perp-cli 0.12.17 → 0.14.0

package/dist/commands/arb-auto.js

@@ -1,18 +1,229 @@
+import { ARB_MARGIN_BUFFER, marketLeverageOf, requiredArbMargin } from "../rebalance.js";
+import { ERROR_CODES, PerpError } from "../errors.js";
+import { unsupported } from "../exchanges/trading-v2.js";
+import { tradingV2Of } from "../exchanges/legacy-trading-v2.js";
+import { invalidateCache } from "../cache.js";
+import { isDryRun, networkOf, supportsDryRun } from "../cli-flags.js";
 import chalk from "chalk";
-import { formatUsd, printJson, jsonOk, makeTable, logSettledRejections } from "../utils.js";
+import { formatUsd, printJson, jsonOk, jsonError, makeTable, logSettledRejections, symbolMatch } from "../utils.js";
 import { computeExecutableSize } from "../liquidity.js";
 import { computeMatchedSize, computeSpotPerpMatchedSize } from "../arb/index.js";
-import { computeAnnualSpread, toHourlyRate } from "../funding.js";
+import { toHourlyRate } from "../funding.js";
+import { toHourlyRateByBasis } from "../funding/normalize.js";
 import { fetchPacificaPricesRaw, parsePacificaRaw, fetchHyperliquidMetaRaw, parseHyperliquidMetaRaw, fetchLighterOrderBookDetailsRaw, fetchLighterFundingRatesRaw, parseLighterRaw, } from "../shared-api.js";
-import { scanDexArb } from "../dex-asset-map.js";
+import { fetchAllDexAssets, findDexArbPairs, scanDexArb } from "../dex-asset-map.js";
 import { logExecution, readExecutionLog } from "../execution-log.js";
 import { smartOrder } from "../smart-order.js";
 import { aggressiveSettleBoost, estimateFundingUntilSettlement, computeBasisRisk, notifyIfEnabled, } from "../arb-utils.js";
 import { checkChainMargins, isCriticalMargin, shouldBlockEntries, computeAutoSize, } from "../cross-chain-margin.js";
-import { loadArbState, saveArbState, addPosition as persistAddPosition, removePosition as persistRemovePosition, createInitialState, } from "../arb-state.js";
+import { loadArbState, addPosition as persistAddPosition, removePosition as persistRemovePosition, updatePosition as persistUpdatePosition, createInitialState, createDaemonStateStore, } from "../arb-state.js";
 import { handleRates, handleBasisScan, handleDexScan, handleCompare, handleFundingHistory, handleFundingPositions, fetchAllPrices, printGapTable, printTrackSummary, formatGapPrice, } from "./arb.js";
 // ── Fee-Adjusted Net Spread Calculation ──
 import { getTakerFee } from "../constants.js";
+import { assertFundingArbVenue, getVenue, listVenuesWithRole, networkConfig, resolveVenueId, tryResolveVenueId } from "../exchanges/venue.js";
+import { sharedApiNetwork } from "../api/public/urls.js";
+import { findSpotQuoteBalance, readSpotQuoteAvailableFresh, requireBotSpotVenue, requireSpotAdapter, spotNetworkOf, spotPairSymbol, spotSharesPerpMargin, sweepSpotQuoteToPerp, transferQuoteToPerp, transferQuoteToSpot } from "../exchanges/spot-factory.js";
+import { fillSizeString, readSpotBalancesFresh, sizeDecimalsOf, spotLotStepOf, spotMarketFill } from "../exchanges/spot-result.js";
+import { floorSize, floorToStep, lotStepOf } from "../exchanges/precision.js";
+import { MAX_PRICE_DEVIATION_PCT } from "../exchanges/spot-interface.js";
+import { isQuarantined, quarantineEntryFor, quarantineKey, quarantineSymbol, setQuarantineNetwork } from "../bot/quarantine.js";
+import { clearPendingEntry, orphanedPendingEntries, writePendingEntry } from "../arb/pending-entry.js";
+import { closePerpVerified, isOutcomeUnknown, placePerpVerified, rejectedLotSize, trimFirstLegToHedge } from "../bot/perp-order.js";
+/**
+ * The venue's published order minimums for `sym` (VenueMarket.minSize / minNotional — the same
+ * source `trade scale-in` checks its levels against); null = the venue publishes none.
+ * A market missing from the venue's list throws (Rule #2: no assumed minimum).
+ */
+export async function venueOrderMinimums(adapter, sym, network) {
+    const vm = (await tradingV2Of(adapter, network).getVenueMarkets()).find(m => symbolMatch(m.symbol, sym));
+    if (vm === undefined) {
+        throw new PerpError("SYMBOL_NOT_FOUND", `${adapter.name}: market ${sym} not found — its minimum order size is unknown`, {
+            exchange: adapter.name, remediation: `Check the symbol: perp market list -e ${adapter.name}`,
+        });
+    }
+    return { minSize: vm.minSize, minNotional: vm.minNotional };
+}
+/** The pair's minimums: the larger of the two legs' (both legs trade the same size); 0 = none published. */
+export function pairOrderMinimums(legs) {
+    const parts = legs.map(l => {
+        const bits = [l.minNotional !== null ? `$${l.minNotional}` : null, l.minSize !== null ? `size ${l.minSize}` : null].filter(b => b !== null);
+        return `${l.exchange}: ${bits.length > 0 ? bits.join(", ") : "none published"}`;
+    });
+    return {
+        minNotional: Math.max(0, ...legs.map(l => l.minNotional !== null ? Number(l.minNotional) : 0)),
+        minSize: Math.max(0, ...legs.map(l => l.minSize !== null ? Number(l.minSize) : 0)),
+        describe: parts.join("; "),
+        legs,
+    };
+}
+const errText = (e) => (e instanceof Error ? e.message : String(e));
+function quarantinePair(source, sym, longExch, shortExch, reason, log) {
+    quarantineSymbol(source, sym, reason, `Check ${sym} on ${longExch} and ${shortExch} (perp -e ${longExch} account positions; perp -e ${shortExch} account positions); close or re-hedge by hand, then: perp strategy quarantine-clear ${sym}`, log);
+}
+/**
+ * Open long `size` on longExch, then short the long's verified fill on shortExch.
+ * `smart` sends the opening legs as IOC limits (smartOrder); rollback / trim are
+ * always reduce-only market orders.
+ */
+export async function openPerpPairVerified(p) {
+    const { source, sym, longAdapter, longExch, longSym, shortAdapter, shortExch, shortSym, size, smart, log } = p;
+    let dec = sizeDecimalsOf(size);
+    const q = (reason, exposure) => {
+        quarantinePair(source, sym, longExch, shortExch, reason, log);
+        return { status: "quarantined", reason, exposure };
+    };
+    const smartPlace = (a, legSym, side, sz) => smart ? { place: () => smartOrder(a, legSym, side, sz).then(r => r.result) } : {};
+    let longFilled;
+    try {
+        longFilled = (await placePerpVerified(longAdapter, longExch, longSym, "buy", size, smartPlace(longAdapter, longSym, "buy", size))).filledSize;
+    }
+    catch (e) {
+        if (isOutcomeUnknown(e))
+            return q(`long ${size} on ${longExch} outcome unknown (${errText(e)}) — no short placed`, `long up to ${size} on ${longExch} (unconfirmed)`);
+        return { status: "not_opened", reason: `long leg on ${longExch}: ${errText(e)}`, rolledBack: null, lotSize: rejectedLotSize(e) };
+    }
+    const longOpen = fillSizeString(longFilled, dec);
+    let shortFilled;
+    let shortSize = longOpen;
+    try {
+        try {
+            shortFilled = (await placePerpVerified(shortAdapter, shortExch, shortSym, "sell", longOpen, smartPlace(shortAdapter, shortSym, "sell", longOpen))).filledSize;
+        }
+        catch (e) {
+            const lot = p.shortLotRetry === true ? rejectedLotSize(e) : null;
+            if (lot === null)
+                throw e;
+            const lotDec = Math.max(0, Math.ceil(-Math.log10(lot) - 1e-9));
+            dec = Math.max(dec, lotDec);
+            shortSize = (Math.floor(longFilled / lot + 1e-9) * lot).toFixed(lotDec);
+            if (!(Number(shortSize) > 0))
+                throw e;
+            log(`  short leg on ${shortExch} rejected for lot size ${lot} — placing the short once at ${shortSize} (long ${longOpen} verified, not resubmitted)`);
+            shortFilled = (await placePerpVerified(shortAdapter, shortExch, shortSym, "sell", shortSize, smartPlace(shortAdapter, shortSym, "sell", shortSize))).filledSize;
+        }
+    }
+    catch (e) {
+        const msg = errText(e);
+        if (isOutcomeUnknown(e)) {
+            // The short may exist: rolling the long back could leave a naked short.
+            return q(`short ${shortSize} on ${shortExch} outcome unknown (${msg}); long ${longOpen} open on ${longExch} — not rolled back`, `long ${longOpen} on ${longExch}; short up to ${shortSize} on ${shortExch} (unconfirmed)`);
+        }
+        log(`  short leg on ${shortExch} failed: ${msg} — rolling back long ${longOpen} on ${longExch} (reduce-only)`);
+        let rb;
+        try {
+            rb = await closePerpVerified(longAdapter, longExch, longSym, "sell", longOpen, { decimals: dec });
+        }
+        catch (rbErr) {
+            return q(`short failed (${msg}) and the long rollback ${isOutcomeUnknown(rbErr) ? "is unconfirmed" : "failed"} (${errText(rbErr)})`, `long ${longOpen} on ${longExch} (unhedged${isOutcomeUnknown(rbErr) ? ", rollback unconfirmed" : ""})`);
+        }
+        if (rb.residual > 0) {
+            const residual = fillSizeString(rb.residual, dec);
+            return q(`short failed (${msg}); the long rollback closed ${fillSizeString(rb.closed, dec)} of ${longOpen}${rb.note !== null ? ` (${rb.note})` : ""}`, `long ${residual} on ${longExch} (unhedged)`);
+        }
+        return { status: "not_opened", reason: `short leg on ${shortExch}: ${msg}`, rolledBack: longOpen, lotSize: null };
+    }
+    const hedged = fillSizeString(shortFilled, dec);
+    let trimmed;
+    try {
+        trimmed = await trimFirstLegToHedge(longAdapter, longExch, longSym, "buy", longFilled, shortFilled, dec);
+    }
+    catch (e) {
+        return q(`short filled ${hedged} of ${longOpen}; trimming the long's excess on ${longExch} ${isOutcomeUnknown(e) ? "is unconfirmed" : "failed"} (${errText(e)})`, `long ${longOpen} on ${longExch} vs short ${hedged} on ${shortExch}`);
+    }
+    return { status: "opened", hedged, longFilled, shortFilled, trimmed };
+}
+/**
+ * Close a perp-perp pair: long first, then short — reduce-only, verified, no retry.
+ * A definite failure of the long close changes nothing ("failed": the caller may retry
+ * later and should quarantine after repeated failures). Once the long is closed, any
+ * short failure, an unknown outcome, or a residual that survives one reduce-only residual
+ * close (closePerpVerified) quarantines.
+ */
+export async function closePerpPairVerified(p) {
+    const { source, sym, longAdapter, longExch, longSym, longSize, shortAdapter, shortExch, shortSym, shortSize, smart, log } = p;
+    const closeOpts = (a, legSym, side, sz) => (smart ? { place: () => smartOrder(a, legSym, side, sz, { reduceOnly: true }).then(r => r.result) } : {});
+    const q = (reason) => {
+        quarantinePair(source, sym, longExch, shortExch, reason, log);
+        return { status: "quarantined", reason };
+    };
+    // Each leg: reduce-only verified close; a partial fill gets ONE reduce-only close of the
+    // measured residual (closePerpVerified); still not closed → quarantine.
+    let lc;
+    try {
+        lc = await closePerpVerified(longAdapter, longExch, longSym, "sell", longSize, closeOpts(longAdapter, longSym, "sell", longSize));
+    }
+    catch (e) {
+        if (isOutcomeUnknown(e))
+            return q(`close of long ${longSize} on ${longExch} outcome unknown (${errText(e)}); short ${shortSize} on ${shortExch} left open`);
+        return { status: "failed", reason: `long close on ${longExch}: ${errText(e)}` };
+    }
+    if (lc.residual > 0) {
+        return q(`close of long on ${longExch} closed ${lc.closed} of ${longSize}, ${lc.residual} still open${lc.note !== null ? ` (${lc.note})` : ""}; short ${shortSize} on ${shortExch} not closed (legs unbalanced)`);
+    }
+    let sc;
+    try {
+        sc = await closePerpVerified(shortAdapter, shortExch, shortSym, "buy", shortSize, closeOpts(shortAdapter, shortSym, "buy", shortSize));
+    }
+    catch (e) {
+        return q(`long closed on ${longExch}; close of short ${shortSize} on ${shortExch} ${isOutcomeUnknown(e) ? "has an unknown outcome" : "failed"} (${errText(e)}) — short unhedged`);
+    }
+    if (sc.residual > 0) {
+        return q(`long closed; close of short on ${shortExch} closed ${sc.closed} of ${shortSize}, ${sc.residual} still open${sc.note !== null ? ` (${sc.note})` : ""} — residual short unhedged`);
+    }
+    return { status: "closed" };
+}
+/**
+ * Graceful stop of a daemon loop: SIGINT / SIGTERM (`perp background stop`, Ctrl+C) only REQUEST
+ * the stop — the leg sequence (or rollback) in flight finishes, nothing new starts, then the loop
+ * ends. A repeated signal never exits between two legs (it is logged).
+ */
+export function gracefulStop(name) {
+    let stopping = false;
+    const onSignal = (sig) => {
+        if (stopping) {
+            console.error(chalk.yellow(`\n  ${name}: already stopping (${sig}) — finishing the current leg sequence first`));
+            return;
+        }
+        stopping = true;
+        console.error(chalk.yellow(`\n  ${name}: stop requested (${sig}) — finishing the current cycle, no new entries`));
+    };
+    const onInt = () => onSignal("SIGINT");
+    const onTerm = () => onSignal("SIGTERM");
+    process.on("SIGINT", onInt);
+    process.on("SIGTERM", onTerm);
+    return {
+        requested: () => stopping,
+        dispose: () => { process.removeListener("SIGINT", onInt); process.removeListener("SIGTERM", onTerm); },
+    };
+}
+/** Sleep `ms`, waking within 250 ms once `stop()` is true. */
+export async function interruptibleSleep(ms, stop) {
+    const until = Date.now() + ms;
+    while (!stop() && Date.now() < until)
+        await new Promise(r => setTimeout(r, Math.min(250, until - Date.now())));
+}
+/**
+ * Startup: pending-entry records `source` left behind by a process that died mid-entry → the
+ * symbol is quarantined (legs may be open), then the record is cleared. An unreadable pending
+ * file throws (the daemon does not start on unknown exposure).
+ */
+export function quarantineOrphanedEntries(network, source, log) {
+    for (const e of orphanedPendingEntries(network, source)) {
+        quarantinePair(source, e.symbol, e.longExchange, e.shortExchange, `an entry (${e.size} per leg, started ${e.startedAt} by pid ${e.pid}) was in flight when that daemon stopped — legs may be open`, log);
+        clearPendingEntry(network, source, e.symbol);
+    }
+}
+/** The entry's outcome is recorded: drop its pending record (a failed drop is logged — the next start quarantines it). */
+export function finishPendingEntry(network, source, symbol, log) {
+    try {
+        clearPendingEntry(network, source, symbol);
+    }
+    catch (e) {
+        log(`  CRITICAL: could not clear the pending-entry record of ${symbol} (${e instanceof Error ? e.message : String(e)}) — the next daemon start will quarantine ${symbol}`);
+    }
+}
+/** Consecutive definite close failures before the daemons quarantine a pair. */
+const MAX_PAIR_CLOSE_FAILURES = 3;
 /**
  * Compute the estimated round-trip cost as a percentage of notional.
  * Round-trip = 4 × taker fee + 2 × slippage (entry + exit for both legs).
@@ -45,46 +256,55 @@ export function computeNetSpread(grossAnnualPct, holdDays, roundTripCostPct, bri
     return grossAnnualPct - annualizedCostPct - bridgeCostAnnualPct;
 }
 // ── Funding Settlement Timing ──
-import { SETTLEMENT_SCHEDULES } from "../arb-utils.js";
+import { getLastSettlement, settlementIntervalHours } from "../arb-utils.js";
+/** The perp-perp snapshot only carries mark prices for the four legacy venues. */
+function unknownArbVenue(ex) {
+    throw new PerpError("UNKNOWN_VENUE", `No mark price column for venue "${ex}" in the arb snapshot`, {
+        remediation: "Restrict the scan to pacifica, hyperliquid, lighter, aster",
+    });
+}
+/** Per-venue mark-price column of a snapshot + short display label (data-driven; one entry per scanned venue). */
+const SNAPSHOT_MARK_COLUMNS = {
+    pacifica: { key: "pacMarkPrice", label: "PAC" },
+    hyperliquid: { key: "hlMarkPrice", label: "HL" },
+    lighter: { key: "ltMarkPrice", label: "LT" },
+    aster: { key: "astMarkPrice", label: "AST" },
+};
+/** Hourly funding rate of one venue column of a snapshot (Aster uses the symbol's own interval). */
+function snapshotHourly(s, ex) {
+    switch (ex) {
+        case "pacifica": return toHourlyRate(s.pacRate, ex);
+        case "hyperliquid": return toHourlyRate(s.hlRate, ex);
+        case "lighter": return toHourlyRate(s.ltRate, ex);
+        case "aster":
+            if (s.astHours === null) {
+                throw new PerpError("INVALID_PARAMS", `Aster funding interval for ${s.symbol} is unknown`, {
+                    remediation: "Aster funding basis is per symbol (/fapi/v3/fundingInfo); the symbol was not listed there",
+                });
+            }
+            return toHourlyRateByBasis(s.astRate, { kind: "perHours", hours: s.astHours });
+        default: return unknownArbVenue(ex);
+    }
+}
 /**
- * Get the next settlement time for an exchange.
- * @returns Date of next settlement
+ * Get the next settlement time for an exchange (schedule anchored at 00:00 UTC).
+ * `marketIntervalHours` is the market's settlement interval; required for
+ * per-market venues (Aster). Unknown venues throw UNKNOWN_VENUE.
+ * A settlement exactly at `now` counts as the next one.
  */
-export function getNextSettlement(exchange, now = new Date()) {
-    const schedule = SETTLEMENT_SCHEDULES[exchange.toLowerCase()];
-    if (!schedule || schedule.length === 0) {
-        // Default: every hour
-        return getNextSettlement("pacifica", now);
-    }
-    const currentHour = now.getUTCHours();
-    const currentMinutes = now.getUTCMinutes();
-    const currentSeconds = now.getUTCSeconds();
-    // Find the next settlement hour strictly in the future
-    // A settlement at the current hour is "next" only if we haven't reached it yet (min=0, sec=0)
-    for (const hour of schedule) {
-        if (hour > currentHour || (hour === currentHour && currentMinutes === 0 && currentSeconds === 0)) {
-            // This settlement is still in the future (or exactly now)
-            // But skip if hour === currentHour and we're past minute 0
-            if (hour === currentHour && (currentMinutes > 0 || currentSeconds > 0))
-                continue;
-            const next = new Date(now);
-            next.setUTCHours(hour, 0, 0, 0);
-            return next;
-        }
-    }
-    // Wrap to next day's first settlement
-    const next = new Date(now);
-    next.setUTCDate(next.getUTCDate() + 1);
-    next.setUTCHours(schedule[0], 0, 0, 0);
-    return next;
+export function getNextSettlement(exchange, now = new Date(), marketIntervalHours = null) {
+    const last = getLastSettlement(exchange, now, marketIntervalHours);
+    if (last.getTime() === now.getTime())
+        return last;
+    return new Date(last.getTime() + settlementIntervalHours(exchange, marketIntervalHours) * 3_600_000);
 }
 /**
  * Check if we are within N minutes before a settlement event on either exchange.
  * If so, we should avoid entering positions (rates may change).
  */
-export function isNearSettlement(longExchange, shortExchange, bufferMinutes = 5, now = new Date()) {
+export function isNearSettlement(longExchange, shortExchange, bufferMinutes = 5, now = new Date(), marketIntervalFor = () => null) {
     for (const exch of [longExchange, shortExchange]) {
-        const nextSettle = getNextSettlement(exch, now);
+        const nextSettle = getNextSettlement(exch, now, marketIntervalFor(exch));
         const minutesUntil = (nextSettle.getTime() - now.getTime()) / (1000 * 60);
         if (minutesUntil <= bufferMinutes && minutesUntil >= 0) {
             return { blocked: true, exchange: exch, minutesUntil };
@@ -98,13 +318,16 @@ export function isNearSettlement(longExchange, shortExchange, bufferMinutes = 5,
  * meaning we're now paying on both sides instead of collecting.
  */
 export function isSpreadReversed(longExchange, shortExchange, snapshot) {
-    const rateFor = (e) => e === "pacifica" ? snapshot.pacRate : e === "hyperliquid" ? snapshot.hlRate : e === "aster" ? snapshot.astRate : snapshot.ltRate;
-    const longHourly = toHourlyRate(rateFor(longExchange), longExchange);
-    const shortHourly = toHourlyRate(rateFor(shortExchange), shortExchange);
+    const longHourly = snapshotHourly(snapshot, longExchange);
+    const shortHourly = snapshotHourly(snapshot, shortExchange);
     // Reversed if the long side rate exceeds the short side rate
     return longHourly > shortHourly;
 }
+const _warnedArbPriceMismatch = new Set();
 async function fetchFundingSpreads() {
+    // Selected network (review L7): the Pacifica / HL / Lighter raw fetchers follow -n via
+    // setSharedApiNetwork; Aster's REST base comes from the venue definition for that network.
+    const asterRest = networkConfig(getVenue("aster"), sharedApiNetwork()).restUrl;
     // SSOT rule #2: each DEX fetch is independent. allSettled lets us keep the
     // multi-DEX comparison alive when one DEX errors out, while the rejection
     // reasons get logged to stderr (explicit failure, never silent).
@@ -113,14 +336,26 @@ async function fetchFundingSpreads() {
         fetchHyperliquidMetaRaw(),
         fetchLighterOrderBookDetailsRaw(),
         fetchLighterFundingRatesRaw(),
-        fetch("https://fapi.asterdex.com/fapi/v1/premiumIndex").then(r => r.json()),
+        fetch(`${asterRest}/fapi/v1/premiumIndex`).then(r => r.json()),
+        fetch(`${asterRest}/fapi/v3/fundingInfo`).then(r => r.json()),
     ]);
-    logSettledRejections(settled, ["pacifica", "hyperliquid", "lighter:orderbook", "lighter:funding", "aster:premiumIndex"], "arb-auto");
+    logSettledRejections(settled, ["pacifica", "hyperliquid", "lighter:orderbook", "lighter:funding", "aster:premiumIndex", "aster:fundingInfo"], "arb-auto");
     const pacRes = settled[0].status === "fulfilled" ? settled[0].value : null;
     const hlRes = settled[1].status === "fulfilled" ? settled[1].value : null;
     const ltDetailsRes = settled[2].status === "fulfilled" ? settled[2].value : null;
     const ltFundingRes = settled[3].status === "fulfilled" ? settled[3].value : null;
-    const astPremiums = settled[4].status === "fulfilled" ? settled[4].value : [];
+    // Both Aster calls are needed: a rate without its per-symbol interval cannot be normalized.
+    const astPremiums = settled[4].status === "fulfilled" && settled[5].status === "fulfilled"
+        ? settled[4].value
+        : [];
+    const astFundingInfo = settled[5].status === "fulfilled" ? settled[5].value : [];
+    const astHoursBySym = new Map();
+    for (const row of Array.isArray(astFundingInfo) ? astFundingInfo : []) {
+        const rawSym = String(row.symbol ?? "");
+        const hours = Number(row.fundingIntervalHours);
+        if (rawSym.endsWith("USDT") && Number.isFinite(hours) && hours > 0)
+            astHoursBySym.set(rawSym.replace(/USDT$/, ""), hours);
+    }
     const { rates: pacRates, prices: pacPrices } = parsePacificaRaw(pacRes);
     const { rates: hlRates, prices: hlPrices } = parseHyperliquidMetaRaw(hlRes);
     const { rates: ltRates, prices: ltPrices } = parseLighterRaw(ltDetailsRes, ltFundingRes);
@@ -131,6 +366,7 @@ async function fetchFundingSpreads() {
     // Skip the symbol entirely if either field is missing or non-finite.
     const astRates = new Map();
     const astPrices = new Map();
+    const astNoInterval = [];
     for (const p of astPremiums ?? []) {
         const rawSym = String(p.symbol ?? "");
         if (!rawSym.endsWith("USDT"))
@@ -143,9 +379,16 @@ async function fetchFundingSpreads() {
             // symbol; skip rather than poison downstream math with a 0.
             continue;
         }
+        if (!astHoursBySym.has(sym)) {
+            astNoInterval.push(sym);
+            continue;
+        }
         astRates.set(sym, fundingRate);
         astPrices.set(sym, markPrice);
     }
+    if (astNoInterval.length > 0) {
+        process.stderr.write(`[arb-auto] aster: ${astNoInterval.length} symbol(s) excluded — no fundingIntervalHours in /fapi/v3/fundingInfo: ${astNoInterval.slice(0, 10).join(", ")}${astNoInterval.length > 10 ? ", …" : ""}\n`);
+    }
     const snapshots = [];
     const allSymbols = new Set([...pacRates.keys(), ...hlRates.keys(), ...ltRates.keys(), ...astRates.keys()]);
     for (const sym of allSymbols) {
@@ -165,11 +408,53 @@ async function fetchFundingSpreads() {
             available.push({ exchange: "aster", rate: ast });
         if (available.length < 2)
             continue;
-        const norm = (r) => toHourlyRate(r.rate, r.exchange);
+        // Same bare ticker on two venues is not proof of the same asset (e.g. PRL at
+        // a 167% price gap). Keep only venues whose mark is within
+        // MAX_PRICE_DEVIATION_PCT of the cross-venue median; a venue without a mark
+        // price cannot be checked and is dropped from the pairing.
+        const priceOf = (ex) => ex === "pacifica" ? pacPrices.get(sym) : ex === "hyperliquid" ? hlPrices.get(sym) : ex === "lighter" ? ltPrices.get(sym) : astPrices.get(sym);
+        const priced = available.filter(r => { const px = priceOf(r.exchange); return px !== undefined && px > 0; });
+        if (priced.length < 2)
+            continue;
+        const pxs = priced.map(r => priceOf(r.exchange)).sort((x, y) => x - y);
+        const medianPx = pxs.length % 2 === 1 ? pxs[(pxs.length - 1) / 2] : (pxs[pxs.length / 2 - 1] + pxs[pxs.length / 2]) / 2;
+        const consistent = priced.filter(r => {
+            const devPct = Math.abs(priceOf(r.exchange) - medianPx) / medianPx * 100;
+            if (devPct <= MAX_PRICE_DEVIATION_PCT)
+                return true;
+            const key = `${sym}:${r.exchange}`;
+            if (!_warnedArbPriceMismatch.has(key)) {
+                _warnedArbPriceMismatch.add(key);
+                process.stderr.write(`[arb-auto] excluded ${r.exchange} ${sym}: mark deviates ${devPct.toFixed(1)}% from cross-venue median (likely a different asset with the same ticker)\n`);
+            }
+            return false;
+        });
+        if (consistent.length < 2)
+            continue;
+        available.length = 0;
+        available.push(...consistent);
+        const astHours = astHoursBySym.get(sym) ?? null;
+        const norm = (r) => r.exchange === "aster"
+            ? toHourlyRateByBasis(r.rate, { kind: "perHours", hours: astHours }) // present whenever ast is (filtered above)
+            : toHourlyRate(r.rate, r.exchange);
         available.sort((a, b) => norm(a) - norm(b));
         const lowest = available[0];
         const highest = available[available.length - 1];
-        const spread = computeAnnualSpread(highest.rate, highest.exchange, lowest.rate, lowest.exchange);
+        // Median filtering keeps venues near the centre, but the chosen pair itself
+        // must also agree on price (100 / 104.5 / 109 all pass the median test while
+        // the 100↔109 pair is 8.6% apart).
+        const pairLo = priceOf(lowest.exchange);
+        const pairHi = priceOf(highest.exchange);
+        const pairGapPct = Math.abs(pairLo - pairHi) / ((pairLo + pairHi) / 2) * 100;
+        if (pairGapPct > MAX_PRICE_DEVIATION_PCT) {
+            const key = `${sym}:${lowest.exchange}:${highest.exchange}`;
+            if (!_warnedArbPriceMismatch.has(key)) {
+                _warnedArbPriceMismatch.add(key);
+                process.stderr.write(`[arb-auto] excluded ${sym} ${lowest.exchange}↔${highest.exchange}: pair mark gap ${pairGapPct.toFixed(1)}% > ${MAX_PRICE_DEVIATION_PCT}%\n`);
+            }
+            continue;
+        }
+        const spread = Math.abs(norm(highest) - norm(lowest)) * 24 * 365 * 100;
         // Use best available mark price (prefer HL as most liquid, then PAC, then LT, then AST)
         const markPrice = hlPrices.get(sym) ?? pacPrices.get(sym) ?? ltPrices.get(sym) ?? astPrices.get(sym) ?? 0;
         snapshots.push({
@@ -186,6 +471,7 @@ async function fetchFundingSpreads() {
             hlMarkPrice: hlPrices.get(sym) ?? 0,
             ltMarkPrice: ltPrices.get(sym) ?? 0,
             astMarkPrice: astPrices.get(sym) ?? 0,
+            astHours: ast !== undefined ? astHours : null,
         });
     }
     return snapshots.sort((a, b) => Math.abs(b.spread) - Math.abs(a.spread));
@@ -196,10 +482,11 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
     const arb = program.commands.find(c => c.name() === "arb");
     if (!arb)
         return;
+    // Quarantine checks / entries of every arb command are scoped to its -n network.
+    arb.hook("preAction", (_cmd, action) => setQuarantineNetwork(networkOf(action)));
     // ── arb auto ── (daemon mode)
-    arb
-        .command("auto")
-        .description("Auto-execute funding rate arbitrage (daemon). Use --hip3 for HIP-3 cross-dex mode.")
+    supportsDryRun(arb.command("auto"))
+        .description("Auto-execute funding rate arbitrage (daemon). Use --hip3 for HIP-3 cross-dex mode. Supports --dry-run (also inherited by --background).")
         .option("--min-spread <pct>", "Min annual spread to enter (%)", "30")
         .option("--close-spread <pct>", "Close when spread drops below (%)", "5")
         .option("--size <usd>", "Position size per leg ($)", "100")
@@ -218,8 +505,8 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         .option("--notify <url>", "Webhook URL for notifications (Discord/Telegram/generic)")
         .option("--notify-events <events>", "Comma-separated events: entry,exit,reversal,margin,basis", "entry,exit,reversal,margin,basis")
         .option("--cooldown <minutes>", "Minutes to wait before re-entering a closed symbol", "30")
-        .option("--dry-run", "Simulate without executing trades")
         .option("--background", "Run in background (tmux)")
+        .option("--job-id <id>", "Job ID (set by the background runner)")
         .option("--hip3", "Run HIP-3 cross-dex auto arb instead of perp-perp")
         .option("--min-oi <usd>", "Min OI (USD) to enter (hip3 mode)", "50000")
         .option("--min-grade <grade>", "Min viability grade: A, B, C, D (hip3 mode)", "C")
@@ -234,12 +521,13 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 minOi: opts.minOi,
                 minGrade: opts.minGrade,
                 interval: opts.interval,
-                dryRun: opts.dryRun,
+                dryRun: isDryRun(program),
             });
         }
         if (opts.background) {
-            const { startJob } = await import("../jobs.js");
+            const { startJob, jobSelectorsOf } = await import("../jobs.js");
             const cliArgs = [
+                `arb`, `auto`,
                 `--min-spread`, opts.minSpread,
                 `--close-spread`, opts.closeSpread,
                 `--size`, opts.size,
@@ -250,14 +538,19 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 `--min-margin`, opts.minMargin,
                 `--cooldown`, opts.cooldown,
                 ...(opts.symbols ? [`--symbols`, opts.symbols] : []),
-                ...(opts.dryRun ? [`--dry-run`] : []),
                 ...(opts.reversalExit === false ? [`--no-reversal-exit`] : []),
                 ...(opts.settleAware === false ? [`--no-settle-aware`] : []),
-                ...(opts.minSpread ? [`--auto-execute`] : []),
+                `--min-size`, opts.minSize,
+                `--settle-strategy`, opts.settleStrategy,
+                `--max-basis`, opts.maxBasis,
+                `--notify-events`, opts.notifyEvents,
+                ...(opts.notify ? [`--notify`, opts.notify] : []),
             ];
             const job = startJob({
                 strategy: "funding-arb",
                 exchange: "multi",
+                // The background child inherits the root -n and --dry-run.
+                network: networkOf(program), dryRun: isDryRun(program), selectors: jobSelectorsOf(program),
                 params: { ...opts },
                 cliArgs,
             });
@@ -289,13 +582,15 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const minMarginPct = parseFloat(opts.minMargin);
         const minSizeUsd = parseFloat(opts.minSize);
         const filterSymbols = opts.symbols?.split(",").map(s => s.trim().toUpperCase());
-        const dryRun = !!opts.dryRun || process.argv.includes("--dry-run");
+        const dryRun = isDryRun(program);
         const cooldownMinutes = parseFloat(opts.cooldown);
         const openPositions = [];
         // Track which exchanges have low margin (block entries)
         const blockedExchanges = new Set();
         // Track close times per symbol to prevent close→re-entry loops
         const closeCooldowns = new Map(); // symbol → close timestamp ms
+        // Consecutive definite close failures per symbol (quarantined at MAX_PAIR_CLOSE_FAILURES)
+        const closeFailures = new Map();
         // -- State Persistence: Initialize or recover --
         const daemonConfig = {
             minSpread,
@@ -306,10 +601,59 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             maxPositions,
             settleStrategy: settleAwareEnabled ? "aware" : "disabled",
         };
-        let daemonState = loadArbState();
+        // The daemon manages perp-perp positions only. Spot-perp positions (persisted by
+        // `arb exec spot:<venue> ...`) are closed with `perp arb close <symbol>` (spot-perp
+        // path) — never as perp-perp. Warn once per symbol.
+        const warnedSpotPerp = new Set();
+        const isDaemonManaged = (p) => {
+            if (p.mode !== "spot-perp")
+                return true;
+            if (!warnedSpotPerp.has(p.symbol)) {
+                warnedSpotPerp.add(p.symbol);
+                console.log(chalk.yellow(`  ${new Date().toLocaleTimeString()} SKIP: ${p.symbol} is a spot-perp position (spot ${p.spotExchange ?? p.longExchange} / perp ${p.shortExchange}) — not managed by this daemon; close it with: perp arb close ${p.symbol}`));
+            }
+            return false;
+        };
+        // State access for this daemon. Dry-run NEVER writes the real per-network arb state
+        // (review N3): it works on an in-memory copy seeded read-only from the real state, so a
+        // simulated entry is never picked up by a live run and a simulated close never drops a
+        // real position from tracking.
+        const st = createDaemonStateStore(networkOf(program), dryRun, daemonConfig);
+        // State entries the venues do not confirm (no long on longExchange + short on shortExchange):
+        // never counted toward --max-positions, never managed; they still block a new entry on the
+        // same symbol (the state is keyed by symbol). Drop one with: perp arb close <sym> --state-only.
+        const staleSymbols = new Set();
+        const confirmedOnVenues = async (p) => {
+            try {
+                const [longs, shorts] = await Promise.all([
+                    (await getAdapterForExchange(p.longExchange)).getPositions(),
+                    (await getAdapterForExchange(p.shortExchange)).getPositions(),
+                ]);
+                const has = (list, side) => list.some(x => symbolMatch(x.symbol, p.symbol) && x.side === side && Math.abs(Number(x.size)) > 0);
+                if (has(longs, "long") && has(shorts, "short")) {
+                    staleSymbols.delete(p.symbol);
+                    return true;
+                }
+                if (!staleSymbols.has(p.symbol)) {
+                    console.log(chalk.yellow(`  ${new Date().toLocaleTimeString()} STALE STATE: ${p.symbol} (long ${p.longExchange} / short ${p.shortExchange}, since ${p.entryTime}) is not on the venues — not counted, not managed; drop it: perp arb close ${p.symbol} --state-only`));
+                }
+                staleSymbols.add(p.symbol);
+                return false;
+            }
+            catch (e) {
+                // Unknown (read failed): counted, so a possibly-live pair is never doubled.
+                console.log(chalk.yellow(`  ${new Date().toLocaleTimeString()} ${p.symbol}: could not confirm the state entry on the venues (${e instanceof Error ? e.message : String(e)}) — counted as open`));
+                return true;
+            }
+        };
+        let daemonState = st.load();
         if (daemonState && daemonState.positions.length > 0) {
-            // Crash recovery: restore positions from persisted state
+            // Crash recovery: restore positions from persisted state — only those the venues confirm.
             for (const persisted of daemonState.positions) {
+                if (!isDaemonManaged(persisted))
+                    continue;
+                if (!dryRun && !(await confirmedOnVenues(persisted)))
+                    continue;
                 openPositions.push({
                     symbol: persisted.symbol,
                     longExchange: persisted.longExchange,
@@ -323,30 +667,23 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 });
             }
             daemonState.lastStartTime = new Date().toISOString();
-            saveArbState(daemonState);
+            st.save(daemonState);
             if (!isJson()) {
-                console.log(chalk.yellow(`  Recovered ${openPositions.length} position(s) from previous session.`));
+                console.log(chalk.yellow(`  Recovered ${openPositions.length} perp-perp position(s) from previous session.`));
             }
         }
         else {
             daemonState = createInitialState(daemonConfig);
-            saveArbState(daemonState);
-        }
-        // SIGINT handler: clean up interval and save final state before exit
-        let cycleInterval = null;
-        const handleSigint = () => {
-            if (cycleInterval)
-                clearInterval(cycleInterval);
-            const finalState = loadArbState();
-            if (finalState) {
-                finalState.lastScanTime = new Date().toISOString();
-                saveArbState(finalState);
-            }
-            if (!isJson())
-                console.log(chalk.yellow("\n  Daemon stopped. State saved.\n"));
-            process.exit(0);
-        };
-        process.on("SIGINT", handleSigint);
+            st.save(daemonState);
+        }
+        // A previous daemon that died between two legs (crash / kill) left its pending-entry
+        // record: what is open is unknown → quarantine the symbol (never re-entered blind).
+        if (!dryRun)
+            quarantineOrphanedEntries(networkOf(program), "arb-auto", (m) => console.log(chalk.red(m)));
+        // Graceful stop (SIGINT / SIGTERM — `perp background stop`): the current cycle finishes the
+        // leg sequence (or rollback) it is in, starts nothing new, then the state is saved and the
+        // daemon exits. Never an exit between two legs.
+        const stop = gracefulStop("arb auto");
         if (!isJson()) {
             console.log(chalk.cyan.bold("\n  Funding Rate Arb Bot\n"));
             console.log(`  Mode:          ${dryRun ? chalk.yellow("DRY RUN") : chalk.green("LIVE")}`);
@@ -370,7 +707,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         }
         const cycle = async () => {
             // Sync in-memory positions with persisted state (handles CLI manual closes)
-            const syncState = loadArbState();
+            const syncState = st.load();
             if (syncState) {
                 const persistedSymbols = new Set(syncState.positions.map(p => p.symbol));
                 // Remove positions that were closed externally (e.g. via `perp arb close`)
@@ -382,7 +719,11 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 }
                 // Recover positions that exist in state but not in memory (e.g. added by another process)
                 for (const persisted of syncState.positions) {
+                    if (!isDaemonManaged(persisted))
+                        continue;
                     if (!openPositions.some(p => p.symbol === persisted.symbol)) {
+                        if (!dryRun && !(await confirmedOnVenues(persisted)))
+                            continue;
                         console.log(chalk.gray(`  ${new Date().toLocaleTimeString()} SYNC: recovering ${persisted.symbol} from state`));
                         openPositions.push({
                             symbol: persisted.symbol,
@@ -399,7 +740,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 }
             }
             // Heartbeat check
-            const heartbeatState = loadArbState();
+            const heartbeatState = st.load();
             if (heartbeatState?.lastSuccessfulScanTime) {
                 const lastSuccessMs = new Date(heartbeatState.lastSuccessfulScanTime).getTime();
                 const minutesSinceSuccess = (Date.now() - lastSuccessMs) / (1000 * 60);
@@ -419,160 +760,150 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 const now = new Date().toLocaleTimeString();
                 // Check for close conditions on open positions
                 for (let i = openPositions.length - 1; i >= 0; i--) {
+                    if (stop.requested())
+                        break; // stopping: no new close sequence
                     const pos = openPositions[i];
-                    const current = filtered.find(s => s.symbol === pos.symbol);
-                    if (!current)
+                    // Quarantined (design §12.3): hands off until a human clears it.
+                    if (isQuarantined(pos.symbol, (m) => console.log(chalk.red(m))))
                         continue;
-                    const currentSpread = Math.abs(current.spread);
-                    let shouldClose = false;
-                    let closeReason = "";
-                    // Check spread-based close
-                    if (currentSpread <= closeSpread) {
-                        shouldClose = true;
-                        closeReason = `spread ${currentSpread.toFixed(1)}% <= ${closeSpread}%`;
-                    }
-                    // Check reversal-based close
-                    if (!shouldClose && reversalExitEnabled && isSpreadReversed(pos.longExchange, pos.shortExchange, current)) {
-                        shouldClose = true;
-                        closeReason = "REVERSAL DETECTED — long exchange now has higher rate than short";
-                        await notifyIfEnabled(webhookUrl, notifyEvents, "reversal", {
-                            symbol: pos.symbol, longExchange: pos.longExchange, shortExchange: pos.shortExchange,
-                        });
-                    }
-                    // Check basis risk (mark price divergence) — use prices from fetchFundingSpreads, no extra API calls
-                    {
-                        const priceFor = (e) => e === "pacifica" ? current.pacMarkPrice : e === "hyperliquid" ? current.hlMarkPrice : current.ltMarkPrice;
-                        const bLP = priceFor(pos.longExchange);
-                        const bSP = priceFor(pos.shortExchange);
-                        if (bLP > 0 && bSP > 0) {
-                            const basis = computeBasisRisk(bLP, bSP, maxBasisPct);
-                            if (basis.warning) {
-                                const bExA = (e) => e === "pacifica" ? "PAC" : e === "hyperliquid" ? "HL" : "LT";
-                                console.log(chalk.yellow(`  ${now} BASIS RISK ${pos.symbol}: Long ${bExA(pos.longExchange)} $${bLP.toFixed(4)} / ` +
-                                    `Short ${bExA(pos.shortExchange)} $${bSP.toFixed(4)} | Divergence: ${basis.divergencePct.toFixed(1)}%`));
-                                await notifyIfEnabled(webhookUrl, notifyEvents, "basis", {
-                                    symbol: pos.symbol, longExchange: pos.longExchange, shortExchange: pos.shortExchange,
-                                    divergencePct: basis.divergencePct,
-                                });
-                            }
+                    // Per-position isolation: one position's failing exit check (e.g. an
+                    // unknown funding basis in snapshotHourly) must not skip the others.
+                    try {
+                        const current = filtered.find(s => s.symbol === pos.symbol);
+                        if (!current)
+                            continue;
+                        const currentSpread = Math.abs(current.spread);
+                        let shouldClose = false;
+                        let closeReason = "";
+                        // Check spread-based close
+                        if (currentSpread <= closeSpread) {
+                            shouldClose = true;
+                            closeReason = `spread ${currentSpread.toFixed(1)}% <= ${closeSpread}%`;
                         }
-                    }
-                    if (shouldClose) {
-                        console.log(chalk.yellow(`  ${now} CLOSE ${pos.symbol} — ${closeReason}`));
-                        const exitReason = closeReason.includes("REVERSAL") ? "reversal"
-                            : closeReason.includes("spread") ? "spread"
-                                : "manual";
-                        if (!dryRun) {
-                            try {
-                                const longAdapter = await getAdapterForExchange(pos.longExchange);
-                                const shortAdapter = await getAdapterForExchange(pos.shortExchange);
-                                // Close both legs simultaneously with verification
-                                const [longResult, shortResult] = await Promise.allSettled([
-                                    longAdapter.marketOrder(pos.symbol, "sell", String(pos.size)),
-                                    shortAdapter.marketOrder(pos.symbol, "buy", String(pos.size)),
-                                ]);
-                                const longOk = longResult.status === "fulfilled";
-                                const shortOk = shortResult.status === "fulfilled";
-                                if (longOk && shortOk) {
-                                    logExecution({
-                                        type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
-                                        symbol: pos.symbol, side: "close", size: String(pos.size),
-                                        status: "success", dryRun: false,
-                                        meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, currentSpread, reason: closeReason, exitReason },
-                                    });
-                                    console.log(chalk.green(`  ${now} CLOSED ${pos.symbol} — both legs`));
-                                    persistRemovePosition(pos.symbol);
-                                    closeCooldowns.set(pos.symbol, Date.now());
-                                    openPositions.splice(i, 1);
-                                    await notifyIfEnabled(webhookUrl, notifyEvents, "exit", {
+                        // Check reversal-based close
+                        if (!shouldClose && reversalExitEnabled && isSpreadReversed(pos.longExchange, pos.shortExchange, current)) {
+                            shouldClose = true;
+                            closeReason = "REVERSAL DETECTED — long exchange now has higher rate than short";
+                            await notifyIfEnabled(webhookUrl, notifyEvents, "reversal", {
+                                symbol: pos.symbol, longExchange: pos.longExchange, shortExchange: pos.shortExchange,
+                            });
+                        }
+                        // Check basis risk (mark price divergence) — use prices from fetchFundingSpreads, no extra API calls
+                        {
+                            const longCol = SNAPSHOT_MARK_COLUMNS[pos.longExchange];
+                            const shortCol = SNAPSHOT_MARK_COLUMNS[pos.shortExchange];
+                            const bLP = longCol ? current[longCol.key] : 0;
+                            const bSP = shortCol ? current[shortCol.key] : 0;
+                            if (!longCol || !shortCol) {
+                                const missing = [!longCol ? pos.longExchange : null, !shortCol ? pos.shortExchange : null].filter(Boolean).join(", ");
+                                console.log(chalk.yellow(`  ${now} BASIS CHECK SKIPPED ${pos.symbol}: no mark price column for venue ${missing}`));
+                            }
+                            else if (bLP > 0 && bSP > 0) {
+                                const basis = computeBasisRisk(bLP, bSP, maxBasisPct);
+                                if (basis.warning) {
+                                    console.log(chalk.yellow(`  ${now} BASIS RISK ${pos.symbol}: Long ${longCol.label} $${bLP.toFixed(4)} / ` +
+                                        `Short ${shortCol.label} $${bSP.toFixed(4)} | Divergence: ${basis.divergencePct.toFixed(1)}%`));
+                                    await notifyIfEnabled(webhookUrl, notifyEvents, "basis", {
                                         symbol: pos.symbol, longExchange: pos.longExchange, shortExchange: pos.shortExchange,
-                                        pnl: pos.accumulatedFundingUsd,
-                                        duration: `${Math.round((Date.now() - new Date(pos.entryTime).getTime()) / 3600000)}h`,
+                                        divergencePct: basis.divergencePct,
                                     });
                                 }
-                                else if (longOk !== shortOk) {
-                                    // One leg closed, one failed — retry the failed leg
-                                    const failedSide = longOk ? "short" : "long";
-                                    const failedAdapter = longOk ? shortAdapter : longAdapter;
-                                    const retryAction = longOk ? "buy" : "sell";
-                                    const failedErr = longOk
-                                        ? shortResult.reason
-                                        : longResult.reason;
-                                    console.log(chalk.yellow(`  ${now} PARTIAL CLOSE ${pos.symbol}: ${failedSide} leg failed — retrying...`));
-                                    let retryOk = false;
-                                    for (let attempt = 1; attempt <= 2; attempt++) {
-                                        try {
-                                            await failedAdapter.marketOrder(pos.symbol, retryAction, String(pos.size));
-                                            retryOk = true;
-                                            console.log(chalk.green(`  ${now} RETRY OK ${pos.symbol}: ${failedSide} leg closed (attempt ${attempt})`));
-                                            break;
-                                        }
-                                        catch (retryErr) {
-                                            console.log(chalk.red(`  ${now} RETRY ${attempt}/2 FAILED ${pos.symbol}: ${retryErr instanceof Error ? retryErr.message : retryErr}`));
-                                        }
-                                    }
-                                    if (retryOk) {
+                            }
+                        }
+                        if (shouldClose) {
+                            console.log(chalk.yellow(`  ${now} CLOSE ${pos.symbol} — ${closeReason}`));
+                            const exitReason = closeReason.includes("REVERSAL") ? "reversal"
+                                : closeReason.includes("spread") ? "spread"
+                                    : "manual";
+                            if (!dryRun) {
+                                try {
+                                    const longAdapter = await getAdapterForExchange(pos.longExchange);
+                                    const shortAdapter = await getAdapterForExchange(pos.shortExchange);
+                                    // Sequential, reduce-only, verified (design §12.3): long first, then
+                                    // short. A definite long-close failure changes nothing → retried next
+                                    // cycle, quarantined after MAX_PAIR_CLOSE_FAILURES in a row. An unknown
+                                    // outcome, a partial close or an unhedged leg quarantines (no retry).
+                                    const sizeStr = String(pos.size);
+                                    const closeRes = await closePerpPairVerified({
+                                        source: "arb-auto", sym: pos.symbol,
+                                        longAdapter, longExch: pos.longExchange, longSym: pos.symbol, longSize: sizeStr,
+                                        shortAdapter, shortExch: pos.shortExchange, shortSym: pos.symbol, shortSize: sizeStr, smart: false,
+                                        log: (m) => console.log(chalk.red(m)),
+                                    });
+                                    if (closeRes.status === "closed") {
+                                        closeFailures.delete(pos.symbol);
                                         logExecution({
                                             type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
-                                            symbol: pos.symbol, side: "close", size: String(pos.size),
+                                            symbol: pos.symbol, side: "close", size: sizeStr,
                                             status: "success", dryRun: false,
-                                            meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, currentSpread, reason: closeReason, exitReason, retried: failedSide },
+                                            meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, currentSpread, reason: closeReason, exitReason },
                                         });
-                                        persistRemovePosition(pos.symbol);
+                                        console.log(chalk.green(`  ${now} CLOSED ${pos.symbol} — both legs (reduce-only, verified)`));
+                                        st.remove(pos.symbol);
                                         closeCooldowns.set(pos.symbol, Date.now());
                                         openPositions.splice(i, 1);
+                                        await notifyIfEnabled(webhookUrl, notifyEvents, "exit", {
+                                            symbol: pos.symbol, longExchange: pos.longExchange, shortExchange: pos.shortExchange,
+                                            pnl: pos.accumulatedFundingUsd,
+                                            duration: `${Math.round((Date.now() - new Date(pos.entryTime).getTime()) / 3600000)}h`,
+                                        });
+                                    }
+                                    else if (closeRes.status === "failed") {
+                                        const n = (closeFailures.get(pos.symbol) ?? 0) + 1;
+                                        closeFailures.set(pos.symbol, n);
+                                        logExecution({
+                                            type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
+                                            symbol: pos.symbol, side: "close", size: sizeStr,
+                                            status: "failed", dryRun: false,
+                                            error: `${closeRes.reason} (attempt ${n}/${MAX_PAIR_CLOSE_FAILURES}, nothing changed)`,
+                                            meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, reason: closeReason, exitReason },
+                                        });
+                                        console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.symbol}: ${closeRes.reason} — both legs still open (${n}/${MAX_PAIR_CLOSE_FAILURES})`));
+                                        if (n >= MAX_PAIR_CLOSE_FAILURES) {
+                                            quarantinePair("arb-auto", pos.symbol, pos.longExchange, pos.shortExchange, `close failed ${n} times in a row (last: ${closeRes.reason})`, (m) => console.log(chalk.red(m)));
+                                        }
+                                        // Do NOT splice — kept tracked; reduce-only makes the next attempt safe
                                     }
                                     else {
-                                        // One leg is closed, other still open — log but DON'T remove from tracking
+                                        // Quarantined: kept in state (accurate: exposure may remain); hands off until cleared.
                                         logExecution({
                                             type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
-                                            symbol: pos.symbol, side: "close", size: String(pos.size),
+                                            symbol: pos.symbol, side: "close", size: sizeStr,
                                             status: "failed", dryRun: false,
-                                            error: `Partial close: ${failedSide} failed (${failedErr instanceof Error ? failedErr.message : String(failedErr)}). Retry failed.`,
-                                            meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, reason: closeReason, exitReason, partialClose: true },
+                                            error: `QUARANTINED: ${closeRes.reason}`,
+                                            meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, reason: closeReason, exitReason, quarantined: true },
                                         });
-                                        console.log(chalk.red.bold(`  ${now} PARTIAL CLOSE ${pos.symbol}: ${failedSide} still open — MANUAL CLOSE REQUIRED`));
+                                        console.log(chalk.red.bold(`  ${now} CLOSE ${pos.symbol} QUARANTINED — ${closeRes.reason}. MANUAL CHECK REQUIRED`));
                                         await notifyIfEnabled(webhookUrl, notifyEvents, "margin", {
-                                            exchange: longOk ? pos.shortExchange : pos.longExchange,
+                                            exchange: `${pos.longExchange}+${pos.shortExchange}`,
                                             marginPct: 0, threshold: 0, symbol: pos.symbol,
-                                            message: `PARTIAL CLOSE: ${failedSide} leg still open after retry. Manual close required.`,
+                                            message: `CLOSE QUARANTINED: ${closeRes.reason}. Manual check required.`,
                                         });
-                                        // Do NOT splice — keep tracking so next cycle retries
                                     }
                                 }
-                                else {
-                                    // Both legs failed — keep position, retry next cycle
-                                    const longErr = longResult.reason;
-                                    const shortErr = shortResult.reason;
+                                catch (err) {
                                     logExecution({
                                         type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
                                         symbol: pos.symbol, side: "close", size: String(pos.size),
                                         status: "failed", dryRun: false,
-                                        error: `Both legs failed. Long: ${longErr instanceof Error ? longErr.message : String(longErr)}, Short: ${shortErr instanceof Error ? shortErr.message : String(shortErr)}`,
+                                        error: err instanceof Error ? err.message : String(err),
                                         meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, reason: closeReason, exitReason },
                                     });
-                                    console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.symbol}: both legs — will retry next cycle`));
-                                    // Do NOT splice — retry next cycle
+                                    console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.symbol}: ${err instanceof Error ? err.message : err}`));
+                                    // Do NOT splice — nothing was sent (adapter creation failed); retry next cycle
                                 }
                             }
-                            catch (err) {
-                                logExecution({
-                                    type: "arb_close", exchange: `${pos.longExchange}+${pos.shortExchange}`,
-                                    symbol: pos.symbol, side: "close", size: String(pos.size),
-                                    status: "failed", dryRun: false,
-                                    error: err instanceof Error ? err.message : String(err),
-                                    meta: { longExchange: pos.longExchange, shortExchange: pos.shortExchange, reason: closeReason, exitReason },
-                                });
-                                console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.symbol}: ${err instanceof Error ? err.message : err}`));
-                                // Do NOT splice — retry next cycle
+                            else {
+                                // Dry run — remove from the in-memory (simulated) tracking only
+                                st.remove(pos.symbol);
+                                closeCooldowns.set(pos.symbol, Date.now());
+                                openPositions.splice(i, 1);
                             }
                         }
-                        else {
-                            // Dry run — remove from tracking
-                            persistRemovePosition(pos.symbol);
-                            closeCooldowns.set(pos.symbol, Date.now());
-                            openPositions.splice(i, 1);
-                        }
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error ? err.message : String(err);
+                        console.error(chalk.red(`  ${new Date().toLocaleTimeString()} EXIT CHECK FAILED ${pos.symbol} (${pos.longExchange}/${pos.shortExchange}): ${msg}`));
                     }
                 }
                 // Log next settlement times and funding estimation
@@ -663,13 +994,53 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                     }
                 }
                 catch { /* margin check failed, continue without blocking */ }
-                // Check for entry conditions
+                // Entry decisions: every monitored symbol that is not entered gets its reason — logged per
+                // symbol for --symbols, summarized per cycle for a full scan (a silent run is impossible).
+                const skipCounts = new Map();
+                const skip = (sym, reason) => {
+                    if (filterSymbols)
+                        console.log(chalk.gray(`  ${now} SKIP ${sym}: ${reason}`));
+                    else {
+                        const k = reason.replace(/[-\d.]+/g, "#");
+                        skipCounts.set(k, (skipCounts.get(k) ?? 0) + 1);
+                    }
+                };
+                for (const sym of filterSymbols ?? []) {
+                    if (!filtered.some(x => x.symbol === sym))
+                        console.log(chalk.gray(`  ${now} SKIP ${sym}: not in this cycle's funding scan (no rate on two compared venues)`));
+                }
+                if (openPositions.length >= maxPositions) {
+                    console.log(chalk.gray(`  ${now} NO ENTRY: max positions reached (${openPositions.length}/${maxPositions}: ${openPositions.map(p => `${p.symbol} ${p.longExchange}/${p.shortExchange}`).join(", ")})`));
+                }
                 if (openPositions.length < maxPositions) {
                     for (const snap of filtered) {
-                        if (openPositions.some(p => p.symbol === snap.symbol))
+                        if (stop.requested()) {
+                            console.log(chalk.yellow(`  ${now} STOP requested — no new entries`));
+                            break;
+                        }
+                        if (openPositions.some(p => p.symbol === snap.symbol)) {
+                            skip(snap.symbol, "already open");
                             continue;
-                        if (openPositions.length >= maxPositions)
+                        }
+                        // Global quarantine (design §12.3): unknown / unhedged outcome on this symbol somewhere.
+                        if (isQuarantined(snap.symbol, (m) => console.log(chalk.red(m)))) {
+                            skip(snap.symbol, "quarantined");
+                            continue;
+                        }
+                        // A persisted spot-perp position on this symbol (not daemon-managed) blocks entry:
+                        // the state is keyed by symbol, so a new perp-perp entry would overwrite it.
+                        if (syncState?.positions.some(p => p.mode === "spot-perp" && p.symbol === snap.symbol)) {
+                            skip(snap.symbol, "a spot-perp arb state entry exists for this symbol");
+                            continue;
+                        }
+                        if (staleSymbols.has(snap.symbol)) {
+                            skip(snap.symbol, `a stale arb state entry exists (drop it: perp arb close ${snap.symbol} --state-only)`);
+                            continue;
+                        }
+                        if (openPositions.length >= maxPositions) {
+                            skip(snap.symbol, `max positions reached (${maxPositions})`);
                             break;
+                        }
                         // Cooldown: skip if recently closed to prevent close→re-entry loops
                         const lastCloseMs = closeCooldowns.get(snap.symbol);
                         if (lastCloseMs && cooldownMinutes > 0) {
@@ -687,18 +1058,17 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                         const shortExchange = snap.shortExch;
                         // Block entries if either exchange has low margin
                         if (blockedExchanges.has(longExchange) || blockedExchanges.has(shortExchange)) {
-                            if (!isJson()) {
-                                console.log(chalk.gray(`  ${now} SKIP ${snap.symbol}: margin too low on ${blockedExchanges.has(longExchange) ? longExchange : shortExchange}`));
-                            }
+                            skip(snap.symbol, `entries blocked on ${blockedExchanges.has(longExchange) ? longExchange : shortExchange} (margin low / venue down)`);
                             continue;
                         }
                         // Compute net spread after fees and bridge costs
                         const roundTripCost = computeRoundTripCostPct(longExchange, shortExchange);
                         const effectiveSizeUsd = sizeIsAuto ? 100 : sizeUsd; // Use $100 for net spread calc when auto
                         const netSpread = computeNetSpread(grossSpread, holdDays, roundTripCost, bridgeCostUsd, effectiveSizeUsd);
-                        // Settlement timing check with strategy
+                        // Settlement timing check with strategy (Aster interval is per symbol)
+                        const snapMarketInterval = (ex) => ex === "aster" ? snap.astHours : null;
                         if (settleStrategy === "block") {
-                            const settlCheck = isNearSettlement(longExchange, shortExchange);
+                            const settlCheck = isNearSettlement(longExchange, shortExchange, 5, new Date(), snapMarketInterval);
                             if (settlCheck.blocked) {
                                 console.log(chalk.gray(`  ${now} SKIP ${snap.symbol}: ${settlCheck.minutesUntil?.toFixed(1)}m before ${settlCheck.exchange} settlement`));
                                 continue;
@@ -707,15 +1077,17 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                         // In aggressive mode, boost score for post-settlement entries
                         let settleBoostMultiplier = 1.0;
                         if (settleStrategy === "aggressive") {
-                            settleBoostMultiplier = aggressiveSettleBoost(longExchange, shortExchange, 10, new Date());
+                            settleBoostMultiplier = aggressiveSettleBoost(longExchange, shortExchange, 10, new Date(), snapMarketInterval);
                             if (settleBoostMultiplier > 1.0) {
                                 console.log(chalk.cyan(`  ${now} BOOST ${snap.symbol}: post-settlement ${((settleBoostMultiplier - 1) * 100).toFixed(0)}% score boost`));
                             }
                         }
                         // --min-spread compares against NET spread (with settle boost applied)
                         const effectiveNetSpread = netSpread * settleBoostMultiplier;
-                        if (effectiveNetSpread < minSpread)
+                        if (effectiveNetSpread < minSpread) {
+                            skip(snap.symbol, `net spread ${effectiveNetSpread.toFixed(2)}% < --min-spread ${minSpread}% (gross ${grossSpread.toFixed(2)}%, round-trip cost ${roundTripCost.toFixed(3)}% over ${holdDays}d; long ${longExchange} / short ${shortExchange})`);
                             continue;
+                        }
                         const rateForExch = (e) => e === "pacifica" ? snap.pacRate : e === "hyperliquid" ? snap.hlRate : e === "aster" ? snap.astRate : snap.ltRate;
                         console.log(chalk.green(`  ${now} ENTER ${snap.symbol} — gross ${grossSpread.toFixed(1)}% net ${netSpread.toFixed(1)}%` +
                             ` | Long ${longExchange} (${(rateForExch(longExchange) * 100).toFixed(4)}%)` +
@@ -747,126 +1119,106 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             console.log(chalk.gray(`  ${now} SKIP ${snap.symbol}: auto-size $${actualSizeUsd} below min $${minSizeUsd}`));
                             continue;
                         }
-                        const sizeInAsset = (actualSizeUsd / snap.markPrice).toFixed(4);
+                        // Floored (never rounds up past the requested notional).
+                        const sizeInAsset = fillSizeString(actualSizeUsd / snap.markPrice, 4);
+                        if (!(Number(sizeInAsset) > 0)) {
+                            console.log(chalk.gray(`  ${now} SKIP ${snap.symbol}: size rounds to 0 ($${actualSizeUsd} / $${snap.markPrice})`));
+                            continue;
+                        }
+                        /** Size actually hedged on both legs (verified); the requested size in dry-run. */
+                        let openedSize = sizeInAsset;
                         if (!dryRun) {
+                            // Pending-entry record BEFORE the first leg (crash between legs → quarantine at the next start).
+                            const net = networkOf(program);
+                            try {
+                                writePendingEntry(net, { source: "arb-auto", symbol: snap.symbol, longExchange, shortExchange, size: sizeInAsset });
+                            }
+                            catch (e) {
+                                console.error(chalk.red(`  ${now} SKIP ${snap.symbol}: could not record the pending entry (${e instanceof Error ? e.message : String(e)}) — nothing sent`));
+                                continue;
+                            }
+                            const donePending = () => finishPendingEntry(net, "arb-auto", snap.symbol, (m) => console.error(chalk.red(m)));
+                            let legsStarted = false;
                             try {
                                 const longAdapter = await getAdapterForExchange(longExchange);
                                 const shortAdapter = await getAdapterForExchange(shortExchange);
-                                // Use Promise.allSettled for safe dual-leg entry
-                                const [longResult, shortResult] = await Promise.allSettled([
-                                    longAdapter.marketOrder(snap.symbol, "buy", sizeInAsset),
-                                    shortAdapter.marketOrder(snap.symbol, "sell", sizeInAsset),
-                                ]);
-                                const longOk = longResult.status === "fulfilled";
-                                const shortOk = shortResult.status === "fulfilled";
-                                if (longOk && shortOk) {
-                                    // Both legs filled successfully
+                                // Sequential verified legs (design §12.3): long, then short sized to the
+                                // long's verified fill; reduce-only rollback / trim; unknown → quarantine.
+                                legsStarted = true;
+                                const res = await openPerpPairVerified({
+                                    source: "arb-auto", sym: snap.symbol,
+                                    longAdapter, longExch: longExchange, longSym: snap.symbol, shortAdapter, shortExch: shortExchange, shortSym: snap.symbol,
+                                    size: sizeInAsset, smart: false, log: (m) => console.log(chalk.red(m)),
+                                });
+                                legsStarted = false; // outcome known (opened / not opened / quarantined)
+                                if (res.status === "opened") {
+                                    openedSize = res.hedged;
                                     logExecution({
                                         type: "arb_entry", exchange: `${longExchange}+${shortExchange}`,
-                                        symbol: snap.symbol, side: "entry", size: sizeInAsset,
+                                        symbol: snap.symbol, side: "entry", size: res.hedged,
                                         status: "success", dryRun: false,
-                                        meta: { longExchange, shortExchange, grossSpread, netSpread, roundTripCost, markPrice: snap.markPrice },
+                                        meta: { longExchange, shortExchange, grossSpread, netSpread, roundTripCost, markPrice: snap.markPrice, requested: sizeInAsset, trimmed: res.trimmed },
                                     });
-                                    console.log(chalk.green(`  ${now} FILLED ${snap.symbol} — both legs @ ${sizeInAsset} units ($${actualSizeUsd} / $${snap.markPrice.toFixed(2)})`));
-                                    // Verify actual fill sizes by querying positions
-                                    let verifiedLongSize = sizeInAsset;
-                                    let verifiedShortSize = sizeInAsset;
+                                    console.log(chalk.green(`  ${now} FILLED ${snap.symbol} — both legs @ ${res.hedged} units (requested ${sizeInAsset}; $${actualSizeUsd} / $${snap.markPrice.toFixed(2)})`));
+                                    // Persist to state file immediately (crash-safe) — the verified hedged size.
+                                    const entryTime = new Date().toISOString();
                                     try {
-                                        const [longPositions, shortPositions] = await Promise.all([
-                                            longAdapter.getPositions(),
-                                            shortAdapter.getPositions(),
-                                        ]);
-                                        const longPos = longPositions.find(p => p.symbol.toUpperCase().includes(snap.symbol));
-                                        const shortPos = shortPositions.find(p => p.symbol.toUpperCase().includes(snap.symbol));
-                                        if (longPos)
-                                            verifiedLongSize = longPos.size;
-                                        if (shortPos)
-                                            verifiedShortSize = shortPos.size;
-                                        if (verifiedLongSize !== sizeInAsset || verifiedShortSize !== sizeInAsset) {
-                                            console.log(chalk.yellow(`  ${now} SIZE MISMATCH ${snap.symbol}: requested ${sizeInAsset}, actual long=${verifiedLongSize} short=${verifiedShortSize}`));
-                                        }
+                                        st.add({
+                                            id: `${snap.symbol}-${Date.now()}`,
+                                            symbol: snap.symbol,
+                                            longExchange,
+                                            shortExchange,
+                                            longSize: parseFloat(res.hedged),
+                                            shortSize: parseFloat(res.hedged),
+                                            entryTime,
+                                            entrySpread: grossSpread,
+                                            entryLongPrice: snap.markPrice,
+                                            entryShortPrice: snap.markPrice,
+                                            accumulatedFunding: 0,
+                                            lastCheckTime: entryTime,
+                                        });
                                     }
-                                    catch {
-                                        // Position query failed — use requested size as fallback
-                                        console.log(chalk.gray(`  ${now} Could not verify fill sizes for ${snap.symbol}, using requested size`));
+                                    catch (e) {
+                                        // A hedged pair the state cannot record (write failed / conflicting entry): never
+                                        // left as silent exposure — quarantined with what is open.
+                                        quarantinePair("arb-auto", snap.symbol, longExchange, shortExchange, `entry opened (long ${res.hedged} on ${longExchange} / short ${res.hedged} on ${shortExchange}) but the arb state could not record it: ${e instanceof Error ? e.message : String(e)}`, (m) => console.log(chalk.red(m)));
                                     }
-                                    // Persist to state file immediately (crash-safe)
-                                    const entryTime = new Date().toISOString();
-                                    persistAddPosition({
-                                        id: `${snap.symbol}-${Date.now()}`,
-                                        symbol: snap.symbol,
-                                        longExchange,
-                                        shortExchange,
-                                        longSize: parseFloat(verifiedLongSize),
-                                        shortSize: parseFloat(verifiedShortSize),
-                                        entryTime,
-                                        entrySpread: grossSpread,
-                                        entryLongPrice: snap.markPrice,
-                                        entryShortPrice: snap.markPrice,
-                                        accumulatedFunding: 0,
-                                        lastCheckTime: entryTime,
-                                    });
+                                    donePending();
                                     await notifyIfEnabled(webhookUrl, notifyEvents, "entry", {
                                         symbol: snap.symbol, longExchange, shortExchange,
                                         size: actualSizeUsd, netSpread,
                                     });
                                 }
-                                else if (longOk !== shortOk) {
-                                    // One leg filled, one failed — ROLLBACK the successful leg
-                                    const filledSide = longOk ? "long" : "short";
-                                    const failedSide = longOk ? "short" : "long";
-                                    const filledAdapter = longOk ? longAdapter : shortAdapter;
-                                    const rollbackAction = longOk ? "sell" : "buy"; // reverse the filled side
-                                    const failedErr = longOk
-                                        ? shortResult.reason
-                                        : longResult.reason;
-                                    console.log(chalk.yellow(`  ${now} PARTIAL FILL ${snap.symbol}: ${filledSide} OK, ${failedSide} FAILED — rolling back...`));
-                                    // Attempt rollback with max 2 retries
-                                    let rollbackOk = false;
-                                    for (let attempt = 1; attempt <= 2; attempt++) {
-                                        try {
-                                            await filledAdapter.marketOrder(snap.symbol, rollbackAction, sizeInAsset);
-                                            rollbackOk = true;
-                                            console.log(chalk.green(`  ${now} ROLLBACK ${snap.symbol}: ${filledSide} leg closed (attempt ${attempt})`));
-                                            break;
-                                        }
-                                        catch (rollbackErr) {
-                                            console.log(chalk.red(`  ${now} ROLLBACK ATTEMPT ${attempt}/2 FAILED ${snap.symbol}: ${rollbackErr instanceof Error ? rollbackErr.message : rollbackErr}`));
-                                        }
-                                    }
+                                else if (res.status === "not_opened") {
                                     logExecution({
                                         type: "arb_entry", exchange: `${longExchange}+${shortExchange}`,
                                         symbol: snap.symbol, side: "entry", size: sizeInAsset,
                                         status: "failed", dryRun: false,
-                                        error: `Partial fill: ${failedSide} failed (${failedErr instanceof Error ? failedErr.message : String(failedErr)}). Rollback: ${rollbackOk ? "success" : "FAILED"}`,
-                                        meta: { longExchange, shortExchange, grossSpread, netSpread, partialFill: filledSide, rollbackSuccess: rollbackOk },
+                                        error: `${res.reason}${res.rolledBack !== null ? ` — long ${res.rolledBack} rolled back (reduce-only, verified)` : ""}`,
+                                        meta: { longExchange, shortExchange, grossSpread, netSpread },
                                     });
-                                    if (!rollbackOk) {
-                                        // Critical: manual intervention required
-                                        console.log(chalk.red.bold(`  ${now} IMBALANCE ${snap.symbol}: ${filledSide} leg open, rollback failed — MANUAL CLOSE REQUIRED`));
-                                        await notifyIfEnabled(webhookUrl, notifyEvents, "margin", {
-                                            exchange: longOk ? longExchange : shortExchange,
-                                            marginPct: 0,
-                                            threshold: 0,
-                                            symbol: snap.symbol,
-                                            message: `IMBALANCE: ${filledSide} leg filled on ${longOk ? longExchange : shortExchange}, ${failedSide} failed, rollback failed. Manual close required.`,
-                                        });
-                                    }
-                                    continue; // don't add to openPositions
+                                    console.error(chalk.red(`  ${now} ENTRY FAILED ${snap.symbol}: ${res.reason}${res.rolledBack !== null ? ` — rolled back long ${res.rolledBack}; no open exposure` : " — nothing opened"}`));
+                                    donePending();
+                                    continue;
                                 }
                                 else {
-                                    // Both legs failed
-                                    const longErr = longResult.reason;
-                                    const shortErr = shortResult.reason;
+                                    donePending(); // quarantined (persisted) by openPerpPairVerified
                                     logExecution({
                                         type: "arb_entry", exchange: `${longExchange}+${shortExchange}`,
                                         symbol: snap.symbol, side: "entry", size: sizeInAsset,
                                         status: "failed", dryRun: false,
-                                        error: `Both legs failed. Long: ${longErr instanceof Error ? longErr.message : String(longErr)}, Short: ${shortErr instanceof Error ? shortErr.message : String(shortErr)}`,
-                                        meta: { longExchange, shortExchange, grossSpread, netSpread },
+                                        error: `QUARANTINED: ${res.reason}`,
+                                        meta: { longExchange, shortExchange, grossSpread, netSpread, quarantined: true, exposure: res.exposure },
                                     });
-                                    console.error(chalk.red(`  ${now} ENTRY FAILED ${snap.symbol}: both legs rejected`));
-                                    continue;
+                                    console.log(chalk.red.bold(`  ${now} IMBALANCE ${snap.symbol}: ${res.exposure} — quarantined, MANUAL CHECK REQUIRED`));
+                                    await notifyIfEnabled(webhookUrl, notifyEvents, "margin", {
+                                        exchange: `${longExchange}+${shortExchange}`,
+                                        marginPct: 0,
+                                        threshold: 0,
+                                        symbol: snap.symbol,
+                                        message: `ENTRY QUARANTINED: ${res.reason}. Possible exposure: ${res.exposure}. Manual check required.`,
+                                    });
+                                    continue; // not tracked as a hedged pair; the quarantine blocks every path
                                 }
                             }
                             catch (err) {
@@ -877,6 +1229,11 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                                     error: err instanceof Error ? err.message : String(err),
                                     meta: { longExchange, shortExchange, grossSpread, netSpread },
                                 });
+                                if (legsStarted) {
+                                    // Threw inside the leg sequence: what is open is unknown → quarantine (never retried).
+                                    quarantinePair("arb-auto", snap.symbol, longExchange, shortExchange, `entry threw mid-sequence (${err instanceof Error ? err.message : String(err)}) — legs may be open`, (m) => console.log(chalk.red(m)));
+                                }
+                                donePending();
                                 console.error(chalk.red(`  ${now} ENTRY FAILED ${snap.symbol}: ${err instanceof Error ? err.message : err}`));
                                 continue;
                             }
@@ -886,16 +1243,16 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             symbol: snap.symbol,
                             longExchange,
                             shortExchange,
-                            size: parseFloat(sizeInAsset),
+                            size: parseFloat(openedSize),
                             entrySpread: grossSpread,
                             entryTime: posEntryTime,
                             entryMarkPrice: snap.markPrice,
                             accumulatedFundingUsd: 0,
                             lastCheckTime: Date.now(),
                         });
-                        // Persist for dry-run mode too (tracks what would have been entered)
+                        // Dry-run: record the simulated entry in the in-memory state only (never the real file).
                         if (dryRun) {
-                            persistAddPosition({
+                            st.add({
                                 id: `${snap.symbol}-${Date.now()}`,
                                 symbol: snap.symbol,
                                 longExchange,
@@ -912,6 +1269,9 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                         }
                     }
                 }
+                if (skipCounts.size > 0) {
+                    console.log(chalk.gray(`  ${now} NO ENTRY (${[...skipCounts.values()].reduce((x, y) => x + y, 0)} symbols): ${[...skipCounts].map(([k, n]) => `${n}× ${k}`).join("; ")}`));
+                }
                 // Accumulate estimated funding income & show status
                 if (openPositions.length > 0) {
                     const nowMs = Date.now();
@@ -922,9 +1282,8 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                         const elapsedHours = (nowMs - pos.lastCheckTime) / (1000 * 60 * 60);
                         const notional = pos.size * current.markPrice;
                         // Estimate funding collected: normalize all rates to hourly before comparing
-                        const rateFor = (e) => e === "pacifica" ? current.pacRate : e === "hyperliquid" ? current.hlRate : e === "aster" ? current.astRate : current.ltRate;
-                        const longHourly = toHourlyRate(rateFor(pos.longExchange), pos.longExchange);
-                        const shortHourly = toHourlyRate(rateFor(pos.shortExchange), pos.shortExchange);
+                        const longHourly = snapshotHourly(current, pos.longExchange);
+                        const shortHourly = snapshotHourly(current, pos.shortExchange);
                         // Income = short gets paid positive funding, long pays; net = (shortRate - longRate) * notional * hours
                         const hourlyIncome = (shortHourly - longHourly) * notional;
                         pos.accumulatedFundingUsd += hourlyIncome * elapsedHours;
@@ -937,20 +1296,31 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                         openPositions.map(p => `${p.symbol}(${p.entrySpread.toFixed(0)}% $${p.accumulatedFundingUsd.toFixed(3)})`).join(", ")));
                 }
                 // Update heartbeat: mark successful scan
-                const stateForHeartbeat = loadArbState();
+                const stateForHeartbeat = st.load();
                 if (stateForHeartbeat) {
                     stateForHeartbeat.lastSuccessfulScanTime = new Date().toISOString();
                     stateForHeartbeat.lastScanTime = new Date().toISOString();
-                    saveArbState(stateForHeartbeat);
+                    st.save(stateForHeartbeat);
                 }
             }
             catch (err) {
                 console.error(chalk.gray(`  Error: ${err instanceof Error ? err.message : String(err)}`));
             }
         };
-        await cycle();
-        cycleInterval = setInterval(cycle, intervalMs);
-        await new Promise(() => { }); // keep alive
+        // Serialized cycles (never overlapping): the next starts only after this one finished.
+        while (!stop.requested()) {
+            await cycle();
+            await interruptibleSleep(intervalMs, stop.requested);
+        }
+        const finalState = st.load();
+        if (finalState) {
+            finalState.lastScanTime = new Date().toISOString();
+            st.save(finalState);
+        }
+        stop.dispose();
+        if (!isJson())
+            console.log(chalk.yellow("\n  Daemon stopped (current cycle finished). State saved.\n"));
+        process.exit(0);
     });
     // ── arb scan ── (one-shot spread scan)
     arb
@@ -972,7 +1342,6 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         .option("--symbols <list>", "Comma-separated list of symbols")
         .option("--all", "Include all symbols (not just top)")
         .option("--hours <n>", "Hours of history to show", "24")
-        .option("--exchange <ex>", "Filter by exchange")
         .option("--max-gap <pct>", "Max price gap % (hip3 mode)")
         .option("--include-native", "Include native HL perps (hip3 mode)", true)
         .option("--no-include-native", "Exclude native HL perps (hip3 mode)")
@@ -984,6 +1353,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         .option("--duration <minutes>", "Track duration in minutes (with --track)", "10")
         .option("--beep", "Beep on large gaps (with --gaps)")
         .option("--check-liquidity", "Check orderbook depth in live mode (slower)")
+        .option("--include-unverified", "With --rates / --compare: also show venues whose funding rate is unverified (qfex) — display only, never ranked for trading")
         .action(async (opts) => {
         // ── Price gap modes ──
         if (opts.gaps || opts.track || opts.alert) {
@@ -1178,18 +1548,26 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             }
         }
         // Route to specialized handlers
+        if (opts.includeUnverified === true && !opts.compare && !opts.rates) {
+            throw new PerpError("INVALID_PARAMS", "--include-unverified applies to --rates / --compare only: unverified funding rates are shown, never ranked as arb opportunities", {
+                remediation: "perp arb scan --rates --include-unverified   (or: --compare <symbol> --include-unverified)",
+            });
+        }
         if (opts.compare)
-            return handleCompare(isJson, opts.compare);
+            return handleCompare(isJson, opts.compare, opts.includeUnverified === true);
         if (opts.rates)
-            return handleRates(isJson, { symbol: opts.symbol, symbols: opts.symbols, all: opts.all, minSpread: opts.min, top: opts.top });
+            return handleRates(isJson, { symbol: opts.symbol, symbols: opts.symbols, all: opts.all, minSpread: opts.min, top: opts.top, includeUnverified: opts.includeUnverified === true });
         if (opts.basis)
             return handleBasisScan(isJson, { minBasis: opts.min, symbol: typeof opts.basis === "string" ? opts.basis : opts.symbol });
         if (opts.hip3)
             return handleDexScan(isJson, { minSpread: opts.min, maxGap: opts.maxGap || "5", includeNative: opts.includeNative !== false, top: opts.top || "20" });
+        // The exchange filter (--history / --positions) is the ROOT -e/--exchange (commander gives it
+        // to the root program): used only when passed on the command line, never the root default venue.
+        const exchangeFilter = program.getOptionValueSource("exchange") === "cli" ? String(program.opts().exchange) : undefined;
         if (opts.history)
-            return handleFundingHistory(isJson, { symbol: (typeof opts.history === "string" ? opts.history : opts.symbol) || "ETH", hours: opts.hours || "24", exchange: opts.exchange });
+            return handleFundingHistory(isJson, { symbol: (typeof opts.history === "string" ? opts.history : opts.symbol) || "ETH", hours: opts.hours || "24", exchange: exchangeFilter });
         if (opts.positions)
-            return handleFundingPositions(isJson, getAdapterForExchange, { exchanges: opts.exchange });
+            return handleFundingPositions(isJson, getAdapterForExchange, { exchanges: exchangeFilter });
         // Default: existing scan logic continues below
         const minSpread = parseFloat(opts.min);
         const holdDays = parseFloat(opts.holdDays);
@@ -1272,7 +1650,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 const rtCost = computeRoundTripCostPct(s.longExch, s.shortExch);
                 const net = computeNetSpread(grossSpread, holdDays, rtCost, bridgeCostUsd, sizeUsd);
                 // Compute price gap between long and short exchanges
-                const pFor = (ex) => ex === "pacifica" ? s.pacMarkPrice : ex === "hyperliquid" ? s.hlMarkPrice : ex === "lighter" ? s.ltMarkPrice : s.astMarkPrice;
+                const pFor = (ex) => ex === "pacifica" ? s.pacMarkPrice : ex === "hyperliquid" ? s.hlMarkPrice : ex === "lighter" ? s.ltMarkPrice : ex === "aster" ? s.astMarkPrice : unknownArbVenue(ex);
                 const longPrice = pFor(s.longExch);
                 const shortPrice = pFor(s.shortExch);
                 const mid = (longPrice + shortPrice) / 2;
@@ -1310,7 +1688,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             const netSpread = computeNetSpread(grossSpread, holdDays, rtCost, bridgeCostUsd, sizeUsd);
             const grossColor = grossSpread >= 50 ? chalk.green.bold : grossSpread >= 30 ? chalk.green : chalk.yellow;
             const netColor = netSpread >= 20 ? chalk.green : netSpread >= 0 ? chalk.yellow : chalk.red;
-            const priceFor = (ex) => ex === "pacifica" ? s.pacMarkPrice : ex === "hyperliquid" ? s.hlMarkPrice : ex === "lighter" ? s.ltMarkPrice : s.astMarkPrice;
+            const priceFor = (ex) => ex === "pacifica" ? s.pacMarkPrice : ex === "hyperliquid" ? s.hlMarkPrice : ex === "lighter" ? s.ltMarkPrice : ex === "aster" ? s.astMarkPrice : unknownArbVenue(ex);
             const longPrice = priceFor(s.longExch);
             const shortPrice = priceFor(s.shortExch);
             const mid = (longPrice + shortPrice) / 2;
@@ -1342,19 +1720,34 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         console.log(chalk.gray(`  Use 'perp arb auto --min-spread ${minSpread}' to auto-trade\n`));
     });
     // ── arb exec ── (validate orderbook + simultaneous dual-leg entry)
-    arb
-        .command("exec")
-        .description("Execute arb: validate orderbook depth, then enter both legs simultaneously. Use spot:<exch> for spot+perp mode.")
+    /**
+     * arb exec outcome that is NOT a success (not entered / rolled back / pending / quarantined):
+     * exit code 1, and in JSON mode an ok:false envelope carrying the structured result as
+     * `details` — so a script never reads a failed or unconfirmed entry as success.
+     */
+    const reportExecFailure = (code, message, details) => {
+        process.exitCode = 1;
+        if (!isJson())
+            return;
+        const remediation = typeof details.remediation === "string" ? details.remediation : undefined;
+        printJson(jsonError(code, message, {
+            status: ERROR_CODES[code].status,
+            retryable: ERROR_CODES[code].retryable,
+            details,
+            ...(remediation !== undefined ? { remediation } : {}),
+        }));
+    };
+    supportsDryRun(arb.command("exec"))
+        .description("Execute arb (supports --dry-run): validate orderbook depth, then enter the legs sequentially (long, then short sized to the verified long fill). Use spot:<exch> for spot+perp mode.")
         .argument("<symbol>", "Symbol (e.g. BTC, ETH, ICP)")
-        .argument("<longExch>", "Exchange to go LONG on (hl, pac, lighter, or spot:hl / spot:lt for spot+perp)")
+        .argument("<longExch>", "Exchange to go LONG on (hl, pac, lighter, or spot:<venue> for spot+perp — hl, lt, lrh, aster, ondo)")
         .argument("<shortExch>", "Exchange to go SHORT on (hl, pac, lighter)")
         .argument("<sizeUsd>", "Position size per leg in USD")
         .option("--max-slippage <pct>", "Max slippage % per leg", "0.5")
         .option("--leverage <n>", "Set leverage before entry (both exchanges)")
         .option("--isolated", "Use isolated margin mode")
         .option("--smart", "Smart execution: IOC limit at best bid/ask + 1 tick (reduces slippage)")
-        .option("--dry-run", "Simulate without executing trades")
-        .option("--reconcile", "Auto-adjust leg sizes to match after execution (trim larger side)")
+        .option("--reconcile", "(always on) the long is trimmed reduce-only to the short's verified fill")
         .action(async (symbol, longExch, shortExch, sizeUsdStr, opts) => {
         // Detect spot: prefix -> route to spot-exec logic
         if (longExch.startsWith("spot:")) {
@@ -1364,21 +1757,39 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const sym = symbol.toUpperCase();
         const sizeUsd = parseFloat(sizeUsdStr);
         const maxSlippage = parseFloat(opts.maxSlippage);
-        const dryRun = !!opts.dryRun || process.argv.includes("--dry-run");
+        const dryRun = isDryRun(program);
         // Resolve exchange aliases
-        const aliasMap = { hl: "hyperliquid", pac: "pacifica", lt: "lighter" };
-        longExch = aliasMap[longExch.toLowerCase()] || longExch.toLowerCase();
-        shortExch = aliasMap[shortExch.toLowerCase()] || shortExch.toLowerCase();
+        longExch = resolveVenueId(longExch);
+        shortExch = resolveVenueId(shortExch);
+        // Only venues with a trading role can hold a leg.
+        for (const ex of [longExch, shortExch]) {
+            const venue = getVenue(ex);
+            if (!venue.roles.includes("trading")) {
+                throw unsupported(venue.displayName, "trading", "no trading API — it cannot be an arb leg", `Use a trading venue: ${listVenuesWithRole("trading").map(v => v.id).join(", ")}`);
+            }
+        }
         if (longExch === shortExch) {
+            reportExecFailure("INVALID_PARAMS", "longExch and shortExch must be different", { error: "longExch and shortExch must be different" });
             if (isJson())
-                return printJson(jsonOk({ error: "longExch and shortExch must be different" }));
+                return;
             console.log(chalk.red("  Long and short exchange must be different."));
             return;
         }
+        // Global quarantine (design §12.3): an unknown / unhedged outcome on this symbol
+        // anywhere blocks new trades until a human clears it.
+        const quarantined = quarantineEntryFor(sym, (m) => console.error(m));
+        if (quarantined !== null) {
+            throw new PerpError("RISK_VIOLATION", `${sym} is quarantined (${quarantined.strategy}: ${quarantined.reason})`, {
+                remediation: `${quarantined.remediation} — then: perp strategy quarantine-clear ${sym}`,
+            });
+        }
+        // A venue whose funding rate is unverified is never a funding-arb leg (design §14.12 #6).
+        assertFundingArbVenue(longExch);
+        assertFundingArbVenue(shortExch);
         const longAdapter = await getAdapterForExchange(longExch);
         const shortAdapter = await getAdapterForExchange(shortExch);
-        // 1. Set leverage if requested
-        if (opts.leverage) {
+        // 1. Set leverage if requested (a venue write — skipped under --dry-run, reported in the plan)
+        if (opts.leverage && !dryRun) {
             const lev = parseInt(opts.leverage);
             const mode = opts.isolated ? "isolated" : "cross";
             if (!isJson())
@@ -1389,15 +1800,17 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             ]);
             if (longLev.status === "rejected") {
                 const msg = `Failed to set leverage on ${longExch}: ${longLev.reason instanceof Error ? longLev.reason.message : longLev.reason}`;
+                reportExecFailure("EXCHANGE_ERROR", msg, { error: msg });
                 if (isJson())
-                    return printJson(jsonOk({ error: msg }));
+                    return;
                 console.log(chalk.red(`  ${msg}`));
                 return;
             }
             if (shortLev.status === "rejected") {
                 const msg = `Failed to set leverage on ${shortExch}: ${shortLev.reason instanceof Error ? shortLev.reason.message : shortLev.reason}`;
+                reportExecFailure("EXCHANGE_ERROR", msg, { error: msg });
                 if (isJson())
-                    return printJson(jsonOk({ error: msg }));
+                    return;
                 console.log(chalk.red(`  ${msg}`));
                 return;
             }
@@ -1425,8 +1838,9 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 fillableUsd: Math.round(fillableUsd * 100) / 100,
                 validation,
             };
+            reportExecFailure("SIZE_TOO_LARGE", `Insufficient orderbook depth for $${sizeUsd} (fillable ~$${result.fillableUsd})`, result);
             if (isJson())
-                return printJson(jsonOk(result));
+                return;
             console.log(chalk.red(`\n  Insufficient depth for $${sizeUsd}:`));
             console.log(chalk.gray(`    ${longExch} asks: $${longCheck.depthUsd.toFixed(0)} depth, ${longCheck.canFillFull ? "OK" : "NOT ENOUGH"}`));
             console.log(chalk.gray(`    ${shortExch} bids: $${shortCheck.depthUsd.toFixed(0)} depth, ${shortCheck.canFillFull ? "OK" : "NOT ENOUGH"}`));
@@ -1448,11 +1862,17 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const matchedBase = Math.min(longCheck.recommendedSize, shortCheck.recommendedSize);
         const avgPrice = (longCheck.avgFillPrice + shortCheck.avgFillPrice) / 2;
         const matchedUsdRaw = matchedBase * avgPrice;
-        const sizing = computeMatchedSize(matchedUsdRaw, avgPrice, longExch, shortExch, { longSizeDecimals: longDecimals, shortSizeDecimals: shortDecimals });
-        if (!sizing) {
-            const msg = `Order too small: $${matchedUsdRaw.toFixed(2)} below exchange minimum. Request a larger size.`;
+        // Each leg's minimum is the venue's own published one (market info), never a fixed table.
+        const pairMin = pairOrderMinimums([
+            { exchange: longExch, ...(await venueOrderMinimums(longAdapter, sym, networkOf(program))) },
+            { exchange: shortExch, ...(await venueOrderMinimums(shortAdapter, sym, networkOf(program))) },
+        ]);
+        const sizing = computeMatchedSize(matchedUsdRaw, avgPrice, longExch, shortExch, { longSizeDecimals: longDecimals, shortSizeDecimals: shortDecimals, minNotional: pairMin.minNotional });
+        if (!sizing || Number(sizing.size) < pairMin.minSize) {
+            const msg = `Order too small: $${matchedUsdRaw.toFixed(2)} is below the venue minimum (${pairMin.describe}). Request a larger size.`;
+            reportExecFailure("SIZE_TOO_SMALL", msg, { error: msg, computedUsd: matchedUsdRaw, minimums: pairMin.legs });
             if (isJson())
-                return printJson(jsonOk({ error: msg, computedUsd: matchedUsdRaw }));
+                return;
             console.log(chalk.red(`\n  ${msg}`));
             return;
         }
@@ -1466,7 +1886,8 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         // 4b. Dry-run: return simulated result without executing
         if (dryRun) {
             const result = {
-                status: "filled", symbol: sym, dryRun: true,
+                status: "filled", symbol: sym, dryRun: true, sent: false,
+                leverage: opts.leverage ? { value: parseInt(opts.leverage), mode: opts.isolated ? "isolated" : "cross" } : null,
                 size: matchedSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
                 long: { exchange: longExch, side: "buy", size: matchedSize, slippagePct: longCheck.slippagePct },
                 short: { exchange: shortExch, side: "sell", size: matchedSize, slippagePct: shortCheck.slippagePct },
@@ -1477,192 +1898,75 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             return;
         }
         if (!isJson())
-            console.log(chalk.gray(`    Executing both legs simultaneously...\n`));
-        // 5. Execute both legs simultaneously
-        const execLong = opts.smart
-            ? smartOrder(longAdapter, sym, "buy", matchedSize).then(r => r.result)
-            : longAdapter.marketOrder(sym, "buy", matchedSize);
-        const execShort = opts.smart
-            ? smartOrder(shortAdapter, sym, "sell", matchedSize).then(r => r.result)
-            : shortAdapter.marketOrder(sym, "sell", matchedSize);
-        const [longResult, shortResult] = await Promise.allSettled([execLong, execShort]);
-        const longOk = longResult.status === "fulfilled";
-        const shortOk = shortResult.status === "fulfilled";
-        if (longOk && shortOk) {
-            // 6. Verify both positions actually exist (some exchanges return success but silently reject)
-            // SSOT rule #2: distinguish "API error" from "no position opened".
-            // Previously `.catch(() => [])` collapsed both into the same code path,
-            // so a transient verify-side network blip would be misclassified as a
-            // silent exchange reject and trigger an unnecessary rollback.
-            const [longSettled, shortSettled] = await Promise.allSettled([
-                longAdapter.getPositions(),
-                shortAdapter.getPositions(),
-            ]);
-            if (longSettled.status === "rejected" || shortSettled.status === "rejected") {
-                const longErr = longSettled.status === "rejected" ? (longSettled.reason instanceof Error ? longSettled.reason.message : String(longSettled.reason)) : "ok";
-                const shortErr = shortSettled.status === "rejected" ? (shortSettled.reason instanceof Error ? shortSettled.reason.message : String(shortSettled.reason)) : "ok";
-                throw new Error(`arb-auto: cannot verify post-fill positions for ${sym} ` +
-                    `(long ${longExch}: ${longErr}; short ${shortExch}: ${shortErr}). ` +
-                    `Refusing to silently misclassify API failure as a silent reject.`);
-            }
-            const longPositions = longSettled.value;
-            const shortPositions = shortSettled.value;
-            const longPos = longPositions.find(p => p.symbol.toUpperCase().startsWith(sym));
-            const shortPos = shortPositions.find(p => p.symbol.toUpperCase().startsWith(sym));
-            if (!longPos && !shortPos) {
-                // Both silently rejected
-                const result = { status: "both_rejected", symbol: sym, size: matchedSize, message: "Both exchanges accepted order but no positions opened. Check min order size." };
-                if (isJson())
-                    return printJson(jsonOk(result));
-                console.log(chalk.red(`  Both orders accepted but no positions opened. Min order size not met?\n`));
-                return;
-            }
-            if (!longPos || !shortPos) {
-                // One side silently rejected — close the other
-                const openSide = longPos ? "long" : "short";
-                const openAdapter = longPos ? longAdapter : shortAdapter;
-                if (!isJson())
-                    console.log(chalk.yellow(`  ${openSide} opened but other side silently rejected — closing ${openSide}...`));
-                try {
-                    await openAdapter.marketOrder(sym, longPos ? "sell" : "buy", matchedSize);
-                }
-                catch { /* best effort */ }
-                const result = { status: "silent_reject", symbol: sym, openedSide: openSide, closedSide: longPos ? "short" : "long", message: "One leg silently rejected (likely min order size). Rolled back." };
-                if (isJson())
-                    return printJson(jsonOk(result));
-                console.log(chalk.yellow(`  Rolled back ${openSide} leg. Check exchange min order sizes.\n`));
-                return;
-            }
-            // 7. Verify fill sizes match expected
-            const expectedSize = parseFloat(matchedSize);
-            const longFilled = Number(longPos.size);
-            const shortFilled = Number(shortPos.size);
-            const fillWarnings = [];
-            if (longFilled < expectedSize * 0.5)
-                fillWarnings.push(`Long fill ${longPos.size} < expected ${matchedSize} — partial fill?`);
-            if (shortFilled < expectedSize * 0.5)
-                fillWarnings.push(`Short fill ${shortPos.size} < expected ${matchedSize} — partial fill?`);
-            // Size mismatch between legs
-            const sizeDiffPct = Math.abs(longFilled - shortFilled) / Math.max(longFilled, shortFilled) * 100;
-            if (sizeDiffPct > 5)
-                fillWarnings.push(`Leg size mismatch: long ${longPos.size} vs short ${shortPos.size} (${sizeDiffPct.toFixed(1)}% diff)`);
-            // 8. Reconcile — trim larger leg to match smaller
-            let reconciled = false;
-            let reconciledSize = "";
-            if (opts.reconcile && sizeDiffPct > 1 && longFilled > 0 && shortFilled > 0) {
-                const targetSize = Math.min(longFilled, shortFilled);
-                const trimSide = longFilled > shortFilled ? "long" : "short";
-                const trimAdapter = trimSide === "long" ? longAdapter : shortAdapter;
-                const trimAction = trimSide === "long" ? "sell" : "buy"; // reduce long = sell, reduce short = buy
-                const excess = Math.abs(longFilled - shortFilled);
-                const trimDecimals = matchedSize.includes(".") ? matchedSize.split(".")[1].length : 0;
-                const excessStr = excess.toFixed(trimDecimals);
-                if (!isJson())
-                    console.log(chalk.cyan(`    Reconciling: ${trimSide} has ${excess.toFixed(trimDecimals)} excess → trimming...`));
-                try {
-                    if (opts.smart) {
-                        await smartOrder(trimAdapter, sym, trimAction, excessStr, { reduceOnly: true });
-                    }
-                    else {
-                        await trimAdapter.marketOrder(sym, trimAction, excessStr);
-                    }
-                    reconciled = true;
-                    reconciledSize = targetSize.toFixed(trimDecimals);
-                    fillWarnings.length = 0; // clear mismatch warnings
-                    if (!isJson())
-                        console.log(chalk.green(`    Reconciled: both legs now ~${reconciledSize} units`));
-                }
-                catch (reconErr) {
-                    const msg = reconErr instanceof Error ? reconErr.message : String(reconErr);
-                    fillWarnings.push(`Reconcile failed (${trimSide} trim): ${msg}`);
-                    if (!isJson())
-                        console.log(chalk.yellow(`    Reconcile failed: ${msg}`));
-                }
-            }
-            const fillStatus = fillWarnings.length > 0 ? "filled_unverified" : "filled";
-            const finalSize = reconciled ? reconciledSize : matchedSize;
+            console.log(chalk.gray(`    Executing legs sequentially (long, then short sized to the verified long fill)...\n`));
+        // 5. Sequential verified legs (design §12.3). The second leg is sized to the
+        //    first leg's VERIFIED fill, any shortfall is trimmed off the long
+        //    (reduce-only, verified — always, --reconcile is implied), a definite short
+        //    failure rolls the long back reduce-only, and an unknown outcome (incl. a
+        //    venue that accepted the order but the position did not move) quarantines
+        //    the symbol — nothing is retried.
+        const res = await openPerpPairVerified({
+            source: "arb-exec", sym, longAdapter, longExch, longSym: sym, shortAdapter, shortExch, shortSym: sym,
+            size: matchedSize, smart: !!opts.smart, log: (m) => console.error(chalk.red(m)),
+        });
+        if (res.status === "opened") {
+            const finalSize = res.hedged;
+            const reconciled = res.trimmed !== "0";
             logExecution({
                 type: "arb_entry", exchange: `${longExch}+${shortExch}`,
                 symbol: sym, side: "entry", size: finalSize,
-                status: fillWarnings.length > 0 ? "unverified" : "success", dryRun: false,
-                meta: { longExch, shortExch, matchedUsd, longSlippage: longCheck.slippagePct, shortSlippage: shortCheck.slippagePct, reconciled, ...(fillWarnings.length > 0 && { warnings: fillWarnings }) },
+                status: "success", dryRun: false,
+                // arbPairId / longExchange / shortExchange: the keys `arb status` provenance matches on.
+                meta: { arbPairId: `${sym}:${longExch}:${shortExch}`, longExchange: longExch, shortExchange: shortExch, longExch, shortExch, matchedUsd, requested: matchedSize, longSlippage: longCheck.slippagePct, shortSlippage: shortCheck.slippagePct, reconciled, trimmed: res.trimmed },
             });
             const result = {
-                status: fillStatus, symbol: sym, size: finalSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
-                long: { exchange: longExch, side: "buy", size: reconciled ? reconciledSize : longPos.size, slippagePct: longCheck.slippagePct },
-                short: { exchange: shortExch, side: "sell", size: reconciled ? reconciledSize : shortPos.size, slippagePct: shortCheck.slippagePct },
-                ...(reconciled && { reconciled: true }),
-                ...(fillWarnings.length > 0 && { warnings: fillWarnings }),
+                status: "filled", symbol: sym, size: finalSize, requestedSize: matchedSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
+                long: { exchange: longExch, side: "buy", size: finalSize, slippagePct: longCheck.slippagePct },
+                short: { exchange: shortExch, side: "sell", size: finalSize, slippagePct: shortCheck.slippagePct },
+                ...(reconciled && { reconciled: true, trimmed: res.trimmed }),
             };
             if (isJson())
                 return printJson(jsonOk(result));
-            if (fillWarnings.length > 0) {
-                console.log(chalk.yellow(`  FILLED (unverified): ${sym} ${finalSize} units (~$${matchedUsd.toFixed(2)})`));
-                for (const w of fillWarnings)
-                    console.log(chalk.yellow(`    ⚠ ${w}`));
-            }
-            else {
-                console.log(chalk.green(`  FILLED${reconciled ? " (reconciled)" : ""}: ${sym} ${finalSize} units (~$${matchedUsd.toFixed(2)})`));
-            }
-            console.log(chalk.green(`    LONG  ${longExch} ✓ (${reconciled ? reconciledSize : longPos.size})`));
-            console.log(chalk.green(`    SHORT ${shortExch} ✓ (${reconciled ? reconciledSize : shortPos.size})\n`));
-        }
-        else if (longOk !== shortOk) {
-            // One leg failed — rollback
-            const filledSide = longOk ? "long" : "short";
-            const failedSide = longOk ? "short" : "long";
-            const filledAdapter = longOk ? longAdapter : shortAdapter;
-            const rollbackAction = longOk ? "sell" : "buy";
-            const failedErr = longOk
-                ? shortResult.reason
-                : longResult.reason;
-            if (!isJson())
-                console.log(chalk.yellow(`  PARTIAL: ${filledSide} OK, ${failedSide} FAILED — rolling back...`));
-            let rollbackOk = false;
-            for (let attempt = 1; attempt <= 2; attempt++) {
-                try {
-                    if (opts.smart) {
-                        await smartOrder(filledAdapter, sym, rollbackAction, matchedSize, { reduceOnly: true });
-                    }
-                    else {
-                        await filledAdapter.marketOrder(sym, rollbackAction, matchedSize);
-                    }
-                    rollbackOk = true;
-                    break;
-                }
-                catch { /* retry */ }
-            }
+            console.log(chalk.green(`  FILLED${reconciled ? ` (long trimmed by ${res.trimmed})` : ""}: ${sym} ${finalSize} units (requested ${matchedSize}, ~$${matchedUsd.toFixed(2)})`));
+            console.log(chalk.green(`    LONG  ${longExch} ✓ (${finalSize}, verified)`));
+            console.log(chalk.green(`    SHORT ${shortExch} ✓ (${finalSize}, verified)\n`));
+        }
+        else if (res.status === "not_opened") {
             logExecution({
                 type: "arb_entry", exchange: `${longExch}+${shortExch}`,
                 symbol: sym, side: "entry", size: matchedSize,
                 status: "failed", dryRun: false,
-                error: `Partial: ${failedSide} failed (${failedErr instanceof Error ? failedErr.message : String(failedErr)}). Rollback: ${rollbackOk ? "ok" : "FAILED"}`,
+                error: `${res.reason}${res.rolledBack !== null ? ` — long ${res.rolledBack} rolled back (reduce-only, verified)` : ""}`,
             });
             const result = {
-                status: "partial_fill", symbol: sym, filledSide, failedSide,
-                failedError: failedErr instanceof Error ? failedErr.message : String(failedErr),
-                rollback: rollbackOk ? "success" : "FAILED — MANUAL CLOSE REQUIRED",
+                status: res.rolledBack !== null ? "rolled_back" : "not_filled", symbol: sym,
+                error: res.reason, rolledBack: res.rolledBack, openExposure: null,
             };
+            reportExecFailure("ORDER_REJECTED", `arb exec ${sym}: entry failed (${result.status}) — ${res.reason}`, result);
             if (isJson())
-                return printJson(jsonOk(result));
-            console.log(rollbackOk
-                ? chalk.yellow(`  Rollback OK — no open exposure.\n`)
-                : chalk.red.bold(`  ROLLBACK FAILED — ${filledSide} leg still open. Close manually!\n`));
+                return;
+            console.log(chalk.red(`  Entry failed: ${res.reason}`));
+            console.log(res.rolledBack !== null
+                ? chalk.yellow(`  Rolled back long ${res.rolledBack} on ${longExch} (reduce-only, verified flat) — no open exposure from this trade.\n`)
+                : chalk.yellow(`  Nothing was opened.\n`));
         }
         else {
-            // Both failed
-            const longErr = longResult.reason;
-            const shortErr = shortResult.reason;
+            logExecution({
+                type: "arb_entry", exchange: `${longExch}+${shortExch}`,
+                symbol: sym, side: "entry", size: matchedSize,
+                status: "failed", dryRun: false,
+                error: `QUARANTINED: ${res.reason}`,
+                meta: { exposure: res.exposure },
+            });
             const result = {
-                status: "both_failed", symbol: sym,
-                longError: longErr instanceof Error ? longErr.message : String(longErr),
-                shortError: shortErr instanceof Error ? shortErr.message : String(shortErr),
+                status: "quarantined", symbol: sym, error: res.reason, openExposure: res.exposure,
+                remediation: `Check ${sym} on ${longExch} and ${shortExch}; close or re-hedge by hand, then: perp strategy quarantine-clear ${sym}`,
             };
+            reportExecFailure("ORDER_PARTIAL", `arb exec ${sym}: QUARANTINED — ${res.reason}`, result);
             if (isJson())
-                return printJson(jsonOk(result));
-            console.log(chalk.red(`  Both legs failed:`));
-            console.log(chalk.red(`    LONG:  ${result.longError}`));
-            console.log(chalk.red(`    SHORT: ${result.shortError}\n`));
+                return;
+            console.log(chalk.red.bold(`  QUARANTINED ${sym}: ${res.reason}`));
+            console.log(chalk.red.bold(`  Possible open exposure: ${res.exposure} — check manually!\n`));
         }
     });
     // ── spot-exec logic (called from exec when longExch starts with "spot:") ──
@@ -1670,178 +1974,121 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const sym = symbol.toUpperCase();
         const sizeUsd = parseFloat(sizeUsdStr);
         const maxSlippage = parseFloat(opts.maxSlippage);
-        const dryRun = !!opts.dryRun || process.argv.includes("--dry-run");
+        const dryRun = isDryRun(program);
         // Resolve exchange aliases
-        const aliasMap = { hl: "hyperliquid", pac: "pacifica", lt: "lighter" };
-        spotExch = aliasMap[spotExch.toLowerCase()] || spotExch.toLowerCase();
-        perpExch = aliasMap[perpExch.toLowerCase()] || perpExch.toLowerCase();
-        // Validate spot exchange
-        if (!["hyperliquid", "lighter"].includes(spotExch)) {
-            const msg = `Spot exchange must be hl or lt (got ${spotExch}). Pacifica is perp-only.`;
+        spotExch = resolveVenueId(spotExch);
+        perpExch = resolveVenueId(perpExch);
+        // Validate spot exchange: bot/arb spot scope (§12.4 #3) — throws CAPABILITY_UNSUPPORTED
+        // for venues without spot or outside the scope (pacifica shared margin, arcus swaps).
+        const spotDef = requireBotSpotVenue(spotExch.replace(/-spot$/, ""));
+        spotExch = spotDef.id;
+        perpExch = tryResolveVenueId(perpExch) ?? perpExch;
+        if (!getVenue(perpExch).roles.includes("trading")) {
+            throw unsupported(perpExch, "trading", "no trading API — it cannot be the perp leg", `Use a trading venue: ${listVenuesWithRole("trading").map(v => v.id).join(", ")}`);
+        }
+        assertFundingArbVenue(perpExch);
+        const spotAdapter = await requireSpotAdapter(spotDef.id, await getAdapterForExchange(spotDef.id));
+        const perpAdapter = await getAdapterForExchange(perpExch);
+        // Order of operations (C3 / M6): every validation (balances, orderbooks, price
+        // identity, depth, sizing) runs BEFORE anything moves; dry-run returns before the
+        // leverage change and any transfer; after a transfer, every abort transfers back.
+        const lev = opts.leverage ? parseInt(opts.leverage) : null;
+        const levMode = opts.isolated ? "isolated" : "cross";
+        const sameVenue = spotDef.id === (tryResolveVenueId(perpExch) ?? perpExch);
+        const fail = (msg, extra = {}) => {
+            reportExecFailure("ORDER_REJECTED", msg, { error: msg, ...extra });
             if (isJson())
-                return printJson(jsonOk({ error: msg }));
+                return;
             console.log(chalk.red(`  ${msg}`));
-            return;
-        }
-        // Load spot adapter
-        const { HyperliquidSpotAdapter } = await import("../exchanges/hyperliquid-spot.js");
-        const { LighterSpotAdapter } = await import("../exchanges/lighter-spot.js");
-        let spotAdapter;
-        if (spotExch === "hyperliquid") {
-            const hlAdapter = await getAdapterForExchange("hyperliquid");
-            const hlSpot = new HyperliquidSpotAdapter(hlAdapter);
-            await hlSpot.init();
-            spotAdapter = hlSpot;
+        };
+        // Global quarantine (design §12.3): checked before anything is read or moved.
+        const quarantined = quarantineEntryFor(sym, (m) => console.error(m));
+        if (quarantined !== null) {
+            throw new PerpError("RISK_VIOLATION", `${sym} is quarantined (${quarantined.strategy}: ${quarantined.reason})`, {
+                remediation: `${quarantined.remediation} — then: perp strategy quarantine-clear ${sym}`,
+            });
         }
-        else {
-            const ltAdapter = await getAdapterForExchange("lighter");
-            const ltSpot = new LighterSpotAdapter(ltAdapter);
-            await ltSpot.init();
-            spotAdapter = ltSpot;
+        // 1. Balance validation (errors propagate — no "continue anyway").
+        //    Shared spot/perp (HL unified): perp available is the spot purchasing power.
+        //    Separate: spot quote available + what can be transferred from the spot venue's perp account.
+        const spotVenuePerp = await getAdapterForExchange(spotDef.id);
+        const isShared = spotSharesPerpMargin(spotDef, spotVenuePerp);
+        const spotVenuePerpAvail = Number((await spotVenuePerp.getBalance()).available);
+        const perpAvail = sameVenue ? spotVenuePerpAvail : Number((await perpAdapter.getBalance()).available);
+        if (!Number.isFinite(spotVenuePerpAvail) || !Number.isFinite(perpAvail)) {
+            return fail(`Balance read returned a non-numeric available balance (spot venue ${spotVenuePerpAvail}, perp ${perpAvail})`);
         }
-        const perpAdapter = await getAdapterForExchange(perpExch);
-        // 1. Set perp leverage if requested
-        if (opts.leverage) {
-            const lev = parseInt(opts.leverage);
-            const mode = opts.isolated ? "isolated" : "cross";
-            if (!isJson())
-                console.log(chalk.gray(`  Setting perp leverage ${lev}x ${mode} on ${perpExch}...`));
-            try {
-                await perpAdapter.setLeverage(sym, lev, mode);
-            }
-            catch (e) {
-                const msg = `Failed to set leverage: ${e instanceof Error ? e.message : e}`;
-                if (isJson())
-                    return printJson(jsonOk({ error: msg }));
-                console.log(chalk.red(`  ${msg}`));
-                return;
-            }
+        const quoteRow = isShared ? null : findSpotQuoteBalance(spotDef, spotNetworkOf(spotAdapter), await readSpotBalancesFresh(spotAdapter));
+        const spotQuoteHave = isShared ? spotVenuePerpAvail : (quoteRow === null ? 0 : Number(quoteRow.available));
+        const spotTarget = Math.ceil(sizeUsd * 1.1);
+        // Separate model: only the shortfall is transferred from the spot venue's perp account.
+        const transferWant = isShared ? 0 : Math.max(0, Math.ceil(spotTarget - spotQuoteHave));
+        // Perp leg margin: notional / the leverage the venue applies to the market × ARB_MARGIN_BUFFER
+        // (requiredArbMargin — the same rule as funding-arb; unknown leverage → 1x). Spot leg: 100%.
+        let perpLeverage;
+        try {
+            perpLeverage = await marketLeverageOf(perpAdapter, sym);
         }
-        // 2. Auto-transfer USDC to spot account if needed
-        if (spotExch === "hyperliquid") {
-            const hlSpot = spotAdapter;
-            const transferAmt = Math.ceil(sizeUsd * 1.1);
-            try {
-                const xferResult = await hlSpot.transferUsdcToSpot(transferAmt);
-                if (xferResult?.status === "err" && xferResult.response?.includes("unified")) {
-                    if (!isJson())
-                        console.log(chalk.gray(`  Unified account — no USDC transfer needed`));
-                }
-                else if (xferResult?.status !== "err") {
-                    if (!isJson())
-                        console.log(chalk.gray(`  Transferred $${transferAmt} USDC perp→spot`));
-                    await new Promise(r => setTimeout(r, 500));
-                }
-            }
-            catch {
-                // Non-critical — may be unified account or already have balance
-            }
+        catch (e) {
+            return fail(`Could not read the ${sym} leverage on ${perpExch}: ${e instanceof Error ? e.message : String(e)}`);
         }
-        else if (spotExch === "lighter") {
-            // Lighter requires explicit USDC transfer from perp → spot account
-            const ltSpot = spotAdapter;
-            const transferAmt = Math.ceil(sizeUsd * 1.1);
-            try {
-                const xferResult = await ltSpot.transferUsdcToSpot(transferAmt);
-                if (!isJson())
-                    console.log(chalk.gray(`  Transferred $${transferAmt} USDC perp→spot on Lighter`));
-                await new Promise(r => setTimeout(r, 300));
-            }
-            catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
-                if (!isJson())
-                    console.log(chalk.yellow(`  USDC transfer warning: ${msg}`));
-                // Continue — spot order may still work if spot balance already exists
+        const perpMarginNeed = requiredArbMargin(sizeUsd, perpLeverage);
+        const marginText = `~$${perpMarginNeed.toFixed(2)} perp margin (${perpLeverage !== null ? `${perpLeverage}x` : "leverage unknown → 1x"}, ×${ARB_MARGIN_BUFFER} buffer)`;
+        if (isShared) {
+            const need = sameVenue ? sizeUsd + perpMarginNeed : sizeUsd;
+            if (spotQuoteHave < need) {
+                return fail(`Insufficient balance: have $${spotQuoteHave.toFixed(2)} on ${spotDef.displayName}, need ~$${need.toFixed(2)} ($${sizeUsd} spot${sameVenue ? ` + ${marginText}` : ""})`, { available: spotQuoteHave, required: need, perpLeverage });
             }
         }
-        // 2b. Verify balance is sufficient after transfer
-        try {
-            // HL unified account: perp equity IS spot balance (shared)
-            const isUnified = spotExch === "hyperliquid";
-            let spotUsdcAvail;
-            if (isUnified) {
-                // Unified account: perp adapter's available balance = spot purchasing power
-                const hlBalance = await perpAdapter.getBalance();
-                spotUsdcAvail = Number(hlBalance?.available ?? 0);
-            }
-            else {
-                const spotBalances = await spotAdapter.getSpotBalances();
-                const spotUsdc = spotBalances.find(b => b.token === "USDC_SPOT" || b.token === "USDC");
-                spotUsdcAvail = Number(spotUsdc?.available ?? 0);
-            }
-            // Check perp balance (for perp leg margin)
-            const perpBalance = await perpAdapter.getBalance();
-            const perpAvail = Number(perpBalance?.available ?? 0);
-            // For unified accounts (same exchange), total needed = spotSize + perpMargin from same pool
-            const totalNeeded = spotExch === perpExch ? sizeUsd * 1.5 : sizeUsd;
-            const checkBalance = spotExch === perpExch ? spotUsdcAvail : spotUsdcAvail;
-            if (checkBalance < totalNeeded * 0.9) {
-                const msg = `Insufficient balance: have $${spotUsdcAvail.toFixed(2)}, need ~$${totalNeeded.toFixed(0)} (spot + perp margin)`;
-                if (isJson())
-                    return printJson(jsonOk({ error: msg, spotUsdcAvail, required: totalNeeded }));
-                console.log(chalk.red(`  ${msg}`));
-                return;
-            }
-            if (spotExch !== perpExch && perpAvail < sizeUsd * 0.5) {
-                const msg = `Insufficient perp balance: have $${perpAvail.toFixed(2)} available on ${perpExch}, need margin for ~$${sizeUsd}`;
-                if (isJson())
-                    return printJson(jsonOk({ error: msg, perpAvail, required: sizeUsd }));
-                console.log(chalk.red(`  ${msg}`));
-                return;
+        else {
+            const fromSpotVenuePerp = transferWant + (sameVenue ? perpMarginNeed : 0);
+            if (spotVenuePerpAvail < fromSpotVenuePerp) {
+                return fail(`Insufficient balance on ${spotDef.displayName}: spot ${quoteRow?.token ?? "quote"} $${spotQuoteHave.toFixed(2)} + transferable perp $${spotVenuePerpAvail.toFixed(2)}; need $${spotTarget} in spot${sameVenue ? ` + ${marginText}` : ""}`, { spotQuoteAvail: spotQuoteHave, perpAvail: spotVenuePerpAvail, required: fromSpotVenuePerp, perpLeverage });
             }
         }
-        catch {
-            // Balance check failed — continue with execution, let order placement catch errors
+        if (!sameVenue && perpAvail < perpMarginNeed) {
+            return fail(`Insufficient perp balance: have $${perpAvail.toFixed(2)} available on ${perpExch}, need ${marginText} for $${sizeUsd}`, { perpAvail, required: perpMarginNeed, perpLeverage });
         }
-        // 3. Fetch orderbooks simultaneously
-        const spotSymbol = `${sym}/USDC`;
+        // 2. Fetch orderbooks simultaneously
+        const spotSymbol = spotPairSymbol(spotDef, spotNetworkOf(spotAdapter), sym);
         if (!isJson())
             console.log(chalk.gray(`  Checking orderbook depth (spot ${spotExch} + perp ${perpExch})...`));
         const [spotBook, perpBook] = await Promise.all([
             spotAdapter.getSpotOrderbook(spotSymbol),
             perpAdapter.getOrderbook(sym),
         ]);
-        // 3a. Price cross-validation: verify spot and perp are the same underlying
-        //     Prevents wrong-token trades if index mapping is incorrect
+        // 2a. Price cross-validation: spot and perp must be the same underlying
         const spotMid = spotBook.bids.length > 0 && spotBook.asks.length > 0
             ? (Number(spotBook.bids[0][0]) + Number(spotBook.asks[0][0])) / 2 : 0;
         const perpMid = perpBook.bids.length > 0 && perpBook.asks.length > 0
             ? (Number(perpBook.bids[0][0]) + Number(perpBook.asks[0][0])) / 2 : 0;
-        if (spotMid > 0 && perpMid > 0) {
-            const priceDeviation = Math.abs(spotMid - perpMid) / perpMid * 100;
-            if (priceDeviation > 5) {
-                const msg = `Price mismatch: spot mid $${spotMid.toFixed(4)} vs perp mid $${perpMid.toFixed(4)} (${priceDeviation.toFixed(1)}% deviation). Possible wrong token index — aborting.`;
-                if (isJson())
-                    return printJson(jsonOk({ error: msg, spotMid, perpMid, deviationPct: priceDeviation }));
-                console.log(chalk.red(`\n  ${msg}`));
-                return;
-            }
+        if (spotMid === 0)
+            return fail(`Empty spot orderbook for ${sym} — cannot verify token identity`);
+        if (perpMid === 0)
+            return fail(`Empty perp orderbook for ${sym} on ${perpExch} — cannot verify token identity`);
+        const priceDeviation = Math.abs(spotMid - perpMid) / perpMid * 100;
+        if (priceDeviation > MAX_PRICE_DEVIATION_PCT) {
+            return fail(`Price mismatch: spot mid $${spotMid.toFixed(4)} vs perp mid $${perpMid.toFixed(4)} (${priceDeviation.toFixed(1)}% deviation). Possible wrong token index — aborting.`, { spotMid, perpMid, deviationPct: priceDeviation });
         }
-        else if (spotMid === 0) {
-            const msg = `Empty spot orderbook for ${sym} — cannot verify token identity`;
-            if (isJson())
-                return printJson(jsonOk({ error: msg }));
-            console.log(chalk.red(`\n  ${msg}`));
-            return;
-        }
-        // 3b. Validate depth
+        // 2b. Validate depth
         const spotCheck = computeExecutableSize(spotBook.asks, sizeUsd, maxSlippage);
         const perpCheck = computeExecutableSize(perpBook.bids, sizeUsd, maxSlippage);
         if (!spotCheck.canFillFull || !perpCheck.canFillFull) {
             const fillableUsd = Math.min(spotCheck.maxSize * spotCheck.avgFillPrice, perpCheck.maxSize * perpCheck.avgFillPrice);
+            reportExecFailure("SIZE_TOO_LARGE", `Insufficient orderbook depth for $${sizeUsd} (fillable ~$${(Math.round(fillableUsd * 100) / 100)})`, {
+                error: "Insufficient orderbook depth",
+                requestedUsd: sizeUsd, fillableUsd: Math.round(fillableUsd * 100) / 100,
+                spot: { exchange: spotExch, depthUsd: spotCheck.depthUsd, canFill: spotCheck.canFillFull },
+                perp: { exchange: perpExch, depthUsd: perpCheck.depthUsd, canFill: perpCheck.canFillFull },
+            });
             if (isJson())
-                return printJson(jsonOk({
-                    error: "Insufficient orderbook depth",
-                    requestedUsd: sizeUsd, fillableUsd: Math.round(fillableUsd * 100) / 100,
-                    spot: { exchange: spotExch, depthUsd: spotCheck.depthUsd, canFill: spotCheck.canFillFull },
-                    perp: { exchange: perpExch, depthUsd: perpCheck.depthUsd, canFill: perpCheck.canFillFull },
-                }));
+                return;
             console.log(chalk.red(`\n  Insufficient depth for $${sizeUsd}:`));
             console.log(chalk.gray(`    ${spotExch} spot asks: $${spotCheck.depthUsd.toFixed(0)}`));
             console.log(chalk.gray(`    ${perpExch} perp bids: $${perpCheck.depthUsd.toFixed(0)}`));
             return;
         }
-        // 4. Compute matched size (with min order value enforcement)
+        // 3. Compute matched size (with min order value enforcement)
         const avgPrice = (spotCheck.avgFillPrice + perpCheck.avgFillPrice) / 2;
         const inferDecimals = (levels) => {
             for (const [, s] of levels) {
@@ -1854,146 +2101,229 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const spotDecimals = inferDecimals(spotBook.asks);
         const matchedBase = Math.min(spotCheck.recommendedSize, perpCheck.recommendedSize);
         const matchedUsdRaw = matchedBase * avgPrice;
-        // Use computeSpotPerpMatchedSize which enforces exchange min order values
-        // (e.g. HL $10 min) — rounds UP if floor would drop below minimum
+        // computeSpotPerpMatchedSize enforces exchange min order values (e.g. HL $10 min)
         const sizing = computeSpotPerpMatchedSize(matchedUsdRaw, avgPrice, spotExch, perpExch, spotDecimals);
-        if (!sizing) {
-            const msg = `Order too small: $${matchedUsdRaw.toFixed(2)} below exchange minimum. Request a larger size.`;
-            if (isJson())
-                return printJson(jsonOk({ error: msg, computedUsd: matchedUsdRaw }));
-            console.log(chalk.red(`\n  ${msg}`));
-            return;
-        }
-        const matchedSize = sizing.size;
+        if (!sizing)
+            return fail(`Order too small: $${matchedUsdRaw.toFixed(2)} below exchange minimum. Request a larger size.`, { computedUsd: matchedUsdRaw });
+        // Lot steps from the venue market info (unknown → throws, Rule #2): both legs are sent on
+        // the lot grid, the hedge is floored to the perp lot and fills are judged with half-lot tolerance.
+        const perpStep = await lotStepOf(perpAdapter, sym);
+        const spotStep = await spotLotStepOf(spotAdapter, spotSymbol);
+        const matchedSize = floorSize(floorSize(sizing.size, perpStep), spotStep);
         const matchedUsd = sizing.notional;
+        const sizeDec = sizeDecimalsOf(matchedSize);
         if (!isJson()) {
             console.log(chalk.cyan(`\n  Spot+Perp Arb: ${sym}`));
             console.log(chalk.gray(`    SPOT  ${spotExch}: buy  ${matchedSize} (~$${(matchedBase * spotCheck.avgFillPrice).toFixed(2)})`));
             console.log(chalk.gray(`    PERP  ${perpExch}: sell ${matchedSize} (~$${(matchedBase * perpCheck.avgFillPrice).toFixed(2)})`));
-            console.log(chalk.gray(`    Executing both legs simultaneously...\n`));
         }
-        // 5. Execute both legs (or return dry-run result)
+        // 4. Dry-run: report the plan; nothing is changed (no leverage, no transfer, no order).
         if (dryRun) {
             const result = {
-                status: "filled", mode: "spot-perp", symbol: sym, dryRun: true,
+                status: "simulated", mode: "spot-perp", symbol: sym, dryRun: true, sent: false,
                 size: matchedSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
+                transfer: transferWant > 0 ? { from: "perp", to: "spot", venue: spotDef.id, amount: transferWant } : null,
+                leverage: lev === null ? null : { exchange: perpExch, leverage: lev, mode: levMode },
                 spot: { exchange: spotExch, side: "buy", size: matchedSize },
                 perp: { exchange: perpExch, side: "sell", size: matchedSize },
             };
             if (isJson())
                 return printJson(jsonOk(result));
+            if (transferWant > 0)
+                console.log(chalk.cyan(`  [DRY-RUN] Would transfer $${transferWant} perp→spot on ${spotDef.displayName}`));
+            if (lev !== null)
+                console.log(chalk.cyan(`  [DRY-RUN] Would set perp leverage ${lev}x ${levMode} on ${perpExch}`));
             console.log(chalk.cyan(`  [DRY-RUN] Would execute: spot buy ${matchedSize} on ${spotExch} + perp sell ${matchedSize} on ${perpExch}`));
             return;
         }
-        // Same exchange (e.g. Lighter) shares nonce → must execute sequentially
-        // Different exchanges → execute simultaneously for speed
-        const validatePerpFill = (r) => {
-            const res = r;
-            const statuses = res?.response?.data?.statuses;
-            if (statuses && statuses.length > 0) {
-                const st = statuses[0];
-                if (st.error)
-                    throw new Error(`Perp sell ${sym}: ${st.error}`);
-                const filled = st.filled;
-                if (filled && Number(filled.totalSz ?? 0) === 0) {
-                    throw new Error(`Perp sell ${sym}: 0 fill`);
-                }
+        // 5. Set perp leverage if requested (before any funds move)
+        if (lev !== null) {
+            if (!isJson())
+                console.log(chalk.gray(`  Setting perp leverage ${lev}x ${levMode} on ${perpExch}...`));
+            try {
+                await perpAdapter.setLeverage(sym, lev, levMode);
+            }
+            catch (e) {
+                return fail(`Failed to set leverage: ${e instanceof Error ? e.message : e}`);
+            }
+        }
+        // 6. Transfer the spot quote shortfall perp → spot (separate model only). A failed transfer stops here.
+        let transferred = 0;
+        if (transferWant > 0) {
+            if (await transferQuoteToSpot(spotAdapter, transferWant)) {
+                transferred = transferWant;
+                if (!isJson())
+                    console.log(chalk.gray(`  Transferred $${transferWant} perp→spot on ${spotDef.displayName}`));
+                await new Promise(r => setTimeout(r, 500));
+            }
+        }
+        else if (!isJson()) {
+            console.log(chalk.gray(isShared
+                ? `  Shared spot/perp balance on ${spotDef.displayName} — no transfer needed`
+                : `  Spot ${quoteRow?.token ?? "quote"} balance already covers the order — no transfer`));
+        }
+        /** Abort path after a transfer: move it back and report the outcome (never silent). */
+        const returnTransfer = async (warnings) => {
+            if (transferred <= 0)
+                return;
+            try {
+                await transferQuoteToPerp(spotAdapter, transferred);
+                if (!isJson())
+                    console.log(chalk.gray(`  Returned $${transferred} spot→perp on ${spotDef.displayName}`));
+            }
+            catch (e) {
+                const w = `Transfer back of $${transferred} failed (funds remain in ${spotDef.id} spot): ${e instanceof Error ? e.message : String(e)}`;
+                warnings.push(w);
+                if (!isJson())
+                    console.log(chalk.yellow(`  ⚠ ${w}`));
             }
-            return r;
         };
+        // 7. Execute both legs. Same exchange shares a nonce → sequential; else parallel.
+        if (!isJson())
+            console.log(chalk.gray(`    Executing ${sameVenue ? "sequentially" : "both legs simultaneously"}...\n`));
+        // The perp leg goes through placePerpVerified (design §12.3): a fill is the measured
+        // position delta; an unknown outcome is ORDER_PENDING (quarantine, never roll back).
         let spotResult;
         let perpResult;
-        if (spotExch === perpExch) {
-            // Sequential: spot first, then perp (avoids nonce collision on same exchange)
-            spotResult = await spotAdapter.spotMarketOrder(spotSymbol, "buy", matchedSize)
+        if (sameVenue) {
+            // Sequential: spot first; the perp leg is sized to what the spot leg filled.
+            spotResult = await spotMarketFill(spotAdapter, spotSymbol, "buy", matchedSize, spotStep)
                 .then(r => ({ status: "fulfilled", value: r }))
                 .catch(e => ({ status: "rejected", reason: e }));
             if (spotResult.status === "fulfilled") {
-                perpResult = await perpAdapter.marketOrder(sym, "sell", matchedSize)
-                    .then(validatePerpFill)
-                    .then(r => ({ status: "fulfilled", value: r }))
-                    .catch(e => ({ status: "rejected", reason: e }));
+                const perpSize = floorToStep(spotResult.value.filledSize, perpStep);
+                perpResult = Number(perpSize) > 0
+                    ? await placePerpVerified(perpAdapter, perpExch, sym, "sell", perpSize, { stepSize: perpStep })
+                        .then(r => ({ status: "fulfilled", value: r }))
+                        .catch(e => ({ status: "rejected", reason: e }))
+                    : { status: "rejected", reason: new PerpError("ORDER_REJECTED", `Skipped: spot filled only dust (${spotResult.value.filledSize})`) };
             }
             else {
-                perpResult = { status: "rejected", reason: new Error("Skipped: spot failed") };
+                perpResult = { status: "rejected", reason: new PerpError("ORDER_REJECTED", "Skipped: spot failed") };
             }
         }
         else {
-            // Parallel: different exchanges, no nonce conflict
             [spotResult, perpResult] = await Promise.allSettled([
-                spotAdapter.spotMarketOrder(spotSymbol, "buy", matchedSize),
-                perpAdapter.marketOrder(sym, "sell", matchedSize).then(validatePerpFill),
+                spotMarketFill(spotAdapter, spotSymbol, "buy", matchedSize, spotStep),
+                placePerpVerified(perpAdapter, perpExch, sym, "sell", matchedSize, { stepSize: perpStep }),
             ]);
         }
-        const spotOk = spotResult.status === "fulfilled";
+        const errMsg = (e) => e instanceof Error ? e.message : String(e);
+        const spotPending = spotResult.status === "rejected" && spotResult.reason instanceof PerpError && spotResult.reason.structured.code === "ORDER_PENDING";
+        const spotFilled = spotResult.status === "fulfilled" ? spotResult.value.filledSize : 0;
+        const hedgeSize = floorToStep(spotFilled, perpStep);
         const perpOk = perpResult.status === "fulfilled";
-        if (spotOk && perpOk) {
-            // ── Post-execution fill verification ──
-            // Wait for exchange state to settle, then verify both legs actually filled
-            let fillVerified = true;
-            let verifyWarnings = [];
+        const warnings = [];
+        /** Set when a perp outcome is unknown: quarantine and stop (no spot sell-back, no transfer back). */
+        let perpUnknown = perpResult.status === "rejected" && isOutcomeUnknown(perpResult.reason)
+            ? `perp sell on ${perpExch} outcome unknown: ${errMsg(perpResult.reason)}` : null;
+        // 7a. Perp leg open (verified) while the spot leg filled less (failed / pending / partial):
+        //     reduce the perp short to the spot fill (reduce-only, verified) — never a naked short.
+        let shortOpen = perpResult.status === "fulfilled" ? floorToStep(perpResult.value.filledSize, perpStep) : "0";
+        if (perpOk && Number(hedgeSize) < Number(shortOpen)) {
+            const excess = floorToStep(Number(shortOpen) - Number(hedgeSize), perpStep);
+            const why = spotResult.status === "rejected"
+                ? `spot leg ${spotPending ? "PENDING" : "failed"}: ${errMsg(spotResult.reason)}`
+                : `spot leg filled ${spotFilled} of ${matchedSize}`;
+            if (!isJson())
+                console.log(chalk.yellow(`  ${why} — reducing perp short by ${excess} to match`));
+            // One verified reduce-only close (+ one residual close inside closePerpVerified); never resubmitted.
             try {
-                await new Promise(r => setTimeout(r, 800));
-                // Verify spot: check base token balance appeared
-                const spotBals = await spotAdapter.getSpotBalances();
-                const baseToken = sym; // e.g. "ETH"
-                const spotTokenBal = spotBals.find(b => b.token.toUpperCase().startsWith(baseToken));
-                const spotTokenAmt = Number(spotTokenBal?.total ?? 0);
-                const expectedSize = parseFloat(matchedSize);
-                if (spotTokenAmt < expectedSize * 0.5) {
-                    fillVerified = false;
-                    verifyWarnings.push(`Spot buy may not have filled: expected ~${matchedSize} ${baseToken}, found ${spotTokenAmt.toFixed(6)}`);
-                }
-                // Verify perp: check short position exists
-                const perpPositions = await perpAdapter.getPositions();
-                const perpPos = perpPositions.find(p => p.symbol.replace("-PERP", "").toUpperCase() === sym && p.side === "short");
-                if (!perpPos) {
-                    fillVerified = false;
-                    verifyWarnings.push(`Perp short position not found for ${sym} on ${perpExch} — fill may not have executed`);
-                }
-                else if (Number(perpPos.size) < expectedSize * 0.5) {
-                    verifyWarnings.push(`Perp short size ${perpPos.size} < expected ${matchedSize} — partial fill?`);
-                }
+                const c = await closePerpVerified(perpAdapter, perpExch, sym, "buy", excess, { decimals: sizeDecimalsOf(perpStep), stepSize: perpStep });
+                shortOpen = floorToStep(Math.max(0, Number(shortOpen) - c.closed), perpStep);
+                if (c.residual > 0)
+                    warnings.push(`Perp reduce of ${excess} ${sym} on ${perpExch} closed ${c.closed}, ${c.residual} still open${c.note !== null ? ` (${c.note})` : ""} — MANUAL CLOSE REQUIRED`);
             }
-            catch (verifyErr) {
-                // Verification check itself failed — log but don't block
-                verifyWarnings.push(`Fill verification check failed: ${verifyErr instanceof Error ? verifyErr.message : String(verifyErr)}`);
+            catch (e) {
+                if (isOutcomeUnknown(e))
+                    perpUnknown = `perp reduce of ${excess} on ${perpExch} outcome unknown: ${errMsg(e)} (short ${shortOpen} was open)`;
+                else
+                    warnings.push(`Perp reduce of ${excess} ${sym} on ${perpExch} FAILED: ${errMsg(e)} — MANUAL CLOSE REQUIRED`);
             }
-            if (verifyWarnings.length > 0 && !isJson()) {
-                for (const w of verifyWarnings) {
-                    console.log(chalk.yellow(`  ⚠ ${w}`));
-                }
+        }
+        // 7a'. Unknown perp outcome: stop here. Selling the spot back could leave a naked short
+        //      and the short may or may not exist — quarantine for a human.
+        if (perpUnknown !== null) {
+            const pendingNote = spotPending ? `; spot buy ${matchedSize} also PENDING` : `; spot bought ${spotFilled}`;
+            quarantineSymbol("arb-exec", sym, `arb exec spot:${spotExch}: ${perpUnknown}${pendingNote} — not rolled back`, `Check ${sym} on ${spotDef.id} spot (perp -e ${spotDef.id} trade spot-balance / spot-orders) and the ${perpExch} perp (perp -e ${perpExch} positions); hedge or close by hand`, (m) => console.error(m));
+            logExecution({
+                type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
+                symbol: sym, side: "entry", size: matchedSize,
+                status: "failed", dryRun: false,
+                error: `${perpUnknown} — MANUAL CHECK REQUIRED`,
+                meta: { mode: "spot-perp", spotPending, spotFilled, perpPending: true, ...(warnings.length > 0 && { warnings }) },
+            });
+            const result = {
+                status: "perp_pending", mode: "spot-perp", symbol: sym,
+                spotFilled, spotPending, perpError: perpUnknown,
+                remediation: `Perp order outcome unknown — do NOT resubmit and do NOT sell the spot back blindly. Check: perp -e ${perpExch} positions; perp -e ${spotDef.id} trade spot-balance`,
+                ...(warnings.length > 0 && { warnings }),
+            };
+            reportExecFailure("ORDER_PENDING", `arb exec spot:${spotExch} ${sym}: perp leg outcome unknown (quarantined) — ${perpUnknown}`, result);
+            if (isJson())
+                return;
+            for (const w of warnings)
+                console.log(chalk.red.bold(`  ${w}`));
+            console.log(chalk.red.bold(`  PERP ORDER PENDING — ${perpUnknown}. Spot ${spotPending ? "PENDING" : `bought ${spotFilled}`}. Nothing rolled back; ${sym} quarantined.\n`));
+            return;
+        }
+        // 7b. Spot leg filled while the perp leg DEFINITELY failed: sell the spot fill back.
+        let spotHeld = spotFilled;
+        if (!perpOk && spotFilled > 0) {
+            const perpErr = perpResult.reason;
+            if (!isJson())
+                console.log(chalk.yellow(`  Perp leg failed (${errMsg(perpErr)}) — selling back ${hedgeSize} spot`));
+            try {
+                const rb = Number(hedgeSize) > 0 ? await spotMarketFill(spotAdapter, spotSymbol, "sell", hedgeSize, spotStep) : null;
+                spotHeld = rb === null ? spotFilled : Math.max(0, spotFilled - rb.filledSize);
+                if (spotHeld > 0)
+                    warnings.push(`Spot rollback left ${spotHeld} ${sym} on ${spotExch} — MANUAL CLOSE REQUIRED`);
             }
-            if (!fillVerified) {
-                // Fills couldn't be confirmed — log as unverified but still persist
-                // (rolling back based on uncertain data is worse than persisting)
-                logExecution({
-                    type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
-                    symbol: sym, side: "entry", size: matchedSize,
-                    status: "unverified", dryRun: false,
-                    meta: { mode: "spot-perp", spotExch, perpExch, matchedUsd, warnings: verifyWarnings },
-                });
+            catch (e) {
+                warnings.push(`Spot rollback FAILED: ${errMsg(e)} — ${spotFilled} ${sym} still held on ${spotExch}, MANUAL CLOSE REQUIRED`);
             }
-            else {
-                // Log execution — verified
-                logExecution({
-                    type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
-                    symbol: sym, side: "entry", size: matchedSize,
-                    status: "success", dryRun: false,
-                    meta: { mode: "spot-perp", spotExch, perpExch, matchedUsd },
-                });
+        }
+        // Hedged only when the perp short is VERIFIED (placePerpVerified measured it) and spot is held.
+        const hedged = perpOk && Number(shortOpen) > 0 && spotHeld > 0;
+        if (hedged) {
+            if (spotResult.status === "fulfilled" && spotResult.value.status === "partial") {
+                warnings.push(`Spot leg partially filled: ${spotFilled} of ${matchedSize} ${sym}; perp short sized to match`);
+            }
+            // Legs must match: an excess short whose reduce failed, or a verified short below the
+            // spot held, is real unhedged exposure → quarantine and report it, never "filled".
+            // Spot held on the perp lot grid: sub-lot spot dust cannot be hedged and is not an imbalance.
+            const heldStr = floorToStep(spotHeld, perpStep);
+            let unbalanced = null;
+            if (Number(heldStr) > Number(shortOpen)) {
+                unbalanced = `verified perp short ${shortOpen} < spot held ${heldStr} ${sym} — ${fillSizeString(spotHeld - Number(shortOpen), sizeDec)} spot is unhedged`;
+            }
+            else if (Number(shortOpen) > Number(heldStr)) {
+                unbalanced = `perp short ${shortOpen} on ${perpExch} > spot held ${heldStr} ${sym} — ${fillSizeString(Number(shortOpen) - spotHeld, sizeDec)} short is naked (reduce did not complete)`;
+            }
+            if (unbalanced !== null) {
+                warnings.push(unbalanced);
+                quarantineSymbol("arb-exec", sym, `arb exec spot:${spotExch}: ${unbalanced}`, `Check ${sym} on ${spotDef.id} spot (perp -e ${spotDef.id} trade spot-balance) and the ${perpExch} perp (perp -e ${perpExch} positions); re-hedge or close by hand, then: perp strategy quarantine-clear ${sym}`, (m) => console.error(m));
             }
-            // Persist position state
-            persistAddPosition({
+            if (!isJson())
+                for (const w of warnings)
+                    console.log(chalk.yellow(`  ⚠ ${w}`));
+            logExecution({
+                type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
+                symbol: sym, side: "entry", size: hedgeSize,
+                status: "success", dryRun: false,
+                meta: { mode: "spot-perp", spotExch, perpExch, matchedUsd, requestedSize: matchedSize, spotFilled, shortOpen, perpVerified: true, quarantined: unbalanced !== null, ...(warnings.length > 0 && { warnings }) },
+            });
+            // Persist the actual leg sizes
+            persistAddPosition(networkOf(program), {
                 id: `${sym}-spot-${Date.now()}`,
                 symbol: sym,
                 longExchange: spotExch,
                 shortExchange: perpExch,
-                longSize: parseFloat(matchedSize),
-                shortSize: parseFloat(matchedSize),
+                longSize: spotHeld,
+                shortSize: parseFloat(shortOpen),
                 entryTime: new Date().toISOString(),
                 entrySpread: 0, // Will be updated on next scan
-                entryLongPrice: spotCheck.avgFillPrice,
+                entryLongPrice: spotResult.status === "fulfilled" && spotResult.value.avgPrice !== null ? spotResult.value.avgPrice : spotCheck.avgFillPrice,
                 entryShortPrice: perpCheck.avgFillPrice,
                 accumulatedFunding: 0,
                 lastCheckTime: new Date().toISOString(),
@@ -2001,143 +2331,120 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 spotExchange: spotExch,
                 spotSymbol: spotSymbol,
             });
-            // Return leftover USDC from spot back to perp (non-unified HL accounts)
-            if (spotExch === "hyperliquid") {
-                try {
-                    const hlSpot = spotAdapter;
-                    const bals = await hlSpot.getSpotBalances();
-                    const usdcBal = bals.find(b => b.token.startsWith("USDC"));
-                    const leftover = Number(usdcBal?.available ?? 0);
-                    if (leftover > 1) {
-                        const xfer = await hlSpot.transferUsdcToPerp(Math.floor(leftover));
-                        if (xfer?.status !== "err") {
-                            if (!isJson())
-                                console.log(chalk.gray(`  Returned ~$${Math.floor(leftover)} USDC to perp account`));
-                        }
-                    }
-                }
-                catch { /* non-critical — unified accounts don't need transfer */ }
-            }
-            const result = {
-                status: fillVerified ? "filled" : "filled_unverified",
-                mode: "spot-perp", symbol: sym,
-                size: matchedSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
-                spot: { exchange: spotExch, side: "buy", size: matchedSize },
-                perp: { exchange: perpExch, side: "sell", size: matchedSize },
-                ...(verifyWarnings.length > 0 && { warnings: verifyWarnings }),
-            };
-            if (isJson())
-                return printJson(jsonOk(result));
-            if (fillVerified) {
-                console.log(chalk.green(`  FILLED (verified): ${sym} ${matchedSize} units (~$${matchedUsd.toFixed(2)})`));
-            }
-            else {
-                console.log(chalk.yellow(`  FILLED (unverified): ${sym} ${matchedSize} units (~$${matchedUsd.toFixed(2)})`));
+            // Return the leftover of what THIS trade transferred in (pre-existing spot quote is
+            // never swept; no-op when shared with perp or nothing was transferred).
+            try {
+                const moved = transferred > 0 ? await sweepSpotQuoteToPerp(spotAdapter, 1, { keep: spotQuoteHave, max: transferred }) : 0;
+                if (moved > 0 && !isJson())
+                    console.log(chalk.gray(`  Returned ~$${moved.toFixed(2)} to perp account`));
             }
-            console.log(chalk.green(`    SPOT  ${spotExch} ✓ (bought ${matchedSize})`));
-            console.log(chalk.green(`    PERP  ${perpExch} ✓ (shorted ${matchedSize})\n`));
-        }
-        else if (spotOk !== perpOk) {
-            // One leg failed — rollback
-            const filledSide = spotOk ? "spot" : "perp";
-            const failedSide = spotOk ? "perp" : "spot";
-            const failedErr = spotOk
-                ? perpResult.reason
-                : spotResult.reason;
-            const failedErrMsg = failedErr instanceof Error ? failedErr.message : String(failedErr);
-            if (!isJson()) {
-                console.log(chalk.yellow(`  PARTIAL: ${filledSide} OK, ${failedSide} FAILED — rolling back...`));
-                console.log(chalk.red(`    Reason: ${failedErrMsg}`));
+            catch (e) {
+                const w = `Leftover spot→perp transfer failed (funds remain in ${spotDef.id} spot): ${errMsg(e)}`;
+                warnings.push(w);
+                if (!isJson())
+                    console.log(chalk.yellow(`  ⚠ ${w}`));
             }
-            let rollbackOk = false;
-            for (let attempt = 1; attempt <= 2; attempt++) {
-                try {
-                    if (spotOk) {
-                        await spotAdapter.spotMarketOrder(spotSymbol, "sell", matchedSize);
-                    }
-                    else {
-                        await perpAdapter.marketOrder(sym, "buy", matchedSize);
-                    }
-                    rollbackOk = true;
-                    break;
-                }
-                catch { /* retry */ }
+            if (unbalanced !== null) {
+                const result = {
+                    status: "quarantined", mode: "spot-perp", symbol: sym,
+                    exposure: { spotHeld: heldStr, perpShort: shortOpen, spotExchange: spotExch, perpExchange: perpExch },
+                    reason: unbalanced,
+                    remediation: `Legs unbalanced — do NOT resubmit. Re-hedge or close by hand (perp -e ${perpExch} positions; perp -e ${spotDef.id} trade spot-balance), then: perp strategy quarantine-clear ${sym}`,
+                    ...(warnings.length > 0 && { warnings }),
+                };
+                reportExecFailure("ORDER_PARTIAL", `arb exec spot:${spotExch} ${sym}: QUARANTINED — ${unbalanced}`, result);
+                if (isJson())
+                    return;
+                console.log(chalk.red.bold(`  QUARANTINED: ${sym} spot ${heldStr} / perp short ${shortOpen} — ${unbalanced}\n`));
+                return;
             }
-            logExecution({
-                type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
-                symbol: sym, side: "entry", size: matchedSize,
-                status: "failed", dryRun: false,
-                error: `Partial: ${failedSide} failed (${failedErrMsg}). Rollback: ${rollbackOk ? "ok" : "FAILED"}`,
-            });
             const result = {
-                status: "partial_fill", mode: "spot-perp", symbol: sym,
-                filledSide, failedSide,
-                failedError: failedErrMsg,
-                rollback: rollbackOk ? "success" : "FAILED — MANUAL CLOSE REQUIRED",
+                status: spotFilled < Number(matchedSize) ? "partial_filled" : "filled",
+                mode: "spot-perp", symbol: sym,
+                size: hedgeSize, requestedSize: matchedSize, notionalUsd: Math.round(matchedUsd * 100) / 100,
+                spot: { exchange: spotExch, side: "buy", size: String(spotHeld) },
+                perp: { exchange: perpExch, side: "sell", size: shortOpen },
+                ...(warnings.length > 0 && { warnings }),
             };
             if (isJson())
                 return printJson(jsonOk(result));
-            console.log(rollbackOk
-                ? chalk.yellow(`  Rollback OK — no open exposure.\n`)
-                : chalk.red.bold(`  ROLLBACK FAILED — ${filledSide} leg still open. Close manually!\n`));
+            console.log(chalk.green(`  FILLED (perp verified): ${sym} spot ${spotHeld} / perp short ${shortOpen} (~$${matchedUsd.toFixed(2)} requested)`));
+            console.log(chalk.green(`    SPOT  ${spotExch} ✓ (bought ${spotFilled})`));
+            console.log(chalk.green(`    PERP  ${perpExch} ✓ (short ${shortOpen})\n`));
+            return;
         }
-        else {
-            // Both failed
-            const spotErr = spotResult.reason;
-            const perpErr = perpResult.reason;
-            const result = {
-                status: "both_failed", mode: "spot-perp", symbol: sym,
-                spotError: spotErr instanceof Error ? spotErr.message : String(spotErr),
-                perpError: perpErr instanceof Error ? perpErr.message : String(perpErr),
-            };
-            if (isJson())
-                return printJson(jsonOk(result));
-            console.log(chalk.red(`  Both legs failed:`));
-            console.log(chalk.red(`    SPOT:  ${result.spotError}`));
-            console.log(chalk.red(`    PERP:  ${result.perpError}\n`));
+        // Not hedged: nothing (or only an unrecoverable remainder) is open. Return the transfer
+        // unless the spot leg is pending (the quote may already be spent).
+        if (!spotPending)
+            await returnTransfer(warnings);
+        const spotErrMsg = spotResult.status === "rejected" ? errMsg(spotResult.reason) : null;
+        const perpErrMsg = perpResult.status === "rejected" ? errMsg(perpResult.reason) : null;
+        const manual = warnings.some(w => w.includes("MANUAL")) || spotPending;
+        if (manual) {
+            // Persisted globally so the `arb auto` daemon, the bots and later `arb exec` runs
+            // leave this symbol alone until a human resolves it.
+            quarantineSymbol("arb-exec", sym, spotPending ? `arb exec spot:${spotExch}: spot buy ${matchedSize} PENDING (outcome unknown)` : `arb exec spot:${spotExch}: rollback incomplete — ${warnings.join("; ")}`, `Check ${sym} on ${spotDef.id} spot (perp -e ${spotDef.id} trade spot-balance / spot-orders) and the ${perpExch} perp (perp -e ${perpExch} positions)`, (m) => console.error(m));
         }
+        logExecution({
+            type: "arb_entry", exchange: `spot:${spotExch}+${perpExch}`,
+            symbol: sym, side: "entry", size: matchedSize,
+            status: "failed", dryRun: false,
+            error: `spot: ${spotErrMsg ?? `filled ${spotFilled}`}; perp: ${perpErrMsg ?? "ok"}${manual ? " — MANUAL CHECK REQUIRED" : ""}`,
+            meta: { mode: "spot-perp", spotPending, spotHeld, shortOpen, ...(warnings.length > 0 && { warnings }) },
+        });
+        const result = {
+            status: spotPending ? "spot_pending" : (spotErrMsg !== null && perpErrMsg !== null ? "both_failed" : "rolled_back"),
+            mode: "spot-perp", symbol: sym,
+            spotError: spotErrMsg, perpError: perpErrMsg,
+            spotHeld, perpShortOpen: shortOpen,
+            ...(spotPending && { remediation: `Spot order outcome unknown — do NOT resubmit. Check: perp -e ${spotDef.id} trade spot-balance; the perp leg was reduced to match.` }),
+            ...(warnings.length > 0 && { warnings }),
+        };
+        // pending spot → ORDER_PENDING; an incomplete rollback (quarantined) → ORDER_PARTIAL; else nothing open → ORDER_REJECTED.
+        reportExecFailure(spotPending ? "ORDER_PENDING" : manual ? "ORDER_PARTIAL" : "ORDER_REJECTED", `arb exec spot:${spotExch} ${sym}: not hedged (${result.status}${manual ? ", quarantined" : ""})`, result);
+        if (isJson())
+            return;
+        if (spotErrMsg !== null)
+            console.log(chalk.red(`    SPOT:  ${spotErrMsg}`));
+        if (perpErrMsg !== null)
+            console.log(chalk.red(`    PERP:  ${perpErrMsg}`));
+        for (const w of warnings)
+            console.log(chalk.red.bold(`  ${w}`));
+        if (spotPending)
+            console.log(chalk.red.bold(`  SPOT ORDER PENDING — outcome unknown, do NOT resubmit. Verify ${spotDef.id} spot balance manually.\n`));
+        else if (!manual)
+            console.log(chalk.yellow(`  Not hedged — entry aborted: spot held ${spotHeld} ${sym}, perp short ${shortOpen}${spotErrMsg !== null && perpErrMsg !== null ? " (both legs rejected)" : " (the filled leg was rolled back)"}${warnings.length > 0 ? "; see warnings above" : ""}.\n`));
     }
     // ── Expose spot-close handler for consolidated "arb close" in arb/index.ts ──
     handleSpotClose = async (sym_arg, opts_arg, getAdapter, isJsonFn) => {
         const sym = sym_arg.toUpperCase();
         // Try to find the position from state
-        const state = loadArbState();
+        const state = loadArbState(networkOf(program));
         const pos = state?.positions.find(p => p.symbol.toUpperCase() === sym && p.mode === "spot-perp");
-        const aliasMap = { hl: "hyperliquid", pac: "pacifica", lt: "lighter" };
-        const spotExch = aliasMap[opts_arg.spotExch?.toLowerCase() ?? ""] || opts_arg.spotExch?.toLowerCase() || pos?.spotExchange || pos?.longExchange;
-        const perpExch = aliasMap[opts_arg.perpExch?.toLowerCase() ?? ""] || opts_arg.perpExch?.toLowerCase() || pos?.shortExchange;
+        const venueIdOf = (v) => resolveVenueId(v.replace(/-spot$/i, ""));
+        const spotRaw = opts_arg.spotExch ?? pos?.spotExchange ?? pos?.longExchange;
+        const perpRaw = opts_arg.perpExch ?? pos?.shortExchange;
+        const spotExch = spotRaw === undefined ? undefined : venueIdOf(spotRaw);
+        const perpExch = perpRaw === undefined ? undefined : venueIdOf(perpRaw);
         if (!spotExch || !perpExch) {
-            const msg = "Cannot determine exchanges. Specify --spot-exch and --perp-exch, or ensure the position is tracked in state.";
-            if (isJsonFn())
-                return printJson(jsonOk({ error: msg }));
-            console.log(chalk.red(`  ${msg}`));
-            return;
-        }
-        // Load adapters
-        const { HyperliquidSpotAdapter } = await import("../exchanges/hyperliquid-spot.js");
-        const { LighterSpotAdapter } = await import("../exchanges/lighter-spot.js");
-        let spotAdapter;
-        if (spotExch === "hyperliquid") {
-            const hlAdapter = await getAdapter("hyperliquid");
-            const hlSpot = new HyperliquidSpotAdapter(hlAdapter);
-            await hlSpot.init();
-            spotAdapter = hlSpot;
-        }
-        else {
-            const ltAdapter = await getAdapter("lighter");
-            const ltSpot = new LighterSpotAdapter(ltAdapter);
-            await ltSpot.init();
-            spotAdapter = ltSpot;
+            throw new PerpError("INVALID_PARAMS", "Cannot determine the spot and perp exchanges of this spot-perp position", {
+                remediation: `Pass both: perp arb close ${sym} --spot-exch <spot venue> --perp-exch <perp venue>`,
+            });
         }
+        // Load adapters (bot/arb spot scope — §12.4 #3)
+        const spotDef = requireBotSpotVenue(spotExch.replace(/-spot$/, ""));
+        const spotAdapter = await requireSpotAdapter(spotDef.id, await getAdapter(spotDef.id));
         const perpAdapter = await getAdapter(perpExch);
-        const spotSymbol = `${sym}/USDC`;
-        // Find how much to close
+        const spotSymbol = spotPairSymbol(spotDef, spotNetworkOf(spotAdapter), sym);
+        // Find how much to close — fresh read (the reduce-only close is sized from it, never a cached position)
+        invalidateCache("acct");
         const perpPositions = await perpAdapter.getPositions();
         const perpPos = perpPositions.find(p => p.symbol.replace("-PERP", "").toUpperCase() === sym && p.side === "short");
         if (!perpPos) {
             const msg = `No short perp position found for ${sym} on ${perpExch}`;
+            process.exitCode = 1;
             if (isJsonFn())
-                return printJson(jsonOk({ error: msg }));
+                return printJson(jsonError("POSITION_NOT_FOUND", msg));
             console.log(chalk.red(`  ${msg}`));
             return;
         }
@@ -2148,122 +2455,168 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
             console.log(chalk.gray(`    PERP  ${perpExch}: buy  ${closeSize} (close short)`));
             console.log(chalk.gray(`    Executing...\n`));
         }
-        // Same exchange → sequential (nonce collision), different → parallel
+        // Spot quote before the sale (uncached): only the proceeds above it are swept back.
+        // Read before anything moves — a failure aborts the close.
+        const preCloseQuote = await readSpotQuoteAvailableFresh(spotAdapter);
+        // Same exchange → sequential (nonce collision), different → parallel.
+        // The spot leg's REAL fill decides the outcome (§12.4 #5): only a confirmed spot sale
+        // counts as closed; legs are re-matched so no naked short / unhedged spot is left.
+        const sameVenue = spotDef.id === (tryResolveVenueId(perpExch) ?? perpExch);
+        const closeDec = sizeDecimalsOf(closeSize);
+        // The perp buy-back and every re-match order go through placePerpVerified (design
+        // §12.3): only a measured position change counts; an unknown outcome stops the close.
         let spotResult;
         let perpResult;
-        if (spotExch === perpExch) {
-            // Sequential: sell spot first, then close perp
-            spotResult = await spotAdapter.spotMarketOrder(spotSymbol, "sell", closeSize)
+        if (sameVenue) {
+            spotResult = await spotMarketFill(spotAdapter, spotSymbol, "sell", closeSize)
                 .then(r => ({ status: "fulfilled", value: r }))
                 .catch(e => ({ status: "rejected", reason: e }));
-            perpResult = await perpAdapter.marketOrder(sym, "buy", closeSize)
+            perpResult = await placePerpVerified(perpAdapter, perpExch, sym, "buy", closeSize, { reduceOnly: true })
                 .then(r => ({ status: "fulfilled", value: r }))
                 .catch(e => ({ status: "rejected", reason: e }));
         }
         else {
             [spotResult, perpResult] = await Promise.allSettled([
-                spotAdapter.spotMarketOrder(spotSymbol, "sell", closeSize),
-                perpAdapter.marketOrder(sym, "buy", closeSize),
+                spotMarketFill(spotAdapter, spotSymbol, "sell", closeSize),
+                placePerpVerified(perpAdapter, perpExch, sym, "buy", closeSize, { reduceOnly: true }),
             ]);
         }
-        const spotOk = spotResult.status === "fulfilled";
+        const errMsg = (e) => e instanceof Error ? e.message : String(e);
+        const spotPending = spotResult.status === "rejected" && spotResult.reason instanceof PerpError && spotResult.reason.structured.code === "ORDER_PENDING";
+        const sold = spotResult.status === "fulfilled" ? Math.min(spotResult.value.filledSize, Number(closeSize)) : 0;
+        const soldStr = fillSizeString(sold, closeDec);
         const perpOk = perpResult.status === "fulfilled";
-        if (spotOk && perpOk) {
-            // ── Post-close fill verification ──
-            let closeVerified = true;
-            let closeWarnings = [];
-            try {
-                await new Promise(r => setTimeout(r, 800));
-                // Verify spot token was sold (balance should be near zero or gone)
-                const spotBals = await spotAdapter.getSpotBalances();
-                const baseToken = sym;
-                const spotTokenBal = spotBals.find(b => b.token.toUpperCase().startsWith(baseToken));
-                const remainingSpotAmt = Number(spotTokenBal?.total ?? 0);
-                const closedSize = parseFloat(closeSize);
-                if (remainingSpotAmt > closedSize * 0.5) {
-                    closeVerified = false;
-                    closeWarnings.push(`Spot sell may not have filled: still have ${remainingSpotAmt.toFixed(6)} ${baseToken} (expected ~0)`);
+        const closeWarnings = [];
+        /** Set when a perp outcome is unknown: quarantine and stop (no re-short, no further reduce). */
+        let perpUnknown = perpResult.status === "rejected" && isOutcomeUnknown(perpResult.reason)
+            ? `perp buy-back ${closeSize} on ${perpExch} outcome unknown: ${errMsg(perpResult.reason)}` : null;
+        // Size still short on the perp (verified buy-back only), and spot still held (in closeSize units).
+        const perpClosed = perpResult.status === "fulfilled" ? Number(fillSizeString(perpResult.value.filledSize, closeDec)) : 0;
+        let shortLeft = Number(closeSize) - perpClosed;
+        const spotLeft = Number(closeSize) - sold;
+        if (perpUnknown === null && !spotPending) {
+            const unhedgedSpot = Number(fillSizeString(Math.max(0, spotLeft - shortLeft), closeDec));
+            const nakedShort = Number(fillSizeString(Math.max(0, shortLeft - spotLeft), closeDec));
+            if (unhedgedSpot > 0) {
+                // Only reachable after a VERIFIED buy-back: spot sold less — re-short the unsold spot to stay hedged.
+                const reShort = fillSizeString(unhedgedSpot, closeDec);
+                try {
+                    const rs = await placePerpVerified(perpAdapter, perpExch, sym, "sell", reShort);
+                    const reShorted = fillSizeString(rs.filledSize, closeDec);
+                    shortLeft += Number(reShorted);
+                    // A partial re-short (accepted partial fill) leaves part of the unsold spot unhedged.
+                    closeWarnings.push(Number(reShorted) < Number(reShort)
+                        ? `Spot sold ${soldStr} of ${closeSize} ${sym}; re-short on ${perpExch} filled ${reShorted} of ${reShort} — ${fillSizeString(Number(reShort) - Number(reShorted), closeDec)} spot unhedged, MANUAL ACTION REQUIRED`
+                        : `Spot sold ${soldStr} of ${closeSize} ${sym}; re-shorted ${reShort} on ${perpExch} (verified) — stays open (hedged)`);
                 }
-                // Verify perp short was closed (position should be gone or reduced)
-                const perpPositionsAfter = await perpAdapter.getPositions();
-                const remainingPerpPos = perpPositionsAfter.find(p => p.symbol.replace("-PERP", "").toUpperCase() === sym && p.side === "short");
-                if (remainingPerpPos && Number(remainingPerpPos.size) > closedSize * 0.5) {
-                    closeVerified = false;
-                    closeWarnings.push(`Perp short still open: ${remainingPerpPos.size} ${sym} on ${perpExch} (expected closed)`);
+                catch (e) {
+                    if (isOutcomeUnknown(e))
+                        perpUnknown = `re-short of the unsold ${reShort} ${sym} on ${perpExch} outcome unknown: ${errMsg(e)}`;
+                    else
+                        closeWarnings.push(`Re-short of the unsold ${reShort} ${sym} FAILED: ${errMsg(e)} — unhedged spot on ${spotExch}, MANUAL ACTION REQUIRED`);
                 }
             }
-            catch (verifyErr) {
-                closeWarnings.push(`Close verification failed: ${verifyErr instanceof Error ? verifyErr.message : String(verifyErr)}`);
-            }
-            if (closeWarnings.length > 0 && !isJson()) {
-                for (const w of closeWarnings) {
-                    console.log(chalk.yellow(`  ⚠ ${w}`));
+            else if (nakedShort > 0) {
+                // Spot sold more than the perp bought back: reduce the short to the spot left (no naked short).
+                const reduce = fillSizeString(nakedShort, closeDec);
+                try {
+                    const rd = await placePerpVerified(perpAdapter, perpExch, sym, "buy", reduce, { reduceOnly: true });
+                    const reduced = fillSizeString(rd.filledSize, closeDec);
+                    shortLeft -= Number(reduced);
+                    // A partial reduce (accepted partial fill) leaves part of the short naked.
+                    if (Number(reduced) < Number(reduce))
+                        closeWarnings.push(`Perp reduce on ${perpExch} filled ${reduced} of ${reduce} ${sym} — ${fillSizeString(Number(reduce) - Number(reduced), closeDec)} short naked, MANUAL CLOSE REQUIRED`);
+                }
+                catch (e) {
+                    if (isOutcomeUnknown(e))
+                        perpUnknown = `perp reduce of ${reduce} ${sym} on ${perpExch} outcome unknown: ${errMsg(e)}`;
+                    else
+                        closeWarnings.push(`Perp still short ${fillSizeString(shortLeft, closeDec)} ${sym} on ${perpExch} while ${soldStr} spot was sold (${errMsg(e)}) — MANUAL CLOSE REQUIRED`);
                 }
             }
-            // Remove from state
-            persistRemovePosition(sym);
+        }
+        if (spotPending) {
+            closeWarnings.push(`Spot sell PENDING (${errMsg(spotResult.reason)}) — outcome unknown, do NOT resubmit; verify ${spotDef.id} spot balance and the ${perpExch} short manually`);
+        }
+        if (perpUnknown !== null) {
+            closeWarnings.push(`${perpUnknown} — do NOT resubmit; verify the ${perpExch} short and ${spotDef.id} spot balance manually`);
+        }
+        if (spotPending || perpUnknown !== null || closeWarnings.some(w => w.includes("MANUAL"))) {
+            // Persisted globally: bots, the daemon and later arb runs leave the symbol alone.
+            quarantineSymbol("arb-close", sym, `arb close spot:${spotExch}: ${spotPending || perpUnknown !== null ? closeWarnings.filter(w => w.includes("PENDING") || w.includes("unknown")).join("; ") : closeWarnings.join("; ")}`, `Check ${sym} on ${spotDef.id} spot (perp -e ${spotDef.id} trade spot-balance / spot-orders) and the ${perpExch} perp (perp -e ${perpExch} positions)`, (m) => console.error(m));
+        }
+        if (perpUnknown !== null) {
+            // Stop: the perp position is unknown, so neither the stored legs nor the proceeds are touched.
             logExecution({
                 type: "arb_close", exchange: `spot:${spotExch}+${perpExch}`,
-                symbol: sym, side: "exit", size: closeSize,
-                status: closeVerified ? "success" : "unverified", dryRun: false,
-                meta: { mode: "spot-perp", ...(closeWarnings.length > 0 && { warnings: closeWarnings }) },
+                symbol: sym, side: "exit", size: soldStr,
+                status: "failed", dryRun: false,
+                error: `${perpUnknown} — MANUAL CHECK REQUIRED`,
+                meta: { mode: "spot-perp", requestedSize: closeSize, spotSold: sold, spotPending, perpPending: true, warnings: closeWarnings },
             });
-            // Return spot USDC proceeds back to perp account
-            if (spotExch === "lighter") {
-                try {
-                    const ltSpot = spotAdapter;
-                    const bals = await ltSpot.getSpotBalances();
-                    const usdcBal = bals.find(b => b.token === "USDC");
-                    const leftover = Number(usdcBal?.available ?? 0);
-                    if (leftover > 0.01) {
-                        await ltSpot.transferUsdcToPerp(leftover);
-                        if (!isJsonFn())
-                            console.log(chalk.gray(`  Returned ~$${leftover.toFixed(2)} USDC spot→perp on Lighter`));
-                    }
-                }
-                catch { /* non-critical */ }
-            }
-            else if (spotExch === "hyperliquid") {
-                try {
-                    const hlSpot = spotAdapter;
-                    const bals = await hlSpot.getSpotBalances();
-                    const usdcBal = bals.find(b => b.token.startsWith("USDC"));
-                    const leftover = Number(usdcBal?.available ?? 0);
-                    if (leftover > 1) {
-                        await hlSpot.transferUsdcToPerp(Math.floor(leftover));
-                    }
-                }
-                catch { /* non-critical */ }
-            }
-            const closeResult = {
-                status: closeVerified ? "closed" : "closed_unverified",
-                mode: "spot-perp", symbol: sym, size: closeSize,
-                ...(closeWarnings.length > 0 && { warnings: closeWarnings }),
+            const result = {
+                status: "perp_pending", mode: "spot-perp", symbol: sym,
+                spotSold: soldStr, spotPending, perpError: perpUnknown, warnings: closeWarnings,
+                remediation: `Perp order outcome unknown — do NOT resubmit. Check: perp -e ${perpExch} positions; perp -e ${spotDef.id} trade spot-balance`,
             };
             if (isJsonFn())
-                return printJson(jsonOk(closeResult));
-            if (closeVerified) {
-                console.log(chalk.green(`  CLOSED (verified): ${sym} ${closeSize} units`));
+                return printJson(jsonOk(result));
+            for (const w of closeWarnings)
+                console.log(chalk.red.bold(`  ${w}`));
+            console.log(chalk.red.bold(`  PERP ORDER PENDING — close stopped; spot ${spotPending ? "PENDING" : `sold ${soldStr}`}. ${sym} quarantined.\n`));
+            return;
+        }
+        shortLeft = Number(fillSizeString(Math.max(0, shortLeft), closeDec));
+        const fullyClosed = perpOk && sold > 0 && Number(soldStr) >= Number(closeSize) && shortLeft === 0 && !spotPending;
+        if (fullyClosed) {
+            persistRemovePosition(networkOf(program), sym);
+        }
+        else if (!spotPending && (shortLeft > 0 || spotLeft > 0)) {
+            // Persist the legs that remain (actual sizes).
+            persistUpdatePosition(networkOf(program), sym, { longSize: spotLeft, shortSize: shortLeft });
+        }
+        // Return spot quote proceeds back to perp account (no-op when shared with perp)
+        if (sold > 0) {
+            try {
+                const moved = await sweepSpotQuoteToPerp(spotAdapter, 0.01, { keep: preCloseQuote, max: null });
+                if (moved > 0 && !isJsonFn())
+                    console.log(chalk.gray(`  Returned ~$${moved.toFixed(2)} spot→perp on ${spotDef.displayName}`));
             }
-            else {
-                console.log(chalk.yellow(`  CLOSED (unverified): ${sym} ${closeSize} units — check positions manually`));
+            catch (e) {
+                closeWarnings.push(`Spot→perp transfer of proceeds failed (funds remain in ${spotDef.id} spot): ${errMsg(e)}`);
             }
-            console.log(chalk.green(`    SPOT  ${spotExch}: sold ✓`));
+        }
+        logExecution({
+            type: "arb_close", exchange: `spot:${spotExch}+${perpExch}`,
+            symbol: sym, side: "exit", size: soldStr,
+            status: fullyClosed ? "success" : "failed", dryRun: false,
+            meta: { mode: "spot-perp", requestedSize: closeSize, spotSold: sold, perpOk, spotPending, shortLeft, spotLeft, ...(closeWarnings.length > 0 && { warnings: closeWarnings }) },
+        });
+        const closeResult = {
+            status: fullyClosed ? "closed" : spotPending ? "spot_pending" : "partial_close",
+            mode: "spot-perp", symbol: sym, size: closeSize,
+            spotSold: soldStr, perpClosed: perpOk,
+            spotError: spotResult.status === "rejected" ? errMsg(spotResult.reason) : null,
+            perpError: perpResult.status === "rejected" ? errMsg(perpResult.reason) : null,
+            remaining: { spot: spotLeft, perpShort: shortLeft },
+            ...(closeWarnings.length > 0 && { warnings: closeWarnings }),
+        };
+        if (isJsonFn())
+            return printJson(jsonOk(closeResult));
+        for (const w of closeWarnings)
+            console.log(chalk.yellow(`  ⚠ ${w}`));
+        if (fullyClosed) {
+            console.log(chalk.green(`  CLOSED: ${sym} ${closeSize} units`));
+            console.log(chalk.green(`    SPOT  ${spotExch}: sold ${soldStr} ✓`));
             console.log(chalk.green(`    PERP  ${perpExch}: bought (closed short) ✓\n`));
         }
         else {
-            const errors = [];
-            if (!spotOk)
-                errors.push(`Spot sell failed: ${spotResult.reason}`);
-            if (!perpOk)
-                errors.push(`Perp buy failed: ${perpResult.reason}`);
-            const result = { status: "partial_close", symbol: sym, spotOk, perpOk, errors };
-            if (isJsonFn())
-                return printJson(jsonOk(result));
-            console.log(chalk.red(`  Close partially failed:`));
-            for (const e of errors)
-                console.log(chalk.red(`    ${e}`));
-            console.log(chalk.yellow(`  Manual intervention may be needed.\n`));
+            console.log(chalk.red(`  Close incomplete: spot sold ${soldStr} of ${closeSize}, perp ${perpOk ? "closed" : "NOT closed"}`));
+            if (closeResult.spotError)
+                console.log(chalk.red(`    SPOT: ${closeResult.spotError}`));
+            if (closeResult.perpError)
+                console.log(chalk.red(`    PERP: ${closeResult.perpError}`));
+            console.log(chalk.yellow(`  Remaining: spot ${spotLeft} / perp short ${shortLeft}\n`));
         }
     };
     // ── arb pnl logic (extracted as inner function, no command registration) ──
@@ -2493,9 +2846,77 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
         const gradeOrder = { A: 0, B: 1, C: 2, D: 3 };
         const minGradeIdx = gradeOrder[opts.minGrade.toUpperCase()] ?? 2;
         const intervalMs = parseInt(opts.interval) * 1000;
-        // Check both subcommand option and global/argv (Commander may route --dry-run to parent)
-        const dryRun = !!opts.dryRun || process.argv.includes("--dry-run");
+        // Root --dry-run flag (never re-declared on the subcommand — the root would swallow it).
+        const dryRun = isDryRun(program);
         const openPositions = [];
+        // Consecutive definite close failures per underlying (quarantined at MAX_PAIR_CLOSE_FAILURES)
+        const dexCloseFailures = new Map();
+        const net = networkOf(program);
+        const qlog = (m) => console.error(chalk.red(m));
+        if (!dryRun) {
+            // A previous daemon that died between two legs → quarantine (legs may be open).
+            quarantineOrphanedEntries(net, "arb-dex-auto", qlog);
+            // Positions live only in memory: a restart re-reads what is held on the dexes, so a
+            // held underlying is managed (closed when the spread converges), never re-entered.
+            // Unpaired / size-mismatched legs are quarantined. An unreadable dex → not started.
+            const assets = await fetchAllDexAssets();
+            const pairsNow = findDexArbPairs(assets, { minAnnualSpread: 0, includeNative: true });
+            const legs = new Map();
+            for (const dex of [...new Set(assets.map(a => a.dex))]) {
+                let list;
+                try {
+                    list = await (await getHLAdapterForDex(dex)).getPositions();
+                }
+                catch (e) {
+                    throw new PerpError("EXCHANGE_ERROR", `arb auto --hip3: ${dex} positions unreadable at start (${e instanceof Error ? e.message : String(e)}) — not started (held pairs unknown)`, {
+                        exchange: "hyperliquid", remediation: `Check connectivity (perp -e hyperliquid account positions), then restart`,
+                    });
+                }
+                for (const p of list) {
+                    const size = Math.abs(Number(p.size));
+                    if (!(size > 0))
+                        continue;
+                    const raw = p.symbol.toUpperCase();
+                    const asset = assets.find(a => a.dex === dex && (a.raw.toUpperCase() === raw || (dex === "hl" && a.base.toUpperCase() === raw)))
+                        ?? assets.find(a => a.raw.toUpperCase() === raw);
+                    const assetRaw = asset?.raw ?? p.symbol;
+                    const pairOf = pairsNow.find(x => x.long.raw === assetRaw || x.short.raw === assetRaw);
+                    // One entry per venue symbol (a native read that also lists HIP-3 positions is not counted twice).
+                    legs.set(assetRaw.toUpperCase(), {
+                        dex: asset?.dex ?? dex, raw: assetRaw, base: asset?.base ?? raw, side: p.side, size, sizeStr: p.size.replace(/^-/, ""),
+                        underlying: pairOf?.underlying ?? quarantineKey(asset?.base ?? raw),
+                    });
+                }
+            }
+            const all = [...legs.values()];
+            const used = new Set();
+            for (const l of all) {
+                if (l.side !== "long" || used.has(l))
+                    continue;
+                const sh = all.find(x => !used.has(x) && x.side === "short" && x.underlying === l.underlying && x.dex !== l.dex && x.size === l.size);
+                if (sh === undefined)
+                    continue;
+                used.add(l);
+                used.add(sh);
+                openPositions.push({ underlying: l.underlying, longDex: l.dex, longSymbol: l.raw, shortDex: sh.dex, shortSymbol: sh.raw, size: l.sizeStr, entrySpread: 0, entryTime: new Date().toISOString(), longPrice: 0, shortPrice: 0 });
+            }
+            const leftover = new Map();
+            for (const l of all)
+                if (!used.has(l))
+                    leftover.set(l.underlying, [...(leftover.get(l.underlying) ?? []), l]);
+            for (const [u, group] of leftover) {
+                if (isQuarantined(u, qlog))
+                    continue;
+                const desc = group.map(l => `${l.side} ${l.sizeStr} ${l.raw}`).join(", ");
+                const mismatched = group.some(l => l.side === "long") && group.some(l => l.side === "short");
+                quarantineSymbol("arb-dex-auto", u, mismatched ? `recovery: ${u} long/short sizes do not match (${desc}) — not tracked as a pair` : `recovery: unpaired ${u} leg (${desc}) — no hedge found, not tracked`, `Check ${u} on Hyperliquid (perp -e hyperliquid account positions; every HIP-3 dex); close or re-hedge by hand, then: perp strategy quarantine-clear ${u}`, qlog);
+            }
+            if (openPositions.length > 0 && !isJson()) {
+                console.log(chalk.yellow(`  Recovered ${openPositions.length} pair(s) from the dexes: ${openPositions.map(p => `${p.underlying} ${p.longDex}/${p.shortDex} ${p.size}`).join(", ")}`));
+            }
+        }
+        // Graceful stop: the leg sequence in flight finishes, nothing new starts, then exit.
+        const stop = gracefulStop("arb auto --hip3");
         if (!isJson()) {
             console.log(chalk.cyan.bold("\n  HIP-3 Cross-Dex Arb Bot\n"));
             console.log(`  Mode:          ${dryRun ? chalk.yellow("DRY RUN") : chalk.green("LIVE")}`);
@@ -2517,6 +2938,8 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                 const now = new Date().toLocaleTimeString();
                 // Check close conditions
                 for (let i = openPositions.length - 1; i >= 0; i--) {
+                    if (stop.requested())
+                        break; // stopping: no new close sequence
                     const pos = openPositions[i];
                     // Find current pair for this position
                     const current = pairs.find(p => p.underlying === pos.underlying &&
@@ -2524,6 +2947,9 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             (p.long.dex === pos.shortDex && p.short.dex === pos.longDex)));
                     const currentSpread = current?.annualSpread ?? 0;
                     if (currentSpread <= closeSpread || !current) {
+                        // Quarantined (design §12.3): hands off until a human clears it.
+                        if (isQuarantined(pos.underlying, (m) => console.error(chalk.red(m))))
+                            continue;
                         const reason = !current ? "pair disappeared" : `spread ${currentSpread.toFixed(1)}% <= ${closeSpread}%`;
                         if (!isJson())
                             console.log(chalk.yellow(`  ${now} CLOSE ${pos.underlying} — ${reason}`));
@@ -2531,18 +2957,46 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             try {
                                 const longAdapter = await getHLAdapterForDex(pos.longDex);
                                 const shortAdapter = await getHLAdapterForDex(pos.shortDex);
-                                await Promise.all([
-                                    longAdapter.marketOrder(pos.longSymbol, "sell", pos.size),
-                                    shortAdapter.marketOrder(pos.shortSymbol, "buy", pos.size),
-                                ]);
-                                logExecution({
-                                    type: "arb_close", exchange: `${pos.longDex}+${pos.shortDex}`,
-                                    symbol: pos.underlying, side: "close", size: String(pos.size),
-                                    status: "success", dryRun: false,
-                                    meta: { longDex: pos.longDex, shortDex: pos.shortDex, reason, longSymbol: pos.longSymbol, shortSymbol: pos.shortSymbol },
+                                // Sequential, reduce-only, verified; unknown / unhedged → quarantine.
+                                const res = await closePerpPairVerified({
+                                    source: "arb-dex-auto", sym: pos.underlying,
+                                    longAdapter, longExch: pos.longDex, longSym: pos.longSymbol, longSize: pos.size,
+                                    shortAdapter, shortExch: pos.shortDex, shortSym: pos.shortSymbol, shortSize: pos.size, smart: false,
+                                    log: (m) => console.error(chalk.red(m)),
                                 });
-                                if (!isJson())
-                                    console.log(chalk.green(`  ${now} CLOSED ${pos.underlying} — both legs`));
+                                if (res.status === "closed") {
+                                    dexCloseFailures.delete(pos.underlying);
+                                    logExecution({
+                                        type: "arb_close", exchange: `${pos.longDex}+${pos.shortDex}`,
+                                        symbol: pos.underlying, side: "close", size: String(pos.size),
+                                        status: "success", dryRun: false,
+                                        meta: { longDex: pos.longDex, shortDex: pos.shortDex, reason, longSymbol: pos.longSymbol, shortSymbol: pos.shortSymbol },
+                                    });
+                                    if (!isJson())
+                                        console.log(chalk.green(`  ${now} CLOSED ${pos.underlying} — both legs (reduce-only, verified)`));
+                                    openPositions.splice(i, 1);
+                                }
+                                else {
+                                    let note = res.reason;
+                                    if (res.status === "failed") {
+                                        const n = (dexCloseFailures.get(pos.underlying) ?? 0) + 1;
+                                        dexCloseFailures.set(pos.underlying, n);
+                                        note = `${res.reason} — both legs still open (${n}/${MAX_PAIR_CLOSE_FAILURES})`;
+                                        if (n >= MAX_PAIR_CLOSE_FAILURES) {
+                                            quarantinePair("arb-dex-auto", pos.underlying, pos.longDex, pos.shortDex, `close failed ${n} times in a row (last: ${res.reason})`, (m) => console.error(chalk.red(m)));
+                                        }
+                                    }
+                                    logExecution({
+                                        type: "arb_close", exchange: `${pos.longDex}+${pos.shortDex}`,
+                                        symbol: pos.underlying, side: "close", size: String(pos.size),
+                                        status: "failed", dryRun: false,
+                                        error: res.status === "quarantined" ? `QUARANTINED: ${note}` : note,
+                                        meta: { longDex: pos.longDex, shortDex: pos.shortDex },
+                                    });
+                                    if (!isJson())
+                                        console.error(chalk.red(`  ${now} CLOSE ${res.status === "quarantined" ? "QUARANTINED" : "FAILED"} ${pos.underlying}: ${note}`));
+                                    // Kept tracked: exposure remains (retried only after a definite, no-change failure).
+                                }
                             }
                             catch (err) {
                                 logExecution({
@@ -2553,15 +3007,19 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                                     meta: { longDex: pos.longDex, shortDex: pos.shortDex },
                                 });
                                 if (!isJson())
-                                    console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.underlying}: ${err instanceof Error ? err.message : err}`));
+                                    console.error(chalk.red(`  ${now} CLOSE FAILED ${pos.underlying}: ${err instanceof Error ? err.message : err} (nothing sent)`));
                             }
                         }
-                        openPositions.splice(i, 1);
+                        else {
+                            openPositions.splice(i, 1);
+                        }
                     }
                 }
                 // Check entry conditions
                 if (openPositions.length < maxPositions) {
                     for (const pair of pairs) {
+                        if (stop.requested())
+                            break; // stopping: no new entries
                         if (openPositions.some(p => p.underlying === pair.underlying))
                             continue;
                         if (openPositions.length >= maxPositions)
@@ -2572,35 +3030,73 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             continue;
                         if (gradeOrder[pair.viability] > minGradeIdx)
                             continue;
+                        if (isQuarantined(pair.underlying, (m) => console.error(chalk.red(m))))
+                            continue;
                         // Calculate size in asset units
                         const avgPrice = (pair.long.markPrice + pair.short.markPrice) / 2;
                         if (avgPrice <= 0)
                             continue;
                         const szDecimals = Math.min(pair.long.szDecimals, pair.short.szDecimals);
                         const rawSize = sizeUsd / avgPrice;
-                        const size = rawSize.toFixed(szDecimals);
+                        const size = fillSizeString(rawSize, szDecimals); // floored
+                        if (!(Number(size) > 0))
+                            continue;
                         if (!isJson()) {
                             console.log(chalk.green(`  ${now} ENTER ${pair.underlying} — spread ${pair.annualSpread.toFixed(1)}% grade:${pair.viability} OI:$${formatUsd(pair.minOiUsd)}` +
                                 `\n         Long ${pair.long.dex}:${pair.long.base} (${(pair.long.fundingRate * 100).toFixed(4)}%)` +
                                 ` | Short ${pair.short.dex}:${pair.short.base} (${(pair.short.fundingRate * 100).toFixed(4)}%)` +
                                 ` | ${size} units @ $${avgPrice.toFixed(2)}`));
                         }
+                        let openedSize = size;
                         if (!dryRun) {
+                            // Pending-entry record BEFORE the first leg (crash between legs → quarantine at the next start).
+                            try {
+                                writePendingEntry(net, { source: "arb-dex-auto", symbol: pair.underlying, longExchange: pair.long.dex, shortExchange: pair.short.dex, size });
+                            }
+                            catch (e) {
+                                if (!isJson())
+                                    console.error(chalk.red(`  ${now} SKIP ${pair.underlying}: could not record the pending entry (${e instanceof Error ? e.message : String(e)}) — nothing sent`));
+                                continue;
+                            }
+                            let legsStarted = false;
                             try {
                                 const longAdapter = await getHLAdapterForDex(pair.long.dex);
                                 const shortAdapter = await getHLAdapterForDex(pair.short.dex);
-                                await Promise.all([
-                                    longAdapter.marketOrder(pair.long.raw, "buy", size),
-                                    shortAdapter.marketOrder(pair.short.raw, "sell", size),
-                                ]);
+                                // Sequential verified legs; reduce-only rollback / trim; unknown → quarantine.
+                                legsStarted = true;
+                                const res = await openPerpPairVerified({
+                                    source: "arb-dex-auto", sym: pair.underlying,
+                                    longAdapter, longExch: pair.long.dex, longSym: pair.long.raw,
+                                    shortAdapter, shortExch: pair.short.dex, shortSym: pair.short.raw,
+                                    size, smart: false, log: (m) => console.error(chalk.red(m)),
+                                });
+                                legsStarted = false; // outcome known
+                                if (res.status !== "opened") {
+                                    finishPendingEntry(net, "arb-dex-auto", pair.underlying, qlog);
+                                    const error = res.status === "quarantined"
+                                        ? `QUARANTINED: ${res.reason} (possible exposure: ${res.exposure})`
+                                        : `${res.reason}${res.rolledBack !== null ? ` — long ${res.rolledBack} rolled back` : ""}`;
+                                    logExecution({
+                                        type: "arb_entry", exchange: `${pair.long.dex}+${pair.short.dex}`,
+                                        symbol: pair.underlying, side: "entry", size,
+                                        status: "failed", dryRun: false, error,
+                                        meta: { longDex: pair.long.dex, shortDex: pair.short.dex, spread: pair.annualSpread },
+                                    });
+                                    if (!isJson())
+                                        console.error(chalk.red(`  ${now} ENTRY FAILED ${pair.underlying}: ${error}`));
+                                    continue;
+                                }
+                                openedSize = res.hedged;
+                                // Tracked in memory below (synchronously, before anything else can throw); a restart recovers it from the dexes.
+                                finishPendingEntry(net, "arb-dex-auto", pair.underlying, qlog);
                                 logExecution({
                                     type: "arb_entry", exchange: `${pair.long.dex}+${pair.short.dex}`,
-                                    symbol: pair.underlying, side: "entry", size,
+                                    symbol: pair.underlying, side: "entry", size: res.hedged,
                                     status: "success", dryRun: false,
-                                    meta: { longDex: pair.long.dex, shortDex: pair.short.dex, spread: pair.annualSpread, viability: pair.viability, avgPrice },
+                                    meta: { longDex: pair.long.dex, shortDex: pair.short.dex, spread: pair.annualSpread, viability: pair.viability, avgPrice, requested: size },
                                 });
                                 if (!isJson())
-                                    console.log(chalk.green(`  ${now} FILLED ${pair.underlying} — both legs`));
+                                    console.log(chalk.green(`  ${now} FILLED ${pair.underlying} — both legs @ ${res.hedged} (verified)`));
                             }
                             catch (err) {
                                 logExecution({
@@ -2610,8 +3106,13 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                                     error: err instanceof Error ? err.message : String(err),
                                     meta: { longDex: pair.long.dex, shortDex: pair.short.dex, spread: pair.annualSpread },
                                 });
+                                if (legsStarted) {
+                                    // Threw inside the leg sequence: what is open is unknown → quarantine (never retried).
+                                    quarantinePair("arb-dex-auto", pair.underlying, pair.long.dex, pair.short.dex, `entry threw mid-sequence (${err instanceof Error ? err.message : String(err)}) — legs may be open`, qlog);
+                                }
+                                finishPendingEntry(net, "arb-dex-auto", pair.underlying, qlog);
                                 if (!isJson())
-                                    console.error(chalk.red(`  ${now} ENTRY FAILED ${pair.underlying}: ${err instanceof Error ? err.message : err}`));
+                                    console.error(chalk.red(`  ${now} ENTRY FAILED ${pair.underlying}: ${err instanceof Error ? err.message : err}${legsStarted ? " (quarantined)" : " (nothing sent)"}`));
                                 continue;
                             }
                         }
@@ -2621,7 +3122,7 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                             longSymbol: pair.long.raw,
                             shortDex: pair.short.dex,
                             shortSymbol: pair.short.raw,
-                            size,
+                            size: openedSize,
                             entrySpread: pair.annualSpread,
                             entryTime: new Date().toISOString(),
                             longPrice: pair.long.markPrice,
@@ -2650,9 +3151,15 @@ export function registerArbAutoCommands(program, getAdapterForExchange, isJson,
                     console.error(chalk.gray(`  Error: ${err instanceof Error ? err.message : String(err)}`));
             }
         };
-        await cycle();
-        setInterval(cycle, intervalMs);
-        await new Promise(() => { }); // keep alive
+        // Serialized cycles (never overlapping): the next starts only after this one finished.
+        while (!stop.requested()) {
+            await cycle();
+            await interruptibleSleep(intervalMs, stop.requested);
+        }
+        stop.dispose();
+        if (!isJson())
+            console.log(chalk.yellow(`\n  HIP-3 daemon stopped (current cycle finished). ${openPositions.length} pair(s) left open: ${openPositions.map(p => `${p.underlying} ${p.longDex}/${p.shortDex}`).join(", ") || "none"}\n`));
+        process.exit(0);
     }
     // Expose inner handlers for external use
     handleArbPnlRef = _handleArbPnl;