `tag` a strategy
+ * puts on its own fills, which we do not control at all.
+ *
+ * Parsers that do not expect it see one stray character on the first header;
+ * `encoding='utf-8-sig'` is the standard remedy. A spreadsheet that mangles
+ * the whole file is the worse failure, and it is the one that was happening.
+ */
+const BOM = '\uFEFF';
+
 export function toCsv(rows, columns) {
   const out = [columns.join(',')];
   for (const row of rows) out.push(columns.map((c) => csvField(row[c])).join(','));
-  return `${out.join('\n')}\n`;
+  return `${BOM}${out.join('\n')}\n`;
 }
 
 const TRADE_COLUMNS = [
@@ -141,14 +157,17 @@ const FILL_COLUMNS = [
 /**
  * Assemble the archive a customer downloads.
  *
- * The submitted source goes IN, deliberately: a report that cannot be tied back
- * to the exact code that produced it is not reproducible, and "which version of
- * my strategy was this?" is the first question anyone asks a week later.
+ * THE SOURCE IS NOT IN IT. It used to be, so that a report could be tied back
+ * to the exact code that produced it — "which version of my strategy was
+ * this?" is the first question anyone asks a week later. That question is now
+ * answered by `source_sha256` in report.json instead: the same identification,
+ * without handing back a copy of the code. Shipping the strategy inside the
+ * deliverable made a report something you cannot forward to anyone.
  *
  * sha256sums.txt covers every other entry, so the whole thing is verifiable
  * without trusting the transport.
  */
-export async function buildArchive({ runId, report, trades, fills, logs, source }) {
+export async function buildArchive({ runId, report, trades, fills, logs }) {
   const entries = [
     { name: 'report.json', data: `${JSON.stringify(report, null, 2)}\n` },
     { name: 'trades.csv', data: toCsv(trades, TRADE_COLUMNS) },
@@ -158,18 +177,10 @@ export async function buildArchive({ runId, report, trades, fills, logs, source
       name: 'calibration.csv',
       data: toCsv(report.calibration ?? [], ['bucket', 'implied', 'realized', 'edge_cents', 'trades']),
     },
-    {
-      name: 'latency.csv',
-      data: toCsv(report.latency ?? [], ['label', 'delay_ms', 'net_pnl', 'ratio', 'unprofitable']),
-    },
     { name: 'coverage.json', data: `${JSON.stringify(report.coverage ?? {}, null, 2)}\n` },
     { name: 'logs.txt', data: logs ?? '' },
   ];
 
-  for (const f of source ?? []) {
-    entries.push({ name: `strategy/${f.name}`, data: f.content });
-  }
-
   // Checksums last, over everything above.
   const sums = entries
     .map(({ name, data }) => {

package/runner/engine/book.mjs

@@ -209,7 +209,18 @@ export function matchOrder(book, order) {
   const quotedPx = ladder.best();
 
   const { fills, remaining, notional } = ladder.take(size, order.limit ?? null);
-  const filled = size - remaining;
+  // SUMMED FROM WHAT WAS TAKEN, not derived as `size - remaining`.
+  //
+  // `remaining` is the requested size with each level's depth subtracted from
+  // it, and at IEEE-754 precision `1e308 - 1000` is still `1e308`. So a huge
+  // but finite order consumed the whole ladder while reporting `filled: 0` —
+  // no position, no cash, no trade row, and an empty book for every order
+  // after it in that market. The report said nothing happened; the book said
+  // otherwise.
+  //
+  // Adding up the levels actually taken cannot drift from what was removed,
+  // because it IS what was removed. otengine.py mirrors this.
+  const filled = fills.reduce((a, f) => a + f.size, 0);
 
   return {
     fills,

package/runner/engine/feed.mjs

@@ -0,0 +1,116 @@
+// Point-in-time views over an out-of-band series.
+//
+// `ctx.ref(name)` and `ctx.ext(name)` both call `feed.viewAt(ctx.now)` and hand
+// the result to the strategy. Until now nothing implemented `viewAt`: the
+// manifest validator accepted `reference` and `series`, the run was queued and
+// billed, and the strategy crashed on its first `ctx.ref(...)` with a message
+// claiming the feed had not been declared — which it had.
+//
+// Two properties this file exists to guarantee:
+//
+//   1. NOTHING STAMPED AFTER ctx.now IS REACHABLE. Not filtered on the way out
+//      — the cursor never advances past `now`, so a later row is not something
+//      the strategy can ask for. That is the same promise the event replay
+//      makes, and a reference feed is exactly where it would otherwise leak:
+//      the whole point of an outside series is that we hold all of it up front.
+//
+//   2. WHAT THE STRATEGY GETS IS A COPY. `ctx.book()` and `ctx.history()` were
+//      both caught handing out live objects a strategy could rewrite, and a
+//      rewritten reference row would poison every later window() over it.
+//
+// `lagMs` models publication delay: a row is not visible until ts_ms + lagMs,
+// which is how you backtest a signal you could not have had instantly.
+
+/** Frozen, prototype-less copy of one row. */
+function freezeRow(row) {
+  const out = Object.create(null);
+  for (const k of Object.keys(row)) out[k] = row[k];
+  return Object.freeze(out);
+}
+
+export class PointInTimeFeed {
+  /**
+   * @param rows   ascending by ts_ms. Not copied — this class owns them and
+   *               never hands one out directly.
+   * @param lagMs  publication delay; a row becomes visible at ts_ms + lagMs.
+   */
+  constructor(rows, { lagMs = 0 } = {}) {
+    this.rows = rows;
+    this.lagMs = Number(lagMs) || 0;
+    // Monotone cursor: the replay only ever moves forward, so the whole feed is
+    // walked once across a market-day rather than binary-searched per call.
+    // `ctx.now` never goes backwards within a market — but a fresh feed is
+    // built per market, so this is not an assumption about the strategy.
+    this.cursor = 0;
+  }
+
+  /** Index one past the last row visible at `now`. */
+  _visibleCount(now) {
+    const limit = now - this.lagMs;
+    while (this.cursor < this.rows.length && this.rows[this.cursor].ts_ms <= limit) {
+      this.cursor += 1;
+    }
+    // Defensive: if time moved backwards, do not report rows from the future.
+    if (this.cursor > 0 && this.rows[this.cursor - 1].ts_ms > limit) {
+      let i = this.cursor;
+      while (i > 0 && this.rows[i - 1].ts_ms > limit) i -= 1;
+      return i;
+    }
+    return this.cursor;
+  }
+
+  viewAt(now) {
+    const n = this._visibleCount(now);
+    const rows = this.rows;
+    // Captured, not read off `this`: the object below is what the strategy
+    // holds, so `this` inside its methods is that frozen view — `this.lagMs`
+    // was undefined there and turned the clamp into NaN, which made at() return
+    // null for every timestamp.
+    const { lagMs } = this;
+    const horizon = now - lagMs;
+    return Object.freeze({
+      /** The most recent row at or before now, or null. */
+      get last() { return n > 0 ? freezeRow(rows[n - 1]) : null; },
+
+      /** The last `k` visible rows, oldest first. Never more than exist. */
+      window(k) {
+        const want = Math.max(0, Math.min(Number(k) || 0, n));
+        const out = [];
+        for (let i = n - want; i < n; i += 1) out.push(freezeRow(rows[i]));
+        return out;
+      },
+
+      /**
+       * The row in effect at `ts`. Clamped to now: asking for a later
+       * timestamp cannot reach a later row.
+       */
+      at(ts) {
+        const asked = Number(ts);
+        const t = Number.isFinite(asked) ? Math.min(asked, horizon) : horizon;
+        let lo = 0;
+        let hi = n - 1;
+        let found = -1;
+        while (lo <= hi) {
+          const mid = (lo + hi) >> 1;
+          if (rows[mid].ts_ms <= t) { found = mid; lo = mid + 1; } else { hi = mid - 1; }
+        }
+        return found >= 0 ? freezeRow(rows[found]) : null;
+      },
+    });
+  }
+}
+
+/**
+ * Build the feeds a run declared, keyed by the name the strategy will ask for.
+ *
+ * @param declared  manifest names, e.g. ['binance:btcusdt:spot:1s']
+ * @param rowsByName  name -> ascending rows
+ * @param lagByName   name -> publication lag in ms
+ */
+export function buildFeeds(declared, rowsByName, lagByName = {}) {
+  const out = new Map();
+  for (const name of declared ?? []) {
+    out.set(name, new PointInTimeFeed(rowsByName[name] ?? [], { lagMs: lagByName[name] ?? 0 }));
+  }
+  return out;
+}

package/runner/engine/portfolio.mjs

@@ -129,8 +129,74 @@ export class Portfolio {
     if (!isSide(order?.side)) { this.rejected += 1; return null; }
 
     const leg = this.#legs(marketId)[order.side];
-    let size = Number(order.size);
-    if (!(size > 0)) { this.rejected += 1; return null; }
+
+    // ONE PLACE THAT DECIDES WHETHER AN ORDER IS USABLE.
+    //
+    // This was three separate checks bolted on one at a time, and each time a
+    // new shape of bad input walked past the ones already there — an infinite
+    // notional, then a size and a notional together, then a bad `limit` on a
+    // plain size order. Whack-a-mole on a consumption point is how you end up
+    // with an engine that rejects what it happens to have been asked about.
+    //
+    // Every unusable order is COUNTED AND RETURNS NULL. Never thrown: a bad
+    // order is one order, and otengine.py raising ValueError/OverflowError on
+    // the same input turned "reject one order" into "fail the whole run" —
+    // same input, two different outcomes, in a product whose whole promise is
+    // that the two engines are the same engine. That mirror is held to this
+    // table by runner/conformance.
+    // A NUMBER, not something Number() is willing to turn into one.
+    //
+    // Coercion is not validation: `Number('10')` is 10, `Number([10])` is 10,
+    // `Number(true)` is 1. Python's `float()` agrees about the string and the
+    // bool and RAISES on the list — so `{ size: [10] }` filled ten contracts
+    // in JS and was rejected in Python, from one strategy, on one input.
+    //
+    // The SDK's Order requires a number and the docs say a number. Anything
+    // else is a mistake in the strategy, and a mistake that fills is worse
+    // than one that is counted.
+    const finite = (v) => (
+      typeof v === 'number' && Number.isFinite(v) ? v : null
+    );
+
+    const hasSize = order.size != null;
+    const hasNotional = order.notional != null;
+    // Contradictory instructions. Choosing one silently would trade a contract
+    // count while the author believed they had set a spending cap.
+    if (hasSize === hasNotional) { this.rejected += 1; return null; }
+
+    // A limit is optional, but a limit that is PRESENT must be a price: an
+    // outcome token trades in [0, 1], and `limit: 2` or `limit: Infinity`
+    // means "pay anything" — which is what it silently did.
+    let limit = null;
+    if (order.limit != null) {
+      limit = finite(order.limit);
+      if (limit == null || limit < 0 || limit > 1) { this.rejected += 1; return null; }
+    }
+
+    let size;
+    if (hasNotional) {
+      // MONEY -> CONTRACTS, here rather than in the SDK's Order constructor:
+      // a hook may return a plain object literal — most of the JS examples do
+      // — and one that never passed through `new Order()` would carry a
+      // `notional` nobody converted.
+      //
+      // The divisor is the limit, never the current best price: a contract
+      // costs whatever it fills at and a marketable order walks the book, so
+      // dividing by the touch overspends the moment there is any slippage.
+      const budget = finite(order.notional);
+      if (budget == null || budget <= 0 || limit == null || limit <= 0) {
+        this.rejected += 1; return null;
+      }
+      // The QUOTIENT can overflow from two finite inputs: 1e308 / 0.01 is
+      // Infinity. Checked before the floor, because that is where Python
+      // raises.
+      const q = budget / limit;
+      if (!Number.isFinite(q)) { this.rejected += 1; return null; }
+      size = Math.floor(q);
+    } else {
+      size = finite(order.size);
+    }
+    if (size == null || !(size > 0)) { this.rejected += 1; return null; }
 
     // reduce_only is clamped to what is open. A strategy asking to close more
     // than it holds must not accidentally open the other way.
@@ -139,9 +205,15 @@ export class Portfolio {
       if (!(size > EPS)) { this.rejected += 1; return null; }
     }
 
-    const res = matchOrder(book, { ...order, size });
+    // ONE effective order from here on: the derived size has to reach the fill
+    // row as well as the match. It did not, and the row's `requested` came out
+    // as NaN for a notional-only order — the fill was executed (the fee was
+    // identical) but the ROW was rejected by the parser and never emitted, so
+    // the run silently lost its fill log. otengine.py does the same.
+    const eff = { ...order, size, limit };
+    const res = matchOrder(book, eff);
     if (res.filled <= 0) {
-      this.fills.push(this.#fillRow({ ts, marketId, order, res, tag, realised: 0, fee: 0 }));
+      this.fills.push(this.#fillRow({ ts, marketId, order: eff, res, tag, realised: 0, fee: 0 }));
       return res;
     }
 
@@ -177,7 +249,7 @@ export class Portfolio {
       this.cash -= res.notional + fee;
     }
 
-    this.fills.push(this.#fillRow({ ts, marketId, order, res, tag, realised, fee }));
+    this.fills.push(this.#fillRow({ ts, marketId, order: eff, res, tag, realised, fee }));
     return res;
   }