outcometick 1.5.2 → 1.6.2

package/runner/harness/node/harness.mjs

@@ -10,16 +10,61 @@
 // per-event budget is measured, and nothing but trades, fills and logs comes
 // back out.
 //
-//   node harness.mjs <job-dir>      job on stdin, results on fd 3
+//   node harness.mjs <job-dir>      job on stdin, results on stdout
 
 import { readSync, writeSync } from 'node:fs';
 import { createHmac } from 'node:crypto';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { replayMarket, BudgetMonitor, RunAbort } from '../../engine/replay.mjs';
+import { replayMarket, makeLogBudget, BudgetMonitor, RunAbort } from '../../engine/replay.mjs';
+import { Book as BookCls } from '../../engine/book.mjs';
+import { buildFeeds } from '../../engine/feed.mjs';
 import { Portfolio } from '../../engine/portfolio.mjs';
 import { CHANNEL, RESULT_FD, EXIT } from '../protocol.mjs';
 
+/**
+ * REPLACE `console`, before any strategy code is imported. Do not patch it.
+ *
+ * fd 1 is the result channel now (see protocol.mjs), and Node exposes no dup2,
+ * so it cannot be repointed the way the Python harness repoints it. Swapping
+ * out the METHODS is not enough: Node's console keeps the underlying stream on
+ * `console._stdout`, and `console.Console` will build a fresh one over any
+ * stream handed to it. `console._stdout.write(...)` passes the analyser today
+ * and puts arbitrary bytes on the result channel — not a forgery, the MAC still
+ * holds, but a half-line written between two real ones corrupts the record that
+ * follows it, and a dropped result reads as a run that produced nothing and
+ * gets refunded.
+ *
+ * So the strategy gets an object that holds no stream at all. Silently dropped
+ * rather than redirected: ctx.log is the documented, bounded, archived channel,
+ * and a strategy printing megabytes should not be able to turn that into worker
+ * output.
+ */
+let warnedAboutConsole = false;
+function consoleIsGone() {
+  // Not silent: a strategy author whose console.log vanishes without a word
+  // will spend an afternoon on it. stderr is the harness's own channel, and
+  // `ot run` prints it.
+  if (warnedAboutConsole) return undefined;
+  warnedAboutConsole = true;
+  try {
+    writeSync(2, 'harness: console output is discarded — use ctx.log() instead\n');
+  } catch { /* stderr is not worth crashing a run over */ }
+  return undefined;
+}
+globalThis.console = Object.freeze(Object.fromEntries(
+  // Every method the platform documents, so a strategy calling a real one gets
+  // a no-op instead of a TypeError. Deliberately absent: _stdout, _stderr and
+  // Console — the three names that hand back a writable stream.
+  [
+    'assert', 'clear', 'count', 'countReset', 'debug', 'dir', 'dirxml', 'error',
+    'group', 'groupCollapsed', 'groupEnd', 'info', 'log', 'profile',
+    'profileEnd', 'table', 'time', 'timeEnd', 'timeLog', 'timeStamp', 'trace',
+    'warn',
+  ].map((m) => [m, consoleIsGone]),
+));
+
+
 /**
  * The parser, captured at module load — before any strategy is imported.
  *
@@ -249,7 +294,7 @@ function checkHooks(Klass, hooks, arities) {
 async function main() {
   const jobDir = process.argv[2];
   if (!jobDir) {
-    process.stderr.write('usage: harness.mjs <job-dir>   (job on stdin, results on fd 3)\n');
+    process.stderr.write('usage: harness.mjs <job-dir>   (job on stdin, results on stdout)\n');
     return 2;
   }
 
@@ -265,7 +310,7 @@ async function main() {
   const job = parseJson(first);
   const srcDir = path.join(jobDir, 'src');
 
-  // Every result line goes out over FD 3, authenticated with the per-run key
+  // Every result line goes out over stdout, authenticated with the per-run key
   // that arrived in the job — before any strategy was imported. See the long
   // note in protocol.mjs: /out used to be a writable mount, and an allowlisted
   // pandas could rewrite trades.jsonl from on_settle.
@@ -301,10 +346,18 @@ async function main() {
     return code;
   };
 
-  // One monitor across the whole run: the budget is a p99 over events, and
-  // resetting it per market would let a strategy be pathological on every
-  // market and never trip.
+  // One monitor across the whole run: resetting it per market would let a
+  // strategy be pathological on every market and never trip. That is also
+  // exactly why the verdict is a WINDOW rather than a lifetime mean — spanning
+  // the run means a cheap prefix would otherwise pay for an expensive phase.
   const monitor = new BudgetMonitor({ limitMicros: job.limits?.perEventBudgetMicros ?? 400 });
+  // ONE log allowance for the whole run. Every market gets the same object, so
+  // a strategy cannot multiply its budget by the number of markets in a day —
+  // which on polymarket is about 386.
+  const logBudget = makeLogBudget({
+    bytes: job.limits?.logBytesPerRun,
+    lineChars: job.limits?.logLineChars,
+  });
 
   let Klass;
   try {
@@ -337,8 +390,40 @@ async function main() {
     // them. Nothing here holds more than the current row, which is the whole
     // point — see syncLineReader above.
     let seenEvents = 0;
-    let lastBook = null;
+    // The book as the ENGINE sees it, advanced by the same class.
+    //
+    // Three things were wrong with reading the last book event instead. A
+    // Polymarket snapshot carries one side, so the other came back null. Its
+    // ask ladder is published descending while Predict's is ascending, so
+    // element zero was the worst offer on one venue. And a `price_change`
+    // after the last snapshot moved the price for the engine but not for this
+    // number. Advancing a real Book removes all three, and removes a second
+    // implementation with them.
+    const summaryBook = new BookCls();
+    // The first book state that quotes BOTH sides — the same rule the worker
+    // applies, so the two do not report different numbers for one run. Locking
+    // each side as it appears would mix prices from two instants, and the
+    // favourite is the dearer of the pair.
+    let openQuotes = null;
     const remaining = { n: entry.n ?? 0 };
+
+    // Reference feeds and user series arrive INTERLEAVED in the same stream,
+    // in event time, and are appended to a growing array as they pass.
+    //
+    // Not shipped as a block on the market header, which would be simpler:
+    // a Binance price is very nearly the underlying that decides the outcome,
+    // so holding the whole window in the process would reopen exactly the hole
+    // the event stream was hardened against — a strategy that patched
+    // JSON.parse at import time could read the future off it. Streaming keeps
+    // the guarantee structural: a row the replay has not reached is not in the
+    // process at all.
+    const feedRows = new Map();
+    const rowsFor = (name) => {
+      let a = feedRows.get(name);
+      if (!a) { a = []; feedRows.set(name, a); }
+      return a;
+    };
+
     function* eventStream() {
       while (remaining.n > 0) {
         remaining.n -= 1;
@@ -352,12 +437,37 @@ async function main() {
           // worker reconciles what it sent against what came back.
           continue;
         }
+        // Consumed here, never handed to a hook: these are not market events.
+        if (ev.kind === 'ref' || ev.kind === 'ext') {
+          const row = projectRow(ev, Object.keys(ev).filter((k) => k !== 'kind' && k !== 'name'));
+          rowsFor(ev.name).push(row);
+          continue;
+        }
         seenEvents += 1;
-        if (ev.kind === 'book' && ev.snapshot) lastBook = ev;
+        if (ev.kind === 'book') {
+          if (ev.snapshot) summaryBook.snapshot(ev.ts_ms, ev.levels);
+          else if (ev.side && ev.ladder) {
+            summaryBook.delta(ev.ts_ms, ev.side, ev.ladder, ev.px, ev.size);
+          }
+          if (openQuotes === null) {
+            const up = summaryBook.best('UP');
+            const down = summaryBook.best('DOWN');
+            if (up != null && down != null) openQuotes = { up, down };
+          }
+        }
         yield ev;
       }
     }
 
+    // The arrays are shared with the stream above, so the feeds see each row
+    // the moment the replay passes its timestamp — and not before.
+    const references = buildFeeds(entry.references ?? [], Object.fromEntries(
+      (entry.references ?? []).map((n) => [n, rowsFor(n)]),
+    ), entry.lags ?? {});
+    const series = buildFeeds(entry.series ?? [], Object.fromEntries(
+      (entry.series ?? []).map((n) => [n, rowsFor(n)]),
+    ), entry.lags ?? {});
+
     /** Drain whatever the replay did not consume, so the stream stays framed. */
     const drainRest = () => {
       while (remaining.n > 0) {
@@ -389,18 +499,61 @@ async function main() {
         strategy: instance,
         hooks: job.hooks,
         portfolio: pf,
+        // ONE allowance for the whole run, handed to every market. Per-market
+        // was the old shape and the reason ctx.log was an export channel.
+        logBudget,
         fillDelayMs: job.fillDelayMs ?? 0,
         logLimit: job.limits?.logLinesPerMarketDay ?? 10_000,
         budget: monitor,
         seed: job.seed ?? 1,
         feeBps: job.feeBps ?? 0,
+        references,
+        series,
       });
 
       drainRest();
       result.markets_run += 1;
       result.events_seen += seenEvents;
-      if (out.logTruncated) result.log_truncated = true;
-      for (const line of out.logs) logsOut.write(`${entry.market.market_id} ${line}\n`);
+      // Acknowledge the market-day AFTER it is replayed, so the panel a
+      // customer is watching counts finished work rather than queued bytes.
+      emit(CHANNEL.progress, stringify({ n: result.markets_run }));
+      if (out.logTruncated && !result.log_truncated) {
+        result.log_truncated = true;
+        // SAID IN THE LOG ITSELF, once, where someone reading it will see it.
+        // A log that just stops looks like a strategy that stopped calling
+        // ctx.log — and the reader goes hunting for a bug in their own code.
+        logsOut.write('[runner] log budget spent — the rest of this run\'s'
+          + ' ctx.log output was dropped. ctx.log is for reading, not for'
+          + ' exporting; see the SDK docs for the limit.\n');
+      }
+      // OPENING TIME FIRST, then a short id.
+      //
+      // The prefix used to be the full 64-character condition hash, which
+      // identifies a market to the venue and to nobody reading a log: there is
+      // no way to tell from it which market this was, or when. The opening
+      // time is the thing a person actually navigates by — it is what the
+      // venue puts in the slug — and eight characters of the hash still
+      // separate the several strikes that open at the same instant.
+      //
+      // MUST MATCH THE PYTHON HARNESS. Two log formats from one archive is the
+      // kind of divergence the conformance suite exists to catch.
+      // A market with no opening time keeps the id alone rather than gaining a
+      // leading space — every consumer of this file splits on whitespace, and
+      // a blank first field shifts all of them by one.
+      const shortId = String(entry.market.market_id ?? '').slice(0, 10);
+      // READABLE, because ctx.log already puts the EVENT time on every line as
+      // epoch millis. Two bare 13-digit numbers side by side are two numbers
+      // nobody can tell apart — and the one this prefix exists for is the one
+      // that would be mistaken for the other.
+      //
+      // UTC, to the minute: the market schedule is published in UTC and a
+      // market-day is a UTC day, so a local rendering would file a row under a
+      // different date than the archive does.
+      const openedAt = entry.market.open_ts_ms == null
+        ? null
+        : new Date(entry.market.open_ts_ms).toISOString().slice(0, 16).replace('T', ' ');
+      const prefix = openedAt == null ? shortId : `${openedAt} ${shortId}`;
+      for (const line of out.logs) logsOut.write(`${prefix} ${line}\n`);
       for (const c of out.crosschecks) result.crosschecks.push(c);
 
       // Tracked as the stream went past rather than scanned afterwards: there
@@ -411,8 +564,8 @@ async function main() {
         asset: entry.market.asset ?? null,
         interval: entry.market.interval ?? null,
         outcome: entry.market.outcome ?? null,
-        up_px: lastBook?.levels?.UP?.asks?.[0]?.[0] ?? null,
-        down_px: lastBook?.levels?.DOWN?.asks?.[0]?.[0] ?? null,
+        up_px: openQuotes?.up ?? null,
+        down_px: openQuotes?.down ?? null,
         stream: entry.stream ?? null,
       });
     } catch (err) {

package/runner/harness/node/sdk/index.d.ts

@@ -132,10 +132,37 @@ export interface Ctx<P = Record<string, unknown>> {
   assert_outcome(market: unknown, outcome: Side): void;
 }
 
-export interface OrderInit {
+/**
+ * Size an order in contracts, or in money.
+ *
+ * A union rather than two optional fields, so `{ size, notional }` together is
+ * a compile error rather than a run-time rejection: they answer the same
+ * question two ways and there is no sensible reading of both.
+ */
+export type OrderSizing =
+  | {
+    /** Contracts. Must be positive. */
+    size: number;
+    notional?: never;
+  }
+  | {
+    size?: never;
+    /**
+     * Spend at most this much, converted to contracts as
+     * `floor(notional / limit)`.
+     *
+     * REQUIRES `limit`, which is why this arm makes it non-optional: a
+     * contract costs whatever it fills at and a marketable order walks the
+     * book, so dividing by the current best price overspends the moment there
+     * is any slippage. The limit is the price you have already said you will
+     * not exceed, which is what makes "at most" true.
+     */
+    notional: number;
+    limit: number;
+  };
+
+export type OrderInit = OrderSizing & {
   side: Side;
-  /** Contracts. Must be positive. */
-  size: number;
   /**
    * A bound in whichever direction protects you: a ceiling when opening, a
    * floor when reducing. Must be within [0, 1] — a binary outcome token
@@ -149,7 +176,7 @@ export interface OrderInit {
   /** Only 'ioc' is modelled; anything else is rejected at construction. */
   tif?: 'ioc';
   tag?: string | null;
-}
+};
 
 /**
  * An order a hook returns.

package/runner/harness/node/sdk/index.mjs

@@ -37,15 +37,59 @@ export class Strategy {
  * opening, a floor when reducing.
  */
 export class Order {
-  constructor({ side, size, limit = null, holdS = null, hold_s = null,
+  constructor({ side, size, notional = null, limit = null, holdS = null, hold_s = null,
     reduceOnly = false, reduce_only = false, tif = 'ioc', tag = null } = {}) {
     if (!SIDES.includes(side)) {
       throw new Error(`side must be "UP" or "DOWN", got ${JSON.stringify(side)}`);
     }
+    // SIZING IN MONEY — this is about the `notional` field, converted here
+    // rather than in the engine. `size` is CONTRACTS (see OrderSizing in
+    // index.d.ts); it is not money, and reading this heading as if it were
+    // is the one wrong turn this comment can cause.
+    //
+    // Position sizing is nearly always a budget, not a contract count, and the
+    // conversion has exactly one honest divisor: your own limit. A contract
+    // costs whatever it fills at, and a marketable order walks the book — so
+    // dividing by the current best price overspends the moment there is any
+    // slippage, by an amount nobody stated. Dividing by the limit is the price
+    // you have already said you will not exceed, which makes "spend at most
+    // this much" true rather than approximately true.
+    //
+    // Hence: `notional` REQUIRES `limit`. Without one there is no upper bound
+    // on the fill price, so "spend $80" has no answer, and picking one for the
+    // caller would be inventing a number they never wrote.
+    if (notional != null) {
+      if (size != null) {
+        throw new Error('give size or notional, not both — they answer the same question two ways');
+      }
+      if (!(typeof notional === 'number' && Number.isFinite(notional) && notional > 0)) {
+        throw new Error(`notional must be a positive number, got ${JSON.stringify(notional)}`);
+      }
+      if (limit == null) {
+        throw new Error('notional needs a limit: without a price ceiling there is no way to turn a budget into a size');
+      }
+      const px = Number(limit);
+      if (!(Number.isFinite(px) && px > 0)) {
+        throw new Error(`notional needs a limit above 0, got ${JSON.stringify(limit)}`);
+      }
+      // FLOOR, so the spend is at most the budget rather than around it.
+      const derived = Math.floor(notional / px);
+      if (derived < 1) {
+        throw new Error(`notional ${notional} buys no contracts at limit ${px}`);
+      }
+      // eslint-disable-next-line no-param-reassign
+      size = derived;
+    }
     if (!(typeof size === 'number' && Number.isFinite(size) && size > 0)) {
       throw new Error(`size must be a positive number, got ${JSON.stringify(size)}`);
     }
-    if (limit != null && !(Number(limit) >= 0 && Number(limit) <= 1)) {
+    // A NUMBER, matching the engine. `Number('0.5')` is 0.5, `Number([0.5])`
+    // is 0.5 and `Number(true)` is 1 — while Python's `float([0.5])` raises,
+    // so the same published SDK accepted a list in one language and threw in
+    // the other. Coercion is not validation, and the two languages do not
+    // coerce alike.
+    if (limit != null
+      && !(typeof limit === 'number' && Number.isFinite(limit) && limit >= 0 && limit <= 1)) {
       // A binary outcome token trades between 0 and 1. A limit outside that is
       // not a price, and silently clamping it would fill an order the strategy
       // never asked for.

package/runner/harness/protocol.mjs

@@ -41,7 +41,7 @@ import { createHmac, timingSafeEqual } from 'node:crypto';
 export const JOB_FILE = 'job.json';
 
 /**
- * Results come back over FD 3, authenticated. There is no output directory.
+ * Results come back over stdout, authenticated. There is no output directory.
  *
  * `/out` used to be a writable bind mount holding trades.jsonl and fills.jsonl.
  * A Python strategy declaring the allowlisted `pandas` could call
@@ -72,10 +72,38 @@ export const CHANNEL = Object.freeze({
   fill: 'f',
   log: 'l',
   result: 'r',
+  /**
+   * "I have finished replaying market-day N." Display only.
+   *
+   * The worker used to count how many market-days it had WRITTEN into stdin,
+   * which is not the same thing: a write only proves the bytes were accepted
+   * into a buffer. Small days fit several at a time, so the bar ran ahead of
+   * the replay and could show 100% while the sandbox still had work to do —
+   * the "looks stuck" experience this panel exists to prevent.
+   *
+   * It comes from the sandbox, so it is attacker-influenced like every other
+   * line, and it is authenticated like every other line. That is fine for a
+   * progress bar and NOT fine for money: billing still uses only what the
+   * worker itself fetched and fed.
+   */
+  progress: 'p',
 });
 
-/** The fd the harness writes results to. 0 is the job, 1 and 2 are discarded. */
-export const RESULT_FD = 3;
+/**
+ * The authenticated result channel: the container's stdout.
+ *
+ * It used to be fd 3. Docker hands a container stdin/stdout/stderr and nothing
+ * else — the worker spawns `docker run` with a fourth pipe, but that fd belongs
+ * to the docker CLIENT, so inside the container fd 3 was closed and every write
+ * failed with EBADF. No containerised run had ever produced a result.
+ *
+ * Each harness makes fd 1 unreachable for the strategy before loading its code
+ * (Python dups it away and points 1 at /dev/null; JavaScript takes over
+ * `console`, which is the only route left once the analyser has refused
+ * `process`). The MAC is what makes forgery impossible, and always was —
+ * /proc/self/fd/1 was addressable either way.
+ */
+export const RESULT_FD = 1;
 
 /** Exit codes a harness may use. Anything else is treated as a crash. */
 export const EXIT = Object.freeze({

package/runner/harness/python/harness.py

@@ -7,32 +7,77 @@ same exit codes. The worker does not know or care which language produced a
 run's logs, which is what stops the report shape depending on the customer's
 choice of language.
 
-    python3 harness.py <job-dir>      job on stdin, results on fd 3
+    python3 harness.py <job-dir>      job on stdin, results on stdout
 """
 
 from __future__ import annotations
 
+import builtins
 import hashlib
 import hmac
 import importlib.util
 import json
 import os
+import datetime as _datetime
 import sys
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-from otengine import BudgetMonitor, Portfolio, RunAbort  # noqa: E402
-from otreplay import replay_market  # noqa: E402
+from otengine import Book as _Book, BudgetMonitor, Portfolio, RunAbort  # noqa: E402
+from otreplay import (  # noqa: E402
+    write_all,
+    replay_market, make_log_budget, LOG_BYTES_PER_RUN, LOG_LINE_CHARS,
+)
+from otfeed import build_feeds  # noqa: E402
 
-# Results go out over FD 3, authenticated — see the long note in protocol.mjs.
+# Results go out over stdout, authenticated — see the long note in protocol.mjs.
 # /out used to be a writable bind mount, and a strategy declaring the allowed
 # `pandas` could rewrite trades.jsonl from on_settle, after being told the
 # official outcome.
-RESULT_FD = 3
+# The authenticated result channel.
+#
+# Docker hands a container stdin/stdout/stderr and nothing else. The worker
+# spawns `docker run` with a fourth pipe, but that fd belongs to the docker
+# CLIENT — inside the container fd 3 is closed, and every write to it failed
+# with EBADF. That is why no containerised run had ever produced a result.
+#
+# So the real stdout is duplicated to a private fd and fd 1 is pointed at
+# /dev/null, HERE, before any strategy code is imported: results leave over the
+# container's stdout, and a strategy's print() goes nowhere. Which was already
+# the intent — the worker used to discard stdout for exactly that reason.
+#
+# /proc/self/fd/<n> stays addressable. The MAC is what makes forgery
+# impossible, and always was.
+RESULT_FD = os.dup(1)
+_devnull = os.open(os.devnull, os.O_WRONLY)
+os.dup2(_devnull, 1)
+os.close(_devnull)
+
+
+def _print_is_gone(*_args, **_kwargs):
+    """print() writes to /dev/null now; say so once, on stderr.
+
+    Not silent: a strategy author whose print() vanishes without a word will
+    spend an afternoon on it. `ot run` shows stderr.
+    """
+    if not _print_is_gone.warned:
+        _print_is_gone.warned = True
+        try:
+            sys.stderr.write("harness: print() output is discarded -- use ctx.log() instead\n")
+        except Exception:
+            pass  # stderr is not worth crashing a run over
+
+
+_print_is_gone.warned = False
+builtins.print = _print_is_gone
 CHANNEL_TRADE = "t"
 CHANNEL_FILL = "f"
 CHANNEL_LOG = "l"
 CHANNEL_RESULT = "r"
+# "I have finished replaying market-day N." Display only, and the mirror of
+# CHANNEL.progress in protocol.mjs -- see the long note there. Both engines or
+# neither: runner/conformance compares them line by line.
+CHANNEL_PROGRESS = "p"
 
 EXIT_OK = 0
 EXIT_REJECTED = 10
@@ -184,7 +229,7 @@ def read_line(stream):
 
 def main() -> int:
     if len(sys.argv) < 2:
-        sys.stderr.write("usage: harness.py <job-dir>   (job on stdin, results on fd 3)\n")
+        sys.stderr.write("usage: harness.py <job-dir>   (job on stdin, results on stdout)\n")
         return 2
     job_dir = sys.argv[1]
 
@@ -198,6 +243,10 @@ def main() -> int:
 
     limits = job.get("limits") or {}
     monitor = BudgetMonitor(limit_micros=limits.get("perEventBudgetMicros", 400))
+    log_budget = make_log_budget(
+        limits.get("logBytesPerRun", LOG_BYTES_PER_RUN),
+        limits.get("logLineChars", LOG_LINE_CHARS),
+    )
 
     result = {
         "markets_run": 0,
@@ -220,7 +269,7 @@ def main() -> int:
         mac = hmac.new(
             key_bytes, f"{channel} {payload}".encode("utf-8"), hashlib.sha256
         ).hexdigest()[:32]
-        os.write(RESULT_FD, f"{mac} {channel} {payload}\n".encode("utf-8"))
+        write_all(RESULT_FD, f"{mac} {channel} {payload}\n".encode("utf-8"))
 
     class _Logs:
         @staticmethod
@@ -268,7 +317,29 @@ def main() -> int:
         # Pulled one at a time as replay asks. Nothing here holds more than the
         # current row — that is what makes "future rows are not in the process"
         # literally true rather than approximately true.
-        counters = {"n": int(entry.get("n") or 0), "seen": 0, "last_book": None}
+        # The book as the ENGINE sees it, advanced by the same class. A
+        # Polymarket snapshot carries one side, its ladder is published
+        # descending while Predict's is ascending, and a price_change after the
+        # last snapshot moves the price for the engine — reading the last event
+        # got all three wrong, and was a second implementation besides.
+        counters = {"n": int(entry.get("n") or 0), "seen": 0,
+                    "book": _Book(entry["market"]["market_id"]),
+                    # The first book state that quotes BOTH sides — the same
+                    # rule the worker applies. Locking each side as it appears
+                    # would mix prices from two instants, and the favourite is
+                    # the dearer of the pair.
+                    "open_quotes": None}
+
+        # Reference feeds and user series arrive INTERLEAVED in this same
+        # stream, in event time, and are appended to growing arrays as they
+        # pass. Not shipped as a block on the market header: a Binance price is
+        # very nearly the underlying that decides the outcome, so holding the
+        # whole window in the process would reopen exactly the hole the event
+        # stream was hardened against. Streaming keeps it structural.
+        feed_rows: dict = {}
+
+        def rows_for(name):
+            return feed_rows.setdefault(name, [])
 
         def event_stream():
             while counters["n"] > 0:
@@ -281,9 +352,24 @@ def main() -> int:
                 except json.JSONDecodeError:
                     # Corruption in OUR data, not the strategy's problem.
                     continue
+                kind = ev.get("kind")
+                if kind in ("ref", "ext"):
+                    # Consumed here, never handed to a hook: not market events.
+                    row = {k: v for k, v in ev.items() if k not in ("kind", "name")}
+                    rows_for(ev.get("name")).append(row)
+                    continue
                 counters["seen"] += 1
-                if ev.get("kind") == "book" and ev.get("snapshot"):
-                    counters["last_book"] = ev
+                if kind == "book" and ev.get("snapshot"):
+                    counters["book"].snapshot(ev.get("ts_ms") or 0, ev.get("levels") or {})
+                elif kind == "book" and ev.get("side") and ev.get("ladder"):
+                    counters["book"].delta(
+                        ev.get("ts_ms") or 0, ev["side"], ev["ladder"],
+                        ev.get("px"), ev.get("size"))
+                if kind == "book" and counters["open_quotes"] is None:
+                    _up = counters["book"].best("UP")
+                    _down = counters["book"].best("DOWN")
+                    if _up is not None and _down is not None:
+                        counters["open_quotes"] = (_up, _down)
                 yield ev
 
         def drain_rest():
@@ -313,10 +399,24 @@ def main() -> int:
                 hooks=job.get("hooks") or {},
                 portfolio=pf,
                 fill_delay_ms=job.get("fillDelayMs", 0),
-                log_limit=limits.get("logLinesPerMarketDay", 10_000),
+                # ONE allowance for the whole run, handed to every market.
+                # Per-market was the old shape and the reason ctx.log was an
+                # export channel: polymarket has ~386 markets a day, so a
+                # per-market budget is a per-run budget multiplied by 386.
+                log_budget=log_budget,
                 budget=monitor,
                 seed=job.get("seed", 1),
                 fee_bps=job.get("feeBps", 0),
+                references=build_feeds(
+                    entry.get("references") or [],
+                    {n: rows_for(n) for n in (entry.get("references") or [])},
+                    entry.get("lags") or {},
+                ),
+                series=build_feeds(
+                    entry.get("series") or [],
+                    {n: rows_for(n) for n in (entry.get("series") or [])},
+                    entry.get("lags") or {},
+                ),
             )
         except RunAbort as err:
             drain_rest()
@@ -336,19 +436,37 @@ def main() -> int:
         drain_rest()
         result["markets_run"] += 1
         result["events_seen"] += counters["seen"]
-        if out["log_truncated"]:
+        # Acknowledged AFTER the replay, so the panel a customer is watching
+        # counts finished work rather than queued bytes.
+        emit(CHANNEL_PROGRESS, _DUMPS({"n": result["markets_run"]}))
+        if out["log_truncated"] and not result["log_truncated"]:
             result["log_truncated"] = True
+            # Said in the log itself, once. A log that just stops reads as a
+            # strategy that stopped calling ctx.log, and the reader goes
+            # hunting for a bug in their own code.
+            emit(CHANNEL_LOG, "[runner] log budget spent -- the rest of this"
+                 " run's ctx.log output was dropped. ctx.log is for reading,"
+                 " not for exporting; see the SDK docs for the limit.")
         for line in out["logs"]:
-            logs_fh.write(f'{entry["market"]["market_id"]} {line}\n')
+            # 开盘时间在前，短 id 在后 —— 见 node harness 里的同一处注释。
+            # 两个 harness 的日志格式必须一致。
+            _open = entry["market"].get("open_ts_ms")
+            _sid = str(entry["market"].get("market_id") or "")[:10]
+            # 格式化成可读的 UTC —— ctx.log 已经在每行放了事件时间（毫秒数），
+            # 两个 13 位裸数字挨在一起没人分得清。见 node harness 的注释。
+            # 没有开盘时间时只留 id，不要留一个前导空格。
+            if _open is None:
+                _prefix = _sid
+            else:
+                _dt = _datetime.datetime.fromtimestamp(_open / 1000, _datetime.timezone.utc)
+                _prefix = f"{_dt.strftime('%Y-%m-%d %H:%M')} {_sid}"
+            logs_fh.write(f'{_prefix} {line}\n')
         result["crosschecks"].extend(out["crosschecks"])
 
         # Tracked as the stream went past; there is no array left to scan.
-        lb = counters["last_book"] or {}
-        levels = lb.get("levels") or {}
-        up_asks = (levels.get("UP") or {}).get("asks") or []
-        down_asks = (levels.get("DOWN") or {}).get("asks") or []
-        up_px = up_asks[0][0] if up_asks else None
-        down_px = down_asks[0][0] if down_asks else None
+        _oq = counters["open_quotes"]
+        up_px = _oq[0] if _oq else None
+        down_px = _oq[1] if _oq else None
         result["market_summaries"].append({
             "market_id": entry["market"]["market_id"],
             "asset": entry["market"].get("asset"),