Changelog

All notable changes to this project will be documented in this file.

[1.6.11] - 2026-10-02 - AMA-Slope Persistence Gate, PnL HTML Report & Fill Cache, Five Order-Engine Safety Fixes

2026-10-02

• Feat(market-adapter): gate AMA-slope resets behind a 3-bar persistence window and shorten the Huber lookback to 16 — two coupled default changes measured on a live 1h market-pair pool (docs/AMA_SLOPE_WINDOW.md). DYNAMIC_WEIGHT_AMA_LOOKBACK_BARS 20 → 16 buys a faster slope signal (AMA group delay 10 → 8 bars, reversal lag 22 → 20, range-tilt wrong-way 13.7% → 12.6%) at ~8% noisier bar-to-bar slope; a new persistence gate on the slope-delta reset trigger (trigger B) — AMA_SLOPE_PERSIST_ENABLED (true) + AMA_SLOPE_PERSIST_BARS (3) — requires 3 consecutive confirming bars in the same direction before the reset fires, absorbing the shorter window's extra noise. Net vs the old 20h/ungated default: resets −35% (1.45 → 0.95/day), whipsaw ~52% → ~17%, lag and tilt unchanged; the independent price/Drift trigger is unaffected. Per bot/market override via amaSlope.persistBars / amaSlope.persistEnabled; 1 = legacy fire-on-first-crossing (values < 1 fall through to the global default). The gate is mirrored everywhere the decision path is replayed so all consumers stay on one logic path: resolveAmaSlopePersistBars / advanceAmaSlopePersistence in the service (counters persist across restarts via normalizePersistedAmaSlopeDiagnostics and clear on every successful reset, bootstrap included), grid_reset_config resolves and exports slopePersistBars (same override chain), grid_reset_sim implements the gate and its panel prints persist K, and the backtests follow the production default unless pinned (the fitting harness gains an optional bandTilt hook). New tool analysis/trend_detection/backtest_ama_slope_huber.ts sweeps the lookback and reports lag, reset churn and noise metrics (--data required). Tests: new test_grid_reset_sim_gate.ts (K-bar latency, 1-bar blip filtered, direction flip restarts the counter) and testAmaSlopePersistenceGate; existing slope-trigger tests pinned to legacy (persistBars 1). Verified: tsc clean, 305/305 tests, browser bundle 40/40 (market_adapter/core/market_adapter_service.ts, analysis/tradingview/grid_reset_sim.ts, modules/constants.ts, docs/AMA_SLOPE_WINDOW.md, tests/test_grid_reset_sim_gate.ts).

• Refactor(ama): remove the two EMA filters and align research charts with the live engine — the AMA had accreted two independent EMA filters that both add lag to address noise the estimator now handles lag-free (the slope is a Huber-robust regression and small residuals are dead-banded): the live ama.erSmoothPeriod (an EMA over the raw Efficiency Ratio inside the AMA) and the research amaEmaSpan (--ema, a post-AMA input EMA in the dynamic-weight chart). Both are removed so the live engine and both research charts run one canonical 3-parameter Kaufman AMA. Live: ama.ts gains the 3-param constructor and drops erSmoothAlpha/effectiveER and the ER-smoothing convergence term from getAmaWarmupBars; AMA_ER_SMOOTH_FAST_PERIOD is dropped from constants.ts; market_adapter.ts / market_adapter_service.ts / fetch_cex_synthetic_data.ts / log_format.ts drop the ER-smoothing resolution, warmup, payload fields and the /esN log suffix. Research: analyze_dynamic_weight.ts + dynamic_weight_chart_generator.ts drop the ema knob, its Raw reference line and --ema; bot_key_utils / resolve_source / grid_reset_config stop threading erSmoothPeriod. Two chart divergences from the live regime gate surfaced while verifying parity are also fixed: peNodes (the canonical key, not pNodes) is passed to bilinearInterpolate, and the per-bar multiplier is clamped to 1.0 with 3-decimal rounding before the absolute-threshold dead-band; the AMA clip threshold always comes from computeAmaSlopeClipThreshold, so changing the lookback with clip% = 0 no longer keeps a stale percentile cap. Configs still carrying ama.erSmoothPeriod are ignored (the default was 0, so no live behavior change in practice). Docs and tests updated. Verified: tsc clean, full suite 303 pass / 0 fail, browser bundle 40/40 (market_adapter/core/strategies/ama.ts, modules/constants.ts, analysis/analyze_dynamic_weight.ts, analysis/dynamic_weight_chart_generator.ts).

• Feat(analysis): research tooling and findings for the AMA-slope scale bias and lookback drawdown — two research surfaces, both default-preserving and production-untouched. Scale bias: the canonical estimator's robust scale is a plug-in 1.4826·MAD of the fit's own residuals, so with two fitted parameters it reads low by ~1/(bars−1) (~13% at 8 bars, ~7% at 16) and the effective Huber constant is ~1.25 at the 16-bar window, not the nominal 1.345; analysis/trend_detection/huber_scale_variants.ts adds three scale modes (none reproduces production byte-for-byte, df applies the sqrt(n/(n−2)) correction, mscale a Huber proposal-2 M-scale) plus an outlier-fraction diagnostic, exposed via --scale-mode on backtest_ama_slope_huber.ts. Measured: compensating is decision-neutral (wobble ≤0.2%, AMA lag unchanged, resets within ≤5%, wrong-way within noise) and trades away more robustness (~0.8% RMS under 10% contamination) than it recovers in efficiency (~0.4% clean), so production keeps the uncompensated plug-in scale; the DYNAMIC_WEIGHT_AMA_HUBER comment records this so the next reader does not "correct" it, and a guard test asserts none == computeHuberWindowSlopePct bar-for-bar. Lookback drawdown: simulatePersistentGrid gains params.lookbackBars and a --lookback flag (unset falls back to the centralized constant), and backtest_lookback_drawdown.ts runs paired persistent-grid comparisons across a lookback set over one geometry grid. Finding: the window has a real per-pool effect on realized drawdown and net capture but no stable sign across pools (16h beat 12h on a long-lived liquid pool, reversed on a shorter one), so it strengthens keeping the shipped 16h without converting it into a general economic proof. Both are documented in docs/AMA_SLOPE_WINDOW.md with reproduction commands. Behaviour: research-only; no production logic changed (one code comment). Verified: npm run build && npm run build:tests && node dist/tests/test_huber_scale_variants.js (analysis/trend_detection/huber_scale_variants.ts, analysis/trend_detection/backtest_lookback_drawdown.ts, docs/AMA_SLOPE_WINDOW.md).

• Feat(pnl): add a self-contained HTML PnL report and a per-account month-shard fill cache — dexbot pnl was terminal-only; a self-contained HTML report now renders per-pair 2×2 card blocks, a metrics grid and a collapsible realized-lot table (analysis/pnl_report.ts), wired through a thin scripts/pnl.ts entry and the dexbot pnl command. The analyzer gains --month (default 3), a --pair BASE/QUOTE filter and --html/--report, and its terminal output now shows Net inventory delta. Per-account fill_order fetches are cached in calendar-month shards (analysis/fills_cache.ts): settled months answer from disk, only the unsettled tail re-queries Kibana, and --refresh-account bypasses coverage while still merging. Account resolution checks local bot profiles before the chain (analysis/account_resolver.ts), and on-chain-resolved asset symbols are cached so pair filters work for non-static assets (analysis/fills_source.ts); PATHS.ANALYSIS.CACHE_DIR is added for the shard root. Doc updates: README, analysis/README, scripts/README, docs/README, docs/WORKFLOW, docs/EVOLUTION. Risk: the default lookback for the analyzer / analysis:trade-pnl changes from 7 days to 3 months. Verified: tsc root + tests clean; tests/test_pnl_report.ts, tests/test_fills_cache.ts, tests/test_trade_profitability_fees.ts, tests/test_paths.ts pass; dexbot pnl --help and bad-flag/missing-value paths exit correctly (analysis/pnl_report.ts, analysis/fills_cache.ts, scripts/pnl.ts, docs/WORKFLOW.md).

• Refactor(format): share the 4-significant-figure funds formatter and the month→hours helper — formatFundsValue lived privately in scripts/analyze-orders.ts and trimmed trailing zeros, so four valid digits rendered as "1.01K" instead of "1.010K", and the PnL report needed the same rule. It moves into modules/order/format.ts (keeps significant trailing zeros, still caps large magnitudes with K/M), and the fixed 730h/month lookback conversion shared by the chart and PnL commands is extracted into modules/utils/time_range.ts so they cannot disagree on --month N. Behavioral impact: dexbot order now keeps significant trailing zeros (e.g. 10000 → "10.00K", 1500000 → "1.500M"). No caller changes beyond the import; the format.ts TOC is realigned to its 15 exports. Verified: tsc root clean; tests/test_analyze_orders_dynamic_weight.ts and tests/test_dw_cli.ts pass (modules/order/format.ts, modules/utils/time_range.ts, scripts/analyze-orders.ts).

• Fix(order-engine): five order-engine and lifecycle safety fixes — (1) Stop could leave a live worker behind over the running orders (unlock.ts): stop returned as soon as the monolithic wrapper exited, but start's already-running guard only checks the supervisor pid file, which is wiped on wrapper exit, so a fast stop→start could spawn a SECOND worker trading the same live orders (duplicate trades); after the wrapper exits, stop now polls /proc up to 15s until no dexbot worker remains (best-effort/no-op off Linux). (2) Live bots.json changes did not take effect until the next fill or the 240-min fetch (modules/dexbot_maintenance_runtime.ts): config pickup logged "targeted maintenance will place missing / cancel excess orders" but never ran it; it now fires the targeted drift reconciliation immediately, fire-and-forget (same callee and cooldown as the poll tick, serialized via the fill-processing lock). (3) Live-but-slotless chain orders were invisible to fund accounting (modules/order/accounting.ts): an order resting on chain without a grid slot (out-of-grid/boundary-unknown deferral) locks real funds, but recalculateFunds counted only grid orders, so every orphan produced a fund-invariant violation equal to its size (triggering futile recovery resyncs) and sizing could double-spend the orphan-locked funds; unmatched chain orders are now added to the on-chain committed totals (chainBuy/chainSell) with type/size validation, grid totals unchanged. (4) An adopted orphan was then double-counted (modules/order/sync_engine.ts): with (3) counting orphans as committed, adopting one into a slot left the stale record in _lastUnmatchedChainOrders, so it was counted twice (slot + list); both success exits of adoptChainOrderIntoSlot and the createOrder materialize branch now prune the deferred-orphan record on adoption. (5) Freshly placed orders could be cancelled seconds after placement (modules/constants.ts, modules/order/utils/order.ts, modules/order/manager.ts): spread correction and surplus sweeps run on different count snapshots within one cycle, so a fill between them made the second controller cancel what the first had just placed (fee bleed, empty levels, no net change); a new 15-minute SURPLUS_CANCEL_GRACE_MS window timestamps placements (_placedAt) when a slot gains a new orderId, and surplus/cancel-only cancellations skip orders inside the window and leave them queued to re-drain after it expires, covering both the batched and serial cancel paths (the batch path bypasses the per-entry check, so the drain filters fresh placements before batching); load contexts ('grid-load'/'grid-init') are excluded so restarts do not suppress sweeps. Verified by tests/test_accounting_logic.ts and tests/test_surplus_cancel_grace.ts; npm test 309 files, 0 failures; tsc --noEmit clean (unlock.ts, modules/dexbot_maintenance_runtime.ts, modules/order/accounting.ts, modules/order/sync_engine.ts, modules/order/manager.ts, tests/test_surplus_cancel_grace.ts).

[1.6.10] - 2026-10-01 - Huber-Robust AMA Slope, Asset-Pair Canonicalization, TradingView Indicator Ownership & View Preservation

2026-10-01

• Feat(market-adapter): derive the AMA slope as a Huber-robust regression — the slope was a two-point endpoint estimate, (ama[i] - ama[i-lookback]) / ama[i-lookback] / lookback, so the window-edge bar carried full weight and one anomalous hour moved the reading as much as a tenth of the window; averaging the per-bar returns cannot help because their telescoping sum is algebraically identical to the endpoint difference. It is now a Huber-robust linear regression of ln(AMA) over the same window (uniform weights, no kernel), reported as log-return per bar × 100 — measured at a 20-bar window, a 1/3/5/10% single-bar AMA impulse moves the old endpoint reading by 0.050/0.150/0.250/0.499 %/bar (7×–70× the 0.0072 %/bar reset gate) while the bounded-influence fit barely moves, its second-difference energy ~25× lower than an order-statistic median's because its influence function is continuous rather than a discrete order statistic. Parameters live once in modules/constants.ts (MARKET_ADAPTER.DYNAMIC_WEIGHT_AMA_HUBER: C 1.345, 5 IRLS passes, scale floor 1e-6, zero epsilon 1e-9, aliased AMA_SLOPE_HUBER) and the definition once in dynamic_weight_series.ts (computeHuberWindowSlopePct), read by the dynamic-weight series, the AMA slope model, both clip paths, the grid-reset replay, the backtests and the browser charts (the generated HTML injects the same constant, so page and runtime cannot drift). Two fixes fall out of the shared definition: the estimator rejects non-positive values anywhere in the window (Number(null) === 0 made a pre-warmup hole read as a zero price and produce a bogus −100% return), and simulateGridResetSeries keeps its optional cfg.slopeEstimator seam defaulting to the canonical estimator, so the plotted tilt and the replayed Δs trigger measure one quantity by construction. Operational note: slopePct is a different quantity from any pre-Huber reading, so the first post-deploy cycle compares Huber against the persisted baseline; magnitudes agree closely (delta below the reset gate on 98% of bars, p50 0.00043, p90 0.00277), i.e. roughly one whitelisted bot in fifty costs one extra recenter, once, and no version marker suppresses it. Tests were converted, not weakened (geometric-ramp fixtures in place of the 0 %/bar order-statistic fixtures, a browser-execution guard asserting the generated estimator matches the Node module bar for bar). Validation: tsc src+tests clean, node dist/scripts/run-tests.js exit 0, verify:browser-bundle 40/40 (market_adapter/core/strategies/ama_slope_model.ts, market_adapter/core/strategies/dynamic_weight_series.ts, modules/constants.ts, analysis/tradingview/grid_reset_sim.ts, docs/GRID_RECALCULATION.md, tests/test_ama_slope_model.ts, tests/test_backtest_bot_fitting_logic.ts).

• Feat(asset-symbols): centralize uppercase canonicalization of asset pairs — BitShares stores symbols UPPERCASE but a node answers a lowercase lookup without error, so a mis-cased assetA/assetB is a silent-wrong-answer bug rather than a loud one: the lowercase spelling travels on into the resolved symbol, cache keys, Kibana query terms, chart titles and the exported HTML. Two real defects came out of this: dexbot tv/dw forwarded the raw CLI string as the asset symbol, and the market-profile lookup in analysis/bot_key_utils compared assetA/assetB with a strict ===, so a case-only difference between bots.json and market_profiles.json silently dropped the whole AMA/grid config. New modules/utils/asset_symbols.ts is the single definition of the rule (normalizeAssetSymbol/normalizeAssetRef, isAssetObjectId, isSameAssetSymbol, splitPairTarget, canonicalizeBotAssetSymbols); object ids (1.3.x) pass through verbatim so ref-routing callers keep their get_assets vs lookup_asset_symbols branch and only real symbols are rewritten. Applied at every boundary that accepts a pair from a human or hands a symbol to the chain (chain/order/system resolvers, the bot_settings.ts and bot_key_utils.ts read funnels sharing canonicalizeBotAssetSymbols, credit/credential cache keys, dexbot.ts collateral, scripts/{analyze-credit,chart_command}.ts, claw/modules/{claw_bridge,chain_queries}.ts), and de-duplicates the ad-hoc uppercase copies in optimizer_high_resolution.ts. Behavioral impact: a lowercase pair is normalized end to end, so assetA === 'BTS' checks, getBtsSide and market-profile matching behave identically for hand-edited lowercase bots.json; botKey is unaffected (createBotKey already ran the case-insensitive sanitizeKey) and no config file is rewritten. Coverage: tests/test_asset_symbol_normalization.ts (uppercase-on-the-wire at every boundary, id pass-through, non-mutation, debtPolicy handling, claw pair contract); npm test 300 pass / 0 fail, verify:browser-bundle 39 pass, tsc --noEmit clean for root and claw.

• Chore(market-adapter): raise the AMA-slope lookback default from 9 to 20 bars — measured over the real 1h pools, 20 vs 9 cuts the slope's bar-to-bar wobble ~34% and slope-driven grid resets ~19% at an unchanged band-tilt magnitude; the cost is freshness, with the window centre moving from ~4.5 to ~10 bars back. The whole 5–32 range was measured rather than guessed: noise and resets fall monotonically with the window and lag grows linearly, with no knee, so 20 is a deliberate point on a straight dial. Scope note: the constant is not only the grid-reset trigger window, it is also the default for the live dynamic-weight / grid-range-scaling slope (ama_slope_model.ts), so the directional weight shift follows the same longer average — a live trading behaviour change, not a reset-only change. Operational impact: readyBars = erPeriod + lookbackBars, so post-restart convergence is ~11 bars longer, and persisted slope snapshots are re-normalized through normalizePersistedAmaSlopeDiagnostics on the first cycle after restart — watch that first restart for one off-cycle Δs reset. The gitignored deployment override in profiles/general.settings.json was set to 20 as well, so the code default and the running config agree (modules/constants.ts).

• Fix(tradingview): share one AMA-slope lookback across the band and the reset replay — the chart resolved the slope window twice: computeRangeBand read the embedded constant (payload.rangeSlope.lookbackBars) while buildGridResetSeries passed the bot-configured gridSimCfg.lookbackBars (grid_reset_config had already resolved it from the bot's own amaSlope.lookbackBars), so a bot with its own lookback got it in the replayed Δs trigger but not in the plotted range band, silently misrepresenting the bot. Both now route through one resolveSlopeLookbackBars() that prefers the resolved grid-sim value and falls back to the embedded constant for pool/pair charts, which carry no grid-sim data. No UI change: the untilted band stays span-symmetric, the toolbar is unchanged, and the reset panel reports exactly what it did before. Chart-only, no runtime or bot behaviour change. Verified: typecheck + build:tests, tests/test_tradingview_chart_storage_key.ts (16 checks), and a local Firefox check that a bot-configured 32h lookback paints the independently computed 32h geometry rather than the constant's (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/README.md, tests/test_tradingview_chart_storage_key.ts).

• Fix(tradingview): keep the chart view when toggling Range / Scale — the Scale toggle cleared manualYRange and both toggles rerendered without keeping the X range, so the rerender's X restore fired the rAF price refit, which follows the band envelope (visiblePriceRange returns the band when Range + Scale + AMA are on); the price axis jumped to the band fit on set and back to the candle fit on unset though the data and the visible window were unchanged. New captureView()/preserveView(fn) snapshot X and Y, run the toggle, then re-assert X and restore Y through a one-shot pendingViewY applied inside the refit's own rAF after the autofit, so the refit cannot win the frame; Range on/off, Scale on/off and the grid-span slider are wrapped in preserveView(...). It deliberately does not set manualYRange, so a later X pan still autofits and a user price lock is respected; the band axis-fit lands on the next autofit (reload, timeframe switch, X pan) or a double-click of the price axis. Verified (Playwright, X/Y scale + axis-pixel diffs): both axes stay byte-identical across every toggle and a span-slider drag, and a manual Y lock still blocks the autofit. Risk: low — view behaviour only, no band/AMA/order-math change (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/README.md).

• Feat(tradingview): auto opt-in for Range/Scale and widen the span slider to 1.3x-2.1x — the band min/max are built from the live AMA price and Scale additionally sizes it by AMA slope, but the toggles were independent, so Scale-on with Range/AMA off produced a silently dead toggle (the draw hook and the axis fit both bail out on !currentAmaEnabled). New autoOptInAma() pushes the dependency one way (Range → AMA, Scale → Range + AMA; switching an indicator off never disables its dependencies) and returns whether AMA actually flipped, so the caller takes the AMA-toggle render path (rerender(false), series added) instead of the keep-view one; switching AMA off takes Range and Scale down with it, and the same chain is re-applied when hydrating localStorage state, so a chart saved with Scale on and AMA off cannot silently come back with a working AMA. Behavior note: a chart generated with --range or --range-scale plus --no-ama now renders the AMA line (that combination was already a dead band). The span slider range moves 1.2x-2.0x → 1.3x-2.1x (default 1.55x unchanged); the bounds, previously hardcoded in six places and already drifted once, are now RANGE_SPAN_MIN/MAX/DEFAULT at module scope interpolated into the generated page, so slider, tooltip and every clamp share one source of truth (the 0.05 step still lands exactly on 2.10). Verified: tsc --noEmit, the generated page's inline script through node --check, a slider/clamp spot-check in a regenerated chart (min="1.3" max="2.1"), tests/test_tradingview_chart_storage_key.ts (14 checks) (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/README.md).

• Refactor(tradingview): drop the Range/Scale/AMA on-off CLI flags — --range, --no-range, --range-scale and --no-ama only set indicator state that the in-chart toolbar owns and persists per chart (localStorage), so a chart regenerated with a different flag combination silently overrode the user's choice; worse, they could disagree (--no-ama with the range highlight on produced a dead band, since the band min/max are built from the AMA price). The four flags are gone from the config, the defaults, the parser and the payload in analyze_tradingview.ts — and no longer warn, since indicator state has exactly one owner. AMA stays auto-enabled for gridPrice ama/ama1-4 bots as before; only the manual override is gone. rangeEnabled/rangeScaleEnabled are pinned off at generation time (already their effective default) while the payload keys stay so state hydration keeps its shape. --range-span and --no-sma/--no-vwap are untouched: the span has a real generation-time default derived from the bot grid ratio, and the other two are plain switches for indicators with no dependencies. Docs: analysis/tradingview/README.md + analysis/README.md; historical CHANGELOG entries keep the old flags, since they record what those releases shipped. Verified: npx tsc --noEmit, a regenerated chart ignores the removed flags and renders the range/ama toggles unchecked with payload rangeEnabled/rangeScaleEnabled false, the inline script through node --check, tests/test_tradingview_chart_storage_key.ts (14 checks) (analysis/tradingview/analyze_tradingview.ts, analysis/tradingview/tradingview_uplot_chart_generator.ts).

[1.6.9] - 2026-09-30 - Market-Adapter Cycle CPU & Off-Hour Idle, Grid Spread-Tightening Correction

2026-09-29

• Perf(market-adapter): cut hourly cycle CPU via regime memo, incremental analyzers and a single AMA — the hourly cycle re-created both signal analyzers and replayed the whole candle history per bot per cycle (~99.8% identical numbers), re-ran calculateAMA four extra times per bot for an AMA1..AMA4 preset sweep that only fed a log line, and re-parsed ~250 KiB of candle JSON per bot per cycle that the process had just serialized itself. Measured on the production shape (capped sliding window): regime gate ~3.7 ms cold → 0.05–0.24 ms resumed (median 0.088 ms), cycle CPU ~155 ms → ~103 ms. The cross-cycle regime memo is keyed by <botKey>:<intervalSeconds> and resumes only when the incoming window ADVANCES the cached one (k leading bars dropped, m appended) with a leading-drop tolerance for the capped sliding window (a strict prefix check missed every steady-state cycle); exactness rests on the analyzers being rolling — resume requires the shared region to cover bufferBars (read from the analyzer instances, fails closed), so any verified alignment is exact by construction, and ambiguous/related-window mismatches, parameter changes and history rewrites all fall back to a cold recompute. Permutation entropy now keeps an incremental count map with factorial-number-system integer pattern keys (update() allocates nothing, O(1) per bar); Hurst uses preallocated rolling buffers and computeRS takes a [from, to) range instead of slicing ~30 arrays per bar. calcAmaComparison becomes buildAmaRecord, so the cycle reports the ONE AMA the bot trades on (resolved preset name + the already-computed value) instead of a 4-preset sweep; the persisted state.bots[key].amaComparison field keeps its key but holds a single entry (was four) — its only repo reader, the cycle log formatter, tolerates both shapes, and the log label changes AMA compare: → AMA active:. Config: market_adapter no longer honours ama.enabled; gridPrice is the only switch that makes a bot AMA-driven (the resolver previously disagreed with itself depending on whether a market profile matched, so a bot with ama.enabled: false kept trading while its published center froze) — no shipped bot sets the flag, and docs/GRID_RECALCULATION.md documents the single-switch rule plus the profile/keyword/defaultAmaKey/bot-block precedence. A write-through candle-JSON read cache (market_adapter/utils/file_json_cache.ts) is mtime/size-validated, consumed on read, and fails closed to the loader whenever the file cannot be stated. Coverage: a new entropy-equivalence suite (bar-by-bar equivalence vs verbatim pre-optimization reference algorithms, incl. sliding-window, alignment and ambiguity cases, all shown non-vacuous by defect re-injection), a file-JSON-cache suite, and AMA layering/precedence tests. Risk: the amaComparison shape change from four entries to one is verified to have no other repo consumer. Validation: 302/302 tests, tsc src+tests clean, browser bundle 39 passed (market_adapter/core/strategies/regime_gate.ts, market_adapter/core/signals/permutation_entropy_analyzer.ts, market_adapter/core/signals/hurst_analyzer.ts, market_adapter/market_adapter.ts, market_adapter/core/market_adapter_service.ts, market_adapter/utils/file_json_cache.ts, modules/constants.ts, docs/GRID_RECALCULATION.md, tests/test_market_adapter_entropy_equivalence.ts, tests/test_market_adapter_file_json_cache.ts, tests/test_market_adapter_logic.ts, tests/test_market_adapter_service.ts).

• Perf(market-adapter): skip off-hour work and sleep to the candle boundary — the adapter only has work once per closed candle, but a respawn ran a full cycle immediately and an extra cycle could re-fetch, re-parse and re-serialize the same ~250 KiB candle file for zero new information. A per-bot closed-candle gate now runs before the native overlap fetch, the Kibana stale-tail check and the re-serialize: when the persisted lastClosedCandleTs already equals the newest closed bucket and the candle file covers that bucket (source match, no unresolved gaps, AMA warmup target met), the cycle records lastCycleSource=off-hour-skip and returns. One-shot entry points (--once, runOnceForAma backing ama_signal_runner) are exempt so they always emit a computed AMA. Daemon startup now decides before connecting whether every active AMA bot is caught up, and if so sleeps to the same poll boundary the loop uses, otherwise runs a catch-up cycle; the verdict is per bot (never max-aggregated across bots), reports every veto reason with the offending bot keys, and treats a known warmup target with an unknown candle count as outstanding. Refactor with no behavior change: the candle-grid arithmetic is centralized as bucketStartMs/latestClosedBucketStartMs in interval_utils.ts (shared by sleepUntilAlignedBoundary, selectClosedCandles and the startup sleep), isCandleSourceMismatch is shared between the off-hour gate and the full-path cache reset, and evaluateStateRepairVeto is shared as the state-side mirror of candleFileCoversClosedBucket. The socket stays open only for a working cycle; between cycles the process holds just an unref'd lock heartbeat, and the startup wait is always shorter than one poll period so no candle is ever skipped. An off-hour-skip state record is a last-known snapshot: data fields keep the last full cycle's values, only lastCycleSource/lastCycleAt/pendingClosedCandle/lastTriggerSuppressedReason are refreshed. (market_adapter/market_adapter.ts, market_adapter/core/market_adapter_service.ts, market_adapter/interval_utils.ts, market_adapter/test_helpers.ts, market_adapter/README.md, tests/test_market_adapter_service.ts).

• Fix(grid): make spread correction tighten the spread instead of walking to the rail edge — spread correction chose candidates via a two-branch comparator (windowFirst on a live rail, edgeFirst otherwise) written as exact opposites, so on a SELL rail with a live window the branch sorted descending and correction picked the grid ceiling (BUY mirrored it at the rail floor). Neither placement moves bestBuy/bestSell, so the measured spread was unchanged and the next resync cancelled the orders as surplus. Both branches are replaced with one market-nearest comparator, and a spread-tightening guard anchors the placement to the live book: a SELL candidate must sit below the lowest live sell and a BUY above the highest live buy, using the same on-chain order set calculateCurrentSpread measures from (an empty rail has no anchor and stays open). The guard is the fix — the orphan pool is rail-wide, so market-nearest alone still resolves to the first empty slot past the live window; with the guard that pool empties, the promotion gate opens and the gap band is asked. Gap-band promotion candidates are now placed ahead of the rail pools, and a promotion that yields nothing names its binding constraint (stranding cap, spread reserve, no contiguous run) instead of skipping silently. Coverage: tests/test_spread_correction_market_nearest.ts (6 cases; 5 fail against pre-fix code, 1 passes both ways by design) (modules/order/grid.ts, tests/test_spread_correction_market_nearest.ts).

• Docs(agents): require an explicit user request before any version bump — an agent that treats "the work is done" as "ship a release" will bump package.json, retag and push on its own initiative, and worse will end every task by asking whether to bump; the ask is the failure mode, turning a finished change into a decision the operator has to make twice and training a reflex that fires whether or not a release is warranted. The rule is one line: never bump, never propose, never ask; the user alone decides. The existing three-step procedure stays, scoped to a turn where the bump was explicitly requested, and that request is also the authorization for the commits/tags it needs so a real release is not gated twice. Documentation only, no runtime change (AGENTS.md).

Version-notice hardening

The fix(version-notice) work committed after the 1.6.8 tag (real verdict from every entry point, staged dexbot stat status, npm-then-GitHub probe) is documented under [1.6.8]'s 2026-09-29 section above; no additional code change ships in 1.6.9.

[1.6.8] - 2026-09-28 - Correction-Drain Bounds, PM2 Log Capture, Version Notice, Genesis Refusal & Legacy Matcher Removal, TV Grid-Reset Replay & Packaging Trim

2026-09-29

• Fix(version-notice): one version check on every entry point, and never a silent one — the audit found the check was centralized but its rendering was not: dexbot stat fell back to a bare DEXBot2 vX.Y.Z header when the notice was switched off (DEXBOT_SKIP_VERSION_NOTICE=1 / UPDATER.NOTICE_ENABLED=false) while dexbot pm2 and unlock printed nothing at all, so on a node with the notice off the operator learned their build from one command and not the others; and pm2.ts exited 1 on a credential-daemon failure without awaiting the probe it had already started, discarding the answer it had paid for. The fallback is now the module's decision, not each entry point's: printVersionStatusOrHeader / flushVersionStatusOrHeader render the status line when there is one and the bare header when there is not, and printVersionStatusWhenReady (the non-awaited isolated-foreground path) uses the same contract, so stat, pm2, start, restart, stop and reload cannot disagree. printVersionStatus(null) stays a no-op for callers that only want the line. The pm2 failure path now flushes before exiting. maybePrintVersionStatus (zero callers since stat went staged) is REMOVED rather than left as a second entry path, and the dead intervalMs-ignored option now actually drives the success window. Behavioral impact: with the notice disabled, dexbot pm2/start/restart now name the running build where they previously printed nothing; no wording, colour or network behaviour changes when the notice is on (modules/version_notice.ts, dexbot.ts, pm2.ts, unlock.ts, tests/test_version_notice.ts).

• Feat(version-notice): stage the version verdict around the dexbot stat report, and say "no current version information" when the answer never arrives — a status command that shows a process table is the wrong place to block on the network, but printing the verdict inline under a short cap made a reachable registry read as "unknown", while deferring it unconditionally left a MISSING line that an operator can easily read as "you are up to date". startStagedVersionStatus now owns the escalation as two promises: a 1s grace (UPDATER.NOTICE_STAGE_GRACE_MS) at the top of the report, which a valid cache or a quick answer satisfies without the command ever noticing the wait; and a settled promise for the end, which gives the still-in-flight probe 1s more, then ASKS AGAIN with a forced, full-budget probe (UPDATER.NOTICE_STATUS_TIMEOUT_MS, 3s) — the first attempt may have failed fast or spent its share of the budget on a blocked source, and force matters because a cached FAILURE would otherwise be re-reported for the whole 15min backoff without a single request being made. When even that answers nothing, the verdict is the explicit ? No current version information (npm / github did not answer within 3000ms). — a distinct exhausted state, not a failed check: the inline launcher path (start/pm2, which never escalates) keeps the more specific "could not check (reason)" wording, and neither path may ever render an unknown answer as green. The total wait is ~4s, all of it at the bottom of the report, and the report costs at most 1s up front. case 'status' funnels every branch through one finish() so no early process.exit() can truncate the line (modules/version_notice.ts, dexbot.ts, modules/constants.ts, tests/test_version_notice.ts).

• Fix(version-notice): make the version probe answer instead of shrugging — a node that could not reach registry.npmjs.org reported ? Could not check for a newer version. forever, and a single unreachable host, a too-tight timeout or a 5s network hiccup were indistinguishable from each other and from "you are current". Four defects, one symptom: (1) ONE source was a single point of failure, so the probe now queries npm's dist-tag document FIRST and falls back to the GitHub latest-release endpoint, derived from UPDATER.REPOSITORY_URL (GITHUB_RELEASE_URL pins it, 'off' disables it, GITHUB_API_BASE retargets it at a mirror) — a host that cannot reach the registry now degrades to a slower probe instead of a permanent "unknown"; the total budget is split EVENLY across sources so a hanging first source cannot starve the fallback, and compareVersions strips a leading v so a v1.6.8 GitHub tag does not parse as an ancient version and masquerade as an available update. The npm-first order is deliberate and was benchmarked, not assumed: latency is a wash (warm p50 npm 21ms / github 18ms, cold 92-102ms / 97-99ms), npm's document is 5x smaller (8KB vs 40KB), the GitHub API is 60 req/hour per IP unauthenticated (403 when spent) while npm has no comparable ceiling, and decisively, the release pipeline creates the GitHub release ~4-9 minutes BEFORE it publishes to npm (1.6.8 10:15:14Z vs 10:24:00Z) — GitHub-first would advertise a version dexbot update cannot yet install, which is a wrong hint rather than an early one. (2) EVERY failure path now records WHY (ENOTFOUND, ECONNREFUSED, HTTP 403, timeout after Nms, no version in response, no fetch available) and the gray verdict names it, persisted in the cache so even a throttled run can explain itself; an unnamed "?" is not actionable. (3) A FAILURE was throttled for the full 24h NOTICE_INTERVAL_MS, so one transient outage pinned the "?" for a day with no retry left to disprove it — a success is still cached (UPDATER.NOTICE_INTERVAL_MS, now 12h rather than 24h: the published version does not move, but dexbot stat is the command an operator runs to ask "am I current?" and a 24h window let that answer come from the previous morning), a failure now backs off for UPDATER.NOTICE_RETRY_MS (15min), and DEXBOT_VERSION_CHECK_FORCE=1 bypasses the cache entirely as the diagnostic escape hatch. Every entry point consults the cache on every run; none of them re-probe on a timer of its own. (4) dexbot stat awaited the probe inline under a 750ms cap that a cold DNS + TLS handshake to the registry routinely exceeds; the probe is now STARTED at the top of the report and its verdict APPENDED at the end, so the process table is never delayed, the line can no longer be truncated by an early process.exit() (every branch in case 'status' now funnels through one finish() that flushes first), and the probe gets a real budget (UPDATER.NOTICE_STATUS_TIMEOUT_MS 6s) now that it is off the critical path. UPDATER.NOTICE_TIMEOUT_MS 2s → 4s for the same reason on the launcher path. dexbot stat then wraps the probe in the staged wait above. Behavioral impact: strictly more information and no new failure mode — the notice still never changes code, still never blocks a start beyond its bounded budget, and an unknown verdict is still never dressed up as "up to date". Risk: two requests instead of one when the first source fails (bounded by the same total budget), and a genuinely offline node now retries every 15min instead of once a day (modules/version_notice.ts, dexbot.ts, modules/config.ts, modules/constants.ts, docs/README.md, tests/test_version_notice.ts).

2026-09-26

• Fix(concurrency): bound the price-correction drain and keep timer lock-waiters out of long broadcast regions — correctAllPriceMismatches held _gridLock (no acquisition timeout) across every queued correction, running price updates sequentially with SYNC_DELAY_MS between each, so a large ordersNeedingPriceCorrection backlog could hold the lock for minutes while every concurrent actor died at the 20s fill-lock timeout. Cancel-class entries (duplicate orphans / surplus / type mismatch) are still fully drained — batched, zero-delay, fund-safety-critical — but the sequential update loop is now capped at FILL_PROCESSING.CORRECTION_MAX_UPDATES_PER_CYCLE (default 5); the unselected remainder stays queued durably and re-drains next cycle, keeping its queue position so newer entries cannot be starved. A rate-limited backlog alarm (CORRECTION_QUEUE_WARN_THRESHOLD default 10, CORRECTION_QUEUE_WARN_RATE_LIMIT_MS 5 min) fires even while the drain defers, which is exactly when the queue is growing. The drain also defers before acquiring _gridLock when isBroadcastingActive(), and the maintenance timer loops (open-orders sync, periodic blockchain fetch) get the same pre-acquire deferral via shouldDeferMaintenanceForBroadcast; that helper is age-bounded by BROADCAST_STALE_CLEAR_MS so a leaked broadcast flag still lets the periodic tick through to run _clearStaleBroadcastFlag (deferring on a stale flag would otherwise remove the only watchdog that clears it). TIMING.FILL_BROADCAST_DEFER_MAX_MS is now derived as max(configured, BROADCAST_STALE_CLEAR_MS + 30s) so a legitimately long startup reconcile Phase 2 cannot outlast the fill-consumer deferral and drop it into the in-lock wait, and the deferral bound re-arms whenever manager._broadcastingStartedAt advances (a live region) while a frozen flag still trips the fallback. Startup create-group execution yields to the event loop between groups (setTimeout(0), browser-safe) so the region's timers/watchdogs (region-end reschedule, _awaitBroadcastIdle, stale-flag clear) are not starved. Behavioral impact: a correction backlog no longer monopolizes _gridLock; fills/corrections still drain, bounded per cycle; the broadcast-deferral bound now outlasts the stale-flag watchdog it depends on; a leaked broadcast flag still self-heals. Risk: only the sequential price-update loop is budgeted, so a very large update backlog drains over multiple cycles (modules/order/utils/order.ts, modules/constants.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/order/grid_reconcile_internal.ts, modules/order/manager.ts, tests/test_correction_queue_staleness.ts, tests/test_fill_pipeline_robustness.ts, tests/test_lock_bypass_guards.ts).

• Refactor(concurrency): make the correction-drain bound time-based and harden the grid-lock/deferral invariants — CORRECTION_MAX_UPDATES_PER_CYCLE bounded a count while the invariant it protects is lock-hold duration (each update costs SYNC_DELAY_MS plus its RPC round-trip, which grows with chain congestion), so the default 5 could still hold _gridLock past the 20s fill-lock timeout on a slow chain. New FILL_PROCESSING.CORRECTION_LOCK_HOLD_BUDGET_MS (default 4000) is the primary bound: the sequential update loop stops pulling entries once the elapsed window closes, and CORRECTION_MAX_UPDATES_PER_CYCLE becomes an optional hard cap (default null = uncapped count; 0 = drain no updates). Cancel-class entries stay unbudgeted. AsyncLock.heldForMs() now exposes live hold duration and checkGridLockHoldDuration runs on every maintenance tick, emitting a rate-limited [GRID-LOCK] warn when _gridLock is held past TIMING.GRID_LOCK_HOLD_WARN_MS (default 15s) — observational only, because a mutating lock cannot be force-released safely. BROADCAST_STALE_CLEAR_MS is now the single authority for both deferral bounds: FILL_BROADCAST_DEFER_MAX_MS is derived as staleClear + TIMING.BROADCAST_DEFER_SAFETY_MARGIN_MS (named, default 30s) and a load-time check throws if the ordering invariant is ever violated (modules/constants.ts, modules/order/utils/order.ts, modules/order/async_lock.ts, modules/dexbot_maintenance_runtime.ts, tests/test_correction_queue_staleness.ts, tests/test_async_lock_force_release.ts, tests/test_lock_bypass_guards.ts).

• Fix(logging): restore PM2 log output — the Logger stacked two independent suppressions: it auto-quieted console output whenever PM2 log paths were present (quietUnderPm2 defaulted true) and skipped its own file writes under PM2, so every line from a PM2-managed bot, the credential daemon, and the module loggers was dropped (the content in profiles/logs/*.log came from non-PM2 runs; PM2's own out_files stayed empty). The constructor no longer auto-quiets: under PM2 stdout is the only sink and PM2's log_date_format supplies the timestamp, while non-PM2 runs with a logFile stay console-quiet to avoid duplicate output. quietUnderPm2: true remains as an explicit opt-in to the legacy silent behaviour, and new isPm2LogCaptureActive() centralizes the pm_out_log_path/pm_err_log_path predicate shared by the constructor and _enqueueWrite (modules/order/logger.ts, tests/test_logger.ts).

• Fix(pm2): enable real log rotation — PM2 core ignores the per-app max_size option, so PM2-owned log files were never rotated. The launcher now installs and configures pm2-logrotate (100M per file, retain 10, compressed) on first start; detection via pm2 jlist keeps it idempotent and the step is best-effort with timeouts so startup never blocks on a failed install. New runPm2Raw() covers the module-management verbs (jlist/install/set) that fall outside execPM2Command's process-control whitelist (pm2.ts, docs/LOGGING.md).

• Docs: close the changelog gaps and realign stale references - an audit of the 1.6.5..1.6.6 range found three shipped housekeeping commits documented nowhere (their entries are now filed under [1.6.6], whose title also gained the sweep), and the same staleness pass found published docs describing the pre-1.6.7 guard and the removed key-manager abort path instead of the shipped behaviour: docs/GRID_PRICE_INVARIANT.md now carries the pivot snapshot contract (persist with the grid, restore with the boundary, provenance gate, validation chain, generation invalidation), docs/CREDENTIAL_SECURITY.md states the cancellation contract (Escape is not a wrong password; a complete account key is a usable account, not password metadata), and docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md repoints the boundary invariants and phase statuses at the suites that hold the coverage today. Documentation only, no runtime change (CHANGELOG.md, docs/GRID_PRICE_INVARIANT.md, docs/CREDENTIAL_SECURITY.md, docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md, README.md).

• Feat(version-notice): announce newer DEXBot2 releases on start/pm2 — operators had no way to learn a newer release existed: UPDATER.ACTIVE defaults to false by design (a bot handling real funds must never silently change its own code) and the only version comparison lived in dexbot update. A passive, never-throwing notice now probes the npm registry once per UPDATER.NOTICE_INTERVAL_MS (24h) using a single bounded HTTPS GET (no npm subprocess), reports a newer latest on dexbot start/pm2/status, and never changes code. Gating is independent of the updater via UPDATER.NOTICE_ENABLED (default on); DEXBOT_SKIP_VERSION_NOTICE=1 silences it for tests/CI. The cache lives in profiles/version_check.json (gitignored, atomic write) and records the last probe, the observed latest, and the announced version. dexbot start/pm2 emit from the child launcher (parent/child relocation-notice convention); internal children stay silent (modules/version_notice.ts, dexbot.ts, pm2.ts, unlock.ts, modules/constants.ts, modules/paths.ts, tests/test_version_notice.ts).

• Fix(version-notice): latch notify-once only after the notice is displayed — the "announced" version was persisted as soon as the probe resolved, so a launcher path that returned without printing (the already-running race window, a startup failure before the success summary) could permanently suppress a hint the operator never saw. The probe now records the observation only; the single printVersionNotice path advances the latch, and the latch only ever moves forward so a registry briefly serving an older latest (dist-tag rollback) cannot make an announced version reappear. --dryrun no longer probes or writes the cache, the missed unlock.ts terminal flush is added, and the isolated-foreground launch path prints the notice without awaiting it so the bot start is never delayed. dexbot status caps the inline probe at UPDATER.NOTICE_STATUS_TIMEOUT_MS (750ms) instead of the 2s default. Hardening: path.join for install-kind detection, strict cache field types, and an overridable probe timeout. The probe's timeout is now a race-based hard backstop that resolves even with no AbortController or a fetch that ignores the abort signal, so a hung registry socket can never stall a terminal flushVersionNotice ahead of process.exit(); the await+print flush is centralized in the module rather than reimplemented in unlock.ts (modules/version_notice.ts, unlock.ts, pm2.ts, dexbot.ts, modules/constants.ts, tests/test_version_notice.ts).

• Feat(version-notice): report the installed-vs-published version in dexbot stat and on every start — the notice only spoke when a newer release existed, so an operator had no positive confirmation that the running build was current, and dexbot stat showed a bare DEXBot2 vX.Y.Z line with no verdict. The probe now returns a VersionStatus (up-to-date / update-available / unknown) instead of a notice-or-nothing, and ONE renderer (formatVersionStatusLine) paints it: green ✓ Your version is up to date. when the install matches the registry, orange ⬆ A new version is available: vX.Y.Z. when it does not, gray ? Could not check for a newer version. when the probe could not answer — an unknown probe is never dressed up as "up to date", because that is exactly the state in which a real update hides. A throttled run (probe already done inside NOTICE_INTERVAL_MS) now reports the state from the cached observation instead of returning nothing, so dexbot stat answers "am I current?" without spending a request, and an offline node still prints the installed version. The one-time dexbot update hint keeps its notify-once latch, so the orange line is shown on every start but the hint repeats only until it is displayed. Centralization: the probe (startVersionStatusCheck), the colour/wording (formatVersionStatusLine), the hint text and the latch live only in modules/version_notice.ts; unlock.ts, pm2.ts and dexbot.ts consume them and cannot drift. The old notice-only entry points (startVersionNoticeCheck, printVersionNotice) and the pre-rendered VersionNotice.message string are REMOVED rather than kept as adapters — they were a second copy of the same wording that only tests still read, which is how a start path and a status path end up disagreeing; the tests now assert on the lines the operator actually sees (modules/version_notice.ts, dexbot.ts, unlock.ts, pm2.ts, tests/test_version_notice.ts). dexbot stat falls back to the plain header when the check is disabled (DEXBOT_SKIP_VERSION_NOTICE=1/UPDATER.NOTICE_ENABLED=false), and --dryrun/internal children still stay silent. Rendering-only change to the update path: no config keys, no network behaviour and no latch semantics change (modules/version_notice.ts, dexbot.ts, unlock.ts, pm2.ts, tests/test_version_notice.ts).

2026-09-27

• Refactor(genesis): remove the legacy tolerance price matcher; the frozen ladder is now the only price authority - v1.6.8's fail-closed load/startup gates made the no-genesis fallback unreachable in production (_genesis is only ever set by loadGrid after the E1 gate or by a grid build, and a populated orders Map without a ladder cannot be produced by any supported flow), but the branch was still the path an off-grid chain price became a slot's price — the exact corruption INV-GRID-004 exists to prevent. Deleted: the whole pass-2 legacy block (tolerance duplicate scan + strict findMatchingGridOrderByOpenOrder + the widened ORPHAN_ADOPTION_TOLERANCE_MULTIPLIER spread-orphan adoption), findMatchingGridOrderByOpenOrder itself (its last production caller was that block; the cancelOrder linkage now matches by orderId), computeOutOfToleranceDriftTag with the price-drift-orphan tag and the per-cycle auto-cancel that consumed it (autoCancelOneUnmatchedOrphan, its bot._autoCancelOrphan* state and the maintenance call site) — an off-grid order is HELD (out-of-grid-deferred) and resolved structurally, never cancelled off a fuzzy price diff — the pass-1 price-equality and duplicate-swap tolerance fallbacks, the correction-queue staleness tolerance, and resolveLiveReserveEdgeAnchorPrice tiers 2/3 (live slot extreme, resolved config bound) so the reserve anchor is the ladder extreme or nothing. Two constants go with them (ORPHAN_ADOPTION_TOLERANCE_MULTIPLIER, PRICE_DRIFT_TOLERANCE_MULTIPLIER); a config that still sets either is simply ignored. The unreachable pass-2 hold is tagged no-genesis-deferred, so the shared suffix predicate keeps it non-blocking and the stranded-hold set escalates it (a reload is exactly its remedy). E2 is now fail-closed: syncFromOpenOrders calls _assertGenesisInvariant first and, when slots exist without a ladder, returns an empty result — no locks taken, nothing adopted, nothing queued for correction — after logging at error and requesting the structural resync that re-derives the ladder; it previously warned and continued into the matcher, and giving up that continuation is the point of the change. The same rule tightened two judgement calls: the pass-1 "did this order move?" test and the duplicate-swap tiebreak now compare LADDER LEVELS (chainPriceOnSameLevel: both prices map to the same slot) instead of float equality, so a legitimate few-quanta rest-drift inside one level no longer queues a spurious price correction or fails the tiebreak, and adoptedSlotKeepsItsOwnPrice reports a ladder-less manager as a fault instead of passing it. The createOrder materialize path still keeps a placed chain order tracked when the grid is undefined, but for a slot-N id it now logs the missing ladder at error and requests the resync (the descriptor-price fallback remains only for an unparseable id). Behavioral impact: no production flow changes; a future bypass of E1/E3 now produces a refused sync and a resync request rather than a fuzzy adoption. Risk: the ladder-less state is no longer survivable at runtime — it is repaired at load, which is where it must be (modules/order/sync_engine.ts, modules/order/utils/order.ts, modules/order/genesis_policy.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_class.ts, modules/dexbot_maintenance_runtime.ts, modules/constants.ts, docs/GRID_PRICE_INVARIANT.md, tests/test_sync_excess_orphan.ts, tests/test_sync_out_of_grid_defer.ts, tests/test_sync_logic.ts, tests/test_uncertain_broadcast.ts, tests/test_reserve_orders.ts, tests/test_pending_fill_crawls.ts, tests/test_correction_queue_staleness.ts, tests/test_sync_duplicate_orphan_swap.ts, tests/test_sync_empty_confirm.ts, tests/test_sync_lock_id_verification.ts, tests/test_resync_invariants.ts, tests/test_startup_partial_fill.ts, tests/test_cow_committed_order_protection.ts, tests/helpers/order_test_helpers.ts).

• Fix(genesis): refuse a persisted grid that has no usable price ladder, instead of loading it and degrading every slot-price consumer to a tolerance matcher - the genesis ladder is the only authoritative price for a slot (INV-GRID-004), and the "no genesis" state was reachable only from a pre-v1.4.25 snapshot through three silent paths: a >50% slot mismatch against the config-derived rail (refused to adopt, but then kept the grid anyway), a not-yet-numeric rail config (startPrice:"pool", minPrice:"2x"), and a throwing ladder build. In all three the snapshot loaded with manager._genesis === null, so nearest-slot adoption, computeOutOfToleranceDriftTag, the materialize descriptor-price fallback, resolveLiveReserveEdgeAnchorPrice tiers 3/4 and the isSlotInRail fail-open all ran on a tolerance matcher - the exact path on which an off-grid price becomes grid evidence. loadGrid now resolves the ladder through ONE decision (resolvePersistedGenesis in the new modules/order/genesis_policy.ts) and, when no ladder can be established, throws MissingGenesisError BEFORE any mutation (no asset init, no fund reset, no boundary restore), so the caller rebuilds from a clean manager. The startup gate asks the same question before committing to resume-vs-regenerate, so a ladder-less snapshot is regenerated (initializeGrid re-derives prices and reconcile is update-first) instead of half-loaded; the price-match resume reports "not resumed"; the recovery reload reports the failed reload for the structural resync - or, under 'halt', signals it so the automatic resync is suppressed. GRID_LIMITS.MISSING_GENESIS_POLICY (read as config.gridLimits.MISSING_GENESIS_POLICY) picks the response: 'rebuild' (default, deterministic, no operator action) or 'halt' (abort startup until a human runs a manual grid reset - strongest fund safety, opt-in because the bot stays down under PM2). Unknown values fall back to 'rebuild'. The migration cross-check threshold is now the named GRID_LIMITS.MISSING_GENESIS_MISMATCH_RATIO (0.5) instead of an inline literal. Behavioral impact: a pre-v1.4.25 snapshot on a bot whose rail config is still unresolved now rebuilds once (deriving the ladder from the live market) instead of running permanently ladder-less; a snapshot whose config was edited past the ratio limit is rebuilt rather than loaded with a mismatched genesis. Risk: the rebuild re-slots live orders, the same net effect as a manual dexbot reset - use MISSING_GENESIS_POLICY: 'halt' to require explicit consent. Deliberately NOT adopted (rejected in the analysis): accepting the mismatched rail (mass-virtualizes live tracking, persists a mismatched genesis) and deriving the ladder from persisted slot prices (a truncated array would permanently shrink it) (modules/order/genesis_policy.ts, modules/order/grid.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts, modules/dexbot_maintenance_runtime.ts, modules/constants.ts, docs/GRID_PRICE_INVARIANT.md).

• Fix(genesis): centralize the rail geometry and close a non-terminating loop - the migration ladder builder duplicated createOrderGrid's price-level generation, so a legacy snapshot could migrate to a different ladder than a fresh build of the same config; both now go through one derivePriceLevels (modules/order/utils/math.ts). The shared builder also refuses a non-advancing step (incrementPercent 0, negative, or small enough that 1 + inc/100 underflows) instead of spinning the geometric while forever - previously reachable from the startup migration gate. Config validation stays caller-side (createOrderGrid strict; migration builds a candidate ladder for the slot cross-check, so an out-of-bounds-but-finite edited config keeps reporting slot_mismatch, not a config error). Behavioral impact: a migrated ladder is identical to a fresh one, and an invalid increment cannot hang startup/load. (modules/order/utils/math.ts, modules/order/grid.ts, modules/order/genesis_policy.ts, tests/test_missing_genesis_policy.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts).

• Feat(genesis): defence in depth for the same invariant - the sync entry (syncFromOpenOrders) now asserts the manager holds a ladder whenever it holds grid slots, and on a violation reports once per generation at error (with the recorded refusal reason, when there is one), counts it in _genesisInvariantViolations, and requests the debounced requestStructuralGridResync('missing-genesis') that re-derives the ladder. It deliberately does not throw: a sync in flight is not the place to abort a live manager, and the fail-closed decision belongs to the load-side gates. initializeGrid clears the fault record and the counter when it installs a new generation, so a resolved condition stops reporting. The persisted row is gated at the source too - AccountOrders.loadGenesis now refuses a row with empty/absent priceLevels instead of handing loadGrid a genesis it cannot validate against (a tampered but well-shaped hash is still returned; that warning belongs to loadGrid, which can say what it compared against). Together with the startup gate this is the E1/E2/Schema enforcement layer the invariant analysis asked for (modules/order/sync_engine.ts, modules/account_orders.ts, modules/order/grid.ts).

• Test(genesis): add tests/test_missing_genesis_policy.ts (GEN-01..21) covering the T1 adoption (and its migration log), the T2/T3/T4 refusals, the ratio boundary (at-limit adopts, above refuses), policy resolution (default/case/garbage), loadGrid refusing before it mutates anything and honouring 'halt', the loadGenesis schema gate, the E2 assert's latch/counter/resync request, the recovery reload honouring 'halt' (suppressed resync), and the shared rail geometry (migrated ladder equals a fresh build; a non-advancing increment is refused, not hung). tests/test_grid_price_slot_invariant.ts step 10 updated to the new contract (an edited config now refuses instead of warning and keeping the grid), and six fixtures that fed loadGrid a ladder-less snapshot (test_boundary_restore_validation, test_grid_bloat, test_orphan_load_sanitize, test_pending_fill_crawls, test_uncertain_broadcast, test_dexbot_startup_dynamic_weight_wiring) now persist a real ladder, as every production snapshot does; the boundary test's reversed-snapshot case was rewritten to pin the new contract (refused without a ladder, re-sorted to canonical order with one) (tests/test_missing_genesis_policy.ts, tests/test_grid_price_slot_invariant.ts, tests/test_boundary_restore_validation.ts, tests/test_grid_bloat.ts, tests/test_orphan_load_sanitize.ts, tests/test_pending_fill_crawls.ts, tests/test_uncertain_broadcast.ts, tests/test_dexbot_startup_dynamic_weight_wiring.ts).

• Docs(genesis): document the missing-genesis policy, its trigger table, the three enforcement sites, the routing per caller and the rejected alternatives in docs/GRID_PRICE_INVARIANT.md, and extend INV-GRID-004 in docs/COW_INVARIANTS.md with the refusal contract (docs/GRID_PRICE_INVARIANT.md, docs/COW_INVARIANTS.md).

• Fix(reserve): exclude window members from every reserve classification site - the live-reserve count got the window exclusion in an earlier follow-up, but the no-crawl classification and the boundary-hold refill wire still ranked the plain floor/ceiling via reserveEdgeIdSet without it. When the active window reaches the grid edge (a keep-low window sitting on the floor), window members were misclassified as reserves: a genuine window fill was treated as static insurance and never crawled the boundary, so the hole was refilled same-side - and a guard-skipped window refill was dropped from collectRefillSlotIds' wire, so the hold could not pin the committed boundary. New windowIdSetFromSlots (with liveWindowIdSet delegating to it) supplies the window set to deriveTargetBoundary, consumePendingFillCrawls, collectRefillSlotIds (new manager option), the initializeGrid owed-crawl fold, and _reconcileStartupSide, matching the placement pickers and the count. Genuine reserve fills still never crawl; unknown boundary geometry fails open to the previous classification. Review-driven fixes in the same pass: resolveReserveCount migrates the legacy numeric reserveOrders form at read time and validateBotEntry accepts it (non-negative integer) instead of rejecting it; applyPersistedPendingCrawls logs a restore-failed ledger as retained (not dropped); the shared railCenterIndex removes the duplicated Tier-4 rail-center formula; and the reserve-sizing comment, order.ts section header, AccountOrders method list, and INV-COW-008 are corrected. Behavioral impact: a window fill at the grid edge crawls again and a skipped window refill pins the boundary; a hand-edited numeric reserveOrders is honored. Risk: none beyond restoring the intended crawl - a genuine reserve (outside the window) is unaffected and still no-crawl. Tests: the reserve window-overlap no-crawl and refill-wire regression plus numeric-form read/validation cases, and the dynamic-weights ESM mock name list (modules/order/utils/order.ts, modules/order/grid.ts, modules/order/grid_reconcile_internal.ts, modules/order/manager.ts, modules/order/utils/system.ts, modules/bot_settings.ts, modules/account_orders.ts, docs/COW_INVARIANTS.md, tests/test_reserve_orders.ts, tests/test_bot_settings.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts).

2026-09-28

• Chore(packaging): drop test sources from the npm tarball - the published package shipped 19 claw bridge test files and two Kalman suites under analysis/trend_detection/ through the blanket "claw" and "analysis" files entries, neither reachable from the installed runtime. "!claw/tests" removes 232K of TS test sources with zero runtime use; the two Kalman suites move to analysis/legacy/tests/ (already excluded from the package and the prod tsconfig) and are converted to the CJS require() style the other legacy suites use, and both are wired into the test:legacy chain so they stay executed (their previous entry point, the analysis/trend_detection/package.json test script, nothing invoked). Package drops from 1137 to 1109 files; runtime modules that merely sit under a tests-named path (dist/analysis/trend_detection, dist/market_adapter/test_helpers) and the claw example are deliberately left in (package.json, analysis/legacy/tests/test_kalman_trend.ts, analysis/legacy/tests/test_kalman_velocity_smoothing.ts, analysis/trend_detection/package.json, analysis/README.md).

• Chore(packaging): trim the npm tarball to shipped docs, assets and declarations - two reductions to the files whitelist. The blanket "analysis" entry shipped all 44 analysis .ts sources even though tsc already emits their compiled twins under dist/analysis/, so every tool shipped twice; it is replaced with an explicit list matching the way docs/, modules/ and market_adapter/ are already packaged - analysis/uplot must keep shipping (analysis/chart_utils.ts inlines the vendored uPlot runtime via fs.readFileSync from PATHS.ANALYSIS.ASSETS_DIR, a runtime dependency) plus the six .md files analysis/README.md links to, so shipping the top-level README alone would ship broken links. Separately, dist/**/*.js.map and dist/**/*.d.ts.map (464 files, 3.49 MB) are dropped: they resolve to root .ts sources never in files and nothing consumes them (zero runtime dependencies, no source-map-support, no --enable-source-maps), expressed as files negations so a local dist/ keeps its maps while only the published tarball loses them; the 234 .d.ts files are kept for deep importers. Net: 1109 files / 2.902 MB unpacked down to 600 files / 2.131 MB (package.json).

• Feat(tv): replay market-adapter grid resets in the bot charts - gridPrice: "ama" charts now visualize WHEN the grid would have recentered, not only where it sits today. grid_reset_sim.ts replays the two recentering triggers from docs/GRID_RECALCULATION.md §3/§4 over the chart's 1h AMA series (price-delta ratchet + slope-delta, price trigger first, the accepted slope baseline re-seeded on every reset, clampGridPriceToBounds semantics for absolute bounds), and grid_reset_config.ts resolves the thresholds through the production chain (constants → general.settings → market_adapter_settings globals/pair/bot) instead of reimplementing it, with --grid-delta-pct/--grid-slope-delta-pct/--grid-warmup CLI overrides plus an in-chart toggle and a bottom-left threshold panel; the replay is embedded into the self-contained HTML via embedFunctionSources, so pool/pair charts are untouched. Three runtime fixes were needed to make the chart's source chain honest: a persisted not-ready slope snapshot (isReady:false, slopePct 0) no longer acts as a phantom 0 %/bar baseline that could trip the slope trigger on the first real slope; a non-positive slope threshold now DISABLES the trigger instead of firing every cycle on delta ≥ 0 when the factor/maxSlopePct config is missing; and MARKET_ADAPTER.AMA_SLOPE_DELTA_THRESHOLD_PERCENT is read back from general settings (the editor's AMA-Slope Delta knob was inert) with amaSlope rebuilt so the shared DEFAULTS object is not poisoned. Risk: low - the runtime changes only affect bots whose configured/default slope factor resolves non-positive (previously spurious per-bar resets persisted via advanceTriggeredBotState); research-only modules otherwise (analysis/tradingview/grid_reset_sim.ts, analysis/tradingview/grid_reset_config.ts, analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/analyze_tradingview.ts, analysis/tradingview/README.md, analysis/README.md, market_adapter/core/market_adapter_service.ts, market_adapter/market_adapter.ts, market_adapter/core/strategies/dynamic_weight_series.ts, docs/GRID_RECALCULATION.md, tests/test_grid_reset_sim.ts, tests/test_market_adapter_logic.ts, tests/test_market_adapter_service.ts, tests/test_tradingview_chart_storage_key.ts, tests/README.md).

• Chore(dynamic-weight): raise the kalS% default from 1.0 to 1.11 - DYNAMIC_WEIGHT_KALMAN_MAX_SLOPE_PCT now requires a slightly stronger trend move before the Kalman composite branch reaches full directional strength; the research doc is synced to match (modules/constants.ts, analysis/trend_detection/DYNAMIC_WEIGHT_RESEARCH.md).

• Fix(market-adapter): make the Kibana tail refresh incremental and bounded - shard coverage (meta.queriedRanges) now records at, the wall-clock time each query ran, so the newest window only re-queries buckets no query has seen TAIL_SETTLE_LAG_MS after they closed instead of a fixed 48h overlap. Gap immutability is judged per gap (GAP_SETTLE_HORIZON_MS) rather than per window, so a month-old gap in a "now" window stops being re-fetched forever; small gaps merge (GAP_MERGE_TOLERANCE_BUCKETS) and the sub-range budget is spent on merged span hours, not gap count, so one extra 1h hole can no longer escalate a run to a full-window fetch; persisted coverage spans are capped (MAX_COVERAGE_SPANS); a re-verifying run rewrites its shard even when the candles are identical because the moved verification time is the news, while a pure-reuse run still writes nothing. The timestamped refresh is capped at TAIL_REFRESH_HOURS: an old coverage hole (span compaction, an undatable shard, a hand-written file) would otherwise drag the boundary back weeks and re-query settled history on every run - without the cap a 30-day window with a mid-window hole re-fetched ~20 days per run, with it the worst case is the legacy 48h. Tests cover the incremental tail, the 48h ceiling, per-gap pruning, span compaction, and sub-range gap merging (market_adapter/inputs/window_cache.ts, market_adapter/README.md, tests/test_window_cache.ts).

• Tune(range): widen the orange tight zone, suizidal starts below 1.4x - RANGE_QUALITY ORANGE_MIN/RED_MAX 1.45 → 1.4, so the orange tight zone is 1.4x-1.55x and a range below 1.4x flags red (suizidal); single-sourced via RANGE_QUALITY, the bot-editor legend and live range coloring follow automatically (modules/constants.ts).

• Fix(clear): make the dexbot clear* scripts warn when the runtime is live, and sweep the rotated audit trail - clear reads like a harmless log wipe but is not: a running bot re-persists its grid within seconds, a running adapter rewrites both its state file and market_adapter.lock (deleting that lock is exactly what lets a second adapter start), and open log file descriptors mean the deleted space is only reclaimed on restart, so every wipe issued against a live fleet was silently cosmetic. scripts/lib/dexbot-paths.sh gains five helpers shared by all four clear-* scripts: live_pid_from_file (pid liveness by file), runtime_processes (the monolithic pid files, plus this install's online PM2 apps via pm2 jlist - filtered to cwd/script_path under the project or profiles root, and probed only when the daemon pid file is alive, so a cleanup script can never spawn a PM2 daemon as a side effect), warn_if_runtime_running (a warning block listing every hit with the reason it matters; advisory by construction - the prompt still runs, the deletion still happens, no exit code changes), log_files (one predicate - *.log, rotated *.log.*, *.jsonl* - now used by the count, the preview, the delete and the verification in both clear-logs.sh and clear-all.sh, so those four can no longer disagree) and note_audit_included. The predicate change is a fix, not cosmetics: daemon-audit.jsonl.1 and .2, produced by the credential daemon's own rotation, match neither *.jsonl nor *.log.*, so clear used to delete the live audit file and leave its rotated history behind - a half-wiped trail that reads like tampering without being it. The audit trail is still deleted along with the rest of the logs, deliberately, with no opt-in flag and no second prompt: it is named in the preview (Includes the credential audit trail: daemon-audit.jsonl*) and the operator answers the same single y, since an explicit y/n confirmation is the right place for that decision. The published descriptions were wrong in the same direction - the README comment implied clear also performed the other three commands, and nothing said these are offline-only - so dexbot help, the CLI reference table, the onboarding troubleshooting guide, scripts/README.md and the README now state each command's exact scope, that the credential audit trail goes with the logs, and what deliberately survives every clear*: bots.json, keys.json, the generated settings files and credit_runtime/ (dexbot default remains the separate settings reset) (scripts/lib/dexbot-paths.sh, scripts/clear-logs.sh, scripts/clear-orders.sh, scripts/clear-market-adapter.sh, scripts/clear-all.sh, dexbot.ts, README.md, docs/WORKFLOW.md, docs/BITSHARES_ONBOARDING.md, scripts/README.md).

• Docs: currency sweep over the published docs - CHANGELOG.md re-verified against the 12 commits since v1.6.7 (no gaps, nothing to add), then the drift that accumulated around it is closed. docs/EVOLUTION.md's headline numbers are reconciled with the repository: the executive summary claimed 2,277 commits while its own footer said 2,300 (git rev-list --count HEAD = 2,300), the test count said 298 against 305 files in tests/, and every era row in the version-history table was recomputed from the current history - the first two rows were badly off (v0.1.0→v0.6.0 1,217 → 998, v0.6.0→v1.0.0 309 → 650) and the later rows drifted by 10-25% because each was written when its era closed and never refreshed; the table now states that its counts are git rev-list --count over the current history so the next reader does not have to guess which convention a number used. docs/DEXBOT_COMPARISON.md's testing-depth row moves 256 → 305. docs/README.md gains source-map entries for order/genesis_policy.ts and version_notice.ts, and stops calling the untagged 1.6.8 "released". docs/WORKFLOW.md's start feature list no longer advertises auto-update as a default, because UPDATER.ACTIVE is default-off by design, and the broken #version-notice anchor it introduced is dropped (no such section exists in that file; the behaviour is release-noted, not documented there). modules/README.md's layout tree gains the modules and order/utils/ files it had drifted past (version_notice, cli_start_onboarding, cli_start_output, cli_colors, credit_pricing, grid_price_source, node_connect_policy, order/genesis_policy, utils/text_width, utils/chain_logs; no stale entries were found, only missing ones), and tests/README.md points at npm run test:legacy and the test_missing_genesis_policy.ts / test_last_fill_pivot_persistence.ts / test_version_notice.ts suites. Verified alongside the sweep: the CLI table in docs/WORKFLOW.md matches every command and alias in dexbot.ts; the GRID_PRICE_INVARIANT.md key-constant table matches modules/constants.ts value-for-value; RANGE_QUALITY (1.4/1.55/2.0) and DYNAMIC_WEIGHT_KALMAN_MAX_SLOPE_PCT (1.11) match the constants and the research doc; every relative markdown link in the repo resolves; and no doc still references a removed symbol (ORPHAN_ADOPTION_TOLERANCE_MULTIPLIER, PRICE_DRIFT_TOLERANCE_MULTIPLIER, findMatchingGridOrderByOpenOrder, price-drift-orphan, printVersionNotice, the dexbot whitelist command) outside the changelog's historical and removal-tombstone entries. Documentation only, no runtime change (docs/EVOLUTION.md, docs/DEXBOT_COMPARISON.md, docs/README.md, docs/WORKFLOW.md, modules/README.md, tests/README.md).

[1.6.7] - 2026-09-26 - Native Session Recovery, Start Onboarding, Keys UX, Guard Pivot Persistence

2026-09-26

• Feat(guard): persist/restore the LAST-FILL-GUARD pivot with the grid snapshot — the guard was fully disabled after every restart (in-memory _lastFilledPrice/_lastFilledType reset to null) precisely while the boundary was still being rebuilt, and the book seed (seedLastFilledPricesFromBook) that re-armed it is only a proxy (max resting buy / min resting sell) that goes wrong whenever the book isn't adjacent to the last fill (partials, rotations, reserve shelf, dust). persistGridSnapshot now builds a {price, type, fillsAt, genesisHash} row (buildLastFillPivotPayload) and passes it as storeMasterGrid's 10th param; grid.loadGrid restores it via restoreLastFillPivot right after _restoreBoundary — with genesis applied and the grid re-typed, before the first reconcile/broadcast — so startup, price-match resume, and the recovery reload all inherit it from one call site. The row carries the CURRENT live genesis hash, so a regenerated/re-derived grid refuses a pivot from a dead generation. Restore validation runs TTL → genesis binding → on-grid: the TTL is 24h (GRID_LIMITS.LAST_FILL_PIVOT_TTL_MS) with the ORIGINAL fillsAt preserved through setLastFillPivot's atMs, so it keeps meaning "age of the last fill", not "time since last restart"; the on-grid check reuses the runtime's own resolveOnGridPivot ladder validator (lazily required from utils/system.ts so one increment fallback chain and one drift rule serve both the per-probe live guard and the restore; the snapped ladder level is restored, never the raw float; an off-ladder row falls back to the book seed). TTL and genesis-mismatch verdicts erase the stored row through one shared drop path (AccountOrders.clearPersistedLastFillPivot, so no half-invalid row can re-arm the same verdict next boot). The fill-ledger reconstruction alternative was rejected: a snapshot mirror invalidates in lockstep with the boundary instead of maintaining a second source of truth (modules/account_orders.ts, modules/order/utils/system.ts, modules/order/grid.ts, modules/constants.ts).

• Refactor(guard): centralize LAST-FILL-GUARD pivot mutation behind one provenance-tagged writer — fills persist, heuristics don't. New shared setLastFillPivot(type, price, 'fill'|'book', atMs?) in utils/system.ts sets _lastFilledPrice/_lastFilledType/_lastFilledAt, a lastFillPivotSource flag, and the per-side _lastFilledBuyPrice/_lastFilledSellPrice mirror in one place; OrderManager._setLastFillPivot delegates to it and cow_runtime's queued-fill refresh calls it directly, replacing three hand-rolled scalar-mutation sites. Only 'fill' provenance is persist-eligible, so a book seed never fossilizes as market truth. The row shape is validated by one shared gate (normalizeLastFillPivot) used by both the storeMasterGrid sanitizer and the loader, so the two checks cannot drift (modules/order/manager.ts, modules/dexbot_cow_runtime.ts, modules/order/utils/system.ts, modules/account_orders.ts).

• Fix(guard): invalidate the pivot with the grid generation so a rebuilt grid cannot inherit a pivot validated against wiped geometry — initializeGrid and rejectCorruptedGridSnapshot reset the in-memory pivot via resetLastFillPivot (exposed as OrderManager._resetLastFillPivot), which clears the FULL scalar family including the per-side mirrors so seedLastFilledPricesFromBook's cold gate is not silently suppressed by stale mirrors after a rebuild; AccountOrders.clearGrid wipes the persisted row with the snapshot (modules/order/grid.ts, modules/dexbot_state_recovery.ts, modules/order/utils/system.ts, modules/account_orders.ts).

• Test(guard): add tests/test_last_fill_pivot_persistence.ts (LFP-1..8) covering the store/load round-trip shape gates, null-clears vs undefined-no-op, the provenance gate, the restore validation chain (fillsAt preservation, TTL, genesis-mismatch erase, off-ladder refusal), and full-family reset; test_stale_guard_pivot_fixes and test_dexbot_maintenance_runtime_dynamic_weights updated for the shared writer (tests/test_last_fill_pivot_persistence.ts, tests/test_stale_guard_pivot_fixes.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts).

2026-09-25

• Fix(native): harden fill-channel watchdog recovery and accounting — follow-up to dead-but-open session recovery: the mechanisms were sound but had gaps that could still leave a wedged fill channel silently unchecked or attribute node health to the wrong cause. subscriptions keeps escalating while the channel stays dead (drops the _channelDegraded latch — the shared per-client cooldown is the only rate bound) and routes the fast retry-ladder scan through the same re-entrancy guards (_processingHistory/reconnecting/pendingScans) as every other scan so it cannot race a poll/notice/resubscribe scan; chain_client extracts one createForcedReconnectGate per client returning issued|coalesced|unavailable, so a coalesced request (another escalation already spent the cooldown) still counts as a recovery cycle — the operator alert and node strike are not starved by the stale-api path — while unavailable (no live socket) neither counts nor burns the cooldown; the retry ladder refills only on a genuinely new issued teardown and the recovered "after N" clause emits only when N > 0; warnSubscription uses per-category throttle keys so callback errors and channel errors cannot mask each other's suppressed counts; the superseded CHANNEL_RECONNECT_COOLDOWN_MS is dropped. Behavioral impact: a wedged channel keeps requesting recovery instead of disarming after one attempt, and the unrecoverable-channel alert and fill-channel-unrecoverable node strike fire even when the stale-api escalation holds the cooldown — no forced reconnect alone costs a node a persistent strike (modules/bitshares-native/chain_client.ts, modules/bitshares-native/subscriptions.ts, modules/bitshares-native/transport.ts, modules/bitshares_client.ts, modules/constants.ts, docs/LOGGING.md).

• Fix(native): recover dead-but-open sessions and stop stale COW re-broadcasts — two independent stale-bot failure modes a restart alone did not resolve. (1) A server-side login-session swap left cached api ids rejected with Assert Exception: _local_apis.size() > api_id while the socket still read "connected", so the normal close/keep-alive recovery never fired, the fill-history scan and its polling loop died, and fills went undetected for hours (the error log took ~95k identical lines). (2) A COW batch validated its plan before the single-flight broadcast wait, so if the slot-holding batch committed a master-grid advance during that wait the deferred batch still shipped its now-stale plan, placing duplicate on-chain orders that had to be cancelled. New transport.forceReconnect() reports the active node failed, detaches the old close handler, tears the socket down synchronously (an unresponsive peer may never send its close frame) and reconnects with wasReconnect set so the node-failure ledger prefers a different node; both chain clients window stale-id errors (3 within 60s → forceReconnect, a single reconnect-race stale id still recovers in place); the fill-channel watchdog trips a cooldown-debounced forced reconnect after 3 consecutive history-scan failures with per-account throttled logs ("+N suppressed") while excluding callback/processing errors so a downstream bug cannot reconnect-storm; COW re-validates the plan after winning the broadcast slot and re-plans from the fresh master if it went stale during the wait (only when it was fresh before the wait, so an already-stale plan cannot double the structural-resync request) (modules/bitshares-native/transport.ts, modules/bitshares-native/chain_client.ts, modules/bitshares-native/subscriptions.ts, modules/constants.ts, modules/dexbot_cow_runtime.ts, docs/LOGGING.md).

• Fix(update): regenerate ecosystem config in a clean process — the updater imports dist/modules/paths.js at startup and Node's ESM registry is keyed by resolved URL for the process lifetime, so npm run build rewrites dist/ on disk but the pre-pull modules stay cached; importing the freshly built dist/pm2.js in-process then linked against the stale cached paths.js and failed with "does not provide an export named 'printRelocationNotices'" even though the bundle freshness check passed, and the warning handler swallowed it so profiles/ecosystem.config.cjs was never regenerated (the same latent bug would have broken the PM2-managed restart path). Both post-build consumers of dist/pm2.js — generateEcosystemConfig() and needsMarketAdapter() — now run in a child process with an empty module registry (new resolvePm2ModuleUrl()/pm2NeedsMarketAdapter()), and the build script prints a "tsc is compiling ..." notice so the silent window while tsc runs is explained (scripts/update.ts, package.json).

• Fix(native): self-heal stale api_id in the native chain client — the client cached _dbApiId/_historyApiId/_broadcastApiId across websocket reconnects, so a reconnect that swapped the server-side login session without the client observing a closed status event left those ids pointing past the new session's _local_apis map and every call returned Assert Exception: _local_apis.size() > api_id, wedging the fill-history channel (including the periodic fill poll) until a process restart. login() (run by validateNode on every (re)connect) now resets the cached ids, and db/history/network_broadcast route through callWithApiRecovery(), which re-registers the namespace on the current session and retries once when the node reports a stale api id — mirrored in createReadOnlyClient so the market adapter's read channel is covered too; processObjects failures raised by the fill poll are tagged context: 'fill-poll' so a dead poll is visible instead of swallowed as a generic error. Risk: one extra RPC round-trip only on a stale-id failure (bounded single retry); no happy-path change (modules/bitshares-native/chain_client.ts, modules/bitshares-native/subscriptions.ts, tests/test_native_chain_client.ts).

• Feat(keys): show a BitShares onboarding link for empty vaults and make key/bot tables display-width-aware — a local-document-first onboarding link is printed after first-time vault setup or when authenticating into an empty key manager, with the hosted fallback derived from UPDATER.REPOSITORY_URL/BRANCH in modules/constants.ts instead of a second hardcoded repository URL; stored accounts (modules/chain_keys.ts) and configured bots (modules/account_bots.ts) render as display-width-aware columns so CJK/emoji and combining marks no longer misalign tables (new browser-safe modules/utils/text_width.ts). New resolveOnboardingUrl() exported and covered for local/remote selection plus the first-time and empty-vault notice paths (modules/utils/text_width.ts, modules/chain_keys.ts, modules/account_bots.ts, README.md, tests/test_chain_keys_vault.ts, tests/test_text_width.ts).

• Fix(keys): signal key-manager cancellation explicitly — the interactive key manager conflated Escape with other exit paths: authenticate() returned the raw '\x1b' sentinel, which leaked into callers (key_store, chain_orders, credential_daemon, dexbot_class, dexbot) and was passed to decrypt/resolvePrivateKey as if it were a vault secret, and main() returned no status so the first-run flow always claimed the master password was configured even when setup was cancelled. New MasterPasswordCancelledError thrown on Escape; isMasterPasswordFailure() now recognizes cancellation so existing abort paths handle it; main() returns whether a usable vault exists, routes every close through one message, keeps submenu Escape local to the operation, and selectKeyName() returns null on cancel; dexbot.ts surfaces a cancellation message during first-run setup and honors main()'s return value in runAccountManager (dexbot.ts, modules/chain_keys.ts).

• Feat(cli): route dexbot start through setup onboarding when configuration is incomplete — a bare dexbot start (and its unlock alias) on a fresh install previously failed downstream with confusing errors because neither a key vault nor bot definitions existed, forcing new users to discover dexbot key/dexbot bot on their own. Onboarding now runs at the unlock-launcher boundary (unlock.ts, shared by dexbot start, dexbot unlock, and direct node unlock, so the dexbot CLI only delegates) with the routing logic in a pure, unit-testable selector (modules/cli_start_onboarding.ts); chain_keys.hasKeySetup() requires a usable account entry (valid v2 encrypted key) so a cancelled key setup counts as incomplete instead of skipping onboarding; non-interactive --headless/--dryrun launches fail fast with a message instead of blocking on an interactive prompt; onboarding is opt-in via the direct-run bootstrap so programmatic unlock.main() callers (tests, embeds) never block on a password/key prompt; relocation notices are printed explicitly by dexbot (non-delegating commands), unlock (only when onboarding is not needed), and pm2 (direct runs), with launcher-child start/unlock/pm2 commands excluded to keep a single emission; yellow notice formatting is centralized in modules/cli_start_output.ts; README getting-started documents the auto-redirect (dexbot.ts, unlock.ts, pm2.ts, modules/chain_keys.ts, modules/cli_start_onboarding.ts, modules/cli_start_output.ts, modules/paths.ts, README.md).

[1.6.6] - 2026-09-25 - Stale Cancellation Guard Hardening, Dead Code Sweep

2026-09-25

• Docs: align the published guides with v1.6.6 behavior — batching, dust handling, spread correction, and the reconciliation safeguards are re-documented to match the current runtime, with stale links and project metadata repaired; docs/ index targets are added to the npm artifact and the affected file-level API tables and export docs are corrected to describe the actual implementation (CHANGELOG.md, docs/COW_INVARIANTS.md, docs/DEXBOT_COMPARISON.md, docs/EVOLUTION.md, docs/GRID_PRICE_INVARIANT.md, docs/GRID_RECONCILE.md, docs/architecture.md, docs/developer_guide.md, modules/README.md, package.json).

• Fix(cleanup): remove stale module helpers left behind by browser-portability work, the credit-pricing and COW-runtime extractions, and incomplete determinism plumbing — unused class methods and helper wrappers in accounting, grid, working-grid, export, credit-runtime, and the native crypto browser shim are dropped along with their now-unused imports. Behavioral impact: none — the active accounting, pricing, execution, and shutdown paths are unchanged; the surface is narrower (modules/bitshares-native/crypto/ecc.browser.ts, modules/credit_runtime.ts, modules/dexbot_class.ts, modules/order/accounting.ts, modules/order/export.ts, modules/order/grid.ts, modules/order/manager.ts, modules/order/working_grid.ts).

• Refactor(analysis): drop stale and dead analysis tooling — the grid checker's documentation and output are realigned with LAST-FILL-GUARD semantics, no-op lookup flags are removed from the fill-based tools, zero-consumer module exports are narrowed (account_resolver, fills_source), and the dependency-free nested AMA-fitting manifests are retired so the analysis surface reflects its actual callers and supported workflows (analysis/README.md, analysis/account_resolver.ts, analysis/ama_fitting/package-lock.json, analysis/ama_fitting/package.json, analysis/bot_usage/kibana_bot_queries.ts, analysis/chain_pool.ts, analysis/derivative_chart_generator.ts, analysis/fills_source.ts, analysis/grid_correction_check.ts, analysis/resolve_source.ts, analysis/trade_profitability.ts, scripts/sync-version.ts).

• Fix(update): make the dist freshness check honor the build's tsconfig.json exclude — the updater derived expected dist/ outputs by walking every .ts under the compiled roots, so the archived analysis/legacy/tests (compiled only by tsconfig.tests.json) was read as a missing production output and the post-build check aborted with Build left dist/ incomplete or stale (is missing dist/analysis/legacy/tests/test_derivative_chart.js) after a successful build, blocking the restart. collectCompiledSources now reads the root tsconfig.json exclude directory prefixes and skips them, mirroring the compiler; regression in tests/test_update_dist_freshness.ts (scripts/update_dist_freshness.ts, tests/test_update_dist_freshness.ts).

• Refactor(analysis): archive the legacy SMA/MACD/RSI derivative analyzer — the classic-indicator tool (superseded by the live Kalman/Hurst/PE stack, with no production importer since modules/ and market_adapter/core/ hold none of its symbols) moves to analysis/legacy/ with a local README. It loses its analysis:derivatives npm script, is scrubbed from the centralized docs (analysis/README.md, analysis/trend_detection/README.md, scripts/README.md, docs/README.md, docs/architecture.md, docs/developer_guide.md, docs/DEXBOT_COMPARISON.md), and is excluded from the published npm package (!analysis/legacy + !dist/analysis/legacy). Its four regression tests move under analysis/legacy/tests/ out of the default npm test glob, with a new opt-in npm run test:legacy; the production build excludes that path while tsconfig.tests.json still typechecks it. Full suite 296/296 pass (analysis/legacy/, package.json, tsconfig.json, tsconfig.tests.json, docs).

• Refactor(cache): drop legacy run-relative candle-cache migration — stable calendar-month shards are now the only supported format: *.chunk_* files are ignored (never loaded, never deleted) instead of being absorbed into shards, and the *.fetch_manifest.json identity fallback is removed. The LP fetcher's progress output reads Window N/M (was Chunk N/M) and its match predicate is renamed isLpShardMatch. Refresh/retry/tail semantics are unchanged. Behavioral impact: installs holding only legacy chunks re-fetch once on next run, and the stale files remain inert on disk. Full suite 292/292 pass (market_adapter/inputs/window_cache.ts, market_adapter/inputs/fetch_lp_data.ts, tests/test_window_cache.ts, market_adapter/README.md).

2026-09-24

• Fix(order-engine): close stale-cancellation replays across the correction queue, COW orphan maintenance, and startup reconciliation. Drain-time validation now rechecks live ownership and source-specific geometry for cancel-only, type-mismatch, and gap-evacuation decisions; COW auto-cancel skips adopted orders; startup Phase 2 validates each plan against its own unchanged chain order and live slot/geometry instead of requiring whole-book snapshot equality. Surplus settlement uses only the current live owner and skips stale snapshot fallback. Centralized live-owner lookup across the guards and added regression coverage for truncated/failed pre-cancel reads, per-plan snapshot independence, and stale settlement (modules/order/utils/order.ts, modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts, modules/dexbot_cow_runtime.ts, tests/test_correction_queue_staleness.ts, tests/test_grid_reconcile_regressions.ts, tests/test_uncertain_broadcast.ts).

2026-09-23

• Refactor(bot-editor): unify the configurator menu labels — abbreviated aliases give way to full names so the same term reads identically in the editor and the docs: HealthChk → Health Check, PrefNode → Preferred Node, Incr → Increment, and Log lvl → Log Level. The run-together GridPrice, MarketOrder, and EdgeOrder labels keep their casing. Display-only — stored keys, defaults, and validation are unchanged; the README.md configurator reference aliases and the 4) Log Level heading are updated to match (modules/account_bots.ts, README.md).

• Feat(bot-editor): render 5) List bots as a Name / Account / Pair table — the flat N: name A / B line gains a bold header and columns derived from the longest value in each field, with palette colors (grey index, green name, orange account, cyan pair) replacing the unlabeled white text, and the pair now reads A/B with no spaces around the slash. The [inactive]/(dryRun) suffixes are colored red/yellow so they stand out. Readability only (modules/account_bots.ts).

• Refactor(settings): regroup the General Settings menu by concern — 1) Grid Health → 1) Grid Drift, 2) Order Recovery → 2) Order Maint. (which now also edits the Health Check Interval, moved out of Node Config, so the Health Check value reads next to the dust threshold it schedules), and 3) Node Config narrows to Nodes + Preferred Node; all five rows are padded to a shared value column. Display/prompt grouping only — stored keys, defaults, and validation are unchanged. Docs: the README.md global-settings reference is regrouped to mirror the editor, and docs/GRID_RECALCULATION.md's menu reference now reads 1) Grid Drift (modules/account_bots.ts, README.md, docs/GRID_RECALCULATION.md).

• Refactor(bot-editor): align the per-bot editor with the bots.json/runtime vocabulary — the 5) Funding section is now 5) Inventory with Orders → MarketOrder (active window, counted from the market) and Reserve → EdgeOrder (edge-pinned insurance orders); the Preferred account prompts read Blockchain account; and startPrice (pool, book or A/B) reads startPrice (pool, book or price). poolRef is now prompted only when startPrice is pool: a dormant pin is preserved rather than cleared when switching to book/numeric, and the 3) Price summary renders a dormant pin as grey ignored instead of a value that no longer applies. Reserve order counts accept 0–100 per side (was 0–20), matching the active-order cap, and the 1)–6) summary rows are column-aligned. Display/validation only — stored keys and defaults are unchanged. New formatPoolRefLabel dormant-pin case in tests/test_account_bots_adapter.ts (modules/account_bots.ts).

• Refactor(cli): rebuild dexbot help as grouped sections — printCLIUsage replaces the hand-padded flat list (which had drifted: duplicate order rows, missing dw/export/clear-orders/clear-market-adapter/clear-all) with five groups (Runtime, Trading, Config, Analysis, Files) plus a Help & options block, deriving the command-column width from the longest entry so alignment cannot drift again. Same commands and aliases; output-only (dexbot.ts).

• Docs: regroup the README configurator reference to mirror the editor — the per-bot parameter tables are split into 1) Pair … 6) Adapter and the global-settings tables into 1) Grid Drift … 5) Updater, with the previously-undocumented edge-reserveOrders semantics and adapter-flag storage (market_adapter_whitelist.json, not bots.json) called out; the CLI examples gain export and the clear-* variants. docs/WORKFLOW.md's command table is synced (aliases keys/bots/stats, dw, the three clear-* commands, help), docs/DEXBOT_COMPARISON.md now credits the interactive dexbot bot editor instead of "manual JSON only", and market_adapter/README.md + scripts/reset-settings.sh spell the full path dexbot bot → 2) Modify bot → 6) Adapter (README.md, docs/WORKFLOW.md, docs/DEXBOT_COMPARISON.md, market_adapter/README.md, scripts/reset-settings.sh).

• Fix(bot-editor): accept the pool label's own vocabulary in the poolRef prompt — the 3) Price summary reads green Pool: default when the runtime auto-selects the pair's pool, but the pin prompt showed [none] and rejected default/pool/auto as invalid, so a user typing what the summary displayed hit an error. askPoolRef now treats default/pool/auto as clear aliases (same as none/clear/off/no), and when startPrice is pool the unpinned prompt renders [default] instead of [none], matching the summary, and the now-redundant (none to clear) hint is dropped from the prompt. New isPoolStartPrice/isPoolRefClearInput helpers. Display/parsing only — a pin is still either a concrete 1.19.x ID or absent, and withPoolRef is unchanged. Tests: tests/test_account_bots_adapter.ts (modules/account_bots.ts).

• Fix(grid): make startPrice the master price source over a pinned poolRef — initializeGrid passed manager.config.priceMode || 'auto', and priceMode is never populated in the bot runtime path, so startPrice: "book" was derived as "auto" and a pinned poolRef won over the order book. New resolveStartPriceMode() (modules/order/utils/withPoolRef.ts) derives the mode from startPrice itself, so "book" ignores the pin while "pool"/"auto" still consult it. Behavioral impact: a bot with startPrice: "book" + a pinned pool prices from the order book as documented (previously the pool); numeric startPrice is unchanged. Tests: tests/test_pool_ref_price.ts (book mode never fetches the pinned pool; mode resolution) (modules/order/grid.ts, modules/order/utils/withPoolRef.ts).

[1.6.5] - 2026-09-23 - Editor-Managed Whitelist Flags, GridPrice Normalization, Pool/Health Cues, Log-Symmetric Range Tilt, Centralized Bot Defaults, Dynamic-Weight CLI, Update Self-Heal

2026-09-23

• Fix(bot-editor): treat gridPrice deactivating entries as startPrice and normalize them to null — typing n/no/false/0/f/s/start/none/blank, or a lone space, now commits null and the editor renders it as red startPrice, matching the live echo. Previously a whitespace-only entry previewed startPrice but a bare-Enter path silently kept the old value (readInput trimmed the resolved line, so a typed space was indistinguishable from Enter). readInput gains a trimInput option (default true, existing callers unchanged); askGridPriceMode opts out and tells a bare Enter (keep current) from whitespace (overwrite null). New GRID_PRICE_UNSET_INPUTS/isUnsetGridPrice in modules/bot_defaults.ts is the single spelling set, shared by the editor prompt, the display, and seedBotDraft, so a hand-edited "gridPrice": false/"no" normalizes to null at seed time instead of lingering as a value the runtime only silently degrades. Tests: unset → null (tests/test_bot_defaults_characterization.ts), red-startPrice rendering (tests/test_account_bots_adapter.ts, which now exports colorGridPriceValue), and trimInput default-vs-opt-out (tests/test_read_input.ts) (modules/account_bots.ts, modules/bot_defaults.ts, modules/order/utils/system.ts).

• Feat(bot-editor): clearer Pool and Adapter status cues — the 3) Price summary's Pool: field no longer reads none when the runtime auto-selects the pair's default pool: it shows a green default when startPrice is pool, a grey none otherwise, and a pinned poolRef still shows its ID (display-only; formatPoolRefLabel never touches the stored value; a gridPrice of pool/book is discouraged market-price anchoring and stays red in its own field). 6) Adapter Weight/Range false now render bright yellow (COLORS.yellowBold) as optional-rider warnings instead of red; Price false stays red as the gate. New testFormatPoolRefLabel and a red-book assertion in tests/test_account_bots_adapter.ts (which now exports formatPoolRefLabel).

• Feat(settings): expose the AMA-slope reset trigger in General settings — 1) Grid Health now also edits MARKET_ADAPTER.AMA_SLOPE_DELTA_THRESHOLD_PERCENT (default 8%, range 0.1-100; the slope-delta trigger as a percentage of max AMA slope), and the health line renders both thresholds with the Δ symbol and % (AMA Δ: 1%, AMA-Slope Δ: 8%); the input prompts are labelled AMA Δ / AMA-Slope Δ (the unit stays on the health line, not repeated at the prompt). loadGeneralSettings validates the new value with the same >0 guard as the center-delta threshold, so a hand-edited 0/negative/NaN cannot silently disable the slope reset. Also relabels the first Grid Health value Ratio → Funds (the trigger is available-funds/allocated-capital, so the old name was vague; config key GRID_REGENERATION_PERCENTAGE unchanged) and its prompt Grid Ratio Regeneration % → Grid Funds Regeneration %. Docs: README.md global-settings reference and the docs/GRID_RECALCULATION.md range-scaling trigger note updated (modules/account_bots.ts, README.md, docs/GRID_RECALCULATION.md).

• Refactor(whitelist): remove the legacy dexbot whitelist/white command and its bulk generator — scripts/generate_market_adapter_whitelist.ts and the market-adapter:whitelist npm script are fully superseded by the per-bot editor (dexbot bot -> 2) Modify bot -> 6) Adapter), which reads/writes profiles/market_adapter_whitelist.json directly. The command, script, CLI help/alias/docstring entries, and all docs/tests that referenced it are gone; deleting a bot in the editor now prunes its whitelist entry via a new removeWhitelistEntry(botKey) helper (modules/market_adapter_whitelist.ts), run only after the bots.json save succeeds (modules/account_bots.ts), so a deleted bot cannot leave stale flags for a future same-name bot to inherit (a malformed whitelist file aborts the removal and is never silently replaced). Behavioral impact: dexbot whitelist/white is an unknown command; bots removed by hand-editing bots.json still need manual pruning (documented in market_adapter/README.md). New tests/test_account_bots_adapter.ts case (dexbot.ts, package.json, scripts/README.md, scripts/reset-settings.sh, docs/README.md, docs/GRID_RECALCULATION.md, docs/WORKFLOW.md, market_adapter/README.md).

• Feat(bot-editor): default gridPrice to ama3 and color AMA values as healthy — DEFAULT_CONFIG.gridPrice was null (delegating to startPrice), so a freshly created bot priced its bounds off startPrice while every other AMA-capable path expects a preset; the editor also greened pool/book/numeric exactly like valid AMA values. DEFAULT_CONFIG.gridPrice is now "ama3" (modules/constants.ts), the prompt label reads gridPrice (ama1/ama2/ama3/ama4) (bare ama still accepted), and colorGridPriceValue() greens only AMA values and reds pool/book/numeric/null across the Enter default, live input echo, and 3) Price menu line. Section 6) Adapter now renders Price/Weight/Range through colorBooleanFlag(v, true) instead of a local gray-for-false lambda, so each flag reads as a health state (green on, red off) like Active — the optional Weight/Range off-state was later softened to bright yellow (see the Fix(bot-editor) entry above). Input acceptance is unchanged — pool, book, bare ama, ama1..ama4, positive numbers, none/null/startprice, and Enter keeping the current value all still work; red flags "not an AMA value" rather than blocking it. New drafts and configs missing the key seed ama3; explicit values in existing bots entries are untouched (seeding fills only undefined), and whitelist flags stay false for a bot with no entry, so an ama3 bot starts in adapter dry-run and falls back to startPrice with a warning until Adapter -> Price is enabled. modules/bot_defaults.ts and tests/test_bot_defaults_characterization.ts follow the new default.

• Refactor(launcher): spawn the supervised bot worker as worker, not test — dexbot start launched the bot as dist/dexbot.js test, which read like a test job in htop/ps even though it is the live runtime. buildDexbotStartArgs now emits ['worker', ...(dryrun ? ['--dryrun'] : []), botName?] (modules/launcher/monolithic_runtime.ts); unlock.ts sets DEXBOT_LAUNCHER_WORKER=1 on the child env (modules/config.ts exposes the flag) and dexbot.ts intercepts the internal worker command when the marker is set, before command validation, so it never re-enters the supervisor. Public dexbot start still delegates to unlock; the test help wording was clarified. Launcher/unlock tests updated, including an assertion that the child carries the worker marker.

• Fix(update): rebuild when source is current but dist/ is stale — the git update flow exited before npm run build when there were no incoming commits, and tsc's incremental cache will not re-emit an output it believes is current (it will not even recreate a deleted file), so a dist/ that lagged its source stayed stale while every later run reported "already up to date"; the old guard only checked the dist/modules/dexbot_class.js mtime, so a stale dist/dexbot.js (holding the CLI alias table) went unnoticed. New scripts/update_dist_freshness.ts detects missing/stale outputs without invoking the compiler over exactly the root tsconfig include roots; scripts/update.ts self-heals on the no-op path (force a full rebuild, then restart), re-checks and force-emits on the normal path, and assertDistBundleFresh() replaces the single-marker guard with a full-bundle check. New tests/test_update_dist_freshness.ts covers missing entries, missing/stale counterparts, root-level entry points, and non-compiled files.

• Feat(defaults): centralize bot defaults, settings-doc building, and whitelist flags — seven scattered producers applied DEFAULT_CONFIG and whitelist defaults independently and had already drifted. New modules/bot_defaults.ts (seedBotDraft/seedBotEntry/seedBotRuntimeConfig with classified key sets, normalizeBotDraft/normalizeBotEntry) now backs the editor draft, bot_settings + claw, and the OrderManager constructor. buildDefaultGeneralSettings() (modules/constants.ts) and buildNodesView() (modules/settings_merge.ts) give the first-run generator, the editor fallback (account_bots.loadGeneralSettings), and the local-overrides merge one shared document (loadGeneralSettings/saveGeneralSettings now exported). DEFAULT_WHITELIST_FLAGS/AMA_ONLY/ALL_ENABLED constants replace every inline flag literal. Behavioral impact: a draft's gridPrice follows a DEFAULT_CONFIG.gridPrice override (the default was still null at this stage of the refactor; a subsequent change in the same release set it to ama3); a missing bot.active sources DEFAULT_CONFIG.active (was hardcoded true) and claw no longer coerces present null/0, unifying on active !== false; OrderManager clones absent defaults so config mutations cannot leak into the global default; brand-new first-run settings files gain NODE_MANAGEMENT, drop ANCHOR:{}, and match the editor key order. Existing bots.json/general.settings.json are not rewritten (merge output verified byte-identical to a pre-refactor baseline). Tests: 295/295 files passed; new tests/test_bot_defaults_characterization.ts, tests/test_bot_defaults_parity.ts, and a claw delegation test.

• Feat(bot-editor): manage market-adapter whitelist flags from the editor — the per-bot Price/Weight/Range flags (ama/dynamicWeight/asymmetricBounds) previously required running the dexbot white script with the correct botKey; a wrong key silently wrote a useless entry and the script remained the only way to flip a single flag. New 6) Adapter section in modules/account_bots.ts stages the three flags and commits them only after bots.json saved (migrating the entry on rename); parseBooleanInput fixes askBoolean parsing 'true' as false and accepting any garbage (y/yes/true, n/no/false, Enter keeps current). modules/market_adapter_whitelist.ts gains setWhitelistFlags()/renameWhitelistEntry() read-modify-write helpers — an occupied key refuses the rename, a malformed file aborts instead of clobbering, legacy array-form entries are preserved, and keys are written sorted. Docs now point to dexbot bot -> 6) Adapter. New tests/test_account_bots_adapter.ts (boolean parsing, flag writes, rename/collision, legacy and malformed-file coverage); npm test 293 passed / 0 failed, verify:browser-bundle 39/39, tsc --noEmit clean. Risk: writes touch the same file dexbot white owned; unchanged flags are never rewritten.

• Feat(market-adapter): log-symmetric range-scaling tilt — range scaling previously widened the trend side by (1+a) but tightened the opposite side by (1-a), which in log space made the tighten ~40% more aggressive than the widen at the default cap of 0.333x, collapsing the non-trend side toward center. Both bounds now scale by the same factor (down 1/(1+a), up (1+a)), so delta log = +/-ln(1+a) exactly and total log-width (slot count) is preserved while only the band's geometric center translates toward the trend; the widened side is unchanged and the tightened side is now the reciprocal rather than the linear complement. The geometric safe-clamp is mirrored to base* - 1 so the shifted tightened bound still contains the fixed AMA center (still required: the reciprocal prevents reaching zero, not crossing center). market_adapter/core/asymmetric_bounds.ts, modules/constants.ts, market_adapter/README.md, and tests updated; tests/test_market_adapter_service.ts now sets process.exitCode on failure so its catch no longer masks a real failure. Behavioral change: with range scaling enabled the non-trend bound sits further from center (a 1.55x base at full tilt lands at +16.5% instead of +3.9%). The live grid build, adapter metrics, analyze-orders display, and the TradingView chart (embedded canonical source) all share this function.

• Docs: sync documentation index and linked docs with runtime behavior — docs/README.md bullets still described pre-1.6.4 behavior (batch cap is gapSlots+1, log rotation is 1.1GB total budget / 10 files, the maxPages warning is debug-level, duplicate detection is exact slot-price); docs/architecture.md's batcher diagram/table said default cap 4 after 1f2fd7ae raised it to gapSlots+1; docs/GRID_RECONCILE.md Phase-1 duplicate detection described the removed 5x fuzzy matcher (code uses priceSlotEqual exact equality); docs/FUND_MOVEMENT_AND_ACCOUNTING.md dust partials are cancelled immediately on detection, not marked for consolidation; docs/EVOLUTION.md footer/stats refreshed to repo HEAD. Docs-only.

• Feat(analysis): add an ema knob to the dynamic-weight chart for AMA input smoothing — the AMA slope channel had no post-filter besides the nz% dead-band, so there was no way to research how much additional slope smoothing (peak trimming, fewer sign flips) improves weight stability before touching live code. The dynamic-weight chart gains an ema slider (0-32 bars, 0 = off = previous behavior) that EMA-filters the AMA input before the slope; the clip-percentile pool and canonical computeDynamicWeightSeries offsets derive from it, so one source feeds display, clipping, and pipeline. Panel 2 gains a gray dashed Raw fraction-per-mille reference line and legend entry; the knob participates in SLIDER_RANGES clamps, copy/paste (amaEmaSpan), and init form-restore. analyze_dynamic_weight gains --ema (absent/NaN/out-of-range all resolve to the clamped default). DYNAMIC_WEIGHT_RESEARCH documents the flag row, knob table row, span value table, tuning interactions, and the measured effect on ~8.7k hourly bars (std -3% / peaks -22% / crossings 86 -> 74 at span 9). Research only; default ema = 0 reproduces prior output, the live market adapter and shared dynamic_weight_series module are untouched.

• Feat(cli): add dexbot dw and centralize the chart-command pipeline — dexbot dw renders the dynamic-weight research chart through the same fetch pipeline as dexbot tv, but the pipeline lived in a tv-branded module with the exporter hardcoded. New scripts/chart_command.ts holds the shared pipeline (bot/pool-id/pair target resolution, --feed/--pool/--book routing with pool-first orderbook fallback, MPA/prediction-market guards, cached 1-month candle chunks, temp-JSON handoff) plus a RENDERERS registry (analyzer path, exporter label, title kind, usage blurb) so both commands (and future chart commands) are a table row apart; scripts/tv.ts and new scripts/dw.ts are thin entries with per-command error labels (loading them never triggers a run, test-asserted). Explicit --ama-er/fast/slow-period forwarding to the analyzer was dropped — both renderers resolve resolveAmaConfig() from --bot-key themselves, which also stops silently dropping the 4th field (erSmoothPeriod); verified output-identical for tv, and tv stays intentionally 3-param AMA. analysis/analyze_dynamic_weight.ts gains --title and a clickable file:// save link; dexbot.ts registers dw in CLI_COMMANDS/HELP_OWNING_COMMANDS and the shared tv/dw dispatch (advanced-only, root help/README unchanged; documented in scripts/README.md, analysis/README.md, analysis/trend_detection/DYNAMIC_WEIGHT_RESEARCH.md). Month flags: --month canonical (default 3), --months a pure alias, invalid values always report --month. New tests/test_dw_cli.ts; test_tv_feed_routing now imports scripts/chart_command.

2026-09-22

• Feat(log): tag RMS structural-divergence logs with [RMS] and show the threshold — the RMS reset line logged raw decimal metrics via formatPrice6 (buy=0.162000) with no threshold context, so operators could not tell which level fired or which side breached. resolveRmsThresholdPct() is extracted as the single source of truth for the GRID_COMPARISON.RMS_PERCENTAGE override chain (previously duplicated inline in compareGrids) and surfaced as thresholdPct through compareGrids/monitorDivergence: modules/order/grid.ts emits a per-side [RMS] debug line (metric vs threshold -> TRIGGER-RESYNC/no trigger) each tick plus a "checks disabled" variant when the threshold is 0, and modules/dexbot_maintenance_runtime.ts now prefixes the reset line with [RMS] and formats it as 4 significant digits (buy=16.20%) with threshold, breaching sides, and the resync reason; the failure warn is also tagged. The threshold check itself is unchanged (same override chain, same percent->decimal scaling), but log line format changes, so log scrapers keyed on the old literals must be updated (no legacy format retained). GRID_RECALCULATION.md signatures/examples and the LOGGING.md [RMS] prefix row updated (including the threshold=0 debug variant). Also fixes a red test left by f859941e (tests/test_market_adapter_log_format.ts now expects asymCap=33%).

• Fix(config): lower the default asymmetric bounds max factor to 0.333 — ASYMMETRIC_BOUNDS_MAX_ASYMMETRY_FACTOR moves 0.35 -> 0.333 so the slope-derived grid bound tilt is less aggressive. At the tight end of the supported span range (1.55x) full tilt previously pinched the tightened side to ~0.75% from the AMA center; 0.333 keeps ~3.3%, leaving the narrowing-side slot guard (minScaleSlots) more room before it overrides the tilt. Saturated band width moves from 87.75% to 88.91% of the symmetric base; wide 2x spans are effectively unchanged. The TradingView chart fallback and README defaults are synced to modules/constants.ts; local overrides in profiles/general.settings.json still take precedence at runtime.

• Style(ui): normalize bot editor separators — group related fields with | in the dexbot bot editor summary and keep within-group fields comma-separated, matching the Funding line style: Identity (Name/Account grouped, Active/DryRun comma), Price (Range/Start+Pool/GridPrice grouped with |), Grid (Weights group |, Incr/Spread comma), Funding (Sell/Buy comma, Orders/Reserve grouped with |). Presentational only (modules/account_bots.ts).

• Feat(tradingview): step the AMA ER stepper by 10 per click — the ER period defaults to 781, so the +/-1 per-click stepper (and its held-repeat) made any meaningful adjustment painfully slow. The step is now 10 (floor stays 1, integer rounding); other steppers (sma-period, vwap-bars, fast, slow) are unchanged (analysis/tradingview/tradingview_uplot_chart_generator.ts).

[1.6.4] - 2026-09-22 - Fund-Driven Spread Correction, GapSlots+1 Batch Cap, Analysis Shared Modules

2026-09-21

• Fix(grid): include VIRTUAL orders in RMS structural divergence — compareGrids() filtered each side's RMS metric to ACTIVE orders only, so persisted-vs-ideal drift in VIRTUAL slots was invisible. VIRTUAL slots carry the planned reservation for unplaced rail slots (funds.virtual), and Available = ChainFree − Virtual − fees, so an over-reserved or stale virtual pins spending power without ever tripping a structural check. filterForRms now covers ACTIVE + VIRTUAL (PARTIAL/SPREAD stay excluded); ideal sizing already covers every slot of the side, so no other logic changes. A side whose only divergence is in VIRTUAL reservations now yields an RMS metric and can trigger the rms_structural_grid_resync full resync; the 14.3% threshold is unchanged. Docs: divergence-filter wording corrected in docs/architecture.md and docs/GRID_RECALCULATION.md (modules/order/grid.ts, tests/test_grid_comparison.ts; full suite 291 pass / 0 fail).

• Feat(spread): make spread correction purely fund-driven with a balance refresh fallback — prepareSpreadCorrectionOrders / determineOrderSideByFunds shrank resting orders to manufacture budget (self-funded tail recycling plus a generic redistribution donor loop). Those paths moved inventory within a rail and were gamed by stale-size snapshots: a donor's "current" size could lag a fill, so the recovered budget was phantom and the grid churned instead of healing. All shrink paths removed: corrections are funded only by free available/chainFree; when no side has funds the check returns fundsExhausted and the maintenance runtime refreshes account totals + open orders on the next tick via getTargetedSyncReason (a stale zero balance is re-read, not met with inventory recycling). New tests/test_spread_pure_fund_driven.ts (zero free → no side/create/shrink; funded → spend ≤ free and top-up only); SGP-6 now expects a skip (modules/order/grid.ts, modules/dexbot_maintenance_runtime.ts, tests/test_targeted_drift_reconcile.ts).

• Fix(sync): stop false sync-lock "disappeared" logs and correct shadow-lock metric — _doSyncFromOpenOrders collected slot ids and chain order ids into orderIdsToLock, then re-verified each with mgr.orders.has(id). mgr.orders is keyed by slot id only, so every placed order's chain id failed the check and was logged as "disappeared between collection and locking" (~40 lines per sync, 3,461 in one production log) — phantom lines once mistaken for a COW race during a fill-storm investigation, and chain ids were silently dropped from the lock set. Collection and locking are synchronous, so the re-verification guarded an impossible window; the full collected set is now locked. shadowOrderIds aliases one order under two keys, so size double-counted live orders; new OrderManager.getActiveShadowLockCount() feeds the shadowLocks / shadowLocksActive metrics. New tests/test_sync_lock_id_verification.ts (modules/order/sync_engine.ts, modules/order/manager.ts, modules/dexbot_maintenance_runtime.ts).

• Feat(batch): raise fill/broadcast batch cap to gapSlots + 1 — _getGapSlotBatchSize(), the single source of truth for the fill-batch chunk size and the per-broadcast op cap, now returns the resolved gap-slot count + 1 instead of the count itself, giving one slot of headroom so a queue or operation set that previously spilled into an extra sequential broadcast chunk completes in a single cycle/transaction (1..gapSlots+1 fills → one unified batch; the non-finite/non-positive fallback still returns 1). Docs, constants/cow-runtime comments, and the batch-sizing tests updated to the new contract (modules/dexbot_class.ts, modules/constants.ts, modules/dexbot_cow_runtime.ts, tests/test_cow_ops_per_broadcast.ts, tests/test_fill_batch_chunking.ts, tests/sim_batching.ts).

2026-09-20

• Docs(invariant): make grid-price invariant doc a fully present-tense contract — drops the mixed-state "What is still open" section (the blocking check has seen live traffic: 75 judgeable checks, 0 violations across four live bot logs), folds each item into its owning section, documents runFinalPivotGate as the seventh gate, adds a key-constants table, and cross-links the doc from LIFECYCLE.md, COW_INVARIANTS.md (INV-GRID-004), GRID_RECONCILE.md, tests/README.md, and docs/README.md; repoints dead CONSOLIDATED_ORPHAN_FIX_SUMMARY.md references in CHANGELOG.md to the retrospective. Docs-only, no code or test behavior (docs/GRID_PRICE_INVARIANT.md, docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md).

• Refactor(code): purge dead code and internal-only exports across modules — drops the unreachable processed_transaction serializer chain in bitshares-native/serial/operations.ts (export list 98 → 17 names), the unused CliColors type, the never-read _recentlyRotatedOrderIds field, plus 56 internal-only exports across account/launcher/order/credential/crypto modules. Symbol visibility only, no behavioral impact (npx tsc --noEmit clean; npm test 290 pass, 0 fail).

• Docs(engine): consolidate order-engine docs and move legacy narrative to the history hubs — replaces docs/CONSOLIDATED_ORPHAN_FIX_SUMMARY.md with the synthesis hub docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md (§0–§8 numbering preserved: code comments and tests cite it), folds the grid-price-invariant history into retrospective Appendix A, and refreshes drifted refs/symbols across COW_INVARIANTS.md, GRID_RECONCILE.md, LIFECYCLE.md, FUND_MOVEMENT_AND_ACCOUNTING.md, and architecture.md. History (COW three-era/build-step narrative, memory-only tracking) moves into docs/EVOLUTION.md; docs/comment-only change, no runtime behavior.

2026-09-18

• Fix(range): restore suizidal range threshold to 1.45x — reverts the 1.40 widening so sub-1.45x ranges flag red (suizidal) again and the tight orange zone is 1.45x–1.55x; single-sourced via RANGE_QUALITY, bot-editor legend and live range coloring only (modules/constants.ts). Trivial: TradingView toolbar tag shortened to Offset (tooltip keeps full name).

2026-09-16

• Docs(onboarding): first-run troubleshooting — npm 12 install-script blocking + manual-build fallback, dexbot unknown-command diagnosis (failed link vs stale shell cache), npm link EACCES recovery, and pacman -Syu for Arch-derivative installs (docs/BITSHARES_ONBOARDING.md, README.md, scripts/git-viewer.sh). Docs-only.

• Refactor(analysis): centralize account/node handling, drop --node flags — new analysis/chain_pool.ts (single read-only chain entry point), analysis/account_resolver.ts (single preferredAccount/override decision tree), and analysis/fills_source.ts (shared asset-precision table + paginated fill fetch); trade_profitability.ts and grid_correction_check.ts use the shared modules. Name → accountId resolution always goes through the full built-in pool; breaks anyone passing the undocumented --node flag; no production runtime path touched. New tests/test_analysis_account_resolver.ts; full suite 290 pass, 0 fail, 15 live skipped.

• Feat(analysis): window-aware annualisation of profitability metrics — Sharpe/Sortino now bin the queried window into whole periods (daily for ≥3-day windows, else hourly), zero-filled so flat periods count as 0 PnL, with sample (n−1) variance and √periods-per-year scaling; Sharpe prints with Lo-2002 estimation error, Sortino returns Infinity with no losing periods; new "Projected net PnL" (scored net / scored days × 365); trailing partial periods excluded from ratios, projection, and activity rates via one shared predicate (analysis/trade_profitability.ts, tests/test_trade_profitability_fees.ts, analysis/README.md).

• Feat(charts): inline vendored uPlot into generated chart HTML — every generated chart embeds the vendored uPlot JS+CSS via uplotInlineTags(), so each export is a single self-contained document rendering anywhere with no CDN, install, or sibling-dir dependency (~53KB per chart; tests assert the banner is present and no ../uplot/ reference remains).

• Fix(update): don't fake pm2 process list or claim restarts that failed — when pm2 jlist fails the selective restart step no longer substitutes config-active bots for the process list, and restarted is set only when at least one pm2 restart succeeds, so the monolithic auto-start fallback and the manual-start notice fire correctly on installs without pm2 (scripts/update.ts).

[1.6.3] - 2026-09-14 - Correction-Queue Staleness Guard, Grid-Checker Price Epochs, Final Pivot Gate

2026-09-15

• Fix(guard): final pre-broadcast pivot gate — a fill queued AFTER the batch-start pivot freeze but BEFORE broadcast passed every per-action LAST-FILL-GUARD check on a stale pivot (live incident on a market-pair bot: freeze at .745, sell fill queued at .765, batch of 4 broadcast at .910 against a buy pivot; the violating sell rotation filled 6s later, 0.6% below the true sell threshold, and tripped the fund invariant on drain). New runFinalPivotGate() re-checks BUILT ops against a re-refreshed pivot after the op-building loop and before the batch summary, fund validation, and single-flight claim: unchanged pivot is a pure no-op (arrays untouched, no extra probes); a moved/armed pivot re-runs the guard on each op's final price with the build loop's bypass rules (spread-correction CREATEs incl. batch-origin fallback, stamped gap-evacuations; unstamped evacuations guarded normally, same-slot UPDATEs resolve via source-id fallback) and drops violators into the existing skipped-slot restore paths (rotations restore source+dest from master, creates feed the refill-hold intersect, dropped CREATE pending entries removed by slot). Fail-open throughout: unresolvable price/type, cold pivot, and refresh throws all KEEP the op; cancels and size-updates are never gated. Pair-mode/chunk grouping is computed lazily at broadcast from the filtered opContexts (no stored indexes go stale); cancelOpIndexByOrderId (no live readers past op-building) is rebuilt from kept contexts as defence-in-depth. Pending-index hygiene: the gate's compaction REMAPS this batch's kept pending-broadcast entries' stored opIndex/ctxIndex to the compacted positions (lockstep keeps the two arrays aligned with each other but does not rewrite indexes stored inside pending entries — an unremapped ctxIndex would resolve to a shifted context after the first drop, letting the uncertain-broadcast reconcile adopt a matched chain order into the wrong slot); entries are identified by the fingerprints collected at record time (recordPendingBroadcast now returns its fingerprint; entry.batchId is always null in production and cannot discriminate), and entries whose referenced op was dropped are removed. Gate stats are kept separate from the build loop's counters (own finalGateStats object; reported as gateChecked/gatePassed/gateSkipped/gateBypassed fields on the batch summary, omitted when the gate did not re-check) so the summary's checked/passed/skipped totals stay the build loop's verdicts. The frozen pivot is captured AFTER the batch-start refresh (the refresh is part of the freeze) so batches whose freeze picked up a pre-freeze queued fill no longer trigger a spurious "pivot moved" warn + redundant re-check. Observability: always-on Final gate: queue a->b pivot x->y at debug, pivot-moved line at warn with freeze-queue depth + drop count, per-drop lines at warn. New tests/test_final_pivot_gate.ts (FG-1..FG-11, incl. incident replay dropping both violating rotations, the same-slot fallback, and pending-index remap identity checks); neighbor suites green (modules/dexbot_cow_runtime.ts).

2026-09-14

• Fix(correction-queue): validate queued price corrections against the live slot before broadcast — corrections are queued as snapshots (expected price/size at detect time), but a geometry-changing resync re-slots/re-prices orders without invalidating the queue, so the maintenance pre-gate drain replayed stale snapshots and broadcast UPDATEs that reverted resync placements back onto occupied levels. Entries are now validated pre-broadcast against the live slot (ownership, price via slot predicates, size via integer quantum); stale entries are dropped and self-heal via the next sync re-queue. Zero-delta updateOrder returns {success:true, skipped:true} so routine no-ops no longer count as permanent failures; queue removal/dedupe is keyed on (chainOrderId, isSurplus) so sibling entries sharing a chain id survive; queuedAt/queuedBy provenance is stamped at queue time (sync detectors + gap-evacuation); drain summaries report staleDropped to keep failure WARN a true signal. New tests/test_correction_queue_staleness.ts (11 cases); 10 neighbor suites green (modules/order/utils/order.ts, modules/order/sync_engine.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/order/manager.ts).

• Fix(checker): split grid-correction checker fills into price epochs across repriced order lifetimes — the checker combined fills from different lifetimes of one order id after native repricing (limit-order update) operations and reported a false monotonicity violation. It now queries limit-order update operations and splits fills into chronological price epochs, preserving weighted aggregation for partial fills within one unchanged epoch (analysis/grid_correction_check.ts, analysis/README.md; TypeScript build passes, historical checker run clean).

[1.6.2] - 2026-09-14 - Grid-Price Invariant, Gap-Slot Batch Sizing, Candle Shard Cache, Recovery Tolerance, Fill Counter Hygiene, Node List Cleanup

2026-09-14

• Fix(grid): enforce grid-price invariant at emission sites + escalate persistent corruption and stranded holds — the engine had two sources of truth for a slot's price — the genesis ladder (priceForSlot(idx, genesis)) and the mutable slot.price field — and every violation was the second winning over the first. Five mechanisms fed it: orphan adoption overwrote the slot's identity price (S1), a pre-broadcast "freshness" step re-substituted that corrupted price at debug level (S2), guards checked range membership but never grid membership (S3), the fill-guard pivot was written from unvalidated fill prices (S4), and guard bypasses skipped even that (S5). New checkGridPriceInvariant / reportGridPriceInvariant (modules/order/utils/order.ts) require the emitted price for a slot to equal its genesis level (fail-open on everything unjudgeable: no genesis, unparseable id, out-of-ladder index, non-finite price, checker error), enforced blocking at all six emission sites: CREATE, UPDATE (rotation), CREATE-FALLBACK (modules/dexbot_cow_runtime.ts); RECONCILE-CREATE, RECONCILE-UPDATE, STARTUP-CREATE (modules/order/grid_reconcile_internal.ts). Rotation UPDATE derives the emitted price from the destination slot's genesis level (deriveRotationPrice) instead of trusting the planner's carried newPrice; both pre-broadcast price substitutions removed (drift reported at warn, never adopted); legacy orphan adoption no longer writes chainOrder.price into slot.price and gains a rail guard; materialize path derives slot price (and side) from the ladder; loadGrid repairs a mismatched slot price from the genesis ladder in both validation modes; fill-guard pivot validated onto the ladder (resolveOnGridPivot: near-ladder pivots snap, far off-ladder fail open and are counted as pivotOffGrid). Persistent invariant rejection escalates after GRID_PRICE_INVARIANT_RESYNC_THRESHOLD consecutive rejecting batches per slot (bot-scoped streak, reset on clean check, 15m cooldown) to requestStructuralGridResync('grid-price-invariant-violation'). Out-of-bounds policy: hold and surface — grid geometry is not invalidated by the market leaving it (the removed 5% placement gate is documented as a design deadlock, not a tuning problem). New docs/GRID_PRICE_INVARIANT.md plus docs/README.md index entry and a CONSOLIDATED_ORPHAN_FIX_SUMMARY.md status refresh (now absorbed into docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md). Tests: new tests/test_grid_price_invariant_guard.ts (GPI-001..015) and tests/test_grid_price_invariant_wiring.ts (GPI-WIRE-001..008) plus tests/test_startup_and_guard_log_hygiene.ts (GPI-LOG-001); every behavioral fix mutation-tested (11 escalation/guard mutations verified); audited over 1,153 slots across five geometries with zero rejections; full suite 282/282 pass (modules/order/utils/order.ts, modules/dexbot_cow_runtime.ts, modules/order/grid_reconcile_internal.ts, modules/order/grid.ts).

• Fix(fill): retire deferred-retry counter on queue settle + pin COW finally drain — the fill-consumer deferral counter (_deferredFillRetryWaits) only retired when a pending retry timer fired against an already-empty queue, so a queue drained by any other path left the counter elevated and the deferral log cadence stuck at warn (every 12th defer) after the backlog cleared. The counter now retires in consumeFillQueue at both settle points (top-of-run empty early-return and tail-after-drain); _deferredFillRetryTimer declared/initialized on the bot class and cleared on shutdown so the unref'd timer cannot leak across lifecycle restarts. New RETRY-007 pins the counter reset on a clean drain (7 → 0 on settle); RETRY-006 pins the COW batch finally (injected _ensureCredentialDaemonWritable throw after _batchInFlight++ / _cowBroadcastInFlight asserts the finally releases both and reschedules the fill consumer exactly once; the COW layer converts the throw into a handled {executed:false} abort via _handleBatchHardAbort) (modules/dexbot_fill_runtime.ts, modules/dexbot_class.ts, tests/test_fill_defer_retry.ts; neighbors green, tsc --noEmit clean).

• Fix(recovery): tolerate transient in-band stranding in persisted-boundary gate — a mid-evacuation persisted snapshot (honest boundary one crawl stale, live order stranded in-band by SPREAD GUARD) failed the restore gate's placed_order_in_band check and forced rms_structural_grid_resync, wiping boundary progression, owed crawls, streaks, and the queued GAP-EVAC plan on every uncertain-broadcast recovery (observed: boundary regressed five slots 93 → 88, five owed fill crawls dropped, one live chain order left unmatched, three structural resyncs in twelve minutes). The gate's premise ("honest writers never strand") is disproven: SPREAD GUARD keeps live rail orders in-band across fill-driven boundary crawls by design, and GAP-EVAC heals them per-slot over 2–3 cycles — stranding alone is not a poison signature. validateBoundaryCommit now records in-band placements instead of early-returning, crossed_book_geometry takes precedence over a co-occurring strand, and the full scan no longer skips rail slots after the first strand; new isTransientInBandRejection() (pure stranding, any count, no structural signal) with shared constant BOUNDARY_REJECT_PLACED_IN_BAND. recoverFromPersistedGrid tolerates transient stranding with a warn and proceeds with load (true poison still refuses); loadGrid gains optional options.tolerateTransientStranding (default strict, existing callers unchanged). Startup strict path degrading a mid-evacuation strand to boundary-less is a known follow-up; runtime backstops (GAP-EVAC streaks + cancel-only teeth, commit-time gate, P4 fund-drift snapshot reject) own persistent cases (modules/order/utils/math.ts, modules/dexbot_state_recovery.ts, modules/order/grid.ts, tests/test_boundary_restore_validation.ts 9/9; gap-evac, persistence, bloat, crawl, uncertain-broadcast suites pass; tsc --noEmit clean).

• Fix(nodes): prune dead default nodes and single-source the connection-trace node list — NODE_MANAGEMENT.DEFAULT_NODES drops three dead endpoints, leaving seven live defaults; tests/test_connection_trace.ts no longer carries its own hardcoded copy — it reads NODE_MANAGEMENT.DEFAULT_NODES with an optional BITSHARES_TRACE_NODE override for single-node tracing, and the transport login probe uses NODES[0] instead of a hardcoded URL, so future node-list changes propagate automatically (modules/constants.ts, tests/test_connection_trace.ts).

• Test(seams): eliminate wall-clock sleeps and live-chain hangs from offline tests — offline unit tests slept on production pacing delays and opened real WebSocket connections (suite past 125s, several files over 5s each). New production test seams with defaults unchanged: createSubscriptionManager accepts overrides.noticeCoalesceMs (page-timeout watchdog unref'd), COW options.pollIntervalMs for the 1.5s missing-create poll (set/restored via try/finally across every batch exit path incl. re-plan recursion), scheduleDeferredFillRetry/parkFillsForTotalsRetry retryDelayMs, credit-split settleDelayMs plus overridable collateral-balance fetch, sync-engine targeted-refetch fns plus _skipEmptyReadConfirmDelay, and disconnectClient stopping node health monitoring on teardown. New resolveSeamMs()/resolveSeamMsOrNull() (modules/utils/errors.ts) consolidate seam resolution (explicit 0 disables the delay; null/undefined falls through to the default — fixes retryDelayMs > 0 silently dropping explicit 0 and Number(null) === 0 selecting 0); each caller records its resolved delay so tests assert resolution instead of wall-clock timing (write-only in production). New tests/test_seam_resolve.ts plus COW-COMMIT-012 (seam restore on the guard-refusal path, precedence explicit > bot > default, explicit 0 honored) and RETRY-003b / TOTALS-004 (0 resolves to 0 — the only discriminating input for ||-vs-?? regressions, verified by fault injection); two stale pre-eager-gap-recovery mock expectations corrected, dead CJS override removed. Suite 287 passed, 0 failed, 15 live skipped, ~85s (was ~126s); tsc main + tests clean (modules/bitshares-native/subscriptions.ts, modules/bitshares_client.ts, modules/credit_runtime.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_startup_runtime.ts, modules/order/sync_engine.ts, modules/utils/errors.ts).

2026-09-13

• Feat(batch): derive fill/broadcast batch sizing from gap-slot count — two independent fixed caps (FILL_PROCESSING.MAX_FILL_BATCH_SIZE and COW_PERFORMANCE.MAX_OPS_PER_BROADCAST, both 4) bounded fill batching and per-broadcast order operations with no relationship to actual grid geometry. New _getGapSlotBatchSize() resolves via resolveGapSlots() (manager._gapSlots, else calculateGapSlots(config), ≥1 floor, falls back to 1 on failure); legacy _getMaxFillBatchSize() / _getMaxOpsPerBroadcast() kept as thin aliases; dead config._gapSlots fallback operand removed; both constants removed from modules/constants.ts (remaining COW_PERFORMANCE keys unchanged). executeChunkedWithRetryOnUncertain prefers the gap-slot size with its own ≥1 guard. Docs across architecture.md, LIFECYCLE.md, FUND_MOVEMENT_AND_ACCOUNTING.md, developer_guide.md use gap-slot batch sizing terminology (stale FILL_PROCESSING snippet removed); COPY_ON_WRITE_MASTER_PLAN.md marks MAX_OPS_PER_BROADCAST removed with a pointer. Completed/obsolete legacy docs removed (not describing anything still in the code): BROWSER_COMPAT_PLAN.md (superseded by the package.json browser field + AGENTS.md), GRID_PRICE_SLOT_DETERMINISM_PLAN.md (implemented), PLAN_FILL_STALE_RESTORE_MAIN.md (implemented), PLAN_MIN_BTS_VALUE.md (completed plan), crash_report_jan_mar_2026.md (historical incident). Batch size now scales with grid size by construction (larger-gap grids produce larger fill batches and larger single broadcast transactions than the old fixed cap of 4 — intended); removed keys simply drop out of the runtime-settings override merge, no remaining consumers (modules/dexbot_class.ts, modules/constants.ts, modules/dexbot_cow_runtime.ts; tests/test_cow_ops_per_broadcast.ts mirrors via manager._gapSlots with strict calculateGapSlots equality, chunking/death-spiral expectations updated, tests/sim_batching.ts uses the GAP_SLOTS constant; full npm test exit 0).

• Fix(cache): store Kibana candle cache in stable calendar-month shards — run-relative chunk files (chunk_<index>_<dates>) shifted names on every run because windows anchor at floored-now, forcing a full rewrite plus an orphan-deletion pass each invocation; the deletion destroyed cached history (fully-disjoint files wiped by narrow runs, boundary-straddling files losing out-of-window buckets). Storage is now fixed UTC calendar-month shards (<base>.shard_YYYY-MM.json) decoupled from querying: runs load only overlapping shards, fetch only genuinely missing buckets, and rewrite solely shards that gained buckets (higher-volume-wins) or query coverage (monotonically unioned queriedRanges); pure-reuse runs do zero writes/deletes. Legacy *.chunk_* files are absorbed (buckets + clipped coverage folded into shards) and retired only when every bucket provably lives in a shard; disjoint legacy is never loaded or deleted. Removed cleanupOrphanCacheChunks, chunkPathFor, siblingChunkFiles, priorQueriedInWindow; preserved immutable-gap pruning, 48h tail refresh, partial-window withholding, fetch retry budget. Windows are now fetch-planning splits only ({index, gte, lte}); the LP orphan-cleanup wrapper/export is dropped. Preceded by the narrower prune-scope fix (run passes its active coverage; orphans whose meta.timeRange does not overlap it are kept) plus the chart fixes it was validated against (issues #29/#30): update-marker div reuse (um-wrap class) and log-scale vertical-pan/wheel-zoom bbox offset correction (market_adapter/inputs/window_cache.ts, market_adapter/inputs/fetch_lp_data.ts, market_adapter/README.md, analysis/tradingview/tradingview_uplot_chart_generator.ts; tests/test_window_cache.ts rewritten with shard mapping, coverage set ops, scoped-load, and end-to-end integrations; LP/book assertions target .shard_ files; full suite exit 0; live-verified: repeated feed chart runs show pure reuse, a wider run refetched one genuinely-lost span and left 7 stable shards).

[1.6.1] - 2026-09-13 - Never-Run-Stale Hardening, Whitelist Range-Scaling Opt-In, Live-Save Docs, Shelf-Count Hardening

2026-09-13

• Fix(recovery): give the GRID-PRICE-INVARIANT guard and the deferred-hold policy a self-healing exit — both had the same shape (state the guard refuses to emit, but nothing repairs it) and both now escalate to the existing structural resync rather than running forever. A slot rejected as off-grid is skipped and warned, which is correct for a one-off, but the recurring planner carries the slot's price straight from manager.orders, so an in-process corruption is re-planned, re-rejected and re-warned every cycle with nothing able to heal it short of a restart — the slot is dead while the bot looks healthy, and the repeated warns train operators to ignore them. The guard now counts consecutive rejecting batches per slot (bot-scoped — the monolithic runtime (dexbot.ts, the dexbot bin) builds EVERY active bot in one process, so a module-level streak would let one bot's rejections push another to the threshold on its FIRST rejection and fire a spurious resync on a healthy bot, and the count also must not outlive a repair; GPI-WIRE-009 pins the cross-bot case) and at TIMING.GRID_PRICE_INVARIANT_RESYNC_THRESHOLD (3) fires requestStructuralGridResync('grid-price-invariant-violation', {slotId, expected, actual, site, streak}); a clean check clears the streak so escalation means "rejected N consecutive batches", not "N times ever", and GRID_PRICE_INVARIANT_RESYNC_COOLDOWN_MS (15m) bounds repeats. Healing in place at rejection time is deliberately NOT done — silently rewriting slot.price would erase the diagnostic signal distinguishing the four corruption sources. Separately, out-of-rail orphans hold locked funds and are never auto-cancelled per cycle (correct: cancelling on ambiguous evidence is irreversible), but "held indefinitely" had no exit; a hold whose signature is unchanged for DEFERRED_HOLD_ESCALATE_MS (24h) now escalates at error to requestStructuralGridResync('deferred-hold-stale'), which is safe because the full reset's reconcile is update-first (unmatched orders are price-updated onto rail slots, only true surplus cancelled), so funds are released without inventing a new cancellation policy. Hold age is tracked per stranded order (bot-scoped map keyed id@price/size:reason), because two simpler clocks were wrong: manager._lastUnmatchedChainOrdersAt is unconditionally refreshed on every sync observing any unmatched order, so it records "when we last looked" and an age gate on it could never fire (HOLD-007 pins this); and the whole-held-set signature clock looked correct but was reset by unrelated churn — the signature includes every entry's reason, so an unrelated hold flapping in and out restarted the clock every cycle and starved a genuinely stranded order of escalation forever (HOLD-010 pins this; a 6-hourly flap was simulated reporting a clock reset on every tick). A third defect sat in the same path: the signature-change branch returned before the escalation call, so any churn skipped escalation entirely — escalation now runs on both branches, since a signature change is a reason to re-log, not to stop evaluating age. Escalation triggers only on genuinely stranded reasons via a narrow allow-list (isStrandedHoldOrder: out-of-rail-deferred, out-of-grid-deferred) rather than the broad -deferred non-blocking filter, because a resync cannot end a broadcast region or re-evaluate an uncommitted boundary; broadcast-active-deferred, boundary-hold-trailing-market, boundary-unknown-deferred and held-plan-unchanged-deferred are excluded (HOLD-011 pins this), and the allow-list fails closed so a future transient reason is excluded by default. Both escalations reuse the existing debounced, batch-in-flight-aware resync path; a second repair mechanism would duplicate tested machinery. New GPI-WIRE-006..009 (tests/test_grid_price_invariant_wiring.ts) and HOLD-006..011 (tests/test_hold_and_center_guards.ts); mutation-verified that removing the escalation call, removing the streak reset, disabling the cooldown, removing the hold escalation, re-gating escalation behind the signature early return, reading the hold age from the whole-set clock, and replacing the stranded allow-list with the broad -deferred filter are each caught (modules/constants.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts, docs/GRID_PRICE_INVARIANT.md, docs/ORDER_ENGINE_POST_1.0_RETROSPECTIVE.md — successor of the then-cited docs/CONSOLIDATED_ORPHAN_FIX_SUMMARY.md).

• Fix(shelf): exclude shelf orders from every grid count (issue #27 follow-up) — the four shelf follow-ups gated reserveEdgeIdSet, matchedExcess, and the geometric size recalc to parseSlotIndex(id) !== null, but three counters feeding the same decisions never got the gate, so a live fork-kept shelf (non-slot-N id, ACTIVE + orderId) still poisoned them via the fail-open isSlotInRail geometry. _countActiveOnGrid inflated matchedOnGrid (suppressing neededSlots/creates), chainCount in _reconcileStartupSide counted shelf-bound chain orders (fabricating a chain - target surplus that cancelled real window orders), countLiveGridOrders masked window shortfalls in targeted sync, and _getOnChainOrders plus the spread buyCount/sellCount masked oneSideEmpty. All now apply the same slot-N gate (no-op on grids that only mint slot-N ids); shelf stays in the geometric-recalc denominator by design (conservative sizing direction). _pickVirtualSlotsToActivate and the getInitialOrdersToActivate window picks are gated too so a VIRTUAL shelf can never consume window activation budget (modules/order/grid_reconcile_internal.ts, modules/dexbot_maintenance_runtime.ts, modules/order/grid.ts, modules/order/manager.ts; tests/test_reserve_orders.ts shelf expectations corrected to the fixed behavior — chain 12 grid vs target 8 plans 4 rail cancels, grid count converges to 8 with 3 shelf surviving alongside — plus a new block pinning _countActiveOnGrid, startup create non-suppression, targeted-sync buy 5/8 firing through shelf, and slot-N-only activation picks; tests/test_startup_decision.ts, tests/test_resync_balance_fix.ts, tests/test_resync_duplicate_race.ts fixtures migrated from ad-hoc ids to slot-N ids per the production invariant; full suite exit 0, zero failures).

• Fix(whitelist): disable range scaling in whitelist defaults — AMA whitelist generation is conservative by default so new entries enable AMA live writes without enabling dynamic weights or asymmetric range scaling; new explicit asymmetric-bounds opt-in flags for new and targeted entries, legacy array-form whitelist entries interpreted as AMA-only, CLI help and generation tests updated for the new defaults; README, onboarding, market-adapter, and grid-recalculation guidance aligned with the range-scaling opt-in behavior (modules/market_adapter_whitelist.ts, scripts/generate_market_adapter_whitelist.ts, dexbot.ts, README.md, docs/BITSHARES_ONBOARDING.md, docs/GRID_RECALCULATION.md, market_adapter/README.md, scripts/README.md, tests/test_market_adapter_fixes.ts).

2026-09-12

• Fix(stale): never-run-stale hardening for deferred-fill and spread-correction hangs — a live market-pair bot froze after its sell fills were processed during an already-ended broadcast region: the edge-triggered region-end retry never fired, the owed boundary shift was never applied, and no future fills could unblock the grid. Audit of the same "retry depends on a future event" class found three more silent-hang paths; all deferred work is now level-triggered (scheduled at defer time) with time-based watchdogs, so no retry depends on an event that may never come. Deferred fill retry schedules DexbotStateRecovery.schedulePostRecoveryRebalance directly whenever any chunk defers (level-triggered, idempotent — first trigger wins alongside the hook). Stale-totals deferral no longer drops fills: fills deferred on a failed accountTotals refresh were already spliced from the queue while their dedupe keys stayed marked processed (silent fund loss with a "retrying next cycle" comment but no next cycle without backlog) — now releaseFillDedupeKeys + parkFillsForTotalsRetry parks them outside the live queue (idle gate keeps working) and re-queues on a backoff timer (10s doubling, 60s cap, attempt resets on clean cycle, capped at MAX_INCOMING_FILL_QUEUE). Out-of-spread persistence watchdog trackOutOfSpreadStaleness warns at 10min and structural re-centers at 30min with 5min cooldown (resets on heal or placed orders) for grids whose correction places zero candidates indefinitely. Held-plan suppression is now visible (counted, warn on 1st/every 10th, reset on fresh fills) instead of silently debug-suppressed forever; deferred post-recovery aborts warn (not debug) with throttled pipeline-blocked logging. Region-end hook fan-out via addBroadcastRegionEndListener (dedupe, error-contained) replaces the legacy single _onBroadcastRegionEnd slot that let a second wirer silently displace the fill-queue drain. One-sided spread honesty: calculateSpreadFromOrders returns Infinity (was bogus 0% that looked perfectly tight), shouldFlagOutOfSpread bounds non-finite input to the nominal gap count, and log/status lines are one-side-aware; typed-spread candidates sort edge-first (modules/constants.ts, modules/dexbot_class.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_state_recovery.ts, modules/order/grid.ts, modules/order/logger.ts, modules/order/manager.ts, modules/order/utils/math.ts, modules/order/utils/order.ts; new tests/test_deferred_fill_retry.ts and tests/test_stale_grid_hardening.ts, 11 hardening tests TOTALS-001..003, SPREAD-001..003, INF-001..002, HOOK-001..002, SUPP-001; full suite runner exit 0, zero failures).
• Docs(save): clarify live-save vs reset vs reload; restructure power-law paper — the onboarding guide and the dexbot bot editor hint now spell out the three save groups (live keys auto-apply ~1min, grid geometry needs dexbot reset, market/account needs dexbot reload); the power-law comparison is restructured around pool concepts with a new executive summary, a capital-density section, and corrected static-density and holdings claims (docs/BITSHARES_ONBOARDING.md, docs/DEXBOT2_VS_POWER_LAW_CURVE.md, modules/account_bots.ts).

[1.6.0] - 2026-09-12 - Node-Failure Strike Ledger, Grid Regen, TV Order Overlay, Balance Heal, Live Config Pickup, Reserve Ladder, Boundary Recovery, Candle Cache Unification, Chart Upgrades, Shelf/Startup Hardening

2026-09-12

• Fix(startup): guard startup excess cancels against shelf orders and regress the reserve trigger (issue #27) — hoisting the matched-excess selection made it reachable on every startup, but without the slot-N gate the cheapest-first order wiped fork-kept shelf orders on the next boot; matchedExcess is now filtered to parseSlotIndex(id) !== null in both planOnly and execute branches. Tests: getTargetedSyncReason block (surplus with empty floor reserves fires buy reserves 0/2, filled/disabled/empty-budget configs stay silent) and shelf block (exact rail cancel set, plan/execute parity, floor reserves + closest window + shelf survive) (modules/order/grid_reconcile_internal.ts, tests/test_reserve_orders.ts).
• Fix(funds): skip shelf orders in geometric size recalc (issue #27 follow-up) — the divergence recalc distributed the side budget over every slot carrying the side's type and emitted on-chain UPDATEs for anything off-ideal, so fork-kept shelf orders with manual sizes took curve ideals on the first post-startup divergence pass; _recalculateGridOrderSizesFromBlockchain skips non-slot-N slots in the per-slot loop (same parseSlotIndex gate as reserve classification; shelf stays in the denominator so budget math is unchanged, only the mutation is skipped) (modules/order/grid.ts, tests/test_cow_divergence_correction.ts Test 7).

2026-09-11

• Feat(node): node-failure strike ledger and broadcast-deferred fill rebalancing — a live bot run showed two compounding reliability gaps: a broadcast region outliving the fill lock's acquisition timeout cascaded into repeated "Lock acquisition timeout" consumer failures, and flapping nodes escaped blacklisting because a single successful health probe erased live-transport strikes while the transport kept re-selecting them on reconnect. New node_connect_policy.ts manages a failure ledger with LIVE_FAILURE_HEALTH_SUCCESS_STREAK (2 consecutive probe successes to reset, transport-sourced strikes clear on first success); bitshares-native/transport.ts feeds strikes via onNodeFailure observer (abnormal closes as "connection" strikes, keep-alive trips as "keep-alive" with follow-up suppression, preferred-candidate pass in tryConnect); node_manager.ts applies strikes and resets; dexbot_cow_runtime.ts / dexbot_fill_runtime.ts / subscriptions.ts handle broadcast deferrals and fill rebalancing; docs/COW_INVARIANTS.md updated (docs/COW_INVARIANTS.md, modules/bitshares-native/*, modules/node_connect_policy.ts, modules/node_manager.ts, modules/bitshares_client.ts, modules/constants.ts, modules/dexbot_class.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_fill_runtime.ts, tests/test_node_connect_policy.ts, tests/test_node_failover.ts, tests/test_fill_pipeline_robustness.ts, tests/test_native_transport.ts).

• Feat(trust-chain): guarded trust-chain free-balance heal and deferred-drain fill tolerance — a fill/broadcast chaos window left a persistent one-sided tracked-free drift that recovery could never repair, and deferred fill drains repeatedly tripped the fund invariant on already-processed ledger deltas. New consumeDeferredDrainMarker() helper marks drain residue; the cycle that runs parked fills stamps manager._orphanFillsCreditedAt to widen fund-invariant tolerance (x5) for that cycle only. New _fundDriftLedger records one-sided drift; _tryTrustChainFreeHeal() seeds tracked free balance from chain total minus committed grid sizes, gated by FUND_INVARIANT_HEAL_ON_RECOVERY_FAIL (modules/order/accounting.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_class.ts, modules/dexbot_maintenance_runtime.ts, modules/constants.ts, tests/test_fund_drift_heal.ts, tests/test_fill_pipeline_robustness.ts).

• Feat(tv): TradingView order overlay on the rewritten chart exporter — restores the on-chart order overlay lost in the exporter rewrite and folds in interaction, label, and data-source fixes iterated while validating. Re-adds order rendering from the orders-file (no-orders handling, MKT/DEEP liquidity panel), gates on order data with base-unit volume, derives canonical gridLo, restores drag-pan and X-range sync, uses plain-decimal price labels, removes last-price dashed line, turns off uPlot gridlines, wires the update marker end-to-end, moves timeframes onto the AMA row, and uses English BUYS/SELLS labels and en-US dates (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/analyze_tradingview.ts, analysis/tradingview/README.md, scripts/README.md).

• Fix(credit): full offer id and hide Curr. CR pairs without live funds — Curr. CR lines print the full offer object id (e.g. 1.21.681) instead of the short numeric segment, and skip the line entirely when there is no live offer or the available balance is null/zero so no funds (...) rows no longer print; Avar. CR still covers own positions (scripts/analyze-credit.ts).

• Fix(reserve): reserve-aware targeted sync trigger plus live-config docs note (issue #27) — a live-applied reserveOrders increase never placed orders because the targeted-sync shortfall compared live window+reserves against target window+reserves, so a pre-existing window surplus masked the reserve deficit until fills or the 4h fetch; new countLiveReserveOrders (canonical reserveEdgeIdSet + live-anchor classification over the full master grid, intersected with live ACTIVE/PARTIAL orderIds, fail-closed without a full grid) feeds an independent "<side> reserves live/required" reason in getTargetedSyncReason, budget-gated like the window check. Docs: new "Editing a running bot" subsection in docs/BITSHARES_ONBOARDING.md mirroring BOT_LIVE_CONFIG_KEYS (live keys apply in ~1min, geometry needs dexbot reset, identity needs restart) (modules/dexbot_maintenance_runtime.ts, docs/BITSHARES_ONBOARDING.md, tests/test_reserve_orders.ts).

• Feat(tv): monthly candles, reordered market badge, stat badges — new 1M timeframe with true UTC-calendar-month bucketing in aggregateCandles and Mon-YYYY axis labels; market panel row order changed to SELL/Market/BUY; new bottom-right range panel (visible-window High red / Low green, mirroring SELL/BUY badge colors) and bottom-right volume badge (visible-window max volume only, hides with the volume chart), both refreshed on rerender and glued to the visible window via throttled setScale hooks on both charts (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/README.md).

• Feat(tv): rigid plot pan, axis-gutter scaling, and Shift+wheel price zoom in the uPlot chart — plot drags pan time + price with locked span (sets a manual price range) instead of squashing the visible span mid-drag; Y scaling lives on the price-axis gutter (wheel/drag) and Shift+wheel (cursor-anchored, price pane only); new time-axis gutter drag scales the timeframe around its center, synced across panes; rAF-throttled auto-Y refit to the visible window on every x setScale respects a user-locked manual range, double-click on the price axis returns to autofit; zoom-out band widened (floor min/2, ceil max*2) (analysis/tradingview/tradingview_uplot_chart_generator.ts).

• Fix(cache): trust only genuine query coverage when reusing cached LP candle windows — the immutable-gap pruner treated everything before the first locally cached bucket as proven-empty history, so stray boundary candles from a neighboring window's chunk file certified 700+ unqueried hours as empty and a whole month rendered flat; missing ranges are now pruned only when a chunk file's recorded queriedRanges genuinely cover them (one genuine full fetch still caches truly quiet spans permanently; previously skipped windows self-heal on the next run) (market_adapter/inputs/window_cache.ts, tests/test_window_cache.ts, tests/test_fetch_lp_data_logic.ts).

• Feat(tv): clickable base/quote volume toggle with currency suffix — toolbar unit button plus clickable legend Vol value and V-max badge switch base/quote units, persisted per chart in localStorage (volumeMode) alongside the AMA settings; legend, hover tooltip, and V-max badge always render the currency suffix (e.g. 1.2M BTS), axis ticks stay numeric; quote derived client-side as base x display close per candle; feed charts (volume = publish count) show the feeds suffix and disable the switch via the volumeIsCount payload flag (analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/tradingview/README.md).

• Fix(tv): honest volume affordance on feed charts — legend Vol value and max badge no longer show a pointer cursor with a click-to-switch hint on feed charts where the toggle is dead by design (default cursor + feed title instead); count unit renamed from pubs to feeds; badge label shortened from V max to max (analysis/tradingview/tradingview_uplot_chart_generator.ts).

• Feat(cache): unify Kibana candle caching on runCachedWindows, harden fetch robustness — pool, book, and feed fetches share one cache entry point (LP migrates off its bespoke manifest loop; sidecar *.fetch_manifest.json no longer written, legacy files still read); new fetchRangeWithRetry (per-range attempts + linear backoff + abort-signal timeout; LP keeps its 4-attempt budget, book/feed keep single-shot default); partial windows merge into output but are never persisted; kibanaSearch retries transient errors (3 attempts) for one-shot queries, kibanaMaxPages (500) runaway guard on paged fetchers, bidirectional fetch tolerates one-direction failure; single isTransientNetworkError/sleepMs (modules/utils/errors.ts) and single slugPart (market_adapter/interval_utils.ts); dead consolidateByTimestamp key removed (new tests/test_fetch_book_data.ts, tests/test_kibana_candles.ts cases; market_adapter/inputs/*, market_adapter/core/*).

• Fix(reserve): exclude non-slot-N shelf ids from reserve classification and placement (issue #27 follow-up) — fork-kept shelf orders (live non-slot-N ids below the rail, e.g. deep-*) were classified as the reserve edge in every anchor outcome, so the targeted-sync reserve deficit could never fire while the shelf was live, and the Tier-2 live-anchor scan let the cheapest shelf drag the anchor to itself (isSlotInRail is fail-open for unparseable ids); reserveEdgeIdSet, resolveLiveReserveEdgeAnchorPrice, _pickEdgeReserveSlots, and pickEdgeReserves now gate to parseSlotIndex(id) !== null so classification and placement agree (no-op on grids that only mint slot-N ids) (modules/order/utils/order.ts, modules/order/grid_reconcile_internal.ts, modules/order/manager.ts, tests/test_reserve_orders.ts).

• Fix(reserve): exclude window members from the live-reserve count (issue #27 follow-up) — countLiveReserveOrders classified reserves without excluding window members while every placement picker passes window ids as excludeIds, so when the active window reached the grid edge the edge pick landed on live window orders and the count read N/N with zero dedicated reserves; new liveWindowIdSet helper derives window member ids from master rail geometry (sliced to activeOrders, fail-open on unknown boundary) and reserveEdgeIdSet takes an optional excludeIds forward (modules/order/utils/order.ts, modules/dexbot_maintenance_runtime.ts, tests/test_reserve_orders.ts).

• Fix(startup): startup excess plans matched-surplus cancels (issue #27 follow-up) — startup reconcile always runs planOnly, but the planOnly branch recorded only unmatched-orphan cancels while the matched-surplus leg (cancelCount = chainCount - targetCount, reserve edge last) lived only in the execute branch, so on a fully-placed grid the surplus was silently dropped every restart with zero cancel ops; the matched-excess selection is hoisted above the planOnly/execute split so both share one ordering (orphans first, matched after, reserve edge last), and planOnly omits releaseUntrackedFunds for matched slots (funds tracked on the grid slot) (modules/order/grid_reconcile_internal.ts, tests/test_reserve_orders.ts; full suite 276 passed).

• Fix(feed): align feed volume and AMA timeframes — cross-feed publication counts are averaged across both feed legs instead of summed, comparable feed-rate values are preserved on weekly/monthly candles, and the first sampled AMA value anchors to its warmup average so higher-timeframe charts show no initialization gap (market_adapter/inputs/kibana_feed_source.ts, market_adapter/candle_utils.ts, tests/test_kibana_feed_source.ts).

2026-09-10

• Feat(live-config): apply bots.json edits to the running bot without restart (issue #27) — the 1min bots-config poll only fingerprinted the market-adapter price feed (name:gridPrice), so window-count, reserve, fund, and weight edits sat unapplied until restart with nothing saying so, and monolithic (unlock) bots skipped the poll entirely via the wrapper-owned early return. New checkAndApplyBotConfigChanges runs at the top of the periodic adapter-sync path on every tick (startup, 1min poll, 4h chain fetch, wrapper-owned included) with a single shared snapshot read: it fingerprints the full normalized bot entry (key order/comments/whitespace-insensitive) and live-merges the safe allowlist BOT_LIVE_CONFIG_KEYS (activeOrders, reserveOrders, botFunds, weightDistribution, min_BTS_value, debtPolicy) into bot.config + manager.config, each converging through its existing consumer (targeted drift reconcile, recalculateFunds, dynamic-weight refresh, fee/acquisition reads). Anything outside the allowlist logs a one-time hint naming dexbot reset <name> for grid geometry vs restart for market/account identity and tuning; corrupt/unreadable snapshots preserve the stored fingerprint and never throw. The poll-disabled log now covers the adapter + live-config fallback, and the editor shows the live key list at save (modules/dexbot_maintenance_runtime.ts, modules/runtime_settings.ts, modules/dexbot_class.ts fingerprint fields, modules/account_bots.ts, tests/test_dexbot_maintenance_runtime_market_adapter_watchdog.ts).
• Feat(live-config): live-apply debtPolicy behind a structural shape gate — the credit runtime reads policy through a live getter, so threshold/toggle/item edits take effect on the next credit maintenance/watchdog cycle with no grid impact; a malformed policy is diverted to the reset/restart hint instead of merged so a bad edit can never poison the running credit cycle, and a successful merge reconciles the runtime (_setupCreditRuntime, no-op loadState when already loaded) plus the watchdog interval (enable-from-zero creates/loads state and starts it, removal clears the policy and stops it). Drive-by fix: the full-resync path replaces bot.config with a new object, which left CreditRuntime.config pointing at the stale copy so reset-reloaded policies were silently ignored — the shared replace helper now re-points it (same files as above).
• Feat(claw): agent settings patches touching only live-pickup keys no longer force a full grid-resync trigger — the default auto-trigger fired on activeOrders/botFunds/weightDistribution/debtPolicy, so an agent window-count tweak caused a full cancel/replace wave for an edit the running bot absorbs incrementally within a minute; patches touching any non-live trigger key still trigger, explicit trigger: true/false still overrides, and previewBotSettingsUpdate.triggerRequired follows the same rule (claw/modules/dexbot_profiles.ts, claw/tests/test_dexbot_profiles.ts).
• Refactor(live-config): single-source live-config plumbing, stale-code removal — BOT_LIVE_CONFIG_KEYS lives in modules/runtime_settings.ts (consumed by the maintenance runtime, the editor hint, and the Claw trigger gate); one cloneJsonValue, one diffBotConfigEntries (replacing diffLiveBotConfig + detectNonLiveBotConfigChanges), one shared replaceBotConfigFromEntryPreservingRuntime for the resync path; dead _appliedBotLiveSnapshot field removed and the stale wrapper-owned poll test renamed to match the new behavior (same files as above).
• Fix(boundary): anchor null-boundary recovery from live fill prices instead of fabricating a rail-top boundary — after GRID-LOAD rejected a poisoned persisted boundary with no safe re-derivation, the committed boundary stayed null while fills were the only remaining boundary mover; the first fills hit recovery with config.startPrice="pool" (an unresolved mode string), where every price >= reference comparison is false so the split fell through to the rail top (base at the rail edge, ceiling-clamped, then shifted by same-batch crawls), the active window ran off the rail, and ordinal pairing planned hundred-slot "rotations" that guards had to refuse. deriveTargetBoundary now anchors from position signals, weakest last: live fill prices (gap-side extreme, midpoint when both sides filled) → numeric config center → forwarded genesis center → bounded rail-center fallback; fill-anchored recovery batches skip the crawl (the anchor already contains the fill info, crawling would double-count; genesis/rail-center anchors still crawl); calculateIdealBoundary fails toward rail-center on non-numeric references instead of the rail top (modules/order/utils/order.ts, modules/order/strategy.ts forwards genesisStartPrice, tests/test_boundary_anchor_recovery.ts ANCHOR-001..009 including a replay of both incident batches).
• Fix(recovery): erase the poisoned persisted boundary on unrecoverable GRID-LOAD rejection — storeMasterGrid never persists a null boundary, so the rejected value survived every flush and re-armed the identical rejection on every restart; new explicit-only AccountOrders.clearPersistedBoundary() runs best-effort when re-derivation fails, so the next boot loads boundary-less and the first fill batch re-anchors live (modules/account_orders.ts, modules/order/grid.ts).
• Fix(cow): rail-edge truncation telemetry and structural-resync plumbing for refused plans — warn-only log when the planned window runs off the rail (sell-start past the last slot; no geometry refused, cross-guard/fund-validation/boundary-hold still judge), and the batch executor now honors needsResync from refused plans (unrecoverable boundary) by requesting a structural grid resync where bot context exists (modules/order/manager.ts, modules/dexbot_class.ts).
• Fix(guard): freeze the last-fill-guard pivot once per batch — per-action refreshes mutated the pivot mid-batch so early actions were judged against a different pivot than later ones; all three guard sites pass through a frozen batch pivot (skipRefresh), per-action skip lines demote from warn to debug, batch summary unchanged (modules/dexbot_cow_runtime.ts).
• Fix(boundary): persist uncommitted fill crawls across refused broadcasts and restarts — a processed fill whose derivation never commits (refused broadcast, aborted plan, pre-restart loss) lost its crawl permanently, so startup reconcile refilled the holes same-side instead of rotating (4 consumed buys re-bought at the filled prices after restart). Strategy now records every shift-eligible fill as a pending crawl (slot-level dedupe on push); derivations incorporate owed entries (deduped against the current batch, reserve slots excluded); any accepted non-null commit clears the record; startup applies owed crawls onto the restored boundary (validated placed-order-aware, reserve-aware, clears mark dirty on all paths) before reconcile, and drops them under a null boundary where the absolute fill anchor subsumes all history (modules/order/strategy.ts, modules/order/utils/order.ts incl. consumePendingFillCrawls, modules/order/manager.ts, modules/order/utils/system.ts, modules/account_orders.ts snapshot field + loader, modules/dexbot_startup_runtime.ts, tests/test_pending_fill_crawls.ts PEND-001..010).
• Fix(tests): two pre-existing suite failures — restored the [COW] No actions needed debug log in the empty-action guard (dropped when the structural-resync block was added, breaking COW-COMMIT-003) and added the nine reserve/crossing exports (resolveReserveCount, selectReserveEdgeSlots, resolveReserveFloorIds/CeilIds, geometryTypeForSlotIndex, isShiftEligibleFill, buildCrossingCheckCandidates, isCrossingCheckCandidate, chainOrderMatchesSlotWithTolerance, consumePendingFillCrawls) to the dynamic-weights ESM mock name list, whose stub predated the reserve API (modules/dexbot_class.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts). Full suite: 274/274.
• Feat(tv): opt-in MPA price-feed charts and explicit source selection — market candles and settlement-feed history answer different questions, so the chart shortcut no longer always charts pool/order-book fills: --feed charts settlement-price history for MPA pairs (single MPA or MPA/MPA cross via both legs), --pool forces LP candles, --book forces order-book fills, the default stays pool-first with order-book fallback, and prediction markets are rejected; an explicit --feed warns on stale/unknown feed age (flat-chart risk) but still charts, while auto mode never routes to feed. New market_adapter/inputs/kibana_feed_source.ts buckets settlement-price publications into OHLC candles in backing-per-MPA units, matching the live feed-price convention (cross pairs forward-fill both legs into one quote series). Chart defaults: --scale dropped from tv and the exporter (the chart already ships a persisted Log/Linear toggle and always opens on log), range highlight now off by default with --range re-enabling it (a stored browser choice still wins) (scripts/tv.ts, analysis/tradingview/*, market_adapter/inputs/kibana_feed_source.ts, READMEs, tests/test_tv_feed_routing.ts, tests/test_kibana_feed_source.ts).
• Feat(tv): range-aware candle bucket cache shared by the pool and feed chart paths — repeated chart fetches re-queried every window because each run anchors its range at floored-now, shifting all windows and invalidating the exact time-range cache match, and the price-feed path had no disk cache at all; new market_adapter/inputs/window_cache.ts loads sibling chunks once and keeps in-range buckets, queries only missing buckets plus a bounded 48h tail refresh for late-indexed records, prunes leading no-trade gaps and already-queried ranges out of immutable history, extends sub-range queries by one bucket (an inclusive range would otherwise truncate the final bucket into a fake zero-volume candle; output is clamped to the window and fresh data wins by volume), deletes orphan chunks after complete runs (failures never delete), and opts forward-filled cross-rate data out of sub-range fetches (exact reuse still applies). Chunk metas record the ranges actually queried (meta.queriedRanges), so gap pruning consults real coverage instead of the file's overall timeRange, which over-claimed after sub-range rewrites (legacy files fall back to their timeRange claim), and same-filename overwrites keep prior in-window coverage via priorQueriedInWindow. The pool fetcher delegates to the shared planner/cache (manifest, retry and merge behavior unchanged, helper export names preserved), the feed fetcher gains a cached sequential path, and both modes print identical per-window progress through one formatter with per-page Kibana chatter and staging/render timing lines removed (market_adapter/inputs/fetch_lp_data.ts, market_adapter/inputs/kibana_feed_source.ts, scripts/tv.ts, tests/test_window_cache.ts, tests/test_fetch_lp_data_logic.ts).
• Feat(reserve): anchor the reserve ladder at resolved min/maxPrice bounds (issue #25) — reserve BUYs ranked by raw price alone, so keep-low windows pushed them just above the active window while the minPrice floor zone stayed empty, the opposite of the static dip insurance the ladder is for; both edges now anchor toward their resolved config bound (floor toward minPrice, ceiling toward maxPrice). New resolveReserveEdgeAnchorPrice(config, side) resolves numeric and "Nx" relative bounds via resolveConfiguredPriceBound and returns null when unresolvable so callers keep the previous rank behavior, while new compareReserveEdge is the single-source comparator for every reserve pick (finite anchor: in-bound slots first, nearest the anchor first, floor ascending / ceiling descending, stale out-of-bound slots last; null anchor: plain rank); resolveReserveFloorIds/resolveReserveCeilIds/selectReserveEdgeSlots take an optional anchor, and all selection sites (target grid, initial activation, startup reconcile, edge pick, divergence corrections) resolve and pass the per-side anchor. Unresolvable bound, garbage input, or an unresolved "pool"/"book" startPrice degrades to the rank behavior; the documented limit at the time was that the anchor is the statically resolved config bound rather than the live grid's own rail bound (modules/order/utils/order.ts, modules/order/strategy.ts, modules/order/manager.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/system.ts, tests/test_reserve_orders.ts).
• Feat(reserve): live-grid reserve edge anchors, closing the gap the config-bound anchor left open — a config-resolved anchor misses the rail the bot actually trades, because mode strings like "pool" are unresolvable, relative multipliers need a reference price, and a reload can flip raw/resolved bounds, which left the floor zone empty unless a manual shelf was placed; new resolveLiveReserveEdgeAnchorPrice(manager, side) resolves in explicit tiers (the genesis ladder extreme the loaded grid was built from, then the live in-rail extreme via resolveGapBand + isSlotInRail, then the config bound, then null for legacy rank). deriveTargetBoundary and reserveEdgeIdSet take the anchor explicitly, and the strategy resolves both sides once and shares them between placement and the no-crawl fill classification, so the two can never disagree about which slots are reserves. The startup pending-crawl recovery path resolves the same anchors, so a restart cannot rank a stale below-rail slot as a reserve and silently drop a crawl the live run recorded as ordinary market movement (regression-pinned by a restart test whose crawl is provably applied with the live anchor and dropped with the config fallback). All runtime sites switched off the config-bound anchor: target grid, initial activation, startup reconcile, edge pick, divergence corrections, and pending-crawl recovery (modules/order/utils/order.ts, modules/order/strategy.ts, modules/order/manager.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/system.ts, tests/test_reserve_orders.ts, tests/test_pending_fill_crawls.ts).
• Refactor(reserve): single-source reserve edge ordering — resolveReserveFloorIds/resolveReserveCeilIds hand-rolled the ordering that compareReserveEdge defines, so which slots count as reserves had two spellings and any drift would misclassify fills as no-crawl reserves; both helpers are deleted and reserveEdgeIdSet now filters and sorts through selectReserveEdgeSlots/compareReserveEdge, also keying on the canonical side type so a stale SPREAD placeholder is never ranked as an edge order (parity fuzz over both former resolvers, 864k cases, showed zero price-level divergences). The dynamic-weights ESM mock name list drops the deleted twins and picks up reserveEdgeIdSet, resolveLiveReserveEdgeAnchorPrice, and compareReserveEdge (modules/order/utils/order.ts, modules/order/grid_reconcile_internal.ts, tests/test_reserve_orders.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts).
• Fix(reserve): activate reserves only with their stored size, and hold back the missing reserve share at startup — the reserve picker re-derived per-slot sizes from a different slot list than the strategy (its own SPREAD-inclusive, in-rail derivation), so a startup-placed reserve could be sized by one rule and corrected by another; activation now requires the slot's own stored size to satisfy the minimum, re-types the pick to the activation side, and never derives a size locally. Startup reconcile holds back only the reserve share still missing on-chain (reserveCount minus reserves already placed) from its window plan, so an edge pick that is not activatable yet leaves its slot unplanned for the target-grid sizing pipeline instead of the plan parking a middle window slot there that the next cycle would have to rotate out; a live reserve is already part of matched-on-grid and never shrinks the window plan (fresh-grid deficit 5 → 3 window placements with 2 deferred; steady state unchanged at 5; two live reserves with an empty window → the full 3-slot window plan) (modules/order/grid_reconcile_internal.ts, modules/order/grid.ts, tests/test_reserve_orders.ts).
• Fix(boundary): keep owed fill crawls hold-aware and reload-safe — the pending-crawl ledger records every shift-eligible fill as a relative boundary delta, consumed by a commit that uses the plan's boundary and replayed when a refused broadcast, aborted plan or restart leaves the crawl owed; auditing that contract against the committed-boundary writers found five leaks and one doc drift. A refill hold pins the committed boundary over the plan's target, so the shift those records encode was never applied — the commit clear now requires boundaryHeld !== true and routes through _clearPendingFillCrawls(), which logs the drop and marks the grid dirty so it reaches disk, with the hold flag hoisted in the COW runtime and passed to both commit sites so the uncertain-broadcast poll path cannot keep a pinned boundary while dropping its records. Reserve ladder orders live outside the boundary contract, so a skipped reserve CREATE must not pin geometry — collectRefillSlotIds() is now the single producer of the refill wire, shared by the COW plan path and the divergence fold, and fails open when reserve classification is unavailable. The rotation size-validation skip now records its slot ids like its five sibling skip sites, so the skip set and boundary hold see it. applyPersistedPendingCrawls() is shared by startup and recovery, and recovery applies stored crawls before its persistGrid, which would otherwise write the empty in-memory array over them and erase the owed movement without applying it. A grid rebuild, a rejected snapshot and clearGrid re-anchor the boundary absolutely, so relative deltas from the previous generation are dropped in memory and on disk. Docs: fund-driven sizing with a fill-driven boundary recorded in modules/README.md and docs/COW_INVARIANTS.md (INV-COW-006/007/008 cover boundary ownership, the refill hold with reserve exclusion, and the owed-crawl lifecycle). Crawls are only retained on paths that provably derived nothing, so a drop cannot strand a slot the plan already moved past; reload paths apply deltas onto the boundary they were recorded against (modules/order/manager.ts, modules/dexbot_cow_runtime.ts, modules/order/utils/order.ts, modules/order/utils/system.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts, modules/order/grid.ts, modules/account_orders.ts, tests/test_cow_boundary_hold.ts HOLD-009, tests/test_pending_fill_crawls.ts PEND-012..018 incl. the replay-exactly-once generation invariant, tests/test_reserve_orders.ts refill-wire cases).
• Fix(boundary): rail-gate startup placement, fold owed crawls into static rebuild centers, classify all deferred holds as non-blocking — startup placement could diverge from runtime activation, a static rebuild center discarded owed fill-crawl direction, a stale numeric recovery center could pin the boundary to a rail edge, and deferred chain-order holds were classified by exact reason string, letting a new defer reason re-freeze the pipeline. getInitialOrdersToActivate now filters window and reserve candidates through the shared isSlotInRail geometry (same predicate as _pickVirtualSlotsToActivate/_pickEdgeReserveSlots, fail-open for unknown geometry), so a stale stored rail can never be placed on the wrong side of the boundary. On a rebuild centered on a static config value (startPrice numeric, or AMA-driven whose live snapshot offsets the center — the gridPrice bounds reference does not make the ladder center fresh), owed fill crawls are folded into the rebuild center (one incrementPercent step per net crawl, reserve fills excluded, re-clamped to the post-guard bounds) before _clearPendingFillCrawls('grid rebuild'); a live-derived startPrice drops them because the derived price already contains the movement. deriveTargetBoundary rejects a Tier-2/Tier-3 reference that falls outside the live rail and falls through to the bounded Tier-4 rail center instead of pinning an edge (Tier-1 fill anchors stay exempt — live market wins). The pending-crawl ledger records nothing under dryRun and caps after push at exactly 500, matching the persisted slice(-500) cap. A new shared isNonBlockingUnmatchedOrder classifies any *-deferred reason as a deliberate hold, used at all three blocking sites (validateCreateTargetSlots, the COW pre-broadcast gate, snapshot recovery) — boundary-unknown-deferred is now correctly non-blocking (transient and re-evaluated), so a new defer reason cannot silently regress into a permanent blocker; hold counts (unmatchedChainOrders/heldChainOrders/blockingChainOrders) surface in getMetrics, the shutdown summary, and a deduped periodic [HOLD] warning. New tests/test_hold_and_center_guards.ts (HOLD-001, CENTER-001..003, PEND-CAP-001, REBUILD-FOLD-001..004 including the static-center fold and the mixed-mode gridPrice cases, RAIL-GATE-001), tests/test_sync_out_of_grid_defer.ts extended with OUT-OF-GRID-007 (modules/order/manager.ts, modules/order/grid.ts, modules/order/strategy.ts, modules/order/utils/order.ts, modules/order/utils/validate.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_state_recovery.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_class.ts).
• Feat(grid): bidirectional grid-regeneration trigger (grow + shrink on fund removal) — the 3% available-funds trigger only fired upward, so after an external fund removal the grid stayed over-allocated until the next fill forced a resize. The divergence check now also flags a side when its grid-tracked size exceeds the botFunds-capped allocation by GRID_REGENERATION_PERCENTAGE, reusing the existing COW resize path (modules/order/grid.ts, modules/constants.ts, modules/dexbot_maintenance_runtime.ts, tests/test_grid_logic.ts, docs/FUND_MOVEMENT_AND_ACCOUNTING.md, docs/GRID_RECALCULATION.md).
• Fix(credit): show short offer id behind avail funds in Curr. CR line — Curr. CR lines now append the live offer's short numeric id in grey (e.g. | 53.76K BTS (123)), falling back to the offer object id when the ranked id is missing; no suffix when no offer is found (scripts/analyze-credit.ts).
• Fix(tv): namespace TradingView chart prefs per pool/pair — all generated TradingView charts shared one localStorage key, so opening a chart for one pair applied another pair's saved timeframe, indicators, scale, and pair orientation. The prefs key is now v3 namespaced per chart (pool, asset ids, base interval), computed at export time; the uPlot price/volume cursor-sync key is split into its own constant so namespacing prefs cannot break pane sync; asset nodes without id/symbol no longer collapse distinct charts onto [object Object] (analysis/resolve_source.ts, analysis/tradingview/*, tests/test_tradingview_chart_storage_key.ts).

2026-09-09

• Fix(tradingview): range band ignores span slider on grid-less charts — pair/pool charts render with grid: null, which hid the span slider (display:none) and dropped the band into the uncontrollable ±2% width envelope instead of the 1.25x–2.0x slider span; slider now always renders inline (retagged grid → span), the no-grid fallback builds a symmetric AMA/span-AMA×span base (grid config supplies only tilt/guard params, never a price), and per-bar scaling embeds computeAmaSlopeClipThreshold verbatim so the band clips raw AMA slope at the adaptive 90th-percentile threshold before applyAsymmetricBounds + applyNarrowingSideGuard — grid and pool charts share one path, matching the live grid pipeline (analysis/tradingview/tradingview_uplot_chart_generator.ts).

• Tune(range): widen orange range zone to 1.40x, lower TradingView slider floor — RANGE_QUALITY ORANGE_MIN / RED_MAX 1.45 → 1.40 (suizidal starts below 1.40x, orange tight zone widens 0.10 → 0.15) with the range legend now built from RANGE_QUALITY as single source of truth; TradingView range-span slider floor 1.25x → 1.2x (slider min, tooltip, all server- and client-side clamps, README flag row) (modules/constants.ts, modules/account_bots.ts, analysis/tradingview/*).

• Feat(reserve): per-side reserve ladder, edge-pinned dip/spike insurance (issue #25) — no way to rest live BUY/SELL orders far outside the active window for crash wicks and fat fingers (widening minPrice relocates the window, activeOrders counts from the rail); new reserveOrders: { buy, sell } (default {0,0}, 0 disables per side; editor menu 5 Funding prompts both counts, non-negative-integer validation, legacy numeric form migrates to { buy: n, sell: 0 }). Shared helpers in modules/order/utils/order.ts (single source): resolveReserveCount/resolveReserveOrders, resolveReserveFloorIds/resolveReserveCeilIds (price-rank edge sets, boundary-independent), selectReserveEdgeSlots (floor-first / ceiling-last, skips windowed ids); deriveTargetBoundary filters reserve-edge fills so reserves never crawl; placement is window + edge union (middle stays VIRTUAL) across strategy.ts, utils/system.ts, manager.ts, and grid_reconcile_internal.ts (startup desired split + edge-cancel-last for unmatched orphans and matched excess); fee/count maintenance counts reserves once (grid.ts, grid_reconcile.ts, accounting.ts, dexbot_maintenance_runtime.ts, export.ts). New tests/test_reserve_orders.ts (per-side clamp, floor/ceiling anchors, both-edges no-crawl, window+edge union, off-means-window-only).

• Fix(tradingview): invert range band colors to red-above, green-below — the range envelope around AMA painted the upper segment green and the lower segment red; swaps UP_FILL/DOWN_FILL (plus boundary strokes) to the correct convention (chart cosmetics only, analysis/tradingview/*).

• Fix(sync): defer out-of-grid orphans instead of clamping onto edge slots (issue #24) — slotIndexForPrice clamps below/above-grid prices onto slot-0/slot-(N-1), so the genesis Pass-2 path mis-adopted the first sub-grid orphan into the rail slot (overwriting the live orderId and poisoning slot bookkeeping) and queued every further same-zone orphan as a duplicate cancelOnly, wrongfully cancelling live correctly-priced orders; new isChainPriceOutOfGrid guard defers out-of-range chain orders with reason out-of-grid-deferred (no adopt, no cancel) while exact in-rail orphans still adopt (modules/order/sync_engine.ts, modules/order/utils/math.ts, tests/test_sync_out_of_grid_defer.ts OUT-OF-GRID-001..005).

• Fix(sync): keep out-of-grid holds from freezing creates and refills — holds are permanent by design, so three paths keyed on "any unmatched order" froze around them: validateCreateTargetSlots flagged chain_orphan_collision on the hold's clamped candidate slot (permanently blocking that rail refill), the COW pre-broadcast gate rejected every CREATE batch (UNMATCHED_CHAIN_ORDERS), and snapshot recovery rejected the persisted grid (full grid reset required) on every restart while a hold existed; all three now filter reason !== 'out-of-grid-deferred' (holds stay visible to crossing guards and sync but block nothing), plus auto-cancel idle wording corrected and live order ids replaced with synthetic 1.7.91xxxx in tests (modules/order/utils/validate.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_state_recovery.ts, OUT-OF-GRID-006, tests/test_uncertain_broadcast.ts UNC-016f which fails pre-fix with grid inconsistent after reload: 1 unmatched remain).

• Docs(reserve): reserve ladder references across user docs and removal of the stale boundary-sync section — the per-side reserveOrders feature had no user-facing documentation outside code comments and the changelog, and the architecture doc still described the fund-driven boundary sync deleted in 1.5.3; the README Bot Options Reference gains a reserveOrders row (floor/ceiling, default {buy: 0, sell: 0}, editor menu 5 Funding) with the S/B display notation aligned, and GRID_RECONCILE, COW_INVARIANTS, the developer guide glossary (new Reserve term), FUND_MOVEMENT_AND_ACCOUNTING (the active-order count includes reserves for the BTS fee budget), MPA_CREDIT_USAGE, and DEXBOT2_VS_POWER_LAW_CURVE each gain a code-grounded line (counts re-verified against grid_reconcile.ts, getActiveOrdersTotal, accounting.ts, and the maintenance runtime); docs/architecture.md drops the obsolete Fund-Driven Boundary Sync section (58 lines) with no remaining references in the README, architecture, reconcile, developer guide, or workflow docs (README.md, docs/*).

[1.5.3] - 2026-09-09 - Boundary Ownership Hardening, COW Dedup, TradingView Range Highlight, Sync Materialize Fix

2026-09-07

• Docs(curve): dynamic rho, StableSwap context, and clarity fixes in the power-law curve comparison — new "variable price p" section (p = (y/x)^(1-rho) sliding along the invariant as reserves shift and what that means for liquidity placement); deviation/regime-driven dynamic-rho table plus keeper pseudocode reusing the AMA signal stack (ATR, Kalman velocity, Hurst/PE) with branches aligned to table rows; new "Relation to the StableSwap protocol" section (upstream design link, A/rho interpolation-axis comparison, CES-vs-StableSwap contrast table, flexibility split: StableSwap the more general/operationally complete protocol, CES the more flexible curve shape); stablecoin recommendation justified via tail behavior (StableSwap degrades toward constant product on depeg while high-rho CES thins exponentially below it); rho_buy/rho_sell renamed to tail-oriented rho_high/rho_low with naming note (docs/DEXBOT2_VS_POWER_LAW_CURVE.md; docs-only, no code paths affected).

2026-09-08

• Refactor(cow): deduplicate COW runtime broadcast/reconcile paths — modules/dexbot_cow_runtime.ts (~4700 lines) shared sequences extracted into single spellings: recoverRefusedCommit (3 identical commit-refused recovery sequences, named options object, original log wordings preserved), runPreBroadcastGuards (create-slot validation, recovery-exhausted block, pending/unmatched guards, crossed-book gate), matchPendingToChain/adoptMatchedEntries/restoreDiscardedCreates/resyncIfUnreconciled (4-phase split of reconcileAfterUncertainBroadcastImpl, persist ownership stays with caller), runLastFillGuardCheck (all 3 guard sites), createOpFingerprintForSlot/findChainOrderForPendingEntry, rawOnChainFromInts/applyOptimisticFeeBalance, isAuthoritativeChainRead, getPendingBroadcasts/countPendingBroadcasts; pure helpers (chainOrderUnchangedFromCache, detectCrossedBookPlan, collectKnownOnChainOrderIds) moved to modules/order/utils/order.ts; getAssetFeesSafe require hack removed (direct ESM import); per-kind op builders and broadcast commit/catch blocks deliberately kept inline (threading ~15 shared locals through broadcast-critical code judged riskier than the duplication); full suite 266 passed, 0 failed.

2026-09-09

• Feat(tradingview): bot-grid range highlight with AMA-slope scaling — Range / Scale controls, grid-span slider (1.25-2x, default from bot grid ratio), legend readout (+up% / -down%), range-band draw plugin behind candles/AMA with axis-fit to band when Scale is on; band math embeds canonical sources verbatim via embedFunctionSources (computeAverageAmaSlopePct, resolveBaseBounds, computeAsymmetricBoundsMetrics, applyAsymmetricBounds, applyNarrowingSideGuard, parseRelativeMultiplier, same runtime values: lookback 9, maxSlope 0.09, clamp 0.5, maxAsym 0.35, minSlots 10, plus per-bot overrides); CLI --no-range/--range-scale/--range-span, grid bounds resolved from bot meta (analysis/tradingview/*, analysis/resolve_source.ts, analysis/tradingview/analyze_tradingview.ts); canonical applyNarrowingSideGuard exported from market_adapter/core/asymmetric_bounds.ts with modules/order/grid.ts routing its narrowing-side slot logic through it (behavior-identical); restored .time-btn click listeners, removed y-axis maxSpan zoom-out cap (floor/ceiling anti-slip guards remain).
• Fix(boundary): remove fund-driven boundary sync, fills move the boundary — the periodic fund-ratio check moved rails without guaranteed same-batch refills, so guard-vetoed refill rotations left the commit keeping the boundary move with empty slots stranded past it (no repair path: sell-side spread pass could not touch buy-rail holes, promotion quota exhausted, budget spent on far orphans); syncBoundaryToFunds deleted (modules/order/utils/system.ts divergence pins the boundary to the committed value, boundaryChanged dropped from the return contract), calculateFundDrivenBoundary deleted (modules/order/utils/order.ts), failed-commit immediate retry and boundary-shift spread-skip removed (modules/dexbot_maintenance_runtime.ts); remaining writers are fills (deriveTargetBoundary with same-cycle rotations) and spread promotion (shifts only onto same-batch placements); fund changes still drive sizing via budget allocation, never rails; tests pinning the deleted writer removed (unanchored-spread, boundary-sync, fallback retry/crosser, skip-gate cases; abort-reason propagation and master-unpatched contracts kept).
• Fix(boundary): hold committed boundary when guard-skipped refills strand rail holes — a fill-driven replan could shift the boundary on hole-CREATE refills, then have those refills guard-skipped at broadcast: working grid restores empties, the commit gate skips empties, and the overrun self-legalizes via gap-band re-derivation next cycle; plan.refillSlotIds threaded through buildCowResultFromPlan (string ids only) with skipped CREATE ids tracked at all five guard-skip sites, new resolveRefillBoundaryHold/toRefillSlotIdSet intersect skips (UPDATE + post-fill-clamped + CREATE) with the refill set, frozen effectiveBoundary routed to both _commitWorkingGrid calls and all three recoverRefusedCommit sites (modules/dexbot_cow_runtime.ts, modules/order/manager.ts, modules/order/utils/validate.ts, modules/order/utils/system.ts; tests/test_cow_boundary_hold.ts HOLD-001..008); hold keeps the committed boundary on refill intersect only, grid still commits, unrelated vetoes advance, absent wire never pins; interior skips can delay a justified shift by one cycle (fail-closed, self-healing).
• Fix(sync): materialize-or-error on unknown grid id in createOrder sync path — a broadcast landing after a grid reset replaced master left the live chain order untracked: synchronizeWithChain(createOrder) missed the master lookup and dropped the linkage silently, so the next cycle re-placed the level, duplicating live orders and locking funds; chain id already tracked elsewhere warns + skips (idempotent), caller-supplied placement descriptor materializes the slot (ACTIVE/PARTIAL, orderId set, deferredFee restored), no descriptor logs an error naming both ids with the next readOpenOrders sync adopting the order as an orphan; restoreDiscardedCreates materializes creation-uncertain slots from the broadcast-time descriptor (VIRTUAL, planned size, no orderId so orphan adoption can reconcile) with error logs for unusable descriptors, all three createOrder call sites now pass the descriptor, plus a warn for the cancelOrder post-lock re-fetch miss (modules/order/sync_engine.ts, modules/dexbot_cow_runtime.ts, tests/test_sync_create_unknown_id.ts 5 regression tests).

[1.5.2] - 2026-09-07 - Sync Rejection & Adoption Hardening, Crossing-Guard Coverage, Credit Display Fixes

2026-09-06

• Fix(export): derive offline export trades from fill blocks — the parser only matched a legacy single-line fill format no runtime code emits anymore, so offline export found zero trades; modules/order/export.ts now parses multi-line FILL DETECTED blocks (with and without asset IDs) deriving side/price/amount from precision-scaled amounts via persisted grid metadata (bare blocks fall back to grid-median disambiguation, ambiguous cases skipped; legacy format kept), fee lines attribute the per-fill share to each fill in the window (closest match, fixing aggregated-total double-count), BUY proceeds report quote-asset cost; modules/dexbot_fill_runtime.ts logs pays/receives asset IDs alongside raw amounts (log-only, no behavior change); export help text points at local analysis tooling (dexbot.ts, docs/WORKFLOW.md, modules/order/export.ts, new tests/test_order_export_fill_blocks.ts).
• Feat(credit): show next credit expiry in debt summary lines — debt asset lines in dexbot credit include the earliest latest_repay_time per asset as a 2-digit-year date in bold yellow, bracket-ordered with the biggest single position before the deal count (scripts/analyze-credit.ts).
• Fix(credit): credit overview debt/coll display reflects whole account — the overview summed only deals/call orders matching the analyzed bot's debtPolicy, silently hiding real debt/collateral on shared accounts or from MPA-only configs; MPA debt/coll sums now use all call orders and credit sums all borrower deals on the account (section gates, spacing, and the empty-state note keyed to the same unfiltered lists); CR rows, per-pair/average CR, offer fetch, borrow-now preview, and summary totals stay debtPolicy-filtered (scripts/analyze-credit.ts).

2026-09-07

• Fix(guard): close crossing-guard, empty-read, and rail adoption blind spots — crossing-placement guards saw only master-grid orders, so an UPDATE-only rotation batch could re-price across a pending-broadcast or un-adopted chain order and self-trade: new shared buildCrossingCheckCandidates (master orders + pending-broadcast wrappers + unmatched chain orders) with isCrossingCheckCandidate/crossingCandidateChainId predicates in modules/order/utils/order.ts, all guards delegate to it (modules/dexbot_cow_runtime.ts, modules/order/grid_reconcile_internal.ts, correctOrderPriceOnChain); suspect empty reads now require one delayed confirming re-read (confirmSuspectEmptyRead in modules/order/sync_engine.ts) plus a STARTUP-CONFIRM re-read when a persisted grid meets an empty snapshot (first launch exempt), and adoptPlacedBatchFromChain routes by-id whenever any id hints exist; uncertain-landed creates adopt with chainOrderMatchesSlotWithTolerance (~2 price quanta, strict matcher kept for genesis mapping); validateCreateTargetSlots orphan-price fallback is per-candidate for slotless candidates with a top-level priceSlotEqual import; isSlotInRail returns true for unparseable legacy ids (fail-open) and pre-boundary orphans defer with an explicit boundary-unknown-deferred reason visible to crossing guards; last-fill-guard docstrings corrected to single-pivot semantics (modules/dexbot_cow_runtime.ts, modules/dexbot_startup_runtime.ts, modules/order/grid.ts, modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts, modules/order/manager.ts, modules/order/sync_engine.ts, modules/order/utils/math.ts, modules/order/utils/order.ts, modules/order/utils/validate.ts; new tests/test_crossing_candidate_helpers.ts, tests/test_sync_empty_confirm.ts, tests/test_validate_mixed_orphan_tolerance.ts).
• Fix(grid): correct vacated-rail refill guard comment and repurpose vacuous VRR-6 — the comment referenced a non-existent CANCELED slot state; refill targets are VIRTUAL slots without orderId (in-flight cancels stay ACTIVE/PARTIAL and never reach the scan); VRR-6 now tests that an ACTIVE slot with an orderId at the vacated price keeps the level matched (no re-map UPDATE, no refill CREATE) (modules/order/grid_reconcile_internal.ts, tests/test_vacated_rail_refill.ts).
• Fix(grid): key CREATE-batch price validation on broadcast price and fail closed on unpriceable CREATEs — layer-5 collision detection keyed on live slot price (falling back to broadcast) let two CREATEs broadcasting the same price onto divergent live slots pass; entries now record the broadcast price and non-finite prices push a create_price_invalid violation instead of being skipped (modules/order/utils/validate.ts, modules/dexbot_cow_runtime.ts, tests/test_validate_create_target_slots.ts).
• Fix(sync): release slot match on rejected pass-2 adoption so the next chain order can adopt — adoptChainOrderIntoSlot marked the slot matched before _applyOrderUpdate ran, and on rejection the poisoned mark misclassified the next chain order for the same slot as no-available-nearest-slot (forcing structural resync on genesis builds); both rejection paths now delete the slot from matchedGridOrderIds before returning false (modules/order/sync_engine.ts, new tests/test_sync_adoption_poison.ts).
• Fix(accounting): run fund recalibration on empty chain reads and never virtualize unparseable live orders — dropped the openOrders.length === 0 early return in _recalibrateTrackedFundsFromChain (lag guards make empty reads safe) and track parse failures in malformedOrderIds so the absent branch skips them (unknown is not absent) instead of virtualizing a still-live slot (modules/order/accounting.ts, tests/test_accounting_logic.ts).
• Fix(sync): honor _applyOrderUpdate rejection across pass-1 sync paths — duplicate-swap mutated chainOrderIdsOnGrid before the apply while filled/phantom-cleanup paths pushed fills unconditionally, so rejected updates were treated as applied; set operations moved after successful apply (rejected swap keeps old binding, candidate stays unmatched for pass-2 cancel), rejected filled/partial/phantom paths book nothing and re-detect next sync (modules/order/sync_engine.ts, tests/test_sync_duplicate_orphan_swap.ts).
• Fix(grid): re-prove stamped gap-evacuation size against live booked remaining — a B-stamped gap-evacuation UPDATE bypassed the live probe on stamp geometry alone, so an unprocessed fill landing between plan-build and execution could grow a partially-filled live order back to planned size; new pure isEvacuationSizeStillValid in modules/order/utils/math.ts (planned size must not exceed live booked remaining, blockchain-int compare, fail closed) re-proves the stamped path against the live master slot, invalid stamps route into the existing unstamped probe (modules/dexbot_cow_runtime.ts, tests/test_gap_evacuation.ts EVAC-020).

[1.5.1] - 2026-09-06 - Gap-Evacuation Guard Allowance & Rail-Typed Holes

2026-09-05

• Fix(sync): re-type SPREAD slots before chain-order adoption and honor the apply result — adoptChainOrderIntoSlot re-types the placeholder to the chain order's side before activation/precision work, returns a boolean, and callers only record bookkeeping on success; rejected adoptions land in unmatched orders and queue a cancel-only correction so the chain order cannot dangle untracked (modules/order/sync_engine.ts).

• Fix(accounting): rebuild tracked funds from chain during state recovery — verify the balance fetch actually refreshed (_lastFetchedAt advanced) before trusting balances and defer the attempt otherwise; when drift persists after sync, _recalibrateTrackedFundsFromChain rebuilds the tracked commitment from the fresh chain read (matched slots forced to chain size, fully-consumed and stale-absent slots virtualized under the same recent-commit lag guards as the sync orphan pass, free balances never derived from totals), then re-runs recalculateFunds and re-checks drift (modules/order/accounting.ts; tests/test_accounting_logic.ts, tests/test_resync_invariants.ts stubs now simulate a refreshing snapshot).

• Fix(cow): bit-identical same-price duplicate guard for CREATE slots — new validateCreateTargetSlots layer 5 keyed by side + blockchain-int price (floatToBlockchainInt, asset-aware with float fallback): first target per price wins, later duplicates reported as same_batch_price_duplicate and skipped by the caller; bit-exact by design so adjacent grid levels can never false-positive the way the removed tolerance layer did (modules/order/utils/validate.ts, tests/test_validate_create_target_slots.ts).

• Docs: record the kept last-fill-guard pivot semantics in the guard's doc comment — pivot is the latest fill of either side and never expires; last sold level floors new sells, buy fills pull the pivot down and re-open the sell side, buy-below-sell is never gated (modules/dexbot_cow_runtime.ts).

• Fix(guard): allow violation-reducing gap-evacuation rotations past the last-fill guard — new pure isEvacuationRotationAllowed(oldPrice, oldSize, newPrice, newSize, type, precision?) in modules/order/utils/math.ts (bit-exact blockchain-int size compare, no float epsilon; outward repricing only; rail types only); COW rotation guard honors origin='gap-evacuation' on UPDATE actions only via the frozen plan-build B-stamp (evacBoundary/evacGapSlots stamped in buildActionsFromPlan, reconcileGrid.pairRotations, optimizeRebalanceActions) with fail-closed live-probe fallback (master-grid source read before rotation pre-application); lying "no origin bypass" comments rewritten (modules/dexbot_cow_runtime.ts, modules/order/utils/validate.ts, new tests/test_gap_evacuation.ts EVAC-001..004/009/010).

• Fix(holes): keep rail-typed VIRTUAL holes across fill/rotation/load cycles — new toRailHolePlaceholder (rail type + booked size preserved) used by COW plan pre-apply (buildCowResultFromPlan), divergence-COW surplus cancel (modules/order/utils/system.ts), and fill-consumed rail slots (modules/order/strategy.ts); load-time retype (modules/order/grid.ts) and assignGridRoles type empty slots by slot-index geometry (in-rail stays BUY/SELL, only true band slots are SPREAD; unparseable ids stay SPREAD); validateOrder documents rail-hole preservation; expect a one-time [GRID-TYPE-CORRECT] backfill spike on first load of legacy grids (tests/test_gap_evacuation.ts EVAC-006/011; tests/test_grid_bloat.ts and tests/test_boundary_restore_validation.ts updated to the rail-hole contract).

• Feat(evac): geometry-only gap-evacuation detection + per-slot streak counter — new detectGapEvacuationCandidates (slot idx vs frozen boundary/gapSlots, never stored type) and updateGapEvacuationStreaks (manager._gapEvacStreaks, persisted in the grid snapshot via storeMasterGrid/persistGridSnapshot and restored on startup/recovery with pruning to loaded slots; cancel markers stay in-memory by design) ticked per reconcileGrid plan with [GAP-EVAC] warn on stuck slots; new GAP_EVACUATION_STREAK_THRESHOLD (2) in GRID_LIMITS (modules/order/utils/order.ts, modules/order/manager.ts, modules/account_orders.ts, modules/order/utils/system.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts, modules/constants.ts, tests/test_gap_evacuation.ts EVAC-007/008, tests/test_gap_evac_persistence.ts GEP-1..4).

• Feat(evac-teeth): cancel-only evacuation for orders that stay stranded in the gap band — evacReady now propagates out of the COW engine on both success and aborted plans, and the manager queues a correction per stuck slot at GAP_EVACUATION_CANCEL_THRESHOLD (3, one warn cycle after the streak threshold) via _processGapEvacuationTeeth: re-verifies CURRENT committed geometry + live slot ownership, queues once per slot (_gapEvacCancelQueued, marker released when the slot resolves), and uses surplus semantics so the runner cancels the chain order and settles the slot back to a SPREAD placeholder — no re-placement, fee-light (modules/order/manager.ts, modules/constants.ts, tests/test_gap_evacuation.ts EVAC-012..015).

• Diag(sync): orphan-adoption remap log carries slot geometry (idx/boundary/gap/sellStart/band-vs-rail) so the next re-map incident attributes the path without chain archaeology (modules/order/sync_engine.ts).

• Fix(tests): stub-class hardening for cold-guard batch-summary interference — UNC-015/015c assert on the full warn sequence instead of last-wins capture; test_resync_invariants case-4 fetch stub guarantees _lastFetchedAt advancement past same-ms collisions (production behavior unchanged; tests/test_uncertain_broadcast.ts, tests/test_resync_invariants.ts).

• Fix(accounting): guard the updateOptimisticFreeBalance debug line against an unresolvable order side — formatSizeByOrderType throws on unknown precision, so a debug-only log could crash the accounting flow; the line now falls back to raw numbers when the side is not BUY/SELL. Repairs the long-standing test_scaled_spread_correction Scenario B failure (pre-existing fixture crash since 1.5.0); full suite is green again (modules/order/accounting.ts).

2026-09-06

• Feat(reconcile): refill rail levels vacated by startup re-map (vacate+create atomic) — _reconcileStartupSide records, per PROCEEDING update, whether the vacated price exactly matches (priceSlotEqual) an empty, sized, in-rail slot of the same side and queues a refill CREATE in the same plan (source startupVacatedRailRefill); skipped updates (insufficient balance) vacate nothing, ghost prices (lattice moved) and in-band slots (evacuation/adoption paths own them) are skipped, as are slots already desired for activation (no double-place); refill targets require VIRTUAL state with no orderId (CANCELED slots and phantom VIRTUAL-with-orderId excluded) (modules/order/grid_reconcile_internal.ts, tests/test_vacated_rail_refill.ts VRR-1..7).
• Feat(evac): persist gap-evacuation streaks across restarts — storeMasterGrid accepts gapEvacStreaks (sanitized: finite positive counts only; explicit empty map clears the stored entry, undefined is a no-op for backward-compatible callers), persistGridSnapshot forwards the manager's streak map, loadGapEvacStreaks mirrors the other snapshot loaders, and restoreGapEvacStreaks (pruned to loaded slots) is wired into the startup active-session path and the recovery full-grid reload (modules/account_orders.ts, modules/order/utils/system.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts, tests/test_gap_evac_persistence.ts GEP-1..4).
• Test: incident-replay integration suite for gap-evacuation acceptance — with boundary 141 / gap 4 / increment 0.3% and three sell actives stranded in the band, the pipeline must plan exactly three stamped evacuation rotations, the plain last-fill guard must veto all three, both bypass routes (frozen B-stamp and live probe) must allow them, and the real pre-apply + working-grid commit must end with the band empty and a visible spread of ~1.5% (REP-001..004; tests/test_incident_replay.ts).
• Fix(guard): harden gap-evacuation stamping and execution re-verification — new exported isEvacuationStampStillValid re-verifies B-stamped evacuation UPDATEs against live committed geometry at execution (stale stamps downgrade to the unstamped live probe, which itself now requires valid live evacuation geometry); plan-level withOrigin routes gap-evacuation rotations through the real stampGapEvacuationRotation (geometry + bit-exact non-growing size with side precision + outward repricing must prove, refusals strip the origin, sourceless rotations stay unstamped, gap-plan CREATEs no longer carry a dead origin); stamp and live probe share bit-exact blockchain-int size semantics via threaded manager assets (modules/dexbot_cow_runtime.ts, modules/order/utils/validate.ts, modules/order/manager.ts, modules/order/utils/system.ts, tests/test_gap_evacuation.ts EVAC-016..019).
• Fix(sync): legacy fallback adoption parity — the legacy adoption branch now captures _applyOrderUpdate's result and on rejection queues an adoption-rejected cancelOnly correction (mirroring the genesis branch) with bookkeeping only after a successful apply (modules/order/sync_engine.ts).
• Fix(cow): bit-exact same-batch price duplicate key — the layer-5 duplicate guard keys on floatToBlockchainInt(price, sidePrecision) when assets context exists (float fallback preserved for asset-less callers) so distinct prices quantizing to the same on-chain int no longer escape (modules/order/utils/validate.ts, tests/test_validate_create_target_slots.ts).

[1.5.0] - 2026-09-05 - Credit Overview & Whitelist-Scoped CR, TradingView Shortcut, Reload Command, Guard & Rotation Hardening

2026-09-02

• Fix(editor): bold Mountain weight in selector display (modules/account_bots.ts).

2026-09-03

• Feat(cli): add dexbot credit live per-bot debt overview and centralize CLI color palette — new scripts/analyze-credit.ts (wired as dexbot credit [<bot>]) queries live get_margin_positions + paginated get_credit_deals_by_borrower per preferredAccount and prints summed debt/collateral per asset per bot (lending-asset filtered, shared accounts tagged, chain chatter muted, inclusive-pagination overlap dropped to avoid double-counting); new modules/cli_colors.ts (CLI_COLORS) is the single source of truth for every ANSI shade repo-wide with no visual change (scripts/analyze-credit.ts, dexbot.ts, modules/cli_colors.ts, README.md, docs/WORKFLOW.md, tests/test_analyze_credit.ts).

2026-09-04

• Feat(credit): whitelist-scoped CR reporting and shared credit-pricing math — new browser-safe modules/credit_pricing.ts holds the canonical math (collateral-map normalization, core/legacy-reversed orientation, offer conversion rates, per-deal and value-weighted average CR, fee helpers) with credit_runtime.ts delegating to it (conversion-rate fallback extended offer → pool-derived → universal market price incl. BTS-bridge hops); analyzer per-pair Curr. CR and per-bot Avar. CR are now scoped to whitelisted debtPolicy.lending pairs priced on the current offer, color-coded vs maxCollateralRatio, with Excluded split by reason and uncapped offer pagination; new derivePriceViaBridges/derivePriceWithBridges in modules/order/utils/system.ts (LP legs bridge only on opt-in) (modules/credit_pricing.ts, modules/credit_runtime.ts, modules/order/utils/system.ts, new tests/test_credit_pricing.ts, tests/test_price_bridges.ts, tests/test_credit_conversion_fallback.ts).
• Feat(cli): add dexbot reload that leaves the credential daemon untouched — mirrors restart on every runtime surface (unlock reload-all recycles bots + market adapter via SIGUSR2 skipping the daemon re-unlock block, supervisor reload/reload-all, pm2 restart with no ensureCredentialDaemon, reload dexbot-cred rejected) so bot/adapter recycling no longer costs a password prompt (unlock.ts, modules/launcher/bot_supervisor.ts, modules/launcher/launch_modes.ts, modules/launcher/monolithic_runtime.ts, pm2.ts, dexbot.ts, README.md, docs/WORKFLOW.md).
• Fix(identity): enforce case-insensitive bot-name identity across lookups — new isSameBotName in modules/utils/sanitize_key.ts (sanitized compare with blank-input guard) used by bot_settings, dexbot, unlock, bot, pm2, claw launcher/profiles/credit adapter, maintenance runtime, market-adapter inputs and helper scripts; PM2 stop/delete/restart/reload resolve to the canonical stored name, example pair-derived bot names in comments/help/fixtures replaced with a generic placeholder (published changelog history untouched).
• Fix(update): run npm install only when dependencies actually changed — new needsDepsInstall(preUpdateHead) gate in scripts/update.ts (install only when node_modules missing/incomplete, manifests changed since pre-update commit, or manifests worktree-dirty; fail-open on git errors) plus a lockRegenerated double-install guard (scripts/update.ts).
• Fix(adapter): centralize market-adapter ownership in unlock wrapper on one 1min interval — new modules/launcher/adapter_requirement.ts (semantic name:gridPrice fingerprint, corrupt/unreadable bots.json reported not thrown); wrapper exports DEXBOT_ADAPTER_OWNER=wrapper so supervised bots skip adapter sync and create no poll timer (wrapper-less modes keep the in-bot fallback); TIMING.BOTS_CONFIG_POLL_INTERVAL_MS now 60s shared with the watchdog interval; fixes ''-fingerprint false-change and corrupt-skip regressions (modules/launcher/adapter_requirement.ts, unlock.ts, modules/constants.ts, modules/launcher/*, modules/dexbot_class.ts).
• Feat(accounts): cache bot account IDs in bots.json for offline resolution — byte-preserving in-place accountId patch in analysis/bot_key_utils.ts (comment/string-aware scanner, re-parse assert, atomic write, full-rewrite fallback) with persistBotAccountId/getStoredBotAccountId/findBotKeyByAccountRef; new analysis/resolve_bot_accounts.ts batch backfill CLI (npm run analysis:resolve-accounts, --dry-run/--refresh/--bot-key/--json); editor stamps IDs via ensureBotAccountId, analysis tools and test-credit-renewal prefer the cache with --refresh-account re-verify; process-wide console floor (setGlobalConsoleLevel) silences node-init chatter during supervised lookups (analysis/bot_key_utils.ts, analysis/resolve_bot_accounts.ts, modules/account_bots.ts, modules/order/logger.ts, modules/bitshares_client.ts, tests/test_bot_account_id.js, tests/test_logger_console_floor.js).
• Fix(guard): close stale-pivot race in last-fill guard and harden spread correction — refreshLastFillPivotFromQueue() peeks the incoming fill queue before every COW guard check (CREATE, rotation UPDATE, fallback CREATE) and recordLastFilledPrices() now runs per chunk so later broadcast chunks gate on the true latest fill; per-action plan-origin stamping keeps spread-correction CREATE bypass while rotation UPDATEs never bypass; determineOrderSideByFunds() returns null instead of cross-asset raw-unit compare when priceless with both sides funded; spread check defers on post-gate fills with funds recalc before side decision; batch-level LAST-FILL-GUARD summary + per-batch pivot log lines added (modules/dexbot_cow_runtime.ts, modules/dexbot_class.ts, modules/order/grid.ts, modules/dexbot_maintenance_runtime.ts, modules/order/manager.ts, new tests/test_stale_guard_pivot_fixes.js).

2026-09-05

• Feat(cli): add dexbot tv one-step TradingView chart command — dexbot tv <bot|pool-id|AssetA/AssetB> [--month N] pulls 1h candles in chunked 1-month windows and delegates rendering to the TradingView exporter, replacing the manual fetch-then-export two-step; fetcher chunking reused via exported fetchCandlesSequentially/outputPath/buildFetchWindowsFromRange, chain-log mute centralized in modules/utils/chain_logs.ts, saved-chart paths print as clickable file:// links via toFileUrl (scripts/tv.ts, dexbot.ts, market_adapter/inputs/fetch_lp_data.ts, modules/utils/chain_logs.ts, analysis/chart_utils.ts, docs).
• Fix(cow): clamp COW rotation size to booked remainder for partial surplus — new clampRotationSizeForPartial in modules/order/utils/validate.ts applied at both rotation-pairing sites (pairRotations, optimizeRebalanceActions) so rotations sourced from PARTIAL surplus target the booked remainder instead of the hole size, ending the plan→skip→restore loop that stranded holes and left non-contiguous rails (modules/order/utils/validate.ts, modules/order/manager.ts, modules/order/utils/system.ts, tests/test_cow_master_plan.ts COW-019).
• Fix(credit): distinguish Avar/Curr CR lines in dexbot credit output — display-only: Avar. CR label orange+bold printed first, Curr. CR label grey+bold with trailing comma, values keep health colors (scripts/analyze-credit.ts).
• Feat(discovery): split HIGH discovery tier into DEXBot2 vs DEXBot1-style by op-77 usage — DEXBot2 broadcasts native limit_order_update ops (type 77) for COW re-prices while DEXBot1-style only cancels+recreates, so presence of op 77 in-window assigns flavor; display-only split (score formula unchanged) with Updates column in HIGH tier, summary and --output-json carrying flavor/updates (analysis/bot_usage/kibana_bot_queries.ts, analysis/bot_usage/discover_bot_accounts.ts).
• Fix(cli): forward --help/-h to the credit and tv sub-scripts — the CLI intercepted help flags anywhere in argv and always printed generic help, so dexbot credit --help / dexbot tv --help never reached the scripts that own their usage text; the dispatcher now resolves the requested command first and lets only scripts with offline help handling (credit, tv) keep the flag, everything else keeps the generic help (dexbot.ts).

[1.4.25] - 2026-09-02 - Genesis-Frozen Price-Slot Determinism, Self-Trade & Fill-Guard Hardening, Grid Orphan & Recovery Hardening

2026-08-29

• Fix(grid): restore strict ERROR diagnostics by fixing hidden fund-invariant and precision failures — re-enables strict diagnostics that were masked by NaN fund-invariant comparisons and float precision drift; fixes fund-invariant tolerance fallback, amount precision helpers, and related silent-failure paths so ERROR logs fire correctly (modules/order/accounting.ts, modules/order/utils/math.ts, modules/constants.ts, etc.).
• Fix(gap-band): enforce gap-band invariant across COW plan, sync, reconcile and recovery (P1–P5) — introduces authoritative gap-band checks that reject placements violating the reserved gap, validates gap-band geometry in COW planning, sync adoption, startup reconcile and recovery persistence so boundaries cannot drift into the forbidden band (modules/order/grid.ts, modules/order/utils/math.ts, modules/dexbot_cow_runtime.ts, modules/order/sync_engine.ts, modules/order/grid_reconcile*.ts, modules/dexbot_state_recovery.ts).
• Fix(grid): prevent same-slot re-placement and truncation-drop orphans after COW commit — guards against re-creating an order on a slot that was just committed and against truncation-ambiguous reads dropping live orphans; keeps slot provenance across COW commit so placed orders are not re-issued or lost on a truncated read (modules/dexbot_cow_runtime.ts, modules/order/sync_engine.ts, modules/order/grid_reconcile_internal.ts).
• Fix(grid): make chain evidence authoritative and remove destructive gap-band cancellation — cancels that swept the gap band based on stale local state are removed; chain-observed orders are the sole authority for gap/rail membership and gap-band sweeps are no longer triggered from local-only evidence (modules/order/grid_reconcile*.ts, modules/order/sync_engine.ts).
• Fix(grid): heal and prevent sized-orphan phantom orders in spread and COW commit — spread-correction and COW commit paths that left VIRTUAL slots with size>0 and no orderId (sized orphans causing 2.02% vs 3.04% spread divergence) are healed on reload (virtual-size zeroing with createUncertain preservation) and prevented at commit (or­phan exclusion from sizing denominator, durable markers) (modules/order/grid.ts, modules/order/manager.ts, modules/account_orders.ts, modules/dexbot_cow_runtime.ts).

2026-08-30

• Fix(recovery): stop recovery re-anchoring and make orphan adoption durable — structural resync no longer re-anchors to the latest AMA center (state repair only); orphan adoption widened with ORPHAN_ADOPTION_TOLERANCE_MULTIPLIER (×4) on empty slots, reconcile prefers in-place price updates over pre-emptive cancels, and boundary/slot persistence is hardened (modules/dexbot_maintenance_runtime.ts, modules/order/sync_engine.ts, modules/order/grid_reconcile.ts, modules/constants.ts).
• Fix(engine): harden order engine against orphan-cascade failure modes — closes four unvalidated local-state paths (stale-slot fill price poisoning the anchor, off-market placement, phantom virtualization from empty reads, blind unknown-fill proceed credit) via broadcast orphan gates, anchor outlier rejection, price-sanity clamp, suspect empty-read guard (3 confirms), adoption retry, and durable createUncertain markers; placement now wrapped in startBroadcasting so fill-driven rebalances cannot duplicate plans (modules/order/grid_reconcile.ts, modules/order/manager.ts, modules/dexbot_maintenance_runtime.ts, modules/constants.ts, modules/order/utils/order.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_cow_runtime.ts).
• Fix(maintenance): make trigger reset reliable — skip idle gate, drain stalled fills, repair infeasible boundaries — trigger-file resets now execute immediately (skipIdle), fill queues deferred by batchInFlight/recoverySyncInFlight are drained on pipeline clear via _onBroadcastRegionEnd (wired at both OrderManager creation sites), and NO_FEASIBLE_BOUNDARY (overlapping BUY/SELL inside gap) escalates to a minimal cancel ladder so placements resume instead of freezing in adoption-only mode (modules/dexbot_maintenance_runtime.ts, modules/order/manager.ts, modules/dexbot_startup_runtime.ts, modules/order/utils/math.ts, modules/order/grid_reconcile*.ts).
• Docs: consolidate orphan-fix plans and add grid monotonicity gate — four test-branch incident/plan docs merged into docs/CONSOLIDATED_ORPHAN_FIX_SUMMARY.md (LANDED/REVERTED/SUPERSEDED annotated) and new npm run analysis:grid-check (analysis/grid_correction_check.ts) validates consecutive same-direction fills are monotonic (sell rising / buy falling) via Kibana fill_order history (analysis/*, docs/*, modules/constants.ts).

2026-08-31

• Fix(launcher): ensure bot detection within 5min and correct disable/enable active check — new TIMING.BOTS_CONFIG_POLL_INTERVAL_MS (5min) decouples fingerprint polling from the heavy 240min chain fetch so new/reenabled bots are observed within 5min; dexbot.ts setBotActiveState now treats undefined as active (active !== false) fixing enable all churn on implicit-active bots (modules/constants.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_class.ts, modules/dexbot_startup_runtime.ts, dexbot.ts).
• Fix(security): close shutdown race that wiped live signing tokens — _shutdownImpl no longer nulls botHmacSecret while deferred SAFE-REBALANCE continuations are pending; tokens are wiped only on process exit via registerExitWipe; SOURCE_AUTH_DENIED retries re-read daemon-policies.json, OrderManager gains _shuttingDown/_awaitBroadcastIdle abort, and monolithic mode retries failed bot startups bounded (3×30s) (modules/dexbot_class.ts, modules/graceful_shutdown.ts, modules/key_store.ts, modules/order/manager.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_cow_runtime.ts, dexbot.ts).
• Fix(grid): block self-trading grid placements across all broadcast paths — adds tolerance-widened crossing guard (findCrossedOrder in modules/order/utils/math.ts, buildCrossingCandidates merging master/pending/chain) to COW CREATE/rotation NOT-FOUND fallback and to startup reconcile/relocation/price-correction paths; rotation now uses swept-band exclusion instead of stale slot-type rotation that caused chunked-broadcast self-fills (modules/dexbot_cow_runtime.ts, modules/order/utils/math.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/order.ts, modules/order/strategy.ts).
• Fix(fill): restore main fill queue handling stalled by broadcasting gate — removes isBroadcastingActive from consumeFillQueue defer gate (already serialized by _fillProcessingLock/stale-plan guard; defer had no reschedule and starved the queue during chunked broadcasts) and drains deferred fills when _batchInFlight/_recoverySyncInFlight clears (modules/dexbot_fill_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_class.ts).
• Fix(grid): re-price duplicate-price grid stragglers instead of cancelling them — burst re-anchor that left multiple BUYs at the same level (e.g. 902.08089 ×2, 894.01113 ×3) and self-filled is now fixed by re-pricing stragglers to the next unique ladder step away from market (clamped to [minPrice,maxPrice], preserving orderId/size) via correctOrderPriceOnChain UPDATEs instead of virtualize→cancel; adds whole-burst swept-band caching and asymmetric multi-sell-sweep buy exclusion for chunked and unified bursts (modules/order/strategy.ts, modules/dexbot_class.ts, tests/test_grid_robustness.ts).

2026-09-01

• Fix(engine): revert anchor divergence and boundary-evidence, restore last-fill guard — removes MarketAnchor/BOUNDARY-EVIDENCE/BAND-EXCLUSION paths that drifted from self-trade fills and cancelled stranded orders, restores deriveTargetBoundary/snapRail grid-dedupe and seeds LAST-FILL-GUARD from book at startup/post-fill to block BUY above last filled BUY and SELL below last filled SELL with cross-guard per-type collision checks (modules/constants.ts, modules/order/utils/order.ts, modules/order/strategy.ts, modules/order/grid_reconcile.ts, modules/dexbot_class.ts, modules/order/manager.ts, modules/dexbot_cow_runtime.ts).
• Fix(grid): close duplicate-order incident class from trigger-reset phantom empty read — a trigger reset that observed a single 0-order lagging-node read rebuilt over a live order and queued the wrong duplicate for cancel (books 0.5626 vs chain 0.5626+0.6659). Fix: trigger GRID-RESYNC empty reads now require a 2s confirming re-read (SYNC_EMPTY_READ_CONFIRM_DELAY_MS), rotation/plan UPDATEs clamp or skip growing PARTIAL slots above booked remaining size, Pass 1 size-consistency tiebreak rebinds a slot to the same-price chain order matching booked size (exact), and updateOrdersOnChainBatchCOW drains pending price corrections before planning (modules/dexbot_maintenance_runtime.ts, modules/constants.ts, modules/dexbot_cow_runtime.ts, modules/order/sync_engine.ts, modules/order/manager.ts).
• Fix(g guard): last-fill guard pivot ± halfIncrement (BUY < pivot*(1-half), SELL > pivot*(1+half)) — replaces dual-pivot + tolerance with single global pivot (most recent fill) ± half grid increment (e.g. i=0.5% @1000 → BUY<997.5, SELL>1002.5); fixes SELL 1013>1001 after BUY 1001 being wrongly blocked and closes half-step profit hole; spread-correction bypass retained (modules/order/manager.ts, modules/dexbot_cow_runtime.ts).

2026-09-02

• Feat(genesis): implement genesis-frozen price-slot determinism (Phase 1–2, log mode) — slot-N becomes the single source of truth (price = genesis.priceLevels[N]); adds GridGenesis/hashPriceLevels/priceLevelsForGenesis/priceForSlot/slotIndexForPrice (binary search, lower-wins tie)/priceSlotEqual (int equality)/buildGenesisFromPriceLevels/assertSlotPriceInvariant, canonical parseSlotIndex (modules/order/utils/slot.ts), createOrderGrid dedup+genesis build, loadGrid genesis validation/canonical re-sort/type re-assignment via parseSlotIndex with legacy migration, account_orders/working_grid/system/startup/recovery genesis threading, and GRID_PRICE_SLOT_DETERMINISM_PLAN.md (modules/order/utils/math.ts, modules/order/grid.ts, modules/account_orders.ts, modules/order/working_grid.ts, modules/order/utils/system.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts, modules/order/grid_reconcile.ts, docs/*, tests/test_grid_price_slot_invariant.ts).
• Feat(genesis): complete genesis-frozen price-slot determinism (phases 3–9) — replaces all tolerance-based price matching with slotId equality / priceSlotEqual; sync engine Pass 2 adopts by nearest slot via slotIndexForPrice with isSlotInRail gap check and VIRTUAL/free slot bind; COW guards hasSlotPriceCollision/validateCreateTargetSlots use priceSlotEqual; fill/grid/rail paths (isSlotInRail fail-closed, chainOrderMatchesSlot, hasDuplicatePriceLevel, grid_reconcile cleanup) unified on genesis; legacy tolerance retained only for no-genesis migration (modules/order/sync_engine.ts, modules/dexbot_cow_runtime.ts, modules/order/utils/validate.ts, modules/dexbot_fill_runtime.ts, modules/order/*, tests/* 12 suites).
• Feat(editor): add Range quality legend with tiered coloring — RANGE_QUALITY thresholds (GREEN_MIN 2.0 wide / YELLOW_MIN 1.55 efficient / ORANGE_MIN 1.45 tight / RED_MAX 1.45 suicidal <1.45x) drive a pre-entry legend and live colorRangeValueByQuality in askNumberOrMultiplier/askMaxPrice and summary Pair display (cyan) (modules/constants.ts, modules/account_bots.ts).
• Feat(whitelist): add scoped --bot overwrite with validation and warnings — dexbot white --bot <botKey> overwrites only the targeted whitelist key (merge preserves unknown flags like derivativeSignals) while additive-only behavior is preserved without --bot; parseOptions now collects botKeys (--bot/--bot-key/--botKey, = and comma forms, repeatable) with missing/flag-like validation (throws, main prints usage and exits 1), buildWhitelist filters to targeted keys and warns when --bot target not found or has non-AMA gridPrice (scripts/generate_market_adapter_whitelist.ts, dexbot.ts, docs/*, tests/test_market_adapter_fixes.ts).
• Fix(editor): align Range quality wording — legend ≤1.35x: suizidal → <1.45x: suizidal to match getRangeQuality (<1.45x red, 1.45x–1.55x orange) and make RANGE_QUALITY.RED_MAX authoritative (modules/constants.ts, modules/account_bots.ts).

[1.4.24] - 2026-08-28 - Native Fill Gap Recovery, Eager Coalesced Retry, LP Collateral Offer-First Pricing

2026-08-28

• Fix(native-client): recover dropped fills after subscription notice gaps — core engine fix for the 2026-08-28 crash burst (24 and 38 fills dropped, Fund invariant violation SELL / oversell). handleNotice advanced lastDeliveredHistoryId to the max op id present in the notice (including non-fill ops like limit_order_create), so any fill whose 1.11.x id fell between the old cursor and that max was skipped by the strictly-newer-than-cursor get_account_history scan and lost forever; reconnect/poll did not arm recovery and the history merge left entries unsorted so the cursor could land on a gap entry. The fix: handleNotice now advances only to the max fillMatchesAccount id for that subscription and arms _gapRecovery for the next coalesced processObjects; fetchFillHistoryEntries gains a lookbackOps window (NATIVE_CLIENT.SUBSCRIPTIONS.HISTORY_GAP_LOOKBACK_OPS = 2000 per-account 1.11.x slots) that lowers stop to cursor-lookback-1 inclusive (core api.cpp:443 stop is exclusive) and skips entries below the lookback floor — so [lookbackStop, head] is re-covered with re-delivery safe via downstream history-id dedup; processObjects consumes _gapRecovery with a single inclusive lookback+tail scan, sorts oldest-first, and only clears the flag after a successful fetch (retry on throw/timeout); resubscribeEntry/resubscribeAll arm _gapRecovery unconditionally on reconnect; startFillPolling no longer arms every 60s tick (avoids ~80 pages/min steady-state cost); new decrementObjectIdBy helper and defensive sorting added (modules/bitshares-native/subscriptions.ts, modules/constants.ts, new tests/test_fill_gap_recovery.ts reproducing 5095..5099 gap with cursor 5000→6002 and asserting recovery).
• Fix(native-client): eager gap recovery without waiting for poll — the initial gap fix armed _gapRecovery but recovery was only consumed by the next non-fill notice coalesce (250ms) or the 60s fill poll, leaving up to a 60s correctness window in the quiet-after-gap case where the burst gap (5095..5099 dropped, cursor 5000→6002) could still cause inventory drift before the lightweight 15min/240min open-orders syncs. Now _gapRecovery is armed only when the cursor gap exceeds one op (gap = latest - oldCursor > 1, so sequential 5000→5001 skips the scan while burst 5000→6002 arms it, avoiding a 40-page scan on every sequential fill) and an eager coalesced lookback is scheduled via pendingScans/_processingHistory for each armed sub (fires in ~250ms NOTICE_COALESCE_MS, unref timer, coalesced per burst, respects in-flight scans); processObjects pollution is avoided by skipping poll when _processingHistory is true, with poll retained only as a safety-net fallback — cost is one 40-page window per gap event, not per poll, retry-safe via history-id dedup (modules/bitshares-native/subscriptions.ts, tests/test_fill_gap_recovery.ts tightened to eager-only path without a second no-fill notice).
• Fix(credit-runtime): prefer offer map over pool for LP collateral pricing — the hourly live credit offer price unavailable warn fired for LP share collateral where pool derivation failed for the debt denomination (e.g. pool requires pricing an underlying reserve with no market) even though the offer's acceptable_collateral listed the LP explicitly; the LP-exclusive branch ran before the offer-map lookup and returned cached-offer on pool miss, shadowing the live offer and logging both the pool derivation failure and the cached-offer warn on every hourly collateral distribution call, with redundant asset resolution and stale line-number refs. _resolveCreditConversionRate now tries the offer map (live-offer / owned-offer) first and only falls back to deriveLiquidityPoolTokenValue when the offer has no entry for the debt/collateral pair; pool fallback is gated on !cachedIsFresh to avoid hourly deriveLiquidityPoolTokenValue failures when a fresh cached rate exists; already-resolved debtAsset/collateralAsset are reused instead of re-resolving for the pool path; early cached return on owned-offer miss is replaced by fall-through so genuine LP-no-offer pairs still reach the pool fallback (modules/credit_runtime.ts).

[1.4.23] - 2026-08-28 - Even AMA Ladder, BTS Fee-Carve Fix, Price-Bound Rejection, TradingView Axis, Doc Realignment

2026-08-26

• Fix(analysis): survive numeric botFunds values in analyze-orders — botFunds could arrive as a bare number (e.g. from upstream contribution #13) instead of the {base,quote} object shape the dynamic-weight path expected, throwing on property access; analyze-orders now normalizes numeric botFunds into the object form before use, with a regression test covering the number input (scripts/analyze-orders.ts, tests/test_analyze_orders_dynamic_weight.ts).

2026-08-27

• Docs(readme): add Arch/Manjaro Git install instruction — the prerequisites block assumed apt/debian-based package managers; a one-liner for pacman -S git is added alongside the existing distros (README.md).
• Fix(order): reject sub-1x price-bound multipliers resolving above market (#15) — minPrice/maxPrice accepted multipliers like 0.5x that resolve to a price above the current market (e.g. 0.5x of a higher anchor), silently placing the whole grid off-market; the editor now blocks sub-1x multipliers whose resolved price would sit above market, the multiplier parser reports the resolved price for validation, and utils/math.ts/utils/order.ts gain the rejection helpers with tests/test_utils.ts coverage (modules/account_bots.ts, modules/order/grid.ts, modules/order/utils/math.ts, modules/order/utils/order.ts, tests/test_utils.ts).
• Fix: deep-merge nested kalman override instead of wholesale replace — the AMA-grid-price override path replaced the entire nested kalman config object with the raw override, dropping sibling keys; the override now deep-merges into the existing kalman subtree, with tests/test_dynamic_weight_override_wiring.ts coverage (market_adapter/market_adapter.ts, tests/test_dynamic_weight_override_wiring.ts).
• Tune: even geometric AMA slowPeriod ladder (+16% steps) — the AMA_SLOW_PERIOD_LADDER used uneven spacing between rungs; the geometric step is normalized to a constant +16% ratio so preset spacing is uniform and predictable (modules/constants.ts).
• Docs: align AMA preset references with constants ladder, fix stale warmup math — docs and a few analysis scripts cited AMA ladder values and warmup formulas that had drifted from modules/constants.ts; references are corrected to the live ladder, stale warmup/window math fixed, and scripts/sync-version.ts hardened to sync the version into the docs-derived constants it consumes (analysis/ama_fitting/analyze_lambda_vs_slow.ts, analysis/ama_fitting/optimizer_high_resolution.ts, analysis/tradingview/README.md, docs/GRID_RECALCULATION.md, docs/README.md, market_adapter/README.md, modules/constants.ts, scripts/sync-version.ts, tests/test_market_adapter_logic.ts).
• Fix(tradingview): working price-axis zoom, log density, and 4-digit labels — the TradingView-style chart exporter's price-axis interaction regressed: wheel zoom on the gutter, log-scale density, and 4-digit axis labels are restored with the same UPLOT_SHARED_SCRIPT range-callback contract used elsewhere (analysis/tradingview/tradingview_uplot_chart_generator.ts).
• Docs: reorder Reference Docs from general to specific — README.md's Reference Docs section is reordered so the broad architecture/lifecycle docs lead and the narrower per-subsystem docs follow, matching the reader's narrowing path (README.md).

2026-08-28

• Docs: enrich BitShares onboarding links and restructure closing sections — docs/BITSHARES_ONBOARDING.md adds more precise links to the relevant BitShares resources and reorganizes the closing sections (next steps, troubleshooting, support) for better flow (docs/BITSHARES_ONBOARDING.md).
• Fix(analysis): ensure charts dir exists before writing order-analysis export — analyze-orders --export wrote the HTML report into analysis/charts/ but assumed the directory already existed, throwing on a fresh checkout; the export now materializes the charts directory before writing (scripts/analyze-orders.ts).
• Fix(grid): stop BTS-pair fee carve from clipping the non-BTS side budget — the BTS-pair fee carve adjusted the budget for both sides of a BTS-quoted pair, so carving the BTS-side fee also shrank the opposite (non-BTS) asset's budget below what it should hold; the carve now only trims the BTS leg, leaving the non-BTS side's budget intact, with extended tests/test_grid_logic.ts coverage (modules/order/grid.ts, tests/test_grid_logic.ts).

[1.4.22] - 2026-08-25 - tsx Removal Completion, Exact AMA Bootstrap, Research Parity, Canonical Grid Bounds, Modules-Wide Audit

2026-08-26

• Feat(analysis): TradingView-style price-axis interaction in the tradingview chart exporter — mouse wheel over the right price gutter zooms Y around the cursor (0.91/1.10 factors) and a vertical drag on the axis sets a manual Y range (multiplicative on log scale, additive offset otherwise), while double-clicking the axis restores auto-fit through the existing visiblePriceRange range callback; the plot area keeps pure time pan/zoom via UPLOT_SHARED_SCRIPT using page-local hoisted overrides so the shared script stays untouched, axis hit-testing uses chart.bbox geometry (the .u-over overlay spans the axis gutters too), the manual range resets automatically when dataset/timeframe/pair changes (sticky-manual guard keyed on first-time:last-time:count), and the price axis renders larger labels at a fixed 84px width matching the volume axis (analysis/tradingview/tradingview_uplot_chart_generator.ts).
• Fix(market-adapter): keep Kibana LP fetches alive under proxy connection resets — the kibana.bitshares.dev console proxy kills responses mid-transfer once a single search page streams enough data (~8k docs with full _source, observed even at ~2k with _source: true), and doKibanaRequest only listened for request-phase errors, so an aborted response body left the promise pending forever and fetch_lp_data hung silently with no retry; the response stream now settles exactly once on 'aborted'/'error' with an actionable message, candle queries send a minimal _source projection derived from the field map (legacy _source: true preserved when no projection is passed), default page size drops 10000 → 2000, and transient page failures (aborted/reset/socket/timeout) retry up to kibanaPageRetries attempts (4) with linear backoff — safe because search_after pagination is stateless server-side; adapted from upstream contribution bitshares/DEXBot2#4 / froooze/DEXBot2#12 (market_adapter/core/kibana_client.ts, market_adapter/core/kibana_candles.ts, new tests/test_kibana_candles.ts).
• Refactor(analysis): dedupe tradingview fork CSS fragments and zoom-pan stack — the fork hand-cloned zoom/pan logic shared by every other uPlot generator and re-wrote a CSS fragment with identical shape: chart_css export surface narrowed to sharedChartCSS/uplotBgCSS/cursorCSS (dead fragments un-exported, uplotBgCSS gains an optional bg color parameter keeping the default), the .uplot background rule is interpolated via uplotBgCSS('#0b0f14'), local clampRange/syncXRange/bindWheelZoom/bindPan clones plus a bespoke Ctrl+0 handler are replaced by embedding UPLOT_SHARED_SCRIPT/zoomResetScript() (~90 lines removed) with xMin/xMax maintained in buildData per contract (analysis/chart_css.ts, analysis/tradingview/tradingview_uplot_chart_generator.ts, analysis/chart_ui.ts).
• Feat(analysis): model bot fitting backtests on the production grid lifecycle — both simulators previously ranked parameters by unrealized inventory marks (>99% phantom profit from cross-gap pair differentials no live slot earns); they now run production-style SLOT ROTATION on createOrderGrid geometry where scoring counts realized economics only: a filled buy arms the next rail-node sell booking one hop minus round-trip fees with the freed quote re-bidding behind it, out-of-range falls back to x(1±inc), initial-grid sells execute only against held base at weighted-average entry, production reset triggers fire from MARKET_ADAPTER constants (drift ratchet + slope delta gated behind the asymmetric-bounds whitelist like production) cancelling all orders with fees, BTS op fees are charged at every placement and reset cancel, drawdown tracks realized equity only, and the end-of-run inventory mark is informational/excluded from score; backtest_ama_sweep ports its sized worker simulation to the same model fixing a worker-result race (analysis/bot_fitting/*, tests/test_backtest_ama_sweep_logic.ts, new tests/test_backtest_bot_fitting_logic.ts).
• Refactor(analysis): align research tools with market_adapter sources to stop signal drift — kalman_chart_generator computes the dynamic-weight channel via the canonical computeDynamicWeightSeries/percentile threshold with live config rendered in the legend, regime_chart_generator sources windows/thresholds/boundaries from MARKET_ADAPTER matching classifyHurst instead of drifted local copies, dynamic_weight_chart_generator yields Infinity from empty percentile pools like the live path and fixes an axis tick color typo, generate_unified_comparison_chart reuses findLatestLpData/calculateMetrics from lp_chart_runner, and optimizer_high_resolution/analyzer imports consolidated onto canonical implementations — behavioral changes only where the drifted copies were wrong (analysis/trend_detection/*_chart_generator.ts, analysis/ama_fitting/*, market_adapter/lp_chart_runner.ts).
• Fix(analysis): correct research-tooling bugs surfaced by a full folder audit — analyze_regime_windows paired Hurst/PE bands sliced from different readiness offsets shifting classification into RANDOM|undefined regimes (now strictly per-bar via the production classifyHurst with MARKET_ADAPTER knobs); trade_profitability time bounds went through blind string surgery producing invalid dates for offset ISO strings, date-only --end dropped the final day, zero-amount fills poisoned LIFO lots with infinite prices, and --fee-per-order 0 was ignored (proper Date parsing, end-of-day expansion, positive-amount guard, nullable fee override); analyze_kalman's --q conflated tactical/modal values with divergent defaults (split into --q-tactical/--q-modal falling through to production); derivative_analyzer used macdMinHist as both histogram threshold and MACD line gate so explicit 0 was ignored; fetch_lp_candles rejects non-numeric --interval instead of NaN-ing requests; discover_bot_accounts uses the node management pool instead of a hardcoded websocket endpoint; price_sources resolves the centers filename through PATHS.MARKET_ADAPTER (analysis/analyze_regime_windows.ts, analysis/trade_profitability.ts, analysis/analyze_kalman.ts, analysis/trend_detection/derivative_analyzer.ts, analysis/ama_fitting/fetch_lp_candles.ts, analysis/bot_usage/discover_bot_accounts.ts, analysis/price_sources.ts, tests/test_trade_profitability.ts).
• Fix(modules): correct runtime defects from a modules-wide audit — accounting.ts null-guards the fund-invariant baseline so a missing snapshot degrades safe instead of NaN-comparing; credit_runtime.ts resolves full accounts wrapper-first, unifies LP collateral-ratio math on collateralValueInDebtAsset / borrowAmountFloat across offer and maintenance paths, drops a stale pendingRepayAmount when reborrow policies change, requires all groups resolved before prune treats missing deals as closed, honors lowercase TIMING.* overrides for credit-deal expiry thresholds, and passes explicit null defaults at nullable numeric reads; chain_orders.ts sends the correctly-named collateral_asset/collateral_amount fields for includeCreditDeals, stops caching null resolutions in asset/order resolvers, scopes listenForFills prefetch to subscribed accounts, and fetches get_full_accounts once per cycle extracting the account id from full[0][1]; dexbot_class.ts single-flights shutdown flush through a promise holder so concurrent shutdown requests share one drain and awaits fundRegistry.releaseAllocation before exit; dexbot_state_recovery.ts keys batch abort on the live illegal-state signal (consumeIllegalStateSignal()) instead of an error code nothing emits, mirroring the maintenance-path recovery contract; dexbot_startup_runtime.ts runs credit-runtime maintenance on the trigger-reset branch like every other reset path; graceful_shutdown.ts bounds each cleanup handler at 10s (resolve-mode) instead of one global race that could starve later handlers; settings_merge.ts deep-merges EXPERT GRID_LIMITS.GRID_COMPARISON over the prior subtree so partial expert overrides keep untouched comparison keys and scalar overrides are ignored rather than char-spreading; credential_policy.ts merges policy layers per-op so partial allowedOps constraints no longer replace the builtin op map, and skips __proto__/constructor/prototype own-keys from JSON config (pollution-safe); settings_merge.ts deepMerge skips the same prototype-dangerous keys at every level so crafted config files cannot pollute Object.prototype; fund_registry.ts reloads the shared registry file on mtime change instead of serving stale cross-bot state and clamps collateral releases like buy/sell sides; validate_profiles.ts reports profile syntax errors as ok:false issues instead of crashing validation; bot_settings.ts shares one duplicate-bot-key detector between assert and collect paths (modules/order/accounting.ts, modules/credit_runtime.ts, modules/chain_orders.ts, modules/dexbot_class.ts, modules/dexbot_state_recovery.ts, modules/dexbot_startup_runtime.ts, modules/graceful_shutdown.ts, modules/settings_merge.ts, modules/credential_policy.ts, modules/fund_registry.ts, modules/validate_profiles.ts, modules/bot_settings.ts).
• Fix(orders): order-pipeline corrections — format.ts gives toFiniteNumber proper overload semantics so an explicit null default returns null for non-finite input (previously undefined triggered the default-0 overload and nullable call sites silently read 0), with sync_engine residual/drift chain reads converted to the null form and re-guarded; logger.ts CSV-quotes exported cells containing delimiters/quotes/newlines, captures fee data timestamps from the log line instead of wall clock, and closes the log-flush race; processed_fill_store.ts invokes the explicit flush immediately when configured; async_lock.ts makes forceRelease of an orphaned lock a no-op instead of throwing; utils/order.ts drops the always-equal gridIndex clause from ordersEqual (it masked real content differences) and rewrites initial-order activation as filter-then-select so underfunded candidates skip cleanly; grid_reconcile_internal.ts and utils/validate.ts add missing null guards on chain responses (modules/order/format.ts, modules/order/sync_engine.ts, modules/order/logger.ts, modules/order/processed_fill_store.ts, modules/order/async_lock.ts, modules/order/utils/order.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/validate.ts).
• Fix(launcher): launcher and native-client hardening — process_discovery.ts adds a pid-liveness fallback discovery (runtime.kill(pid, 0), EPERM counts alive) for environments where tool-based discovery is unavailable; the market-adapter watchdog runs children with the scoped child-env builder; unreachable ESRCH catch branches are removed from bot_supervisor, monolithic_runtime and foreign_cred_daemon stop paths (a pid cannot be observed dead then reused before kill); bitshares-native/resolvers.ts invalidation completes alias invalidation and drops unused size getters; node_manager.ts updates health stats before the rate-limited early return; socket_json_client.ts contains synchronous throws inside request dispatch; signing_client.ts exposes an accountId getter used by credential flows; tx/tx_cache.ts excludes broadcast fees from cache keys so fee changes are not served stale results; subscriptions.ts removes dead open/closing subscription branches and resets history flags per batch; storage/browser_adapter.ts warns when degraded to in-memory mode; storage/index.ts header corrected (modules/process_discovery.ts, modules/launcher/market_adapter_watchdog.ts, modules/launcher/*, modules/bitshares-native/resolvers.ts, modules/node_manager.ts, bitshares-native/socket_json_client.ts, bitshares-native/signing_client.ts, bitshares-native/tx/tx_cache.ts, bitshares-native/subscriptions.ts, modules/storage/*).
• Chore(browser-boundary): align the browser-safe surface with reality — package.json browser-map exclusions added for modules/runtime_settings.js, all five Node-bound bitshares-native entry files (transport, signing_client, subscriptions, tx/builder, tx/tx_cache) and market_adapter/utils/chain.js (top-level createRequire(import.meta.url)); AGENTS.md Node-only list extended with the same files so convention docs match the bundler config (package.json, AGENTS.md).
• Refactor(dead-code): remove unreferenced symbols surfaced by the audit — constants.ts prunes the ECC mirror block, unused timing/network constants (SUBSCRIPTION_SILENT_THRESHOLD_MS, STARTUP_CONNECT_TIMEOUT_MS, MAX_TRANSACTION_SIZE, MAX_TIME_UNTIL_EXPIRATION, PERCENT_1) and the supervisor MAX_MEMORY_MB fallback, and aligns OBJECT_TYPES with the BitShares enum (CUSTOM_AUTHORITY 17 … CREDIT_DEAL 22) adding the credit-offer/deal object types used by credit flows; cr_planner.ts drops the legacy CR-formula exports (planCrAdjustment, collateral/debt target helpers) while keeping calculateCollateralRatio internal; credit_runtime.ts removes the test-only openCreditPosition/getCollateralOffsets wrappers (renewOnly coverage retargeted to buildCreditOfferAcceptOperation); key_store.ts removes the unused DirectKeyStore; crypto/index.ts drops dead pure-primitive re-exports; dexbot_fill_runtime.ts collapses tautological FILL_PROCESSING.MODE comparisons (history processing unconditional, open-orders fallback gated solely on requiresOpenOrdersSync); bots_file_lock.ts fixes the writeJsonFileAtomic doc drift (modules/constants.ts, modules/cr_planner.ts, modules/credit_runtime.ts, modules/key_store.ts, modules/crypto/index.ts, modules/dexbot_fill_runtime.ts, modules/bots_file_lock.ts).
• Test: add regression coverage for the trickier audit fixes — test_to_finite_number_null.ts locks the nullable-read semantics, test_credential_policy_layer_merge.ts covers per-op allowedOps merging plus __proto__ rejection, settings-merge tests cover EXPERT GRID_COMPARISON preservation and scalar-override immunity plus deep-merge __proto__ pollution rejection at nested levels, and the fill-batch suite asserts a deferred fill restores the exact pre-call _fillBatchInFlight count so concurrent batches cannot zero each other's guard; fixtures updated for the removed getSizingContext wrapper and the signal-based abort path (tests/test_to_finite_number_null.ts, tests/test_credential_policy_layer_merge.ts, tests/test_settings_merge.ts, tests/test_sync_fill_history_batch.ts, tests/*).
• Tune: raise the AMA slope ceiling default 0.085 → 0.09 and narrow the research slider floor 0.04 → 0.06 — de-sensitizes the AMA trend channel by ~5.6% (factor 0.85/0.9) so grid range-scaling asymmetry, grid price offset, and buy/sell weight tilt react proportionally weaker to the same slope magnitude; applied asymmetry at the current XRP-BTS slope drops ~21.25% → ~20.1% and the AMA-slope grid-reset trigger threshold rises 0.0068 → 0.0072 %/bar; behavior unchanged at |slopePct| ≥ 0.09 (identical saturation cap), research chart paste payloads with amaS% in [0.04, 0.06) clamp up to 0.06 (modules/constants.ts, analysis/trend_detection/dynamic_weight_chart_generator.ts, analysis/trend_detection/DYNAMIC_WEIGHT_RESEARCH.md).
• Fix(market-adapter): harden locking, signal math, and input tools from a full module review — Hurst buffer cap window+2 → window+1 so the newest candle is always included with shared classifyHurst() and a HURST_STRENGTH_NORMALIZER strength scale; ATR re-warms per chain segment so a bad candle no longer leaks pre-break values across the gap; dynamic-weight/slope dead-band boundaries inclusive on both sides with exact-zero slopes staying NEUTRAL at the default neutralZonePct of 0; permutation entropy validates m/delay/window against PE_ANALYZER_LIMITS at construction instead of running degenerate configs silently; Kalman filter defaults unified through a single _initState() with beams returned as a copy and null-safe displacement; a malformed custom regimeTable throws at construction instead of producing silent NaN multipliers. File locks gain an ownership token (fresh UUID per holder written into every payload; release only unlinks when the token still matches) so a stolen lock can no longer be deleted by its previous holder, including pid collisions across containers sharing a mounted volume — legacy token-less payloads stay releasable; partial acquisitions clean up their orphaned lock file instead of locking out later contenders, heartbeat derives as clamp(staleMs/2, 1s..30s) so it always fires inside the staleness window, and the holder heuristic recognizes dexbot-embedded adapters while anchoring entrypoint names to argv/path boundaries so unrelated scripts such as robot.js no longer match. Service wiring clamps clipPercentile to (0,100] at the read point, normalizes volatility exponent/scaleX to their effective ranges at the single configured point, derives amaSlopeGated/amaChannelContribution diagnostics from the canonical Kalman-disabled weight series so diagnostics agree with finalOffset whenever gating is active, records triggerSuppressedReason=stale_candle_data for stale-but-new cycles, and config normalizers treat null/empty as unset before Number() coercion so explicit JSON null no longer means "disabled". Input tools: fetch_lp_data completes the interval map (30m..7d) with loud validation instead of parsing "30m" as 30 seconds, adds linear retry backoff and honest range labels in --start/--end mode; fetch_cex_synthetic_data fixes the dead HTX endpoint (/market/history/kline), honors exchange page caps via CEX_PAGE_LIMIT_CAPS, corrects MEXC intervals (6h/12h/1W), rejects zero-price leg candles, and handles --help before bot resolution. Constants: new keys centralized (FILE_LOCK_HEARTBEAT_MIN/MAX_MS, LP_FETCH_RETRY_BACKOFF_BASE_MS, CEX_PAGE_LIMIT_CAPS, PE_ANALYZER_LIMITS, HURST_STRENGTH_NORMALIZER, DYNAMIC_WEIGHT_KALMAN_WARMUP_BARS_DEFAULT, DYNAMIC_WEIGHT_KALMAN_BEAM_COUNT_DEFAULT, DYNAMIC_WEIGHT_VOLATILITY_EXPONENT/SCALE_X_MIN/MAX), sourceRetries default 3 → 4; misc: kibana_client releases redirect bodies, data_discovery skips unreadable entries and dangling symlinks, asymmetric_bounds/collateral_manager share previously duplicated math, analysis/bot_key_utils delegates to the production createBotKey so unnamed bots resolve identical keys, vestigial exports removed, and 'use strict' hoisted above imports across ~90 files where it sat as a no-op (market_adapter/**, modules/constants.ts, analysis/bot_key_utils.ts).

2026-08-25

• Fix(grid): route root-level range scaling through canonical asymmetric bounds — the initializeGrid root-fallback hand-rolled the DOWN/UP scaling formulas instead of calling applyAsymmetricBounds, dropping its geometric safe-clamp: a persisted appliedAsymmetryFactor clamped at adapter time against AMA-centered geometry was applied to gridCenter-centered rebuild geometry, so an over-limit factor could distort the widened side and diverge from UI display. The fallback now feeds the persisted factor back through applyAsymmetricBounds with neutral caps (keeping the safe-clamp active against rebuild geometry), and the dynamicWeights path prefers rawSlopeOffset over the 2dp-rounded value matching the market adapter service; regression test covers a persisted DOWN factor 0.6 against '2x' bounds (safe limit 0.5) being clamped to 0.5 with correct widened min (modules/order/grid.ts, tests/test_grid_logic.ts).
• Feat(build): remove the tsx dependency entirely — every entry point and the full test suite now executes from compiled dist/ under plain node, making test execution identical to production execution. New tsconfig.tests.json compiles tests/ to dist/tests/ with package markers and ESM mock hook files copied in; frozen-ESM-safe production seams replace export patching (setDerivePriceTestHook, _setFeeCache, bot-level _submitCancelOrder/_syncMarketAdapterHook/_readOpenOrdersHook/_gridModule/_listenForFillsHook, all no-ops when unset); loader-hook based cross-process ESM mocking lands in tests/helpers/esm_mocks.ts; run-tests gains a 240s per-test watchdog; clean-dist.js deletes stale tsbuildinfo caches that made tsc emit nothing after clean; ~60 tests converted off tsx-era patterns and the lockfile sheds 78 orphaned @esbuild/* platform packages. Full suite 237/237 green (package.json, tsconfig.tests.json, tests/helpers/*, scripts/clean-dist.js, modules seam sites).
• Fix(market-adapter): code-health sweep and exact AMA bootstrap sizing — persisted adapter state is normalized once at processBot entry, explicit-null meta timestamps are guarded before Number() (null masqueraded as epoch 1970), kibana client promises settle once (no timeout+error double rejection), unparseable lock-holder pids are treated as alive, and dead helpers are dropped; the one-shot cold-start Kibana bootstrap now requests exactly rawKeepCount × interval hours instead of the old max() heuristic — sub-hourly bots no longer over-fetch ~4x+ and >1h intervals were previously under-fetching; shared browser-safe usesAmaGridPrice() extracted to modules/grid_price_source.ts (previously duplicated as regexes in two modules); fetch_lp_data probe output now describes the window actually queried and unknown ama_signal_runner CLI args throw instead of being ignored (market_adapter/*, modules/grid_price_source.ts).
• Fix(analysis): align research tools with production AMA slope and range-scaling — computeAmaSlopeClipThreshold moves to the import-free ama_slope_model.ts as the single source of truth (plus an incremental createAmaSlopeClipTracker with identical thresholds via binary insertion), analyze_dynamic_weight uses prefix-only clip pools so research reproduces live asymmetry without look-ahead, the analyze_kalman comparison panel feeds production constants instead of hardcoded drift values (72-bar lookback, MAX_SLOPE_PCT=3.0, NEUTRAL_ZONE=0.15), dynamic_weight_chart_generator drops its hand-copied clip loop for the injected canonical function, and scripts/analyze-orders delegates asymmetric-bounds math to canonical applyAsymmetricBounds so displayed bounds stay in lockstep with live grid scaling (market_adapter/core/strategies/ama_slope_model.ts, analysis/*, scripts/analyze-orders.ts).
• Docs: refresh reference documentation against the v1.4.21 codebase — all 15 doc files re-verified against source before editing: stale API references fixed (SPREAD_LIMITS → GRID_LIMITS.MIN_SPREAD_ORDERS; validateIndices/_repairIndices snippets → _gridVersion cache invalidation + assertOrdersStructurallySound(); rebalanceSideRobust fund validation → validateOperationFunds(); _reconcileGridCOW → WorkingGrid.buildDelta(); periodic refresh rewritten around the real setupBlockchainFetchInterval() flow; LendingEntryBase → DebtFirstCrPlanOptions; offer cache TTL corrected to 10 minutes; dead BotLoggingOverrides ref → actual runtime_settings merge wiring); ~24 GRID_RECONCILE.md line anchors plus LIFECYCLE/COW_INVARIANTS/FUND_MOVEMENT_AND_ACCOUNTING function anchors re-verified; legacy narrative removed (vault-migration section and masterPasswordHash row dropped from CREDENTIAL_SECURITY.md, FUND_MOVEMENT_AND_ACCOUNTING fix anecdotes rewritten as present-tense rules, archival appendixes trimmed in GRID_RECALCULATION.md/COPY_ON_WRITE_MASTER_PLAN.md/architecture.md); statistics and version context synced (252 test files, v1.4.21). Docs-only change, no runtime code touched (docs/*).
• Feat(analysis): clickable report path in the order-analysis export output — the --export HTML report lives in analysis/charts/ since output-dir centralization, but the console printed a bare absolute path terminals render as plain text; analyze-orders now wraps it in an OSC 8 hyperlink targeting the file:// URL when stdout is a TTY, falling back to the plain file:// URL for pipes and logs (visible label stays the absolute path so copy-paste works even without OSC 8 support), and README corrects the stale claim that --export writes to the repo root (scripts/analyze-orders.ts, README.md).
• Fix(scripts): repair native release gates and stale tsx-era docs after the dist migration — native_release_gates.ts used bare __dirname, undefined in compiled ESM, crashing every run with ReferenceError (now derived via fileURLToPath(import.meta.url)); the native:serial-snapshots / native:ecc-invariants / native:release-gates scripts invoked dist/tests/*.js after only npm run build, which excludes tests/, so all three failed on a fresh build (they now chain npm run build:tests matching the npm test order); runner.ts usage docs and scripts/README.md converted off tsx-era invocation examples — the wrapper table points at the dist shims the wrappers actually run, build/test rows describe the compiled flow, and a Native Release Gates section documents the native:* scripts plus the corpus report requirement (passed=true, transactionCount≥50) (scripts/native_release_gates.ts, package.json, scripts/runner.ts, scripts/README.md).

[1.4.21] - 2026-08-24 - Runtime Audit Fixes, Claw Dedup Hardening, Boundary Ceiling Alignment, Editor Color Feedback

2026-08-23

• Feat(ui): red/green highlight for botFunds percentage inputs — extend the price-multiplier live color feedback to the Funding section of the account bots editor: percentage allocations ("100%") render green while fixed absolute amounts render red, matching the existing min/maxPrice multiplier treatment. New isPercentageString/colorPercentageInput helpers mirror isMultiplierString/colorMultiplierInput (the local percentage check is stricter than order/utils/math.ts so partial input like "x%" never flashes green mid-typing); askNumberOrPercentage colors its default suffix and wires the readInput colorize option, and the Funding summary line renders Sell/Buy values through the same colorizer (modules/account_bots.ts).

2026-08-24

• Fix: correct runtime defects found in a modules-wide audit — silent-failure and initialization-order defects could disable safety checks, defeat batching, or poison configuration at load time: accounting.ts falls back to GRID_LIMITS.FUND_INVARIANT_PERCENT_TOLERANCE when unset (undefined/100 produced NaN and silently disabled the fund invariant); processed_fill_store.ts flushes on batch size only when configured (previous ?? 0 comparison made size >= 0 always true, flushing every write); sync_engine.ts tracks per-invocation fillGuardLowered so inner and outer finally blocks cannot double-decrement the shared _fillBatchInFlight counter under concurrent batches; bitshares_client.ts applies the configured node list even when node management is disabled, races node refresh against the remaining wait budget so it cannot overshoot the connection timeout, preserves lastConnectionError across disconnects, and reuses the shared withTimeout util; config.ts num() returns the default on empty or non-finite values instead of 0/NaN; settings_merge.ts keeps the base value when a raw override for an object section is not an object instead of spreading char-indexed garbage; fund_registry.ts clamps totalAllocatedPct at zero in releaseAllocation and logs loudly before resetting a corrupt registry file; account_orders.ts warns on corrupt profile files before falling back to empty state; credential_policy.ts uses Object.hasOwn for the allowedOps lookup; dexbot_state_recovery.ts normalizes stale-id input through a Set; runtime_settings.ts warns with bot-name context when market-adapter override resolution fails (modules/order/accounting.ts, modules/order/processed_fill_store.ts, modules/order/sync_engine.ts, modules/bitshares_client.ts, modules/config.ts, modules/settings_merge.ts, modules/fund_registry.ts, modules/account_orders.ts, modules/credential_policy.ts, modules/dexbot_state_recovery.ts, modules/runtime_settings.ts).
• Fix(grid): align boundary writers and add a sell-rail ceiling to the commit gate — deriveTargetBoundary clamped to length−1 while calculateFundDrivenBoundary clamped to N−gapSlots−1, so fill-driven updates could walk the boundary onto or past the SELL rail where resolveGapBand re-derives zero-SELL geometry permanently on every cycle. deriveTargetBoundary now caps at N−gapSlots−1 matching the fund-driven writer (degenerate geometries fall back to the legacy ceiling preserving the current boundary); validateBoundaryCommit rejects proposals past the shared writer ceiling with stable reason sell_rail_ceiling_exceeded; validatePersistedBoundary inherits the rule so loadGrid restore and recoverFromPersistedGrid refuse past-ceiling snapshots and fall through to clean rebuild — legacy persisted snapshots whose boundary sits past the ceiling now trigger the documented rebuild path instead of silently re-legalizing broken geometry (modules/order/utils/order.ts, modules/order/utils/math.ts, tests/test_boundary_restore_validation.ts).
• Refactor(claw): dedupe shared logic, remove dead code, harden error paths — bug fixes: position_manager guards syncPosition against unresolved MPA assets and persists close events before the catch-guarded sync; dexbot_profiles fixes spread order in normalizeBotEntries so active coercion actually applies; chain_actions.listenForFills awaits the subscribe promise before registering callbacks so failures surface as errors instead of unhandled rejections; memu_mcp_server redacts malformed --llm-profile/--db-config values in parse errors (secret leak); claw_launcher.spawnDetached() waits one macrotask for async spawn errors instead of returning false started:true; mcp_utils treats stdin EPIPE/EIO as EOF rather than crashing mid-session and maps tools/list catalog failures to −32603; decision_loop.resetAnalyzers clears marketPremiums; honest-ecosystem logs live pool-reserve fetch failures and returns null for unhonorable pinned poolRefs; position_discovery actually resolves asset triples in parallel; memu_bridge adds an EPIPE guard and the openclaw plugin returns isError results. Deduplication: shared createJsonRpcToolsHandler()/jsonRpcError(), single validateMemuCommandArgs() spec, extracted viaCredentialDaemon() broadcast path, unified computeCallOrderAmounts() call-order math; ~25 unused exports removed across profiles/infra/launcher/ecosystem/bridge modules plus the orphan claw/openclaw.plugin.json stale copy (claw/modules/*, claw/scripts/memu_mcp_server.ts, claw/openclaw.plugin.json).
• Fix(launcher): supervisor and runtime lifecycle corrections — bot_supervisor.ts enforces memory limits only for apps that define one (the previous global fallback restarted unlimited apps at MAX_MEMORY_MB) and the status banner prints real per-app limits; foreign_cred_daemon.ts SIGKILL path polls liveness until timeout like SIGTERM instead of a single immediate check that could race process exit; monolithic_runtime.ts resolves the updater close promise on spawn error (ENOENT left it pending forever and hung the update flow); market_adapter_runtime.ts simplifies isLockStale to pid-liveness semantics (the mtime branch was unreachable dead logic) (modules/launcher/bot_supervisor.ts, modules/launcher/foreign_cred_daemon.ts, modules/launcher/monolithic_runtime.ts, modules/launcher/market_adapter_runtime.ts).
• Fix(storage): persist deletions, debounce flushes, guard ingest in the browser adapter — deleted files resurrected after reload because unlink never reached IndexedDB; writes required a manual flush call to persist at all; records mutated before the startup load cursor reached them were clobbered by stale IndexedDB state. Deletions are now tracked as tombstones replayed as IndexedDB deletes on flush (cleared only after a successful transaction, so failed flushes replay deletes on the next cycle), mutations schedule a debounced 500ms flush, and the initial load skips tombstoned and locally-mutated keys so pre-load unlinks and writes win over stored records (modules/storage/browser_adapter.ts).
• Fix(paths): stop hardcoding repo-relative profiles/* paths in docs and user-facing messages — docs and runtime/error strings still referenced the legacy repo-relative profiles/logs, profiles/bots.json, and profiles/keys.json locations after state resolution moved to the PATHS resolver in v1.4.15/1.4.16, landing npm-install users on paths that do not exist. BITSHARES_ONBOARDING.md rewrites "Where are the logs?" with the resolver-aware location and completes the log-file table (dexbot-cred.log, dexbot-adapter/-error.log, market_adapter.log, dexbot-update/-error.log were undocumented); WORKFLOW.md and scripts/README.md rows corrected; key-vault/bots-not-found/watchdog/update/analyze error messages now print resolver-derived paths; CLI help documents the <profiles> resolution rule. No behavioral change: all file I/O already routed through the resolver (docs/BITSHARES_ONBOARDING.md, docs/WORKFLOW.md, scripts/README.md, credential-daemon.ts, modules/chain_keys.ts, pm2.ts, bot.ts, claw/modules/claw_launcher.ts, modules/dexbot_class.ts, scripts/update.ts, dexbot.ts).
• Feat(ui): live green/red highlighting for price inputs in the bot editor — extends the bot-editor color feedback to the remaining price fields: startPrice and gridPrice inputs colorize live (green for dynamic sources "pool"/"book"/AMA keywords, red for fixed numeric anchors); null gridPrice resolves through startPrice so the default label inherits the matching color; Active/DryRun flags render green in their healthy state; targetSpreadPercent prompt rounds minimum/validation/input display to 2 decimals instead of surfacing 6-decimal floats (modules/account_bots.ts).
• Fix(client): skip disconnect teardown when the client was never initialized — disconnectClient() called ensureInitialized(), which lazily built the whole client stack (including the node-config log) just to discard it immediately, e.g. running dexbot bot after an idle bot-manager session; it now returns early when not initialized (modules/bitshares_client.ts).
• Refactor(orders): remove the sub-unit price nudge from buildUpdateOrderOp — sub-unit price changes that round to the same min_to_receive were nudged by one unit to force an update operation; dust orders are cancelled rather than updated now, so the nudge only produced churn broadcasts with no economic effect and masked genuine no-op skips. Unchanged rounded amount+price is treated as no-op returning null; callers count the skip and restore affected slots via restoreSkippedUpdateSlotsInWorkingGrid (modules/chain_orders.ts).
• Refactor: remove dead code and consolidate duplicated helpers across analysis/market_adapter — delete market_adapter/merge_lp_data.ts and market_adapter/utils/paths.ts (no importers); prune ~180 lines of unused query builders/wrappers from analysis/bot_usage/kibana_bot_queries.ts; un-export zero-consumer symbols (kibana_client INDEX/KIBANA_URL, normalizeAmaSlopeLookbackBars, loadStrategiesFromResults, kibanaSearch/bilinearInterpolate re-exports, candle high/low/ATR re-exports, internal CSS fragments, toCandles); add modules/utils/sanitize_key.ts as the single sanitizeKey source; make the candleFileForBot filename template canonical in analysis/bot_key_utils.ts eliminating three-way filename drift; fix stale tsx invocation comments to node dist/ paths (market_adapter/*, analysis/*, modules/utils/sanitize_key.ts).
• Chore(logging): remove dead state-change history and stale docs — logger_state changeHistory/maxHistory fields were written but never read anywhere; drop them plus the phantom audit-trail doc section and the now-unused GRID_LIMITS.STATE_CHANGE_HISTORY_MAX; console fund-status output keeps ANSI colors while the file drain strips them as before (modules/order/logger_state.ts, modules/constants.ts, modules/order/logger.ts).
• Refactor(ui): centralize bot editor ANSI colors into a shared palette — the account-bots editor scattered raw ANSI escape sequences across ~40 lines; a module-level COLORS palette (13 named entries) now routes all ~152 highlight usages, input/error/OFF highlights use bold red matching the Pair line, rendering stays byte-identical for all other colors (modules/account_bots.ts).
• Docs: sync tuning guidance between the root README and the BitShares onboarding tutorial — README adds weightDistribution as optional setup step 3 (super-valley..super-mountain legend vocabulary), anchors steps 1–2 on the cycle-profit formula spread − increment − fees and the increment speed/fee tradeoff, documents ama1–ama4 presets in the gridPrice row, and adds a "prefer relative values" callout with editor green/red hints; BITSHARES_ONBOARDING.md mirrors the relative-values guidance, expands its tuning list to match, and fixes the broken prerequisite anchor link (README.md, docs/BITSHARES_ONBOARDING.md).
• Test: mute intentional failure-path logs in negative-path fixtures — the run diagnostics listed scary FAILED lines that were assertion-passing fixtures exercising failure branches, making real regressions harder to spot; test_orphan_fill_death_spiral.ts filters its two expected underfunding warnings and test_patch17_invariants.ts mutes expected COW/persist ERROR logs with restore-on-finally semantics; production log wording untouched (tests/test_orphan_fill_death_spiral.ts, tests/test_patch17_invariants.ts).

[1.4.20] - 2026-08-23 - Grid Boundary Hardening, Recovery Poison Gate, Analysis Path Centralization

2026-08-22

• Fix(grid): harden boundary promotion against gap-floor violations — the spread-correction promotion path could consume every gap slot in a single call (maxPromotable computed the opposite rail's span and constrained nothing; resolveGapBand re-derived sellStartIdx unconditionally from the mutable committed boundary), so any one-time overrun became permanent geometry with no spread floor. Promotion is now capped at band size − MIN_SPREAD_ORDERS (disabled entirely when band ≤ reserve) and the walk hard-stops reserve slots short of the opposite rail edge independent of quota; upstream depth caps (BUY P_s−G−1−B, SELL B−P_b) prevent the slide from stranding placed opposite-rail orders; new validateBoundaryCommit() gates commit-time proposals in _commitWorkingGrid (rejected proposals keep the last valid boundary); defense-in-depth detectors add pre-broadcast crossed-book refusal (detectCrossedBookPlan) and post-commit gap-band intrusion detection → structural resync; new shared resolveGapSlots() dedups the _gapSlots ?? calculateGapSlots(config) pattern (modules/order/grid.ts, modules/order/utils/math.ts, modules/order/manager.ts, modules/dexbot_cow_runtime.ts, tests/test_spread_boundary_promotion.ts, tests/test_spread_check_orchestration.ts).
• Fix(recovery): gate persisted boundary restore against overrun poison — a boundary committed and persisted by the pre-fix promotion overrun would legalize itself on every restart: resolveGapBand re-derives sellStartIdx from whatever value is restored and no runtime gate ran before restore, so structural resync "recovered" straight back into corrupted geometry. New validatePersistedBoundary() (stricter than commit-time validation — also rejects in-band placed orders, the poison signature only position-based geometry detects) is applied in loadGrid before _restoreBoundary; on rejection the structural center is re-derived from slot prices via calculateIdealBoundary (unmappable anchors degrade to a boundary-less load the next sync reconciles), and recoverFromPersistedGrid refuses poisoned snapshots BEFORE loadGrid so resync falls through to a clean requestGridReset(refreshCenterPrice) rebuild using config-derived calculateGapSlots (modules/order/utils/math.ts, modules/order/grid.ts, modules/dexbot_state_recovery.ts, new tests/test_boundary_restore_validation.ts, tests/test_uncertain_broadcast.ts fixtures updated).
• Feat(analysis): centralize dynamic weight chart slider ranges, kalS% default 1.0 — the interactive research chart hardcoded its 16 knob ranges independently in four places each (HTML range attrs, tooltip text, server-side clamps, paste-clamp code), and the amaS% paste clamp had already drifted from its slider span. New SLIDER_RANGES constant is the single source of truth feeding HTML attrs, tooltips, payload transport, and every paste/init/latch clamp; kalS% range 0.15–1.5 → 0.5–1.5 with DYNAMIC_WEIGHT_KALMAN_MAX_SLOPE_PCT raised 0.8 → 1.0; fixes a TDZ crash (const SR declared after first use threw ReferenceError on chart load, leaving all panels blank) (analysis/trend_detection/dynamic_weight_chart_generator.ts, analysis/trend_detection/DYNAMIC_WEIGHT_RESEARCH.md, modules/constants.ts).
• Fix(paths): centralize analysis output dirs and npm-install path resolution — research/chart tooling wrote generated artifacts into the package tree via __dirname/import.meta.url/cwd-relative defaults (wiped by npm update -g, blocked on read-only prefixes). New PATHS.ANALYSIS.{DIR,CHARTS_DIR,RESULTS_DIR,ASSETS_DIR} resolver keeps repo-local outputs only for repo-layout source checkouts and follows the resolved profiles dir otherwise, with a DEXBOT_ANALYSIS_DIR env override and XDG_CONFIG_HOME support; all chart generators and optimizer/backtest result writers rerouted (auto-discovery scans RESULTS_DIR first with legacy-dir fallback); writeChartFile materializes vendored uPlot assets next to relocated charts so relative refs keep resolving; claw profile/skill-doc resolution aligned with modules/paths.ts ordering; shell shim npm-package detection switched to exact-parent basename matching; generated charts/repo-stats excluded from the shipped tarball (modules/paths.ts, modules/config.ts, analysis/*, scripts/lib/dexbot-paths.sh, claw/modules/*, package.json).

2026-08-23

• Fix(market-adapter): align dynamic weight clip logic between live service and research chart — the chart dropped zero-slope bars from the AMA clip pool, kept Kalman warmup bars that the live service sliced away, and fed different precision (rounded vs raw) into the velocity smoothing pipeline, so parameter research could mispredict live clipping behavior. The live service now feeds the smoothing pipeline unrounded velocity/displacement percentages and computes the Kalman clip percentile over the full series (no warmup slice); the chart keeps every finite slope including zeros via Number.isFinite and builds the payload-level initial smoothed series from raw fields to match the interactive recompute path; CLIP_PCT_MAX knob bound lowered 55 → 20. Note: at clip=10% totals shift ~−0.12% since warmup bars now count toward the percentile pool (market_adapter/core/market_adapter_service.ts, analysis/trend_detection/dynamic_weight_chart_generator.ts, tests/test_market_adapter_service.ts).

[1.4.19] - 2026-08-21 - COW Broadcast Op Cap, Grid Divergence Rail Fix, UI Price Feedback

2026-08-21

• Feat(cow): enforce a per-broadcast operation cap — a single COW rebalance can expand one fill batch into many more order operations (4 fills → 12 creates + 4 updates = 16 ops), so FILL_PROCESSING.MAX_FILL_BATCH_SIZE is a weak proxy for on-chain transaction size. COW_PERFORMANCE.MAX_OPS_PER_BROADCAST (default 4) now caps operations per broadcast; oversized batches are split into sequential transactions via executeChunkedWithRetryOnUncertain, restoring the original "N fills per broadcast" intent at the op level. An uncertain chunk failure continues broadcasting the remaining chunks (no order dropped); a definitively rejected chunk aborts the rest; the first failure is rethrown enriched with partialOnChainState, chunksTotal/chunksFailed/chunksAborted, and broadcastedOperationCount. Configurable via the runtime settings override chain (runtimeCowPerformance/marketCowPerformance/botCowPerformance). Covered by the new 463-line test_cow_ops_per_broadcast.ts (modules/dexbot_cow_runtime.ts, modules/constants.ts, modules/dexbot_class.ts, modules/runtime_settings.ts).
• Fix(grid): exclude gap-band strays from divergence desired-window selection — a fund-driven boundary shift during applyGridDivergenceCorrections re-types the working grid, but the SPREAD GUARD keeps live on-chain orders inside the new spread band typed BUY/SELL, so the Phase-2 window selected "closest to market" slots purely by stored type+price and a stray SELL inside the new gap looked like the bottom of the sell rail and was never relocated, collapsing the real spread (boundary 107→110 left sells at 111–113 inside the new gap, real spread 0.5% vs the 2.0% target). New shared MathUtils.isSlotInRail (pure geometric rail-membership test) now filters desired-window candidates using the working boundary; the strategy window and virtual-slot selection delegate to the same helper, and gap-band strays become surplus → cancelled and relocated back onto the rail (modules/order/utils/math.ts, modules/order/utils/system.ts, modules/order/strategy.ts, modules/order/grid_reconcile_internal.ts, tests/test_is_slot_in_rail.ts, tests/test_cow_divergence_correction.ts, tests/test_lp_chart.ts).
• Tune: lower the AMA slope grid-reset threshold from 10 to 8 — the AMA slope delta trigger resets the grid when the slope swing exceeds (AMA_SLOPE_DELTA_THRESHOLD_PERCENT/100) × maxSlopePct. At 10 the XRP-BTS trend reversal (DOWN baseline → UP current, delta 0.0074%/bar) stayed below the 0.0085 threshold, leaving the grid scaled for the wrong direction. Lowering to 8 (threshold 0.0068%/bar) reacts to the reversal while still ignoring small slope noise (modules/constants.ts).
• Feat(ui): green/red relative-scaling feedback for price inputs — the bot editor's Price Range displayed min/max as plain white, hiding whether relative scaling (x multipliers) is active. Range values now render green for "1.55x" multipliers and red for fixed prices, and readInput gains a colorize option so the typed input switches red → green live the moment the "x" is entered (modules/account_bots.ts, modules/order/utils/system.ts).
• Fix(ui): clarify the GridPrice label in the bot editor — the Price section displayed the gridPrice reference as bare "Grid:", which was ambiguous next to "Start:"/"Pool:" and collided with the section "4) Grid". Renamed to "GridPrice:" (one word, matching the gridPrice config field name) to reflect the values it accepts (pool/book/ama/number/none) (modules/account_bots.ts).
• Docs: add an end-to-end lifecycle walkthrough — new docs/LIFECYCLE.md consolidates the startup, fill-driven (reactive), and maintenance/AMA-driven (periodic) flows into one newcomer-facing map with mermaid system-context and sequence diagrams (fill → _incomingFillQueue → processFilledOrders → Accounting SSOT → WorkingGrid COW → single atomic broadcast → persist; _performPeriodicGridChecks → performPeriodicGridChecks → runGridMaintenance → executeMaintenanceLogic), plus a cross-cutting invariants table and file map. Surfaced as the first read from README and the docs index, and added to the npm files array (docs/LIFECYCLE.md, docs/developer_guide.md, docs/README.md, README.md, package.json).

[1.4.18] - 2026-08-19 - Compile-First Runtime Migration (tsx to dist)

2026-08-19

• Refactor(build): drop the tsx runtime dependency and run compiled dist/ everywhere — tsx moves from dependencies to devDependencies; the root shims (bot.js, dexbot.js, pm2.js, unlock.js, credential-daemon.js, scripts/update.js) and launcher wrappers (scripts/{bots,dexbot,keys,pm2,unlock}) now hard-error on a missing dist/ build instead of falling back to tsx. The published npm package never shipped the root .ts entrypoints, so the tsx fallback was dead for consumers while forcing tsx into production installs. The research toolset now compiles into the shipped tarball (analysis/ is added to the tsconfig build and .npmignore no longer excludes dist/analysis); npm scripts (lp:chart, market-adapter:*, analysis:*, ama:chart:lp-local, native:*, test:credit-renewal, version:sync, verify:browser-bundle, and all claw/* commands) run the compiled node dist/... output. Every doc, skill file, and in-tool usage string is converted from tsx <file>.ts to the compiled form or the matching npm run * shortcut. Tests are intentionally untouched — they still run via tsx (node --import tsx / npx tsx tests/...) since tests/ is not compiled (package.json, claw/package.json, tsconfig.json, .npmignore, scripts/README.md, market_adapter/README.md, all analysis READMEs, claw/README.md, claw/docs/*, claw/skills/*, docs/GRID_RECALCULATION.md, bot.ts, claw/scripts/claw_bridge.ts, claw/scripts/claw_skill_md.ts, claw/examples/short_mpa_bts_strategy.ts, market_adapter/ama_signal_runner.ts, market_adapter/inputs/fetch_cex_synthetic_data.ts, scripts/test-credit-renewal.ts, scripts/generate_lp_chart.ts, scripts/clear-market-adapter.sh, analysis/bot_usage/discover_bot_accounts.ts, analysis/bot_fitting/backtest_ama_sweep.ts).

[1.4.17] - 2026-08-19 - Duplicate-Code Consolidation, Dead Export Purge, Analysis Source Centralization

2026-08-19

• Refactor(crypto): consolidate duplicated EC math and encodings — modules/bitshares-native/crypto/ecc.ts and ecc.browser.ts now delegate curve constants, point math (ecPointMul/ecPointAdd/pointFromPublicKey/publicKeyFromPoint), bigint conversions, hex/concat helpers, and Base58Check to the shared modules/crypto/pure_secp256k1.ts and modules/utils/base58check.ts instead of carrying private copies. base58check.decode/decodeAsync error messages are aligned with the former ecc-local wording (Invalid base58check: too short / checksum mismatch) so consumers see identical failures; both browser and Node paths now share the double-SHA256 checksum semantics. Unused randomFill, scrypt, and createPrivateKey exports are dropped from modules/crypto/sync.ts and their test coverage removed (modules/crypto/pure_secp256k1.ts, modules/utils/base58check.ts, modules/bitshares-native/crypto/ecc.ts, ecc.browser.ts, tests/test_browser_abstractions.ts).
• Refactor(settings): unify merge and loader helpers — modules/runtime_settings.ts replaces its private recursive merge with the shared deepMerge from modules/settings_merge.ts (source keys are SCREAMING_CASE-normalized before merging; _-prefixed comment keys are now skipped and nested overrides are shallow-copied when the target lacks the subtree, both strict improvements); modules/account_bots.ts loadBotsConfig() delegates to bot_settings.loadSettingsFile(), and that loader's dead branch (always rethrowing when exitOnError:false) now returns { config: {}, filePath } instead. Percentage parsing, precision quantum math, ISO timestamps, and clamp are centralized (isPercentageString/parsePercentageString, quantumForPrecision, nowIso, shared clamp) and used from credit_runtime, cr_planner, grid, validate, node_manager, maintenance/export/account-orders paths; the COW runtime now uses the shared sleep. A consolidated resolveAssetByRef (modules/order/utils/system.ts) replaces three divergent asset-resolution implementations in chain_orders, credit_runtime, and credential_policy (modules/settings_merge.ts, modules/runtime_settings.ts, modules/account_bots.ts, modules/order/utils/math.ts, modules/order/utils/system.ts, modules/chain_orders.ts, modules/credit_runtime.ts, modules/credential_policy.ts).
• Refactor(dead-code): purge dead exports and stale types — modules/types.ts is trimmed from 875 lines of unused interfaces to the Order discriminated union only (Order is the sole consumer, modules/order/grid.ts); modules/bitshares-native/interfaces.d.ts (orphaned ambient declaration) is deleted; the vendored serial layer drops unused types (varuint64, fixed_array, map, vote_id, address) and constants (OPERATION_NAMES, OBJECT_SPACE_TYPE, DB_MAX_INSTANCE_ID, unused OP_*); grid_reconcile_internal drops 10 internal-only exports (keeping _createOrderFromGrid/_executeStartupCreateGroupBatch which test_price_collision_guard imports); validate_profiles keeps only the two dynamically-required entry points; launcher modules drop one-off helpers (parseUnlockStartArgs, resetSharedMarketAdapterRuntime, buildUnlockArgs, resolveProjectRoot, readProcCpuTotal/readProcCmdline) and env.ts drops the bundler-evasion getNodeRequire; tx/builder.ts drops the unused BroadcastError and order/format.ts the unused formatSignificant. claw/modules/dexbot_profiles.ts now imports createBotKey/sanitizeKey from modules/account_orders.ts (byte-identical definitions) instead of re-implementing them (modules/types.ts, modules/bitshares-native/serial/*, modules/order/grid_reconcile_internal.ts, modules/launcher/*, modules/order/format.ts, claw/modules/dexbot_profiles.ts).
• Refactor(shims): delete re-export shims — modules/logger.ts and modules/utils/math_utils.ts (thin re-export wrappers) are removed and their ~30 importers across root entries, launcher, market-adapter, analysis, and tests repointed to modules/order/logger.js / modules/order/utils/math.js, including the source entry points bot.ts and credential-daemon.ts whose require('./modules/logger') calls were missed by the initial sweep. The stale ./dist/modules/logger.js entry in the package.json browser field is dropped, and dangling JSDoc import('./types*') annotations (e.g. FillEvent, BroadcastResult, GridConfig) across dexbot_fill_runtime, dexbot_class, manager, grid, sync_engine, chain_keys and others are replaced with any (tsc ignores JSDoc types in .ts, but the references named removed types) (bot.ts, credential-daemon.ts, modules/order/logger.ts, modules/order/utils/math.ts, package.json).
• Fix(tests): repair tests broken by the dedup — four derivative/analysis tests and five daemon/credential/CLI-output tests failed because they resolved the deleted shims; the nowIso import required four stubbed setCachedModule(systemPath, ...) sites in test_dexbot_maintenance_runtime_dynamic_weights.ts to gain a nowIso export; test_credential_daemon_controller_output.ts wrote to a nonexistent /tmp/dexbot2-test dir and now creates it (analysis/trend_detection/derivative_analyzer.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts, tests/test_credential_daemon_controller_output.ts).
• Feat(analysis): centralize analysis source resolution and enforce strict TypeScript — new analysis/resolve_source.ts is the single source/weight/dynamic-weights resolver across all research scripts, the analysis/tsconfig.json strict rules are enforced, and ~29 scripts are migrated; shared chart CSS and browser JS helpers are extracted into analysis/chart_css.ts and analysis/chart_ui.ts and used by all six chart generators instead of inline copies (analysis/resolve_source.ts, analysis/chart_css.ts, analysis/chart_ui.ts).
• Docs: remove the redundant source-install hint from the README Quick Start; fix the PIPELINE_TIMING.TIMEOUT_MS line reference in docs/GRID_RECONCILE.md (constants.ts:807 → :805); strip stale btsdex parity comments from subscriptions.ts and constants.ts; remove stale imports and refresh tests/README.md helper docs (README.md, docs/GRID_RECONCILE.md, modules/bitshares-native/subscriptions.ts, tests/README.md).
• Fix(claw): harden runtime edge cases and regressions from a claw self-review —
  • Subscription & node wiring: claw/modules/bitshares_client.ts routes account subscriptions through createSubscriptionManager (event-driven instead of polling), resolves configured nodes from general.settings NODES.list (falling back to defaults), and backs off exponentially between connection-retry sweeps so a fast-failing node list no longer hammers the network.
  • Fill callback safety: claw/modules/chain_actions.ts routes both sync throws and async rejections from listenForFills handlers to the error log without skipping the remaining callbacks in the batch — a sync throw previously escaped Promise.resolve(fn(fills)) before .catch attached, which could trigger cursor-not-advanced redelivery (and double-counting) of fills.
  • Config / runtime resolution: claw_launcher normalizes the literal bot target "all" to null, makes bots.json and the recalculate trigger file profileRoot-aware, attaches child 'error' handlers on all spawn sites, and surfaces a corrupt bots.json as a real failure instead of silently defaulting; launcher_mode_detector no longer treats a corrupt bots.json as "no active bots" and normalizes stored mode strings to lowercase; credit_runtime_adapter fingerprints bot config so debt-policy/asset/account edits rebuild the cached runtime instead of being masked, and drops stale runtimes when debtPolicy is removed; claw_manifest accepts a runtime name passed as an object ({ name }) instead of stringifying to [object Object]; claw_skill_md resolves script invocations against the built .js or the .ts source (tsx) instead of hardcoded stale paths and defaults the memU data dir via PATHS.CLAW.MEMU_DIR; skill_utils defaults the normalized profile root to the runtime-resolved profiles dir and drops the unused buildBridgeCommand; liquidity_pools fixes requireDexbot2Module paths to use the modules/ prefix; claw_bridge scans all args for the command token so it may appear before or after flags.
  • Decision loop & position manager: KalmanTrendAnalyzer.update now takes a single price series, per-market premium is cached so the reuse path reports the same value the fresh path computed, and empty position lists are summarized; on entry-open broadcast failure position_manager records entry-open-failed, reconciles against the chain, and surfaces the error, and warns (instead of swallowing) on balance and post-fill sync failures.
  • MCP transport: mcp_utils adds pending-message backpressure with stdin pause/resume so the JSONL transport bounds memory under load; claw_mcp_server loads heavy claw modules lazily after the console shim (so require-time stdout logs cannot corrupt JSON-RPC frames) and moves dynamic imports inside try so failures return a JSON-RPC error; memu_mcp_server adds the console shim, validates --db-config JSON, and echoes the client protocol version; modules/runtime.ts adds pause() to the stdin interface type (non-breaking).
  • Price source & other fixes: kibana_price_source requests candles as (mpa, bts) so returned prices are BTS-per-MPA (matching the live feed source); honest_ecosystem TTL-caches live pool reserves keyed by pool id with clone-on-read, prefers the share-asset symbol, falls back to the hardcoded bridge on symbol mismatch, and surfaces live source labels; honest_assets_report lists assets from lowerBound '' so symbols sorting before A are not silently skipped; memu_bridge reports the real repo version and merges the standard claw manifest fields for a consistent tool shape.
  • Docs & tests: README clarifies source vs npm install headings; claw/README.md documents the optional --memu-dir default; claw tests update expected candle asset order and claw_bridge.js references, extend the native mock surface, and add sync-callback coverage; claw/tsconfig.json includes examples in the type-checked set (claw/modules/**, claw/scripts/**, claw/tests/**, modules/runtime.ts, README.md, claw/README.md).
• Fix(packaging): ship the full analysis toolset and stop leaking runtime/vendored state into the npm tarball. The published 1.4.16 package shipped stale bloat — claw/node_modules/ (8.6MB, a local npm install of btsdex/crypto-js/bignumber.js/@babel that no claw source or compiled output imports) and claw/data/positions.json (3.8MB of git-ignored runtime state). This release excludes both via a new claw/.npmignore (node_modules, data), excludes git-ignored optimizer output (analysis/ama_fitting/optimization_results_*.json) and generated charts//package-lock.json via analysis/.npmignore, adds the full analysis/ source to files (previously only its README shipped), and moves tsx from devDependencies to dependencies so npm consumers can run the shipped tsx analysis/... research tools. Pack size drops from ~13MB / 79MB-unpacked / 3812 files to ~2.2MB / 9.6MB-unpacked / 907 files; production code and the compiled dist/analysis/ helpers (chart_utils, math_utils, tradingview) still ship (package.json, analysis/.npmignore, claw/.npmignore).
• Fix(update): harden the npm-install auto-update flow (scripts/update.ts, modules/paths.ts). The global-install check now runs before the npm registry query, so a local (non-global) dependency gets the correct "run npm update in the parent project" guidance instead of a misleading "already up to date"; the global-root check compares the realpath'd package parent against npm root -g (last non-empty stdout line) so symlinked prefixes, pnpm/yarn global stores, and nested packages are classified correctly instead of by string prefix; the mismatch error reports both the install path and npm root -g and points at the likely cause (symlinked prefix, pnpm/yarn store, or a different Node version manager prefix) with the matching remediation. After npm install -g the flow refuses to restart runtimes unless the installed version matches the requested release and the pre-built dist/ bundle ships the dexbot bin, update script, and unlock entry. isGlobalNpmPackageDir now requires the package dir to be a direct child of a node_modules dir instead of a substring match (scripts/update.ts, modules/paths.ts).

Note

• Behavior: asset resolution is consolidated into the shared resolveAssetByRef helper. Resolution failures (transient RPC errors, missing methods) are now caught, logged at debug level, and reported as null instead of propagating the underlying error — e.g. _getAssetPrecision surfaces Cause: asset not found or precision missing. rather than the raw API error. Failed resolutions degrade to "asset not found" silently; call sites that inspected the cause text will see the new message.
• Docs(scripts): refresh scripts/README.md and align ecosystem config naming — per-bot ecosystem symlinks rename from *.config.js to *.config.cjs to match the shipped ecosystem.config.cjs (a .js symlink pointing at a .cjs file was misleading; the log line now echoes the resolved target basename); test_shell_paths.ts updates the expectation to the new link name; git-viewer.sh installs missing dependencies via the detected package manager (apt-get / brew / dnf / pacman) instead of hardcoding apt-get; the scripts README marks branch-sync scripts (pmain/pdev/ptest) as git-checkout only, corrects the launcher-wrapper target table, drops the stale "auto-runs on npm postinstall" note for create-bot-symlinks.sh, and reorganizes the npm-scripts reference into grouped tables (scripts/README.md, scripts/create-bot-symlinks.sh, scripts/git-viewer.sh, tests/test_shell_paths.ts).
• Fix(packaging): exclude the redundant compiled dist/analysis/ helpers from the npm tarball via a !dist/analysis negation in the files whitelist — the full analysis/ source ships, so the compiled helpers (chart_utils, math_utils, tradingview) doubled the payload; a .npmignore entry inside the whitelisted dist directory is not honored by npm-packlist, so the files negation is the effective mechanism (package.json).

[1.4.16] - 2026-08-18 - Profile-State Path Centralization, In-Place Order Rotations, npm Auto-Update

2026-08-18

• Feat: convert divergence surplus/hole cancel+create into in-place rotations — when a fund-driven boundary shift re-types slots during divergence correction, on-chain orders outside the desired window were cancelled while empty desired slots were created, even though BitShares supports repricing in place via limit_order_update (new_price + delta). The existing optimizeRebalanceActions pairing is now wired into applyGridDivergenceCorrections so same-side surplus-CANCEL + hole-CREATE pairs become single rotation UPDATEs instead of cancel+recreate, matching the reconcile path. Fewer ops per correction, order ids preserved across slot moves, smaller reconciliation/recovery surface; the COW executor already applies rotation transitions and post-rotation metadata. New Test 5 in test_cow_divergence_correction.ts reproduces the boundary-shift shape (3 surplus BUY + 3 hole BUY → 3 rotations, 0 cancels, 0 creates) (modules/order/utils/system.ts, tests/test_cow_divergence_correction.ts).
• Feat(update): support npm package installs in auto-update — the auto-update script hard-failed for npm install -g dexbot users with "Not a git repository". A new npm registry flow lets global npm installs self-update and restart exactly like git checkouts: install-layout detection routes by .git presence vs a global npm package dir (isGlobalNpmPackageDir); compares the installed package.json version against npm view <pkg> version (exit 0, no restart when up to date); verifies the install is global via npm root -g; snapshots runtime state, runs npm install -g <pkg>@<latest> from the home dir, skips git/npm-install/build steps (published package ships pre-built dist), regenerates ecosystem config, and restarts runtimes. The shared snapshot/ecosystem-regen/restart tail is extracted into snapshotMonolithicState()/regenerateEcosystemConfig()/restartActiveRuntimes() used by both layouts, and a hardcoded ecosystem path in the dexbot-adapter start command is fixed to use PATHS.PROFILES.ECOSYSTEM_CONFIG_JS (scripts/update.ts).
• Refactor(paths): centralize profile-state resolution out of the package dir — all user/runtime state now follows a single resolver-derived profiles dir (~/.config/dexbot2/profiles by default for ALL installs) instead of being scattered relative to the install/package root, so fresh source checkouts, npm installs, and migrated users behave identically and state survives re-clones and npm update -g dexbot. Resolution priority: DEXBOT_PROFILE_ROOT → DEXBOT2_ROOT → home default (an existing home config is authoritative); until a home config exists, a source checkout with a populated profiles dir keeps its repo/cwd location while global npm packages never fall back into the package dir. Market-adapter and claw dirs follow the resolved profiles dir (with relocation notices), the credential runtime drops its root parameter in favor of PATHS.CREDENTIAL_RUN_DIR, and scripts/lib/dexbot-paths.sh mirrors the resolution (incl. HOME-unset passwd fallback) so the shell side never falls back into a node_modules package dir (modules/paths.ts, modules/credential_runtime.ts, credential-daemon.ts, pm2.ts, launcher/claw/market-adapter modules, scripts/lib/dexbot-paths.sh, tests/test_paths.ts, tests/test_shell_paths.ts).
• Fix: stop prompting for a master password when none is set — dexbot start (and the credential daemon launcher) called chainKeys.authenticate(), which always showed the "Enter master password:" prompt before checking whether a vault actually exists, so a fresh install with no keys.json asked for a password that does not exist. authenticate() now checks for a vault before prompting and throws immediately when no master password is set; the error is reworded to No master password set, run \dexbot key`.and the existingdexbot.ts auto-launch match still works (modules/chain_keys.ts`).

[1.4.15] - 2026-08-18 - Global Npm Install Path Handling, Market-Adapter State Relocation

2026-08-18

• Fix: never write profiles inside a globally-installed npm package — modules/paths.ts now detects global npm installs (a node_modules segment in the package root) and defaults the profiles dir to ~/.config/dexbot2/profiles instead of <pkg>/profiles. Previously a writable prefix (e.g. nvm) silently stored keys.json/bots.json inside the package dir, which npm update -g dexbot wiped (bot broken until re-setup), while read-only prefixes relied solely on the EACCES respawn. The respawn fallback in dexbot.ts is unified to the same ~/.config/dexbot2/profiles path. Source checkouts are unaffected (modules/paths.ts, dexbot.ts, tests/test_paths.ts).
• Fix: relocate market-adapter data/state under the profiles dir for global npm installs — an npm package ships compiled dist/market_adapter/ but no top-level market_adapter/ dir, so the runtime previously created state inside the package dir (EACCES crash on read-only prefixes, wipe-on-update elsewhere). resolveMarketAdapterDirs keeps <root>/market_adapter/{data,state} for source checkouts and falls back to <profiles>/market_adapter/{data,state} otherwise; new DEXBOT_MARKET_ADAPTER_DATA_DIR / DEXBOT_MARKET_ADAPTER_STATE_DIR env vars override both and are forwarded to launcher-spawned children (modules/paths.ts, modules/config.ts, modules/launcher/child_env.ts).
• Fix: relocate claw data (positions, watcher health, memu) under the profiles dir for global npm installs — claw/ ships in the package, so unlike market_adapter the relocation keys on the npm-global detection rather than dir existence. resolveClawDirs keeps <root>/claw/data for source checkouts and uses <profiles>/claw/data under npm, with a new DEXBOT_CLAW_DATA_DIR env override (forwarded to children); claw/modules/claw_infra.ts already accepted a dataDir option, so only the default resolution needed fixing (modules/paths.ts, modules/config.ts, modules/launcher/child_env.ts).
• Fix: make the clear-*/reset-settings shell scripts npm-layout aware — they are shipped in the package but still hardcoded <root>/profiles and <root>/market_adapter/{data,state}, so dexbot clear*/dexbot default under a global npm install would target the package dir (no-op or EACCES). Path resolution is now centralized in scripts/lib/dexbot-paths.sh (mirrors modules/paths.ts, including the cwd fallback when cwd/profiles/bots.json exists), sourced by all five scripts; dexbot.ts also passes the runtime-resolved DEXBOT_PROFILE_ROOT / DEXBOT_MARKET_ADAPTER_DATA_DIR / DEXBOT_MARKET_ADAPTER_STATE_DIR / DEXBOT_CLAW_DATA_DIR to the spawned scripts so the CLI always clears the same dirs the runtime uses. clear-all now also wipes claw data (positions, watcher health, memu) under <profiles>/claw/data. The shared lib also honors the legacy DEXBOT2_ROOT override and create-bot-symlinks.sh now sources it too (it was the last shipped script still hardcoding <root>/profiles, so npm postinstall would look inside the package dir). New tests/test_shell_paths.ts executes the scripts against fake source/npm/env/cwd-fallback layouts (35 checks) to guard against path drift (scripts/lib/dexbot-paths.sh, scripts/clear-*.sh, scripts/reset-settings.sh, scripts/create-bot-symlinks.sh, dexbot.ts, package.json).
• Note: no state migration for existing npm installs that already wrote profiles/market-adapter/claw state into the package dir — npm update -g dexbot wipes the package dir regardless, and the new defaults place state under ~/.config/dexbot2/profiles from 1.4.15 on.
• Fix(tests): align test_analyze_orders_dynamic_weight with formatCurrency's 4-significant-digit output (100.0/200.0, not 100.00/200.00) — the assertions predated the sig-digit formatting centralization and failed the suite; extend test_paths with npm-detection, home-default profiles, market-adapter source/relocated/env-override coverage (15 checks) (tests/test_analyze_orders_dynamic_weight.ts, tests/test_paths.ts).

[1.4.14] - 2026-08-16 - Market-Adapter Math Canonicalization, Dead-Code Purge, Launcher Guards, Docs Refresh

2026-08-17

• Refactor: centralize significant-digit formatting and reduce display precision from 5 to 4 — added formatSignificant(value, digits=4) to modules/order/format.ts for significant-digit formatting (distinct from fixed-decimal formatPrice4); replaced local formatCurrency in scripts/analyze-orders.ts with the centralized function and reduced formatFundsValue from 5 to 4 significant digits; cleaner terminal output without sacrificing practical accuracy (modules/order/format.ts, scripts/analyze-orders.ts).

• Refactor: purge dead exports, dedupe helpers, and fix a runtime-settings key across modules/ — removed zero-caller class wrappers and methods (dexbot_class fill-consumer/replay wrappers, account_orders.updateBtsFeesOwed, accounting.validateTargetGrid, four logger_state history methods, manager.isBroadcasting, working_grid.getModifiedIds), dropped unused exports (bitshares_client.removeOnReconnect, chain_orders.FILL_PROCESSING_MODE, export.ts helpers, format.isNumeric, the isBotGridRangeScalingWhitelisted alias), and consolidated duplicated logic onto single sources (usesAmaGridPrice → dexbot_maintenance_runtime shared by pm2/launcher/market_adapter, compareNodeHealth shared by node_health_cache/node_manager, positiveOrNull via cr_planner, getMinAbsoluteOrderSize → getMinOrderSize, flattened calculateGapSlots/formatPrice/formatMetric2 aliases). Added apiLimits to RUNTIME_SETTINGS_KEYS so it is preserved on config reload (previously silently dropped). Tests updated for the removed class wrapper (test_fill_replay_guards calls the runtime fn directly) and the whitelist rename (test_market_adapter_service); stale TOCs/comments refreshed (modules/*.ts, market_adapter/**, pm2.ts, claw/docs/POSITION_HEALTH.md).

• Fix: guard against pre-broadcast size drift in COW batches — a limit_order_update's negative delta_amount_to_sell is built from the order's for_sale read during planning; if the order was partially consumed since that read, the delta over-reduces and the chain rejects the entire batch ("Cannot deduct all or more from order than order contains"), cascading into uncertain-broadcast recovery. buildUpdateOrderOp now re-reads the authoritative for_sale right before building when a size change is requested (price-only updates keep the safe cached path), and executeBatch runs a best-effort pre-broadcast guard (findOverReducingUpdateOpError) that re-reads affected orders and throws the matching chain error so the caller's recoverBatchSizeDrift repair path resizes the affected slots before any broadcast. The guard aggregates negative deltas per order since the chain applies a batch's update ops sequentially — two reductions of the same order that each leave a positive residual can still over-reduce cumulatively and are caught pre-broadcast. A negative delta targeting an order already gone from chain reports the stale-order message ("object <id> does not exist") instead, routing it to _recoverExplicitStaleOrders (slot virtualization) rather than the size-drift repair, which cannot re-size a non-existent order (modules/chain_orders.ts, tests/test_prebroadcast_size_drift_guard.ts).

• Fix: re-derive the target grid after state recovery so consumed orders are re-placed — syncFromOpenOrders is reconcile-only (it virtualizes consumed orders but never re-derives the target), so a rail fully consumed on chain while a snapshot still listed it left a permanent hole. recoverFromPersistedGrid now runs a best-effort no-fill COW rebalance after the reload, and triggerStateRecoverySync/recoverBatchSizeDrift schedule a deferred rebalance (_schedulePostRecoveryRebalance) that waits out the failed batch's teardown and the recovery sync before re-placing missing rails; failures defer to the next maintenance divergence check. The no-action path releases the pushed working grid (mirroring _executeBatchIfNeeded), so _rebalanceState returns to NORMAL instead of sticking at REBALANCING with a leaked grid per recovery sync (modules/dexbot_state_recovery.ts).

• Fix: let sub-threshold interior partials qualify as dust — interior partials previously required a duplicate price level to be eligible (no-gap risk), but a partial already below its per-slot dust threshold stranded on the book forever: the residual path only cancels zero-value residuals, and interior dust rarely has a duplicate price level. Cancelling it frees the slot for rotation to re-derive. checkWindowDust now computes per-slot dust thresholds once per side (_computeDustThresholdMap, shared by the eligibility filter and _getDustOrders so classification stays consistent) and treats a sub-threshold interior partial as eligible; a side's thresholds are computed only when that side actually has a partial candidate, so an empty side does not pay for a redundant fund recalculation (modules/order/grid.ts, tests/test_dust_rebalance_logic.ts).

2026-08-16

• Refactor: consolidate market-adapter math so canonical logic lives in market_adapter/ and analysis/ only imports it — browser chart scripts are generated from the same function sources via a new embedFunctionSources helper (fn.toString()), eliminating hand-copied JS to keep in sync:
  • ATR: computeATRSeries (chain-breaking, per-position) is the single canonical series impl in atr/calculator.ts; calculateATR delegates to it; analysis/math_utils.ts re-exports it; analyze_volatility.ts dropped its local copies; the chart embeds it.
  • Volatility shift: new strategies/volatility_shift.ts, used by ama_slope_model.ts, analyze_volatility.ts, and embedded in the volatility chart.
  • Candle accessors: getCandle*/normalizeCandle moved to market_adapter/candle_utils.ts, re-exported via math_utils.ts.
  • Regime bilinear: extracted to pure strategies/regime_interp.ts; regime_gate.ts delegates; chart embeds it.
  • AMA slope %: canonical in dynamic_weight_series.ts; ama_slope_model.ts re-exports (chart embeds the same source).
  • Kalman smoothing: moved to market_adapter/core/signals/kalman_velocity_smoothing.ts and made self-contained; chart embeds it.
  • Signal latch: echoLatchSeries canonical in dynamic_weight_series.ts (self-contained; service + chart + tests all use it).
  • Full pipeline: computeDynamicWeightSeries in dynamic_weight_series.ts is used by the service's _computeDynamicWeights, the research chart (embedded), and the test parity harness.
  • File locking: file_lock.ts collapsed three variants onto shared _acquireLockCore/_acquireLockCoreAsync primitives (parameterized by stale/timeout/retry/contention/heartbeat/alive-check).
  • Production→analysis dependency removed: Kalman/Hurst/PE analyzers moved to market_adapter/core/signals/; analysis/trend_detection/ keeps re-export shims; market_adapter_service.ts, regime_gate.ts, and decision_loop.ts import the canonical paths (market_adapter/core/signals/*, market_adapter/core/strategies/*, market_adapter/candle_utils.ts, market_adapter/utils/file_lock.ts, analysis/*, claw/modules/decision_loop.ts, tests/test_market_adapter_service.ts, tests/test_market_adapter_signal_gates.ts).
• Docs: refresh stale inline documentation in modules/ — modernized file-header and doc-comment blocks across 14 core modules (account bots/orders, bitshares_client, bots_file_lock, chain_keys, chain_orders, constants, credential_policy, credit_runtime, dexbot_class, dexbot_cow_runtime, dexbot_credential_client, dexbot_maintenance_runtime, graceful_shutdown) to match current behavior after the ESM/COW/start-canonicalization work (modules/*.ts).
• Refactor(claw): purge stale claw code and fix the launcher PM2 crash — launcherPm2Start called buildEcosystemApps({ clawOnly: false }) with the wrong first-arg shape and crashed with TypeError: bots.map is not a function; it now uses the apps array returned by generateEcosystemConfig(). Dead exports/types removed (adapter methods listOrderArtifacts/consumeTrigger/writeTrigger, assessAllPositions, formatRatioAsMultiplier, seven unused interfaces), duplicated helpers deduplicated (shellQuote imported from skill_utils; computeBtsPerMpa canonicalized into mpa_utils.ts and shared by position_discovery, position_manager, and feed_price_source), and two inaccurate doc references fixed (broken ../cr_planner.ts path, "implemented and exported" claim) (claw/modules/claw_launcher.ts, claw/modules/dexbot_profiles.ts, claw/modules/position_health.ts, claw/modules/types.ts, claw/modules/mpa_utils.ts, claw/modules/claw_catalog.ts, claw/modules/skill_utils.ts, claw/modules/feed_price_source.ts, claw/docs/POSITION_HEALTH.md, claw/docs/AI_BOT_LIBRARY_API.md).
• Docs: add the CES power-law curve proposal and drop a one-shot migration tool — docs/DEXBOT2_VS_POWER_LAW_CURVE.md proposes a second BitShares liquidity protocol using the CES invariant x^ρ + y^ρ = k, mapping DEXBot2's weight + range allocation onto a continuous curve (grid geometry/sizing and asymmetric tail-decay claims verified analytically and numerically against modules/order/utils/math.ts and constants.ts defaults); scripts/fix-err-message.ts, the one-off codemod from the getErrorMessage() migration, is removed (long applied, no remaining references) (docs/DEXBOT2_VS_POWER_LAW_CURVE.md, scripts/fix-err-message.ts).
• Refactor(market-adapter): purge dead exports and drop the market_adapter/index.ts barrel — its only consumer (inputs/fetch_cex_synthetic_data.ts) now imports market_adapter/market_adapter directly; unused exports removed across kibana_market_candles, native_history, adapter_client, lp_chart_core, lp_chart_runner, fetch_cex_synthetic_data, and data_discovery (exports trimmed, not deleted, where functions remain in-module use); analysis math aligned with canonical sources (analyze_kalman.ts derives AMA slope from the canonical computeAverageAmaSlopePct; ama_slope_model notReady returns rawSlopeOffset: 0; dynamic_weight_series amaReadyBar rewrite is algebraically equivalent; _computeDynamicWeights call site slimmed); docs corrected (removed the non-existent DYNAMIC_WEIGHT_ENABLED key, fixed the state-field table, completed module maps, documented market_adapter/core/signals analyzers as canonical homes, fixed CLI help defaults) (market_adapter/**, analysis/**, market_adapter/README.md, analysis/trend_detection/README.md, analysis/trend_detection/DYNAMIC_WEIGHT_RESEARCH.md).
• Feat(cli): guard raw npm start / pm2 start with launcher guidance — both previously failed with the cryptic Missing script: "start" error or bypassed the credential-daemon unlock, leaving bots unable to reach dexbot-cred; package.json gains a start guard that prints launcher guidance (dexbot pm2 / ./pm2 / npm run pm2:unlock) and exits 1, and a new root ecosystem.config.cjs forwarder rejects raw pm2 start the same way; the forwarder ships in the publish files list (package.json, ecosystem.config.cjs).
• Fix(analysis): align analysis tools/docs with the AMA optimizer's _w result naming — the optimizer writes results as optimization_results_<base>_w<λ1>_<λ2>_<λ3>_<λ4>.json, but backtest_bot_fitting.ts still auto-derived the legacy unsuffixed path; it now auto-derives the newest _w* result in ama_fitting/ (mtime-based) with a legacy fallback; analyze_derivatives.ts drops dead --pool/--precA/--precB flags and unused fields; version:sync targets extended with analysis/ama_fitting/package-lock.json and analysis/trend_detection/package.json (analysis/bot_fitting/backtest_bot_fitting.ts, analysis/analyze_derivatives.ts, analysis/ama_fitting/README.md, analysis/bot_fitting/README.md, scripts/sync-version.ts, AGENTS.md).
• Fix(claw/tests): add strict-mode type annotations across the remaining 16 claw test files (377 TS errors) — explicit params for clearModule/registerMock helpers, typed call-records (fixing never[] inference), typed mock callbacks, let x: any[] = [] (TS7034/TS7005), null as any slots, and as keyof index assertions; annotations only, no runtime logic altered (claw/tests/*.ts).
• Docs: post-1.4.13 documentation audit and Telegram plan rename — docs/TELEGRAM_IMPLEMENTATION.md renamed to docs/TELEGRAM_IMPLEMENTATION_PLAN.md with a "Proposed — not implemented" banner (EVOLUTION entry kept as planned feature); corrected stale line references (FUND_MOVEMENT_AND_ACCOUNTING, GRID_RECONCILE, COW_INVARIANTS, LOGGING tag table pointing at the split fill/COW/startup runtimes, developer_guide env vars, MPA_CREDIT_USAGE fee rate 1/2900), feature corrections (GRID_RECALCULATION AMA presets, market_adapter warmup table, AMA fitting dataset range/output path, divergence-calc threshold 1 promille, Kalman trend signal inputs, fee_cache fees, ESM-first guidance, Node >= 22.12), Docker/docs updates (node:22 base image, dexbot start canonical forms, compose-mode description), and refreshed repo stats (docs/**, claw/skills/**, README.md, modules/README.md, Dockerfile).

2026-08-14

• Feat: add an optional bot filter to dexbot order — pass a bot key as a positional argument (e.g. dexbot order xrp-bts) to render only that bot's persisted grid, optionally combined with --export for a single-bot HTML report; matching accepts the raw key, its sanitized form, or the configured name; a missing key lists available bots and suppresses skipped-candidate noise (scripts/analyze-orders.ts, dexbot.ts, README.md, docs/WORKFLOW.md).

2026-08-13

• Fix(analysis): make HTML chart exports readable and render correctly — white axis-label strokes across all chart generators (readable on dark background), lightened header subtitles, and render fixes for three generators that previously aborted: missing roundTo helper (volatility), raw TS type annotations + missing fixedTo + Node-side smaPeriod interpolation (derivatives), and __dirname undefined in ESM scope (fileURLToPath(import.meta.url)) breaking the volatility runner (analysis/trend_detection/*_chart_generator.ts, analysis/analyze_volatility.ts, analysis/analyze_derivatives.ts, analysis/tradingview/tradingview_uplot_chart_generator.ts).
• Docs: fix Linux install instructions — Ubuntu/Debian (incl. Linux Mint) ship Node 18 (< the >=22.12.0 engines requirement), so README Linux setup now uses official nvm + Node 24 instead of the apt-installed nodejs (README.md).

2026-08-12

• Docs: clarify the BitShares onboarding — adds the peer-to-peer (P2P) credit system as a core BitShares feature ("What is BitShares?" section: on-chain lender credit offers with interest/collateral, credit deals for borrowers, (auto-)repay on expiry), verified against bitshares-core-7.0.2; replaces generic root README links with section anchors (#install, #recommended-bot-setup, #contents) and anchors doc links to exact entry points (docs/BITSHARES_ONBOARDING.md, docs/MPA_CREDIT_USAGE.md#which-section-do-i-need, market_adapter/README.md#quick-start).

[1.4.13] - 2026-08-12 - COW Broadcast Serialization, Start Canonicalization, BitShares Onboarding

2026-08-12

• Docs: add a BitShares onboarding tutorial for first-time users — docs/BITSHARES_ONBOARDING.md walks new users from zero through their first live bot: what BitShares is and how its markets work, creating and funding an account (gateway assets like XBTSX.USDT vs market-pegged assets like HONEST.USD/bitAssets), choosing the right key (active vs owner vs memo vs login — and why the active key is the one DEXBot2 needs), importing it with dexbot key, creating a bot config and activating the market adapter, running a dry run, going live, and troubleshooting the most common first-run mistakes (wrong key type, unresolved account name, missing signing key, background-runtime behavior, log locations, forgotten master password, Node < 22.12 / ERR_REQUIRE_ESM, undrivable startPrice for pairs without a pool/book, insufficient BTS fee balance); linked from the root README (new "First Run" section + docs index) and docs/README.md (docs/BITSHARES_ONBOARDING.md, README.md, docs/README.md).
• Chore: ship the whole claw/ directory in the npm package instead of cherry-picking sub-paths — the files whitelist now includes claw as a unit (covering claw/skills, runtimes, and scripts like memu_runner.py) so a published install can never drop parts of the claw runtime (package.json).

2026-08-10

• Fix: serialize COW broadcasts with a single-flight guard — two overlapping COW batches planning from the same base grid version caused the second commit to be refused (base-version mismatch) → adopt-from-chain → snapshot reload that could drop a placed order and produce orphan fills. A _cowBroadcastInFlight flag is set atomically before the broadcast and cleared only by the frame that claimed the slot; two wait points (entry optimization + authoritative pre-broadcast check-and-set) plus per-frame heldBroadcastSlot ownership so a batch that early-returns never clears a concurrent batch's in-flight flag; the wait is capped at 120s and breaks on shutdown. isDiscardedCreate no longer depends on opContexts being present so the PENDING_BROADCASTS reject path can't re-CREATE a duplicate once the original broadcast lands (modules/dexbot_class.ts, modules/dexbot_cow_runtime.ts, tests/test_cow_single_flight.ts).
• Fix: close fill-lock bypasses — syncOpenOrdersAndProcessFills now self-guards (it mutates grid state and can broadcast a rebalance), serializing unlocked callers through _fillProcessingLock while callers already inside run directly; runDustHealthCheck defers (with a warning) instead of cancelling dust without the lock, so the dust is picked up by the next locked maintenance tick or fill batch (modules/dexbot_maintenance_runtime.ts, tests/test_lock_bypass_guards.ts).
• Fix: harden the AsyncLock no-ALS fallback — the _holding-based fallback treated every concurrent caller as re-entrant and ran it immediately, allowing overlapping critical sections. Now only a call made synchronously inside the holder's own callback prologue is re-entrant; everything else queues, preserving mutual exclusion (async-nested calls in the fallback wait on the held lock until the timeout — a bounded fail-safe stall, never concurrent execution). Added acquireIfNotHeld(lock, fn) as the canonical re-entrancy guard and used it at the COW reconcile and open-orders sync chokepoints, plus a DEXBOT_DISABLE_ASYNC_LOCAL_STORAGE escape hatch for testability (modules/order/async_lock.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts, tests/test_async_lock_no_als_fallback.ts).
• Refactor: trim redundant no-ALS AsyncLock guards and close ESM packaging gaps — removed the dead _holding && _syncPrologue conjuncts (_syncPrologue is only set where _holding is already true and forceRelease cannot run mid-prologue), bumped engines to >=22.12.0 (the codebase calls require() on sibling ESM modules, which only works unflagged from Node 22.12+; on 22.0–22.11 those throws ERR_REQUIRE_ESM at boot), added a package exports map ("." main entry, ./dist/* deep imports, ./package.json), and classified 7 more Node-only launcher modules as false in the browser field (modules/order/async_lock.ts, package.json, package-lock.json).
• Refactor: promote dexbot start as the canonical launch command — the monolithic launcher was historically dexbot unlock with start only an alias; now start is primary and unlock is documented as the legacy alias. Updated CLI help, launcher success/enable hints, all user-facing dexbot unlock strings (update.ts, supervisor_control.ts, postinstall.js banner, claw_launcher.ts, credential-daemon.ts) and the docs (README, WORKFLOW, MPA_CREDIT_USAGE, DEXBOT_COMPARISON, docs/README); internal references (mode labels, npm scripts, entry points) unchanged (dexbot.ts, unlock.ts, scripts/update.ts, modules/launcher/supervisor_control.ts, scripts/postinstall.js, claw/modules/claw_launcher.ts, credential-daemon.ts, tests/test_unlock_output.ts, tests/test_unlock_control_output.ts, tests/test_dexbot_startup_output.ts).
• Chore: remove all residual TUI dashboard references from the default branch — the Rust dashboard was already isolated to dashboard-draft-legacy, but leftover signals (.gitignore/.dockerignore entries, docs/DEXBOT_COMPARISON.md comparison row and doc-index strikethroughs, an analysis/analyze_risk_profile.ts log string) were still confusing DeepWiki's auto-generated docs into emitting a stale "TUI Dashboard" page; CHANGELOG historical mentions intentionally left intact (.gitignore, .dockerignore, docs/DEXBOT_COMPARISON.md, analysis/analyze_risk_profile.ts).

[1.4.12] - 2026-08-09 - Full ESM Migration, Legacy-Compat Removal, Node >= 22

2026-08-10

• Fix: repair ESM direct-run guards and editor tsconfig coverage for analysis tools — the CJS→ESM migration left analysis CLI entry points using require.main, which throws a ReferenceError under "type": "module", and added import.meta usage to analysis/ and claw/examples/ files that no tsconfig project covered (editors inferred CommonJS and flagged import.meta as TS1343). require.main === module is replaced with the argv-independent process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href guard in analyze_derivatives, derivative_chart_generator, backtest_ama_sweep, generate_unified_comparison_chart, optimizer_high_resolution, and analyze_lambda_vs_slow; analyze_tradingview (CLI-only, nothing imports it) now calls main().catch(...) directly so the tradingview chart exporter no longer crashes on run. Added analysis/tsconfig.json and claw/examples/tsconfig.json (loose ESM, noEmit) mirroring tests/tsconfig.json so those directories resolve as ESM in editors, and un-ignored analysis/tsconfig.json for tracking (analysis/*, claw/examples/*, .gitignore).

2026-08-09

• Fix: align claw build emit options with the root build to keep dist consistent — enable declaration/declarationMap/sourceMap in claw/tsconfig.json so a claw build after npm run build never leaves a hybrid dist (regenerated .js without sourceMappingURL footers while stale .d.ts/.js.map lingered); export CredentialDaemonResponse for claw's declaration emit (claw/tsconfig.json, modules/dexbot_credential_client.ts).
• Refactor: remove the deprecated debtPolicy.lending[].ratio alias in favor of outputWeight — ratio now fails validation loudly ("no longer supported; use outputWeight instead") instead of silently defaulting to weight 1, so old configs cannot change behavior unnoticed (modules/types.ts, modules/bot_settings.ts, modules/credit_runtime.ts).
• Refactor: drop legacy market/orderbook price-source aliases and unify book terminology — normalizeMarketSource now accepts only pool/book (an unknown token falls back to pool instead of being misnormalized to book); usesOrderbookMarketSource renamed to usesBookMarketSource (market_adapter/utils/chain.ts, market_adapter/market_adapter.ts, market_adapter/core/market_adapter_service.ts, dexbot.ts).
• Fix: resolve 80 typecheck errors in tests/tsconfig.json — the CJS-pinned test suite used ESM syntax in tests/helpers/* stubs and test_sync_excess_orphan.ts/test_strategy_reaction_cap_fix.ts, and 12 more files had type-shape mismatches (untyped mock accounts, missing manager stubs, stale @ts-expect-error directives, etc.) (tests/helpers/*, tests/test_*.ts).
• Refactor: remove legacy compatibility and migration code that no active deployment exercises — dropped the pre-1.1.0 { bots: {...} } wrapper migration in account_orders, the unlock-start candidate runtime paths in bot_supervisor, the claw unlock-start mode alias, the redundant per-record vault version check, and the silent 0o644 → 0o600 chmod auto-fix (a non-0o600 security/policy file now fails closed with an explicit permission error) (modules/account_orders.ts, modules/launcher/bot_supervisor.ts, claw/modules/*, modules/chain_keys.ts).
• Fix: never throw Cannot require() ES Module in a cycle on boot for Node 22.14 — the ESM migration left a cycle of require()-based imports to sibling ESM modules routing through the storage binding; on the server's Node 22.14.0 this deadlocked at startup and aborted every entrypoint (CLI/bot/pm2/unlock), while newer Node 22 versions only emitted an experimental warning that masked the failure in CI. dexbot_maintenance_runtime now imports storage statically and instantiates it once, and dexbot_cow_runtime/dexbot_fill_runtime/processed_fill_store replace createRequire()-based top-level requires with static imports (lazy require accessors kept where test mocks need call-time resolution); the extensionless scripts/{bots,dexbot,keys,pm2,unlock} wrappers were rewritten as real ESM that createRequire()s the tsx fallback and await-imports the built dist entry (modules/dexbot_maintenance_runtime.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_fill_runtime.ts, modules/order/processed_fill_store.ts, scripts/*).
• Fix: restore the createRequire binding in dexbot_fill_runtime after the ESM migration removed it while leaving three lazy require() accessors (buildFillKey, correctAllPriceMismatches, retryPersistenceIfNeeded) — every queued fill then threw ReferenceError: require is not defined, permanently stalling the fill consumer with retry-every-~3s backoff; the sibling COW/maintenance runtimes were unaffected because they kept their own binding (modules/dexbot_fill_runtime.ts).
• Fix: restore same-order fill batching to eliminate phantom residuals — a same-order multi-fill batch (e.g. partial fill plus the dust fill consuming the rest in the same block) recomputed every fill's transition against the same stale pre-batch baseline, and last-wins batch application left a phantom PARTIAL residual equal to the sum of earlier fills (triggering fund-invariant CRITICALs and, below the 1% tolerance, corrupting the next COW cycle). Phase 6 now groups batch fill contexts by grid slot and emits a single cumulative transition per order against the pre-batch baseline (fully consumed → real full fill/SPREAD placeholder; partial → exact remaining size), while phase 3 still accounts each fill individually; the "fill-batch-committed" flush now also persists the raw per-fill keys so earlier same-order fills (already credited) are not re-credited on crash recovery (modules/order/sync_engine.ts, modules/dexbot_fill_runtime.ts, tests/test_sync_fill_history_batch.ts).
• Fix: explicitly cancel residual dust left on chain after sub-dust fills — the chain only auto-culls a residual when its QUOTE-side value truncates to 0, so a residual of ≥ 1 base unit with non-zero quote value stays on the book forever once the slot is virtualized. syncFromFillHistory now verifies the order against the chain (reusing the drift-refetch result when present) and emits a residualCancel request; cancelResidualOrders() performs a best-effort cancel (tolerating "order does not exist") before post-fill grid maintenance so the residual cannot be re-adopted into a slot as a ghost grid order (modules/order/sync_engine.ts, modules/dexbot_fill_runtime.ts, tests/test_ghost_order_fix.ts, tests/test_sync_fill_history_batch.ts).
• Fix: quiet duplicate-orphan self-heal and dedupe its cancellation — duplicate-price-level orphans are standard designed self-healing (a fully filled order leaves a sub-dust residual that collides with the rotated replacement, and the sync/reconcile layer cancels it); they were logged as ERROR/WARN and processed twice (the sync-layer cancel-only correction plus a reconcile Phase-2 cancel on a stale snapshot). Reconcile Phase-1 now defers duplicates the sync layer already owns (queued as cancel-only or own-cancelled within the 5s TTL), restoring the untracked-fund release the correction's cancel-only path does not perform — so one orphan is cancelled exactly once with exactly one fund release, preserving chainTotal = chainFree + chainCommitted. Duplicate detection logs downgraded warn→info; the skip is limited to cancelOnly entries so price-update/type-mismatch corrections are unaffected (modules/order/grid_reconcile.ts, modules/order/sync_engine.ts, tests/test_grid_reconcile_regressions.ts).
• Fix: release untracked funds even when a duplicate-orphan cancel hits "order does not exist" — when the sync-layer correction already cancelled the orphan and the 5s own-cancel TTL lapsed before reconcile's Phase-2 ran, the ORDER_GONE throw skipped the addToChainFree block and stranded the capital, breaking the chainTotal = chainFree + chainCommitted invariant. _cancelChainOrder now treats a gone order as a successful cancel when releaseUntrackedFunds is set (gated so matched-order cancels keep their old throw-and-log behavior). Persistent duplicate orphans no longer loop silently at info: re-detection of the same orderId (cancel keeps failing or the order keeps getting re-created) escalates to a warn rate-limited by TIMING.STALE_TOTALS_WARN_RATE_LIMIT_MS, with the shared detection counter reused from the existing recent-orderId map budget and cleared on confirmed cancel (modules/order/grid_reconcile_internal.ts, modules/order/utils/order.ts, modules/order/grid_reconcile.ts, modules/order/sync_engine.ts, tests/test_grid_reconcile_regressions.ts, tests/test_duplicate_orphan_escalation.ts).
• Test: prevent the master-password prompt from blocking test_stale_daemon_cleanup — the test stubbed chainKeys.authenticate by mutating its require() binding's property, but credential_daemon.ts imports chain_keys via import * as, which under tsx's ESM transform resolves a separate namespace object so the mutation never reached the controller and the real authenticate() prompted for a password, blocking all remaining tests. Switched to require-cache stubbing via setCachedModule (same pattern as test_credential_controller_cleanup.ts), preserving the real daemon-readiness/reporting logic for the file-based assertions (tests/test_stale_daemon_cleanup.ts).

2026-08-08

• Feat: migrate the codebase to native ES modules — the root and claw/ packages flip to "type": "module" and the compiled dist/ bundle now runs under Node's native ESM loader on Node >= 22. Entry shims (bot.js, dexbot.js, pm2.js, unlock.js, credential-daemon.js, scripts/update.js) are rewritten as ESM with top-level await import() and a dist-first / tsx-fallback loader; createRequire(import.meta.url) shims are added wherever require() is still needed (config, storage, crypto, chain_orders, order utils, and more); tests/ and claw/tests/ are pinned to "type": "commonjs" so the CJS test files keep running under tsx; direct-run guards using pathToFileURL(process.argv[1]) are made argv-independent in 12 files; claw memu:status/check npm scripts switch to --input-type=module + await import() (package.json, claw/package.json, *.js shims, modules/*, market_adapter/*, claw/*, scripts/*).
• Refactor: drop the ws optional dependency and require Node >= 22 native globalThis.WebSocket — the ws fallback for pre-Node-22 environments kept node_modules non-empty in dev and made the "zero runtime dependencies" claim depend on install state. transport.ts now throws a clear error if native WebSocket is missing; package.json engines bumped from >=18 to >=22; optionalDependencies.ws removed and lockfile regenerated (modules/bitshares-native/transport.ts, package.json, package-lock.json, docs/architecture.md).
• Refactor: remove legacy credential daemon compatibility code — dropped the legacy broadcast-operation request handler (all clients send execute-operations), the unreachable hmacResult.skipped branches, the allowedOpTypes backward-compat fallback in the policy engine, the unused isBroadcast client option, and the legacy masterPasswordHash SHA-256 field from keys.json normalization/setup/save (credential-daemon.ts, modules/credential_policy.ts, modules/dexbot_credential_client.ts, modules/chain_keys.ts, modules/types.ts).
• Refactor: remove pre-1.4.0 compatibility shims and the one-time migration script — deleted modules/utils/fs_utils.ts (backward-compat re-export of the unified StorageAdapter) and migrated ~80 call sites to destructure getStorage() directly; deleted scripts/migrate_bot_keys.ts (v1.1.0 unique-bot-names migration) and removed its auto-run call sites from dexbot.ts, bot.ts, and unlock.ts (modules/**, market_adapter/**, claw/**, analysis/**, scripts/**, tests/**).
• Refactor: replace hardcoded module literals with constants.ts references — magic numbers across account_bots, bitshares-native/{subscriptions,tx/builder,tx_cache}, chain_orders, credential_policy, credit_runtime, dexbot_fill_runtime, dexbot_maintenance_runtime, bot_supervisor, node_manager, order/export, and order/utils/system now point at canonical values so runtime tuning stays single-sourced (modules/constants.ts, and the per-file call sites listed above).
• Refactor: prune dead constants, helpers, and a dead AsyncLock queue method from a dead-code audit — removed genuinely unused keys (DUST_CANCEL_DELAY_SEC, SUMMED_RELATIVE_SQUARED_DIFFERENCE, LIMIT_ORDERS_BATCH, TAKER_INDICATOR, MAX_COMMIT_MS, MAX_MEMORY_MB, INDEX_REBUILD_THRESHOLD, GRID_MEMORY_CRITICAL), restored MAX_REBALANCE_PLANNING_MS/STATE_CHANGE_HISTORY_MAX (still referenced via magic numbers) and bound their call sites, removed formatRatio/formatMetric5/getPrecisionForSide/deductOrderFeesFromFunds/clearQueue, and deleted tests/test_dust_cancel_delay_config_migration.ts (modules/constants.ts, modules/order/async_lock.ts, modules/order/format.ts, modules/order/utils/math.ts, modules/order/accounting.ts, modules/order/logger.ts).
• Fix: restore re-entrancy recursion guards broken by the dead-code audit — syncFromOpenOrders and reconcileAfterUncertainBroadcast are self-recursive wrappers and the !isReentrant() gate is required again (the acquire() re-entrant short-circuit alone caused infinite recursion / RangeError in 6 tests); requestGridReset keeps its re-entrant branch so the fill consumer defers fills (modules/order/sync_engine.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts).
• Fix: make the claw build green and stop stray .js emission — claw/tsconfig.json rootDir "." → ".." and outDir "../dist/claw" → "../dist" eliminates 75x TS6059 (files not under rootDir) and the in-place stray .js byproducts; remaining claw type errors fixed (CredentialDaemonResponse trx envelope, nullable profileRoot, deploymentMode === null guard, pool reserves shape, derivePoolPrice poolRef/options overload, Uint8Array buffer type, explicit observedRatio null check, new plugin-entry.d.ts shim) (claw/tsconfig.json, claw/modules/*, claw/runtimes/openclaw-plugin/*).

[1.4.11] - 2026-08-07 - Minimum-Slots Grid Guard, Credential-Daemon Restart, CLI Alias Hardening

2026-08-07

• Feat: add a minimum-slots guard to grid range scaling — the existing asymmetry clamp (1 - 1/D) only prevented the tightened bound from crossing the grid center; it did not stop that side from collapsing into a near-center sliver holding few or no active orders. New ASYMMETRIC_BOUNDS_MIN_SCALE_SLOTS (default 10, 0 disables; overridable per bot/market) guarantees at least N incrementPercent steps remain between the grid center and the narrowed bound while the widened side still extends freely. asymmetricBounds is now merged per-field across the globals → pairs[].marketAdapterSettings → pairs[].botOverrides.<bot> layers so a bot-level minScaleSlots no longer wipes a market-level maxAsymmetryFactor (modules/constants.ts, modules/order/grid.ts, market_adapter/market_adapter.ts, market_adapter/core/market_adapter_service.ts, tests/test_grid_logic.ts).
• Fix: dexbot start (and status/stop/restart/delete) no longer spawn a hard-coded dist/unlock.js — they use buildRuntimeScriptArgs, which resolves the unlock entry point per runtime layout (dist/unlock.js compiled, unlock.ts via tsx in source mode). Previously the source-mode path resolved modules/dist/unlock.js (ENOENT → silent process.exit(0)), so dexbot start was a silent no-op; removed the now-unused BUILD_DIR constant (dexbot.ts).
• Test: retarget the CLI tests that validated the in-process one-shot flow to dexbot test — after the start alias change that flow is covered by the test command. test_dexbot_start_master_password_failure_output.ts, test_dexbot_startup_output.ts, and test_dexbot_daemon_ready_output.ts now invoke test (previously 282-second suite stall + spurious failures from spawning the real dist/unlock.js unlocked password prompts); add test_dexbot_start_alias_unlock.ts guarding the start→unlock delegation (entry point + exit-status forwarding).
• Fix: dexbot status/stat after dexbot stop no longer reports "No DEXBot2 processes running" while the credential daemon still runs — stop stops bots + market adapter by design but keeps the daemon up for fast re-unlock. dexbot.ts now treats a live daemon (via monolithic-cred.pid) as a running runtime and delegates to unlock status, which gained a branch rendering the daemon (PID/memory/alive/ready/socket) alongside a note that the monolithic runtime (bots + adapter) is stopped; shared resolveCredentialDaemonForStatus, printCredentialDaemonStatusBlock, and printMarketAdapterStatusBlock helpers (dexbot.ts, unlock.ts, tests/test_unlock_status_cred_daemon_only.ts).
• Docs: Telegram module implementation plan and aligned EVOLUTION entry (docs/TELEGRAM_IMPLEMENTATION_PLAN.md, docs/EVOLUTION.md).

2026-08-06

• Docs: fix stale EVOLUTION release header and broken internal doc links; add Telegram bot to the planned EVOLUTION features.

2026-08-05

• Feat: dexbot restart (no target) also restarts the credential daemon with a password prompt before restarting bots (guarded by !target + TTY); targeted restarts unaffected. Root-cause fix: isAlive() in process_discovery.ts discarded runtime.kill(pid, 0)'s return value and always returned true, so the credential-daemon kill waited the full 5s SIGTERM timeout despite normal exit; it now returns the kill result, with D-state detection at every kill stage as a safety net. process.exit(0) closes out spawned unlock.js runs and the noisy stop-signal log line is removed (modules/launcher/monolithic_runtime.ts, modules/process_discovery.ts, unlock.ts, scripts/update.ts).
• Fix: alias dexbot start → unlock (persistent monolithic runtime) instead of test (one-shot), properly pairing it with dexbot stop; dexbot test <bot> still runs one-shot (dexbot.ts, README.md, docs/WORKFLOW.md).
• Refactor: prune dead COW/diagnostic methods and orphaned exports — removed 14 zero-reference OrderManager methods and helpers (stale pre-guard copies from the earlier COW rewrite, accountant extraction, and immediate dust-cancel rework), logGridDiagnostics and the dormant grid.displayDiagnostics flag, and writeSkillFile; tests call validateWorkingGridFunds directly instead of the removed wrapper (modules/order/manager.ts, modules/order/logger.ts, modules/constants.ts, claw/modules/skill_utils.ts, docs/*).
• Docs: expose docs/GRID_RECONCILE.md in the root README and docs index.

[1.4.10] - 2026-08-04

2026-08-04

• Fix: re-place zeroed boundary slots on reconcile and run spread check independent of divergence — after a COW batch dies on a stale order, recoverExplicitStaleOrders zeroes the consumed slot; reconcile's _pickVirtualSlotsToActivate now re-derives a funded size for these zeroed boundary-adjacent slots so they become pickable again instead of being skipped (modules/order/grid_reconcile_internal.ts, modules/dexbot_state_recovery.ts).
• Fix: prevent duplicate slot planning and fabricated-boundary promotion in spread correction — the 1.4.10 || o.type === SPREAD addition made orphanedVirtualCandidates overlap typedSpreadCandidates, planning an empty in-rail SPREAD slot twice (each order sized ~half, misreported plan counts, silent drops by the COW same-batch collision filter); spreadCandidates is now deduped by slot id, keeping the orphaned-priority occurrence. The boundary-promotion walk is gated on a known committed boundary (boundaryKnown) so a fabricated ?? 0 boundary can never be returned and committed by the COW pipeline; countGapBandSpread resolves indexes via parseSlotIndex with array-position fallback for an order-independent count (modules/order/grid.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/order.ts, modules/order/utils/math.ts, modules/dexbot_cow_runtime.ts).
• Fix: stop pool-share supply short-circuit returning 0, unblocking LP credit pricing — getAssetCurrentSupply hit the toFiniteNumber(undefined, undefined) default-param trap (returned 0, not null) when the static asset object carries no current_supply (that value lives in the dynamic asset data object); the >= 0 guard then accepted 0 and deriveLiquidityPoolTokenValue bailed at supply <= 0, silently breaking the LP-collateral credit conversion-rate path with hourly "unable to resolve credit offer price" warnings. The direct-supply shortcut now applies only when current_supply is present, falling through to the get_objects(dynamic_asset_data_id) lookup that carries the real supply; -1 sentinel keeps the type check while never passing the >= 0 guard (modules/order/utils/system.ts, modules/order/sync_engine.ts).
• Feat: empty-slot normalization and spread boundary promotion — all size-0 VIRTUAL slots are stored as ORDER_TYPES.SPREAD (side-neutral) during loadGrid, eliminating stale BUY/SELL type misleads in candidate-selection code; currentSpreadCount/initialSpreadCount now count gap-band SPREAD occupancy only; slot-picking accepts SPREAD-typed in-rail slots and re-types them to concrete BUY/SELL before activation; when the funded rail is full during spread correction, contiguous gap-band empty slots are promoted and the new boundary flows through the COW pipeline (modules/order/grid.ts, modules/order/grid_reconcile_internal.ts, modules/order/accounting.ts, modules/dexbot_cow_runtime.ts).
• Refactor: virtualizeOrder → convertToSpreadPlaceholder replaces ad-hoc {...virtualizeOrder(), size: 0} patches at 6 call sites; new resolveGapBand helper centralises gap-band geometry computation previously duplicated across 3 files (modules/order/utils/order.ts, modules/order/utils/math.ts, modules/order/grid.ts, modules/order/accounting.ts, modules/order/grid_reconcile_internal.ts, modules/order/strategy.ts, modules/order/sync_engine.ts, modules/dexbot_state_recovery.ts).
• Refactor: extract shared isEmptyGridSlot predicate — centralizes the "is this slot an empty placeholder?" check that existed as two inline copies with subtly different conditions (loadGrid forced any size-0 VIRTUAL slot to SPREAD including type: null; assignGridRoles additionally required slot.type !== null, a load-bearing guard for grid creation); opts.allowNullType captures that one real difference and liveSlot lets role assignment check the resolved runtime slot. No behavioral change (modules/order/utils/order.ts, modules/order/grid.ts).
• Refactor: deduplicate repeated validation, broadcast, and process-utility code — jscpd clones cut 102 → 88 (837 dup lines, 6,390 tokens). Extracted credential_policy.ts deny helpers (asDeny/denyNotInList/denyBoundExceeded/denyAssetRefMismatch) replacing ~250 lines of near-identical policy blocks with exact reason/verb/matchOnly strings preserved; shared processSweepOrphanFill fill-sweep in fill/startup runtimes; DaemonKeyStore broadcast helpers; promoted formatUptime and isPidAlive delegating to getProcessDiscovery().isAlive(); relocated parseSlotIndex; deduped price-collision guards (modules/credential_policy.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_startup_runtime.ts, modules/key_store.ts, modules/process_discovery.ts, modules/launcher/*, modules/order/utils/order.ts, modules/order/grid_reconcile_internal.ts).
• Chore: remove dead default exports and unreferenced types — deleted 68 zero-reference type definitions from modules/types.ts (kept all types referenced via runtime/type imports or JSDoc import() tags) and unused export default declarations in broadcast_failure.ts, daemon_node_health.ts, node_failure_ledger.ts, socket_json_client.ts; every removal cross-checked against the source tree since ts-prune's dynamic-require false positives make its output unreliable (modules/types.ts, modules/broadcast_failure.ts, modules/daemon_node_health.ts, modules/node_failure_ledger.ts, modules/socket_json_client.ts).
• Test: new test_spread_boundary_promotion.ts covers boundary promotion flow, COW boundary propagation, and regression tests for the duplicate in-rail SPREAD slot and null-boundary promotion block; new test_spread_check_orchestration.ts drives full checkSpreadCondition orchestration for empty-rail scenarios (mid-grid empty rail promotes, rail-edge empty rail requests boundary-at-rail-edge resync); updated test_grid_bloat.ts, test_cow_boundary_slot_replacement.ts, test_rail_reanchor_fix.ts for SPREAD placeholder invariants.

2026-08-03

• Fix: dexbot unlock credit now daemonizes to the background like dexbot unlock but runs only the credit-only bot — the previous credit path skipped the monolithic background daemon and stayed foreground; the credential daemon detaches to the monolithic log files the same way (unlock.ts).
• Docs: remove the dexbot unlock credit line from the root README command list and clarify the credit-only worker's behavior in the docs (README.md, docs/WORKFLOW.md, docs/MPA_CREDIT_USAGE.md, docs/README.md).
• Perf: cut test-suite runtime 95s → 45s — fixed a real grid-generation bug found along the way: createOrderGrid with incrementPercent <= 0 slipped past validation (bounds read from undefined config.incrementBounds) and the geometric loop spun until Node threw "Invalid array length"; now falls back to canonical INCREMENT_BOUNDS and rejects <= 0 up front (modules/order/grid.ts). Test runner (scripts/run-tests.ts) captures per-child output (live echo + timestamped tests/tmp/test-run-*.log), reports per-test elapsed + slowest-top-10, aggregates warn/error/deprecation diagnostics, continues past failures, and moved live-chain/diagnostic-only scripts to the live skip set so npm test counts only genuine offline tests. Per-suite cuts: test_autoderive 15.2s→0.24s, test_grid_logic 6.9s→0.31s, test_credit_runtime 6.3s→0.32s, test_chain_keys_vault 4.8s→0.30s, test_dexbot_maintenance_runtime_dynamic_weights 5.1s→0.15s, test_race_condition_fixes_batch1 2.4s→0.36s, and more. bot_supervisor gains a staggerDelayMs option (default STAGGER_DELAY_MS unchanged) and chain_keys a bounded DEXBOT_VAULT_SCRYPT_N env override so tests can lower scrypt cost (production N=2^17 preserved) (modules/launcher/bot_supervisor.ts, modules/chain_keys.ts, scripts/run-tests.ts).

[1.4.9] - 2026-08-03 - LP-Collateral Credit Conversion Rate, Top-Level Unlock Control Aliases

2026-08-03

• Fix: _resolveCreditConversionRate could not price pool-share collateral — the offer's acceptable_collateral map only carries a direct base/quote price, and a liquidity pool token has no such pair against the debt asset, producing repeated "unable to resolve credit offer price ... no usable last known price" warnings and freezing the collateral group's budget. When the collateral asset has for_liquidity_pool, the rate is now derived via deriveLiquidityPoolTokenValue (prices both pool reserve assets against the debt asset), cached/persisted with source pool-derived, falling back to the existing cached/missing path so non-pool behavior is unchanged; mirrors the existing _calculateCollateralValueInDebtAsset pool-token handling (modules/credit_runtime.ts).
• Test: testLpCollateralResolvesCreditConversionRate covers debt against a pool-share collateral and asserts a positive pool-derived rate (tests/test_credit_runtime.ts).
• Feat: add dexbot stop, dexbot restart, and dexbot delete as top-level aliases for the unlock stop|restart|delete monolithic controls; the shared switch case spawns dist/unlock.js with the resolved command and forwards all remaining args (targets like all or a bot name pass through). New aliases stp/stopall → stop and restartall → restart (dexbot.ts).
• Docs: update README and unlock doc comment/runtime hints to the flat dexbot stop|restart|delete forms, removing the duplicated dexbot unlock / dexbot stat entries (README.md, unlock.ts).

[1.4.8] - 2026-08-01 - Uncertain-Broadcast Duplicate-Order Safety, Truncated-Read Ambiguity, COW Stale-Plan Replan

2026-08-01

• Fix: credential daemon broadcast retries are now limited to provably-untransmitted failures (pre-send connection/frame errors only); RPC timeouts and connection drops with a response pending are classified uncertain and never re-signed — reported as a typed BROADCAST_DEADLINE so the bot's verify-before-retry machinery checks chain inclusion before re-broadcasting (modules/broadcast_failure.ts, credential-daemon.ts).
• Fix: daemon broadcast retries pinned per node with rotation + blacklisting — all attempts stay on one node until provably untransmitted, then the node is reported to a new shared failure ledger (modules/daemon_node_health.ts) that blacklists it after the threshold and removes it from the shared health cache so bot processes stop preferring it (modules/node_failure_ledger.ts).
• Fix: uncertain broadcasts are never blindly re-sent to fallback nodes — BroadcastUncertainError propagates and the COW runtime re-broadcasts only on authoritative absence (non-empty, non-truncated chain read with no CREATE match); empty/landed states defer to poll-confirmed reconciliation (modules/dexbot_cow_runtime.ts, modules/dexbot_credential_client.ts).
• Fix: direct-key and claw broadcast paths classified via the same failure rules — direct-key broadcasts surface BroadcastUncertainError instead of a blind error so verify-before-retry engages; the claw daemon client delegates to the hardened client with a 30s outer deadline covering the daemon's 25s inner window (modules/chain_orders.ts, modules/key_store.ts, claw/modules/chain_broadcast.ts, claw/modules/dexbot_credential_client.ts).
• Fix: truncated get_full_accounts reads are treated as ambiguous (not authoritative absence) in every absence decision — new readOpenOrdersWithMeta propagates the more_data_available.limit_orders truncation flag; cancel-verify, discard, adoption, dust-cancel refetch, recovery, and reconcile sites defer on empty/truncated snapshots instead of freeing slots/capital or clearing broadcast protection for possibly-live orders (modules/chain_orders.ts + ~10 call sites).
• Fix: COW pre-broadcast staleness guard — a master-grid change during planning (fills, syncs) refuses to broadcast the stale plan, re-plans once from fresh master using the same fills (replanStaleBatch), restores the boundary-shift budget, and clears only the abandoned batch's own pending-broadcast entries; still-stale plans proceed + structural resync, and commit-refused-after-broadcast adopts placed orders from chain (modules/dexbot_cow_runtime.ts, modules/order/manager.ts).
• Fix: exactly-once working-grid stack discipline — _pushWorkingGridRef/_popWorkingGridRef/_releaseWorkingGridRef (marker-guarded, identity-checked) replace unconditional pops so aborted/never-pushed results can no longer underflow or steal a nested grid's stack entry; _commitWorkingGrid releases the entry on every settle path (modules/order/manager.ts, modules/dexbot_cow_runtime.ts).
• Fix: COW stale-placement guard made slot-id based and boundary-only — compares rail slot indices against the plan's own target boundary (fill-based veto lines dropped, since burst fills sit beyond legitimate re-place levels); UPDATE rotations covered via newGridId (modules/order/manager.ts, modules/order/utils/order.ts).
• Fix: credential daemon load crash — require('./modules/logger') returned the ESM namespace (no module.exports fallback), crashing with Logger is not a constructor and breaking the unlock bootstrap handshake (60s timeout); daemon now requires the ESM default explicitly and the launcher races child exit against the readiness probe (credential-daemon.ts, modules/launcher/credential_daemon.ts).
• Fix: daemon broadcast deadline now starts at request receipt (before the serialize queue wait) and guards fire after connect/signing-client init, so a deadline-aborted zombie can no longer land after the bot was told the outcome was uncertain (credential-daemon.ts, modules/bitshares-native/transport.ts).
• Fix: recovery isolation — _recoverySyncInFlight raised for the whole structural-resync reload so a fill arriving mid-reload cannot start a batch that overlaps it; open-orders sync loop and lightweight sync skip while the recovery reload is in flight (modules/dexbot_maintenance_runtime.ts).
• Fix: uncertain price updates drop the correction entry — the next sync re-detects any remaining mismatch instead of re-applying the same delta from a possibly-lagging read (double-shrink protection) (modules/order/utils/order.ts).
• Fix: grid regeneration bumps _gridVersion so an in-flight COW plan can never commit over a regenerated (zero-slot) grid; on-chain slots never reassigned to SPREAD; SPREAD-typed fills resolve the real BUY/SELL side so deriveTargetBoundary shifts and illegal SPREAD+on-chain states are impossible (modules/order/grid.ts, modules/order/sync_engine.ts).
• Feat: add reverse dexbot enable CLI command mirroring disable semantics (<bot> or all, unknown-bot error, already-active notice); both unified into setBotActiveState (dexbot.ts).
• Refactor: deduplicate node-health, socket, and chain-read logic — shared failure ledger, shared newline-JSON socket client, readOpenOrdersWithMetaSafe wrapper, unified CLI enable/disable (modules/node_failure_ledger.ts, modules/socket_json_client.ts, modules/chain_orders.ts, dexbot.ts).
• Refactor: split working-grid stack and COW guard paths into named steps — manager owns the push/pop contract, replan branch becomes replanStaleBatch, stale-placement veto extracted to stalePlacementDropReason, pre-retry verification split into per-op-kind verifiers (modules/dexbot_cow_runtime.ts, modules/order/manager.ts).
• Tests: new/expanded suites for uncertain-broadcast verify-before-retry (UNC-013h–l), broadcast failure classification, daemon node health blacklist/rotation, COW stale-slot guard, COW guard replan, credential daemon load, sync fill history batch, truncated-read deferral regressions.
• Fix: open-orders watchdog sync loop defers on truncated reads (was the last unguarded sync path); syncOpenOrdersAndProcessFills returns the post-fill re-read snapshot so targeted-sync reconcileGridOrders sees fresh chain state (modules/dexbot_maintenance_runtime.ts).
• Refactor: shared helpers replace inlined duplicates — resolveSpreadOrderSide (SPREAD side convention, 5 sites), chainOrderMatchesSlot (adoption tolerance matcher, 2 sites), readOpenOrdersGuarded (truncated/empty-read deferral, 14 sites) (modules/chain_orders.ts, modules/order/utils/order.ts, modules/order/sync_engine.ts, modules/order/accounting.ts, modules/order/manager.ts, modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts).
• Test: open-orders sync loop test mocks readOpenOrdersWithMeta and adds a truncated-read deferral phase; resetFunds() awaited at 13 test call sites to match the async contract (tests/test_main_loop_sync_fill_rebalance.ts + 11 test files).
• Fix: all remaining fallback/reset sync paths defer on truncated reads — post-reconnect safety-net, post-reset fallback, bootstrap fallback, open-orders-mode fill sync, full grid reload, trigger-file resync (trigger retained), and missing-CREATE-result recovery; absence on a partial get_full_accounts window would virtualize live ACTIVE slots and re-create duplicates (modules/dexbot_cow_runtime.ts, modules/dexbot_fill_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_startup_runtime.ts, modules/dexbot_state_recovery.ts).
• Test: UNC-016e — _recoverFromPersistedGrid defers on a truncated read and never syncs from a partial snapshot (tests/test_uncertain_broadcast.ts).
• Fix: pinned poolRef price derivation now orients reserves to the bot's pair (B/A) — full-pair-reversed pools no longer return inverted prices, and partial-match pools (only one bot asset in the pinned pool) are oriented via the unmatched pool asset as the proxy; pins sharing no asset keep intrinsic proxy behavior (modules/order/utils/withPoolRef.ts).
• Fix: bot editor (node dexbot bots) no longer strips custom overrides on save — promptBotData returns the full normalized draft instead of a fixed field whitelist, so logging, timing, feeParams, gridLimits, poolRef, etc. survive editing a bot (modules/account_bots.ts).
• Fix: askPoolRef can clear a pinned pool via none/clear/off/no; blank input still preserves the current value, and 0 remains a valid pool ID (modules/account_bots.ts).
• Tests: poolRef orientation suites for full-pair-reversed and partial-match pins; reversed-proxy expectation corrected to the oriented value (tests/test_pool_ref_price.ts).

2026-08-02

• Fix: fills are now treated as authoritative — the transient isGhost "blocked CREATE" flag and ghost-order preservation (keeping orderId as a size-0 PARTIAL after a sub-dust other-side fill) are removed; such fills become regular full fills (convertToSpreadPlaceholder, orderId cleared) so rotation immediately plans the replacement instead of stalling the COW create pipeline (modules/order/sync_engine.ts, modules/order/utils/order.ts, modules/dexbot_cow_runtime.ts, modules/order/grid_reconcile.ts; removed tests/test_isghost_leak_fix.ts).
• Fix: keep the sell rail anchored to the boundary after a crawl-up — the active window excludes slots outside the boundary geometry, so stray gap-band sells become surplus and reconcile rotates them back onto the rail instead of leaving them parked inside the spread gap (modules/order/strategy.ts, modules/order/grid_reconcile_internal.ts, tests/test_rail_reanchor_fix.ts).
• Fix: wire the previously-dead unmatched-orphan auto-cancel into idle maintenance — runs only when targeted-drift reconcile finds nothing to adopt, cancels only price-drift-orphan orders, honors the pending-broadcast guard and per-cycle cap, unblocking the CREATE pipeline reconcile cannot service (modules/dexbot_maintenance_runtime.ts).
• Fix: suppress spurious fund-invariant CRITICAL during rapid multi-fill batches — new _fillBatchInFlight depth counter defers _verifyFundInvariants past the half-accounted window (fresh refresh vs. still-committed grid orders) and re-anchors account totals after accounting + grid mutation (modules/order/manager.ts, modules/order/accounting.ts, modules/order/sync_engine.ts).
• Fix: stale accountTotals fill gate — fill paths refresh the snapshot once up front and defer (deferred:true, replay-safe re-read next cycle) instead of committing against stale totals; busy wall-clock stays unaccounted only by design (modules/order/manager.ts, modules/order/sync_engine.ts, modules/dexbot_fill_runtime.ts).
• Fix: root-cause reconcile, phantom-cleanup, and stale-accounting guards — removed the per-attempt wall-clock that orphaned mid-batch creates, made phantom cleanup defer freshly-assigned orderIds invisible to a lagging read, and sharpened stale-accounting gates (modules/order/grid.ts, modules/order/grid_reconcile.ts, modules/order/manager.ts).
• Fix: clear scripts now include rotated logs (*.log.1, *.log.2) and dexbot enable/disable output no longer shows legacy PM2 hints (scripts/clear-all.sh, scripts/clear-logs.sh, dexbot.ts, b9ddeced).

[1.4.7] - 2026-07-30 - Fund Accounting Race Hardening, Phantom-Order Startup Fix, Create-Cancel Loop Fix

2026-07-30

• Fix: verification snapshot captures actualBuy/actualSell at snapshot time under _fundLock; passes them to _verifyFundInvariants instead of reading mgr.accountTotals live outside the lock, closing the TOCTOU window between snapshot and verification (modules/order/accounting.ts).
• Fix: adjustTotalBalance now acquires _fundLock internally, protecting mgr.accountTotals mutations from concurrent recalculateFunds reads across all callers; extracted _adjustTotalBalanceLocked sync helper so recordFillBalances (which already holds _fundLock) avoids 2 redundant nested acquires (modules/order/accounting.ts, modules/dexbot_maintenance_runtime.ts).
• Fix: remove sub-minimum remnant orphan check in _computeFillTransitionResult — a fill leaving a sub-minimum remnant cleared the local slot while leaving the chain order alive as an untracked orphan; removal lets the existing ghost path preserve orderId as PARTIAL for proper COW clean-up (modules/order/sync_engine.ts, tests/test_ghost_order_fix.ts).
• Fix: prevent fund inflation on startup phantom-order cleanup — _applyOrderUpdate during reconciliation's phantom sanitization was missing { skipAccounting: true }, causing ACTIVE→VIRTUAL transitions to inflate ChainFree by the phantom order's size each restart (modules/order/grid_reconcile.ts).
• Fix: create-cancel loop in Phase 3 grid reconciliation — Phase 2 now returns a Set<string> of created chain order IDs; batch path captures all IDs before _applySync (Phase A/B split); single-create path propagates ID even when _applySync throws; recovery sync fallback added (modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts).
• Fix: negative free balance ordering — MANUAL-queue balance adjustments before IMMEDIATE flush with rollback on flush failure, enforcing invariant: dedup key persisted ⇔ balance adjustments applied; accountTotalsStale flag triggers fresh chain-balance fetch when _updateOrder fails (modules/order/accounting.ts, modules/order/sync_engine.ts).
• Fix: ghost order detection — explicit isGhost: true flag added; existing size≤0 && state===PARTIAL heuristic retained as fallback (modules/order/sync_engine.ts).
• Chore: declare accountTotalsStale field in manager class to satisfy strict field convention (modules/order/manager.ts).
• Docs: add GRID_RECONCILE.md — 3-phase startup reconciliation design doc covering Phase 1 (pure in-memory under _gridLock), Phase 2 (blockchain I/O outside lock), Phase 3 (stale surplus cleanup), edge cases, lock hierarchy reference, and cross-references to 10+ existing docs (docs/GRID_RECONCILE.md).

[1.4.6] - 2026-07-29 - AsyncLock Nested Re-Entrancy Fix, Grid Type Reassignment

2026-07-30

• Refactor: lock hierarchy correction — swapped _syncLock/_gridLock levels (sync: 2, grid: 3) so both fill and reconcile paths acquire in ascending order; eliminated gridLockAlreadyHeld: true from 8 call sites and syncFromOpenOrders/synchronizeWithChain guards; restructured grid_reconcile.ts Phase 1 to pure in-memory planning under _gridLock with Phase 2 executing all blockchain I/O outside the lock; removed redundant outer _gridLock from Phase 3 surplus cancel loop (design doc).
• Fix: cross-chunk boundary shift cap — deriveTargetBoundary now computes a net shift and caps it at half the active window per _processFillsWithBatching call; a cross-chunk budget prevents cumulative overreaction from burst fills (e.g. 200 accumulated fills after reconnect no longer swing the boundary 200 slots). Budget is set inside the try block and cleaned up in finally to prevent stale-state leaks (modules/dexbot_class.ts, modules/order/utils/order.ts).
• Refactor: extract cross-chunk budget from config._boundaryShiftBudget to manager._boundaryShiftBudget — passed as explicit parameter to deriveTargetBoundary which returns { boundaryIdx, remainingBudget } instead of mutating config. Eliminates the config-as-runtime-state code smell (modules/dexbot_class.ts, modules/order/strategy.ts, modules/order/utils/order.ts).
• Docs: document loadGrid side effects — type reassignment, _gapSlots mutation, phantom order sanitization (modules/order/grid.ts).
• Test: fix stale loadGrid slot type reassignment assertion — slot-3 (ACTIVE on-chain) is now corrected to BUY by position; test expectation updated to match new behavior (tests/test_grid_bloat.ts).

2026-07-29

• Fix: AsyncLock nested re-entrancy — ALS store changed from single symbol to Set<symbol> so outer lock identity is preserved across nested acquisitions; prevents self-deadlock when lockA is held and lockB is acquired inside it (modules/order/async_lock.ts).
• Fix: reassign slot types on grid load — all persisted slots are relabeled to match the current boundary + gapSlots on resume, preventing stale SPREAD/BUY/SELL types from causing ILLEGAL_SPREAD_STATE validation errors (modules/order/grid.ts, modules/order/grid_reconcile.ts, modules/dexbot_startup_runtime.ts).
• Test: add nested multi-lock re-entrancy tests (A-in-B and A→B→C) to force-release test suite (tests/test_async_lock_force_release.ts).
• Fix: replace single-value state fields with refcounts/stack for nesting safety — FileLock rewritten to use AsyncLock (was not re-entrant, deadlocked on nested call); _bootstrapping and _broadcastingFlag changed from boolean to refcount; _currentWorkingGrid changed from single ref to stack (modules/bots_file_lock.ts, modules/order/manager.ts).
• Fix: harden 4 additional state fields — _batchInFlight, _recoverySyncInFlight, _blockchainFetchInFlight, _structuralGridResyncRunning changed from boolean to number refcount; _rebalanceState made stack-aware in _clearWorkingGridRef and _resetRebalanceStateToDepth; unconditional NORMAL resets replaced with depth-aware calls in COW runtime (modules/dexbot_class.ts, modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_state_recovery.ts, modules/order/manager.ts).
• Fix: lock hierarchy ABBA deadlock — syncFromOpenOrders with gridLockAlreadyHeld now skips _syncLock entirely instead of queuing behind a concurrent _syncLock holder while holding _gridLock; _doSyncFromOpenOrders is called directly (in-memory only, no RPC) (modules/order/sync_engine.ts). (Superseded 2026-07-30 by full lock hierarchy correction: levels swapped, flag eliminated.)
• Fix: lock hierarchy documentation — corrected Level 0/1 labeling: _fillProcessingLock is outermost (Level 0), _divergenceLock is Level 1, matching all code paths; updated manager.ts, dexbot_class.ts, sync_engine.ts, developer_guide.md, DEXBOT_COMPARISON.md.
• Test: add ABBA deadlock regression test (RC-1B) using real SyncEngine.syncFromOpenOrders with concurrent _syncLock holder (tests/test_race_condition_fixes_batch1.ts).
• Fix: stale fund snapshot in COW plan — getChainFundsSnapshot() now computes committed amounts directly from the orders map instead of reading funds.committed.chain which went stale inside nested pauseFundRecalc regions, preventing double-counting of virtualized order capital (modules/order/manager.ts).
• Fix: gap slot drift on rebalance — persisted manager._gapSlots from grid creation; all rebalance paths read stored value instead of recalculating from live config, preventing boundary/role mismatches when targetSpreadPercent or gridLimits change mid-cycle (modules/order/grid.ts, modules/order/strategy.ts, modules/order/manager.ts, modules/order/utils/system.ts).
• Fix: phantom order fund inflation — skip capital commitment accounting when auto-correcting phantom orders (ACTIVE/PARTIAL with no orderId → VIRTUAL), preventing addToChainFree from inflating accountTotals with funds never committed on-chain (modules/order/manager.ts).

[1.4.5] - 2026-07-29 - Code-Review Hardening: Lock Safety, Error Handling, Structural Integrity

2026-07-29

• Fix: AsyncLock forceRelease concurrent execution — defer _locked=false via _orphaned flag when a callback is executing; prevent new acquirers from entering while stale callback is still running; lock stays held until stale callback settles (modules/order/async_lock.ts).
• Fix: applyGridUpdateBatch continues after fatal error — break loop on first false from _applyOrderUpdate (ILLEGAL_SPREAD_STATE) to prevent compounding an inconsistent grid (modules/order/grid.ts).
• Fix: persistGrid discards write failure — check persistGridSnapshot return; preserve dirty flag on failure so flushGridDirty does not clear it (modules/order/grid_reconcile_internal.ts).
• Fix: _createOrderFromGrid unsynchronized _applyOrderUpdate — wrap zero-slot transition in _gridLock.acquire() (modules/order/manager.ts).
• Fix: _executeStartupUpdateBatch partial finalization — per-entry try/catch; stop on first finalization failure; remaining entries skipped for next full sync (modules/order/grid_reconcile_internal.ts).
• Fix: _commitWorkingGrid returns true on recalc failure — re-throw recalculateFunds error so callers know commit is incomplete (modules/order/manager.ts).
• Fix: checkSpreadCondition swallows all errors — log at error level instead of warn; track lastFailureAt in recovery state for monitoring; removed magic counter that could crash startup (modules/order/manager.ts).
• Fix: stale lastPrice in TOCTOU re-plan path — refresh lastPrice from current grid state inside re-plan block to prevent stale data from biasing determineOrderSideByFunds (modules/order/manager.ts).
• Fix: remove re-entrancy landmine — removed _gridLock re-acquire from TOCTOU re-plan path (pure computations, no lock needed); added early-return guard for absent lock (modules/order/grid.ts).
• Fix: break circular dependency via inline require — calculateGapSlots uses MathUtils instead of require('../grid'); updateGridFromBlockchainSnapshot passes applyGridDivergenceCorrections as 5th parameter (modules/order/utils/system.ts).
• Fix: uncommitted boundary for slot classification — getSlotCorrectType uses manager.boundaryIdx (committed value) instead of syncBoundaryToFunds speculative result; prevents classification against a boundary never persisted (modules/order/grid.ts).
• Fix: remove dead calculateGeometricSizeForSpreadCorrection — no call sites; updated JSDoc TOC (modules/order/grid.ts).
• Fix: replace stale FIX comments with implemented patterns — lock guard and blockchain-outside-lock pattern already in place (modules/order/grid.ts).
• Test: update test_async_lock_force_release.ts for new forceRelease semantics (tests/test_async_lock_force_release.ts).
• Test: add accountOrders mock to test_grid_dirty_flag_persistence.ts for real persist path coverage (tests/test_grid_dirty_flag_persistence.ts).
• Test: update 4 test files + 4 mock stubs for 5-arg updateGridFromBlockchainSnapshot signature (tests/test_cow_divergence_correction.ts, tests/test_dexbot_maintenance_runtime_dynamic_weights.ts, tests/test_maintenance_runtime_market_adapter_watchdog.ts, tests/test_fallback_cow_types_and_spread_crosser.ts, tests/test_unanchored_spread_correction.ts).

[1.4.4] - 2026-07-29 - COW Invariant Enforcement, Grid Engine Consolidation

2026-07-29

• Fix: remove COW-invariant violating master patching — applyGridDivergenceCorrections now returns { committed, boundaryChanged } instead of patching master directly. Caller schedules setTimeout(0) retry on failed boundary-shift commit, keeping master stale but consistent. Removed _applyFallbackCowTypes and both call sites. prepareSpreadCorrectionOrders uses local bIdx instead of writing manager.boundaryIdx directly. computeSideIdeals reads slot counts from calculatedSnap instead of re-reading manager.orders under lock (modules/order/utils/system.ts, modules/dexbot_maintenance_runtime.ts, modules/order/grid.ts).
• Fix: COW pipeline code review fixes — 7 issues: added _restoreBoundary relaxed setter to eliminate startup [COW] warning noise; JSDoc for lazy cache getters/setters; forensic createCount < totalOps log in uncertain-broadcast handler; comment explaining outOfSpread non-reset in divergence corrections; test fix for grid bloat mock (modules/dexbot_cow_runtime.ts, modules/dexbot_maintenance_runtime.ts, modules/order/manager.ts, modules/order/grid.ts, modules/order/utils/system.ts).
• Refactor: consolidate grid engine — getBtsSide utility replaces 8 identical ternaries; precision functions delegate to unified getPrecision(); computeBtsFeeImpact extracted as shared BTS deficit helper for accounting and sizing paths; getSellStartIdx replaces 4 instances of boundaryIdx + gapSlots + 1; dust thresholds use named GRID_LIMITS constants; exported ESM consistency across 5 modules; removed dead validateIndices/assertIndexConsistency/_repairIndices from manager; extracted assertOrdersStructurallySound for tests (modules/order/accounting.ts, modules/order/grid.ts, modules/order/grid_reconcile.ts, modules/order/manager.ts, modules/order/utils/math.ts, modules/order/utils/order.ts, modules/order/utils/validate.ts, modules/order/strategy.ts, modules/order/sync_engine.ts).
• Test: replace testFallbackCowTypes with testFailedCommitSignalsRetry — asserts master NOT patched and correct return signal instead of post-patch state (tests/test_fallback_cow_types_and_spread_crosser.ts).
• Test: test cleanup — removed stale _repairIndices references from COW mutation detection allowlists and console output in 3 test files; converted test_sync_excess_orphan.ts and test_strategy_reaction_cap_fix.ts from mixed/require to all-ESM (tests/test_cow_index_mutation_detection.ts, tests/test_cow_set_mutation_report.ts, tests/test_cow_static_analysis.ts, tests/test_sync_excess_orphan.ts, tests/test_strategy_reaction_cap_fix.ts).

[1.4.3] - 2026-07-29 - Boundary-Shift Preservation, Tolerance Violation Filter, PoolRef Price Derivation

2026-07-29

• Fix: preserve grid boundary-shift state across failed COW commits — new _applyFallbackCowTypes helper applies slot types + _ordersByType + boundaryIdx to master from the working grid on !executed and catch paths without touching sizes or orderIds. Prevents downstream code (syncBoundaryToFunds in prepareSpreadCorrectionOrders) from seeing stale pre-shift types, which produced wrong clamp bounds and missed spread-correction candidates (modules/order/utils/system.ts).
• Fix: SPREAD→BUY crosser handling — applyGridDivergenceCorrections Phase 2 now filters on-chain orders by working grid type (not master type), so a SPREAD→BUY crosser is correctly attributed to the BUY side instead of appearing as a "hole" that triggers a spurious CREATE. updateGridFromBlockchainSnapshot runs assignGridRoles before _recalculateGridOrderSizesFromBlockchain so the size math sees corrected slot types. _recalculateGridOrderSizesFromBlockchain reads types from the working grid when available, including boundary-crossing slots in the correct side's budget. assignGridRoles passes { assignOnChain: true } so on-chain slots are reassigned during boundary shifts (modules/order/grid.ts, modules/order/utils/system.ts).
• Fix: edge-partial filter in prepareSpreadCorrectionOrders uses getSlotCorrectType(o) === railType instead of o.type === railType, matching the pattern already used by the spread/orphaned candidate pools (modules/order/grid.ts).
• Fix: prevent grid-edge gaps from per-batch abort — tolerance-based violations (price_collision, chain_orphan_collision, same_batch_price_collision) now filter only the violating CREATEs from the action list instead of aborting the entire batch. Hard slot_occupied violations still abort. validateCreateTargetSlots returns violatingTargetIds (Set<string>) for per-CREATE filtering (modules/dexbot_cow_runtime.ts, modules/order/utils/validate.ts).
• Fix: precision-0 tolerance overflow — findPriceCollision and validateCreateTargetSlots same-batch check compute tolerance for both entries' types and take Math.min(tolTarget, tolItem). Prevents asymmetry false positives where MIN_ORDER_SIZE_FACTOR=50 floor produces tolerance exceeding the grid increment (modules/order/utils/math.ts, modules/order/utils/validate.ts).
• Fix: use pool.asset_a/pool.asset_b for balance mapping in withPoolRef — resolves price inversion and wrong-precision bugs when bot assets are ordered differently from the pool's numeric ID ordering (modules/order/utils/withPoolRef.ts, thanks @usefuljohn).
• Feat: add poolRef for pinned pool price derivation — withPoolRef(BitShares, poolRef) returns a PoolPriceOverrides object that fetches the pinned pool directly via get_objects. derivePriceWithPoolRef integrates into the existing derivePrice chain. Interactive editor (askPoolRef) stores full 1.19.X form (modules/order/utils/withPoolRef.ts, modules/account_bots.ts, modules/order/grid.ts, modules/types.ts).
• Feat: extract withTimeout utility — shared withTimeout() in modules/order/utils/timeout.ts replaces inline Promise.race+setTimeout across 7 call sites. Breaks circular dependency (order/logger.ts → system.ts → order.ts → logger.ts → order/logger.ts). No hardcoded timeout values remain at any call site (modules/order/utils/timeout.ts, modules/order/logger.ts, modules/order/manager.ts, modules/launcher/credential_daemon.ts, modules/launcher/market_adapter_runtime.ts, modules/launcher/market_adapter_watchdog.ts, unlock.ts, modules/order/utils/system.ts).
• Chore: update manifest versions to 1.4.3 across all package.json, lockfiles, plugin manifests, docs references (package.json, package-lock.json, claw/package.json, claw/runtimes/openclaw-plugin/*.json, analysis/ama_fitting/package.json, claw/tests/test_claw_mcp_transport.ts, docs/README.md, docs/DEXBOT_COMPARISON.md, docs/FUND_MOVEMENT_AND_ACCOUNTING.md, docs/EVOLUTION.md).
• Test: new test_fallback_cow_types_and_spread_crosser.ts — 2 tests covering fallback type-only commit after failure (boundary, types, indexes, orderIds) and SPREAD→BUY crosser correctly attributed (no spurious CREATE) (tests/test_fallback_cow_types_and_spread_crosser.ts).
• Test: COW-COMMIT-011 — batch with tolerance-violating CREATEs verifies per-CREATE filtering leaves valid actions intact (tests/test_cow_commit_guards.ts).
• Test: test_pool_ref_price.ts — unit tests for withPoolRef and derivePriceWithPoolRef (tests/test_pool_ref_price.ts).
• Test: test_with_timeout.ts — updated import path to ./timeout (tests/test_with_timeout.ts).

[1.4.2] - 2026-07-28 - Spread Correction Direction Bias Removal, Precision-Based Collision Guard, Stale-Node Defense Completion

2026-07-28

• Fix: remove direction bias from spread correction — determineOrderSideByFunds simplified to pure fund-based selection (no longer pins side=SELL when marketPrice < centerPrice, eliminating permanent starvation when the preferred side has no correctable slots). checkSpreadCondition gets a starvation fallback: retries the opposite side when prepareSpreadCorrectionOrders returns zero candidates before aborting. prepareSpreadCorrectionOrders now calls syncBoundaryToFunds under grid lock before computing getSlotCorrectType, preventing stale boundary-based misclassification of SPREAD candidates. Eliminates 5 complexity items — direction switch, hasDirection guard, _lastGridPricingContext read, config.startPrice center fallback, and startup edge case (modules/order/grid.ts).
• Fix: replace hardcoded 1e-8 tolerance with precision-based calculatePriceTolerance in validateCreateTargetSlots same-batch duplicate check — near-miss duplicates within the asset precision window now caught consistently with the rest of the collision-detection pipeline (modules/order/utils/validate.ts).
• Fix: complete stale-node defense rollout — _initializeAssets call sites (grid.ts:543, 670, 997) wrapped in withBlockchainRetry for 30s timeout / 3-retry / node-failover. finishBootstrap() moved into work's own finally block so it only fires when reconciliation completes, not when Promise.race settles. Added _resyncAborted flag checked at 9 await boundaries inside reconciliation work, preventing resetFunds/persistGrid/initializeGrid/reconcileGridOrders from mutating manager state after the caller's error path started recovery. Fixed require() consistency — both per-attempt and final failover paths now use optional chaining on getNodeManager?.() to handle the circular dependency (modules/order/grid.ts, modules/order/utils/system.ts).

[1.4.1] - 2026-07-28 - Bot-Hang Prevention, Blockchain Retry Centralization, CREATE Guard Extension

2026-07-28

• Fix: prevent bot hangs via centralized timeout + node failover — after exhausting 3-attempt retry budget, withBlockchainRetry force-blacklists the stuck node and reconnects to a healthy one. All blockchain ops (fetchAccountTotals, readOpenOrders, syncFromOpenOrders, reconcileGridOrders) get automatic failover. Default _fillProcessingLock acquisition timeout (20s) prevents indefinite waits. recalculateGrid wrapped in 10-minute Promise.race ceiling (modules/order/utils/system.ts, modules/order/manager.ts, modules/order/grid.ts).
• Refactor: centralize withBlockchainRetry into shared utility in system.ts — replaces local copy in grid.ts and inline Promise.race in dexbot_startup_runtime.ts, giving the startup path retries + node failover too (modules/order/utils/system.ts, modules/order/grid.ts, modules/dexbot_startup_runtime.ts).
• Fix: prevent duplicate grid-level CREATEs via 4-layer validator guard — validateCreateTargetSlots extended with slot occupancy, master grid price collision, chain orphan collision, and same-batch duplicate detection. Also hardens checkSpreadCondition against TOCTOU between lock release and broadcast (modules/order/utils/validate.ts, modules/order/grid.ts, modules/dexbot_cow_runtime.ts).
• Fix: prevent false-positive excess cancellation on fresh grid — guard _reconcileStartupSide cancelCount with matchedOnGrid > 0 to avoid destroying legitimate orders when no grid slot yet assigned (GRID_RECONCILE.md). Fix reconcile timeout death spiral by overriding timeout to 300s so Phase 2 batch creates finish in one shot (modules/order/grid.ts, modules/order/grid_reconcile_internal.ts).
• Fix: prevent cross-side spread correction via boundary-correct type filter — hoist boundary computation before both candidate pools and filter typedSpreadCandidates by getSlotCorrectType(o) === railType to prevent activating a SPREAD slot on the wrong rail after fill-induced boundary shifts (modules/order/grid.ts).
• Fix: remove dead PARTIAL filter in recalculateGrid (raw chain limit_order objects never have a state property) and fix withBlockchainRetry logger arg — pass manager.logger directly instead of { logger: manager.logger } (modules/order/grid.ts).
• Fix: cancel stale surplus orders after Phase 2 settles in reconcileGridOrders — new Phase 3 pass re-fetches chain orders and cancels any exceeding per-side target that are not tracked by any grid slot's orderId (GRID_RECONCILE.md). Catches orphan orders whose ID was lost when the grid reinitialized mid-resync.
• Test: new testNoExcessCancelWhenMatchedOnGridIsZero regression test — fresh grid with matchedOnGrid=0, non-zero chainCount+targetCount asserts zero cancel calls (tests/test_grid_reconcile_regressions.ts).
• Test: testPhase3CancelsStaleSurplusUntrackedByGrid — 7 chain sells, target 5, all-VIRTUAL grid with matchedOnGrid=0, verifies Phase 3 cancels exactly 2 untracked surplus and does NOT cancel any tracked order (tests/test_grid_reconcile_regressions.ts).
• Test: 9 scenarios in test_validate_create_target_slots.ts covering all four guard layers, released slots, malformed chain candidates, and no-assets fallback (tests/test_validate_create_target_slots.ts).
• Chore: update manifest versions to 1.4.1 across all package.json, lockfiles, plugin manifests, docs references (package.json, package-lock.json, claw/package.json, claw/runtimes/openclaw-plugin/*.json, analysis/ama_fitting/package.json, claw/tests/test_claw_mcp_transport.ts, docs/README.md, docs/DEXBOT_COMPARISON.md, docs/FUND_MOVEMENT_AND_ACCOUNTING.md, docs/EVOLUTION.md).

[1.4.0] - 2026-07-27 - CJS-to-ESM Migration, Strict Mode Zero-Errors, Daemon-Signing Node Failover

2026-07-27

• Refactor: CJS→ESM + strict-mode fixes in credential daemon, startup runtime, and sync engine — no behavioral changes (credential-daemon.ts, modules/credential_runtime.ts, modules/dexbot_credential_client.ts, modules/dexbot_startup_runtime.ts, modules/order/sync_engine.ts).
• Refactor: complete CJS→ESM migration — all remaining require() calls converted to ESM import across every .ts file (modules/, market_adapter/, claw/, scripts/, analysis/, root files). Automated codemods handled the initial bulk conversion; this pass covers everything missed (modules/**/*.ts, market_adapter/**/*.ts, claw/**/*.ts, scripts/**/*.ts, analysis/**/*.ts, *.ts).
• Refactor: enable strict: true noUnusedLocals and noUnusedParameters in tsconfig — fixed all 213 TS6133/TS6192 unused-declaration errors across ~60 files. Remaining implicit-any annotations resolved with explicit : any type annotations (tsconfig.json).
• Refactor: fix all strict-mode type errors — resolved 1249 remaining TS2339/TS2345/TS2322/TS18047 errors (never-types from empty arrays and null-inferred variables) across 99 files with type annotations and null guards. Build produces zero TypeScript errors at all strict levels (tsconfig.json, 99 source files).
• Chore: update manifest versions to 1.4.0 across all package.json, lockfiles, plugin manifests, docs references (package.json, package-lock.json, claw/package.json, claw/runtimes/openclaw-plugin/*.json, analysis/ama_fitting/package.json, claw/tests/test_claw_mcp_transport.ts, docs/README.md, docs/DEXBOT_COMPARISON.md, docs/FUND_MOVEMENT_AND_ACCOUNTING.md, docs/EVOLUTION.md).
• Fix: claw CJS/ESM compatibility — add module.exports to claw/index.ts, modules/order/async_lock.ts, and modules/order/index.ts so tsx require() resolves the default export correctly; fix require() destructuring in modules/storage/index.ts to extract .default from ESM-wrapped modules (claw/index.ts, modules/order/async_lock.ts, modules/order/index.ts, modules/storage/index.ts).
• Feat: claw BitShares proxy and isConnected() export — add isConnected() query function and a BitShares Proxy on the native chain client with node property routing to getNodes(), enabling claw modules to use the same BitShares.node access pattern as the main codebase (claw/modules/bitshares_client.ts).
• Fix: claw liquidity_pools — deduplicate BitShares import path by routing through client.BitShares instead of a stale top-level destructured import; extract derivePoolPrice and derivePrice as direct exports for external callers (claw/modules/liquidity_pools.ts).
• Fix: claw skill_utils storage import path — corrected from ../../modules/storage.js to ../../modules/storage/index.js to match the ESM module layout (claw/modules/skill_utils.ts).
• Fix: strict-mode err.message access in test and diagnostic files — 75 files changed from err.message to getErrorMessage(err) via the new modules/utils/errors.ts helper (tests/diag_ws_lifecycle.ts, tests/diag_ws_nodes.ts, tests/test_*.ts).
• Fix: complete CJS/ESM dual-export coverage — add module.exports to bitshares-native/index.ts, bitshares-native/crypto/ecc_selector.ts, chain_keys.ts, chain_orders.ts, credit_runtime.ts, dexbot_class.ts, node_manager.ts, order/accounting.ts, order/async_lock.ts, order/index.ts, order/logger_state.ts, order/strategy.ts, order/sync_engine.ts, storage/browser_adapter.ts, storage/node_adapter.ts so tsx require() resolves named/default exports in the same module record as ESM import (modules/bitshares-native/index.ts, modules/bitshares-native/crypto/ecc_selector.ts, modules/chain_keys.ts, modules/chain_orders.ts, modules/credit_runtime.ts, modules/dexbot_class.ts, modules/node_manager.ts, modules/order/accounting.ts, modules/order/async_lock.ts, modules/order/index.ts, modules/order/logger_state.ts, modules/order/strategy.ts, modules/order/sync_engine.ts, modules/storage/browser_adapter.ts, modules/storage/node_adapter.ts).
• Fix: getOrderSize — check order?.size directly with != null to avoid JS default-param reinterpreting undefined as 0, preserving fallback to order?.amount for both missing and NaN size values (modules/order/utils/order.ts).
• Fix: modules/logger.ts — simplify to re-export from order/logger with createPm2AwareLogger helper, drop stale JSDoc (modules/logger.ts).
• Fix: widen Runtime.kill() signal param type from string to string | number — removes the as any cast previously needed for numeric signals. Converts all isAlive callers (bot_supervisor.ts, foreign_cred_daemon.ts, monolithic_runtime.ts) from string '0' to numeric 0 for Node v24 compatibility, matching the already-committed process_discovery.ts fix (modules/runtime.ts, modules/launcher/bot_supervisor.ts, modules/launcher/foreign_cred_daemon.ts, modules/launcher/monolithic_runtime.ts).
• Fix: test_grid_logic.ts — correct pool gridPrice fallback assertion from 1000 to 100 to match the configured startPrice (tests/test_grid_logic.ts).
• Chore: remove 7 dead underscore-prefixed variables across 6 test files — _NODE_MGMT_DEFAULTS, _botsFile, _bootstrapDeliveries, _realSyncFromOpenOrders, _effBuy2, _netAmount, _adopted. These were renamed to suppress noUnusedLocals instead of being deleted (tests/test_settings_merge.ts, tests/test_unlock_control_output.ts, tests/test_websocket_subscription_flow.ts, tests/test_sync_lock_routing.ts, tests/test_trade_profitability_fees.ts, tests/test_sync_logic.ts).
• Fix: strict-mode type hygiene — drop unnecessary : any on storage, Promise<> type params, and botKeyFromName(name: any) → name: string across unlock.ts, pm2.ts, process_discovery.ts, and fs_utils.ts (unlock.ts, pm2.ts, modules/process_discovery.ts, modules/utils/fs_utils.ts).
• Fix: harden catch-block error message extraction — replaced all direct .message access on caught error variables with getErrorMessage(err) across 78 files (runtime modules, market adapter, CLI entry points, launcher, claw modules, scripts, tests). Created reusable scripts/fix-err-message.ts migration tool (78 source files, scripts/fix-err-message.ts).
• Fix: abort phantom-order reset when _applyOrderUpdate receives boolean as options — broken call at grid_reconcile.ts:212-217 passed false, 0 as positional args instead of an options object, causing TypeError that aborted the entire reconcile and produced permanent shortfall warnings (modules/order/grid_reconcile.ts).
• Fix: catch remaining ESM-migration regressions — .catch() handler in manager.ts:725 used err.message instead of getErrorMessage; missing getErrorMessage import in constants.ts onError callback; _buildOutsideInCreateGroups callback changed from Boolean(p?.gridOrder) to p?.gridOrder != null accepting falsy values; additional getErrorMessage hardening across 17 files including bitshares-native/subscriptions.ts (5 spots), chain_orders.ts, dexbot_maintenance_runtime.ts, credential-daemon.ts, bot.ts, dexbot.ts, unlock.ts, and more — including a behavioral bug where err?.message?.includes(...) silently took the wrong recovery path (modules/order/manager.ts, modules/constants.ts, modules/order/grid_reconcile_internal.ts, bitshares-native/subscriptions.ts, bitshares-native/transport.ts, bitshares-native/signing_client.ts, bitshares-native/tx/tx_cache.ts, chain_orders.ts, dexbot_maintenance_runtime.ts, dexbot_credential_client.ts, credential-daemon.ts, bot.ts, dexbot.ts, unlock.ts, market_adapter/ama_signal_runner.ts, market_adapter/lp_chart_runner.ts, claw/modules/bitshares_client.ts, claw/modules/position_manager_watch.ts, scripts/test-credit-renewal.ts, modules/order/utils/system.ts).
• Fix: prevent doubled grid-level order creation at overlapping prices — three safety layers: (1) pre-broadcast price collision guard scanning bot.manager.orders for any ACTIVE/PARTIAL slot within calculatePriceTolerance of target price; (2) late-adoption of discarded CREATEs after uncertain-broadcast window; (3) spread-correction candidate dedup filtering overlapping prices. Also promotes sub-minimum dust as full fill to force rotation (modules/dexbot_cow_runtime.ts, modules/order/grid.ts, modules/order/sync_engine.ts).
• Feat: daemon-signing node failover — executeViaDaemonToken queries getNodeManager() for healthy nodes and injects nodeUrl, fallbackNodes, and onNodeFailed callback into daemon signing options automatically. updateOrder, createOrder, executeBatch accept extraOptions parameter forwarded as escape hatch for per-call overrides. Failover is automatic (modules/chain_orders.ts).
• Feat: remove ghost-order cancellation feature — immediate batch-cancel of "other-side rounds to 0" orphan orders removed across the stack (dexbot_fill_runtime.ts, dexbot_class.ts, sync_engine.ts, types.ts). Ghost-order chain remnants now handled by existing unmatched-orphan auto-cancel backstop (1–5 cancels/cycle) instead of immediate batch cancel. Tests updated (tests/test_ghost_order_fix.ts, tests/test_sync_fill_history_batch.ts).
• Fix: log pair-specific order count in sync start message — the "[SYNC] Starting synchronization from N blockchain orders..." message logged total open order count for the account (from readOpenOrders → get_full_accounts), not the count matching the bot's trading pair. Moved log line after the parseChainOrder() loop, using parsedChainOrders.size so the log reports only orders matching the configured assetA/assetB pair. Log now sits inside mgr._syncLock.acquire(...), so force-released syncs skip the "starting" line entirely (modules/order/sync_engine.ts).
• Fix: remove garbled path suffix in test_ama_slope_model import (ESM migration artifact). Also fix two pre-existing test failures: test_cow_commit_guards.ts — add synchronizeWithChain mock + use distinct create prices to avoid same-batch price collision guard; test_ghost_order_fix.ts — update assertions for P4 sub-minimum dust promotion (remainder below minAbsoluteOrderSize is now VIRTUAL full fill) (tests/test_ama_slope_model.ts, tests/test_cow_commit_guards.ts, tests/test_ghost_order_fix.ts).
• Fix: bootstrap fund-drift false positive — initializeStartupState() called finishBootstrap() in its finally block before grid was loaded into manager.orders; drift check saw gridBuy = 0 vs locked chain balances, always reporting massive BUY-side drift. Fix: removed premature finishBootstrap() — now runs only after grid is fully loaded and reconciled (modules/dexbot_startup_runtime.ts).
• Fix (superseded by fill polling below): subscription health-check cycling — server-side database API session TTL (~120s) silently killed notice stream while WebSocket stayed open; transport keepalive only pings login_api (API ID 1), not database_api (API ID 2). Original fix: call get_dynamic_global_properties() at start of each health-check tick to keep database API session alive. Superseded by active fill polling which does not depend on server-side session state (modules/bitshares-native/subscriptions.ts).
• Refactor: centralize price-collision detection and guard grid-reconcile create paths — moved findPriceCollision into modules/order/utils/math.ts as shared utility; dexbot_cow_runtime.ts and grid.ts import it instead of declaring local copies. Added collision guards to _createOrderFromGrid and _executeStartupCreateGroupBatch in grid_reconcile_internal.ts — rejects create operations when another placed order already exists within tolerance of target price. JSDoc documents that _gridLock MUST be held by caller (modules/order/utils/math.ts, modules/order/grid.ts, modules/dexbot_cow_runtime.ts, modules/order/grid_reconcile_internal.ts).
• Refactor: address review concerns — deduplicate _extractRateFromCollateralMap helper in credit_runtime.ts eliminating 3 nearly-identical rate-extraction blocks; hoist _resolveAsset outside pricing loops so asset resolution runs once per refresh. Export RUNTIME_SETTINGS_KEYS from runtime_settings.ts; dexbot_maintenance_runtime.ts uses getRuntimeSettingsKeys() instead of hardcoded list. Reorder finishBootstrap after fetchAccountTotals in dexbot_startup_runtime.ts so bootstrap drift check uses fresh balances. Add Promise.race timeout for readOpenOrders in grid.ts with proper NodeJS.Timeout | undefined typing. Derive SYNC_LOCK_FORCE_RELEASE_AGE_MS as SYNC_LOCK_TIMEOUT_MS * 2 in constants.ts so user overrides propagate automatically (modules/credit_runtime.ts, modules/runtime_settings.ts, modules/dexbot_maintenance_runtime.ts, modules/dexbot_startup_runtime.ts, modules/order/grid.ts, modules/constants.ts).
• Refactor: replace silent-staleness watchdog + DB-ping keepalive with active fill polling at FILL_POLL_INTERVAL_MS (60s). Bitshares-core analysis confirmed get_dynamic_global_properties() has zero effect on subscriptions (no server-side TTL exists). Removed startSubscriptionKeepalive() and SUBSCRIPTION_SILENT_THRESHOLD_MS-based health check that triggered unnecessary set_subscribe_callback cycles every 2-3 minutes. New startFillPolling() runs processObjects per active subscription every FILL_POLL_INTERVAL_MS, discovering fills via get_account_history within 60s regardless of push notification delivery (modules/bitshares-native/subscriptions.ts, modules/constants.ts).

[1.3.3] - 2026-07-25 - Runtime Extraction, Memory-Leak Hardening, Import Cleanup

2026-07-25

• Feat: extract COW batch execution runtime from dexbot_class.ts into new dexbot_cow_runtime.ts — moves _cowBatchExecute, _executeCowTransaction, _processCowResult, _processCowFailure, _processCowConcurrent, and _cleanupCowTailTrap into dedicated runtime module (modules/dexbot_cow_runtime.ts, modules/dexbot_class.ts).
• Refactor: extract fill queue methods into dexbot_fill_runtime.ts — moves _processFillQueue, _processFillStage, _completeFill, _abortFill, _getFillSyncAccounts, and helpers out of dexbot_class.ts (modules/dexbot_fill_runtime.ts, modules/dexbot_class.ts).
• Refactor: extract state recovery and startup runtime from dexbot_class.ts into new dexbot_state_recovery.ts and dexbot_startup_runtime.ts — isolates _doStateRecovery, _adoptUnmatchedOrders, _rebroadcastPendingOrders, startup lifecycle, and bootstrap guards (modules/dexbot_state_recovery.ts, modules/dexbot_startup_runtime.ts).
• Refactor: drop unused bot params from COW runtime wrappers — removes dead assetA/assetB/marketId/profileName parameters from commitGrid, updateCommitmentSlack, and commitBatch (modules/dexbot_fill_runtime.ts, modules/order/grid.ts).
• Fix: add cwd fallback for profile resolution in paths.ts — when __dirname is undefined (e.g. esm-shim context), fall back to process.cwd() to prevent profile-load failures (modules/paths.ts).
• Fix: remove dead imports and fix mock-breaking destructured imports across modules/ — crypto.js, utils.js, OrderError, system.ts imports removed; State/GridOrderState imports converted to namespace access to preserve test monkey-patching (modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts, modules/order/utils/*.ts, modules/fund_registry.ts, modules/general_settings.ts, modules/launcher/*.ts, modules/chain_keys.ts, modules/credential_policy.ts, modules/key_store.ts, modules/bitshares-native/serial/types.ts, modules/order/*.ts).
• Fix: promote v1.3.0 changelog entry from sub-section to top-level header (CHANGELOG.md).
• Chore: add pretest hook — automatically rebuilds the test fee cache via npm run test:fee-cache before test runner invocation; also reconciles package.json browser field entries and fixes a brittle log message in test_cow_orchestration_fixes.ts (package.json, tests/helpers/fee_cache_init.ts, scripts/verify-browser-bundle.ts).
• Chore: clean up dead import annotations, fix type annotations, and resolve mock regression from mock redefinition across test files (tests/test_cow_commit_guards.ts, tests/test_cow_orchestration_fixes.ts, tests/test_cow_structural_resync.ts, tests/test_grid_persistence_guard.ts, tests/test_uncertain_broadcast.ts, tests/test_patch17_invariants.ts).
• Docs: EVOLUTION.md stats refresh (Phase 6 cleanup, 1,857→1,857 commits, 200+→224 tests, 74→75 releases, ~54k→~67.6k LoC), module file listings per directory, doc cross-links updated (docs/EVOLUTION.md, docs/README.md, docs/GRID_RECALCULATION.md, docs/DEXBOT_COMPARISON.md, tests/README.md, modules/README.md, market_adapter/README.md, docs/developer_guide.md).
• Fix: credential daemon memory-leak hardening — store nodeRefreshIntervalTimer and auditPruneIntervalTimer as module-level vars (cleared in shutdown()), add daemonShuttingDown early-return in processRequest() to avoid misleading errors after secrets are zeroed, socket idle timeout (30s) and 1MB buffer cap to prevent idle connection accumulation and OOM, convert audit log queue from chained-Promise serial to parallel drain via process.nextTick, prune stale signing clients on every broadcast, add CREDENTIAL_DAEMON_SOCKET_TIMEOUT_MS and CREDENTIAL_DAEMON_MAX_BUFFER_SIZE constants (credential-daemon.ts, modules/constants.ts).

[1.3.2] - 2026-07-24 - Dust Health Check, Lightweight Sync Fixes, Doc Updates

2026-07-24

• Feat: startup dust health check — run a single dust health check immediately at startup (not only after the 5-minute delay). Extracted cycle body into _runDustHealthCheck() for reuse between startup call and periodic timer (modules/dexbot_class.ts).
• Fix: remove early return in lightweight sync that skipped RMS divergence resync — if (!assets) { ... return; } exited executeMaintenanceLogic entirely, preventing the RMS divergence code from ever executing. Replaced with if/else so execution always falls through (modules/dexbot_maintenance_runtime.ts).
• Fix: lightweight sync pair-filter — counted ALL open orders on account via readOpenOrders().length, causing false-positive "chain=107 grid=40 (diff=67)" warnings when other pairs had orders. Filter chain count through parseChainOrder() to match only the bot's assetA/assetB (modules/dexbot_maintenance_runtime.ts).
• Fix: dust-handling improvements — lock-safe cancel (acquires _fillProcessingLock with 5s timeout, fallback to lock-less cancel if busy), deferred dust logging (logs when pipeline is non-empty), no-budget robustness (computes idealSizes = [] instead of early-return on budget <= 0) (modules/dexbot_class.ts, modules/dexbot_maintenance_runtime.ts, modules/order/grid.ts).
• Fix: correct dexbot stat suggestion in unlock.ts messages — both console messages suggested dexbot unlock stat but the shorter dexbot stat works identically (unlock.ts).
• Docs: align README installation options and fix wording consistency — Option B comment "works everywhere", add missing Option C (local wrappers) to Installation section (README.md).
• Docs: document capital allocation pipeline (funds.allocated vs chainFree) — new Allocated row in Fund Components table, new Capital Allocation Pipeline section with pipeline diagram, renumber subsections, update Global Side Capping reference (docs/FUND_MOVEMENT_AND_ACCOUNTING.md).
• Test: new test_lightweight_sync_chain_filter.ts validates parseChainOrder correctly filters matching orders and classifies SELL/BUY types (tests/test_lightweight_sync_chain_filter.ts).
• Test: new testNoBudgetReturnsEmptyDust in test_dust_rebalance_logic.ts pins the no-budget branch (tests/test_dust_rebalance_logic.ts).

[1.3.1] - 2026-07-24 - CLI Canonical Naming, Browser Exclusion Completeness, Doc Polish

2026-07-24

• Feat: add repo-root symlinks dexbot→scripts/dexbot, pm2→scripts/pm2, unlock→scripts/unlock so ./dexbot, ./pm2, ./unlock work immediately after npm install with no global install. Wrappers try compiled dist/ first, fall back to tsx/cjs for source.
• Fix: rename canonical CLI commands keys/bots → key/bot in dexbot.ts registry. Plural forms continue to work via alias map. Updated all switch cases, JSDoc, and user-facing strings (dexbot.ts, bot.ts, pm2.ts, modules/account_bots.ts, modules/bot_settings.ts, scripts/README.md, scripts/reset-settings.sh, scripts/postinstall.js, docs/GRID_RECALCULATION.md, docs/WORKFLOW.md, AGENTS.md, README.md).
• Fix: add missing browser exclusion entries for modules/logger.js and modules/paths.js to package.json browser false map (regression from 1.3.0 guard removal). Two entries: ./dist/modules/logger.js and ./dist/modules/paths.js.
• Fix: add missing browser exclusion for modules/order/utils/system.js — transitively imports ../../logger and ../../paths (both browser-false, resolve to {} stub) and instantiates new Logger('System') at module load time (package.json, AGENTS.md).
• Fix: add missing npm link to install-from-source command in Option B of README Quick Start (README.md).
• Docs: de-duplicate Quick Start setup commands, drop redundant 'bare' from git clone instructions (README.md, AGENTS.md, CHANGELOG.md).

[1.3.0] - 2026-07-23 - CLI Migration Completion, Market Adapter Cleanup, Doc Refresh

2026-07-23

• Feat: version bump 1.2.7 → 1.3.0 across all manifests (package.json, package-lock.json, analysis/ama_fitting/package.json, claw/package.json, claw/runtimes/openclaw-plugin/*.json, claw/tests/test_claw_mcp_transport.ts, docs/DEXBOT_COMPARISON.md, docs/EVOLUTION.md, docs/MPA_CREDIT_USAGE.md, docs/FUND_MOVEMENT_AND_ACCOUNTING.md, docs/WORKFLOW.md, docs/README.md, docs/architecture.md).
• Fix: migrate all remaining node unlock/node pm2 user-facing references to dexbot unlock/dexbot pm2 across 22 source files — error messages, help text, doc comments, success banners, runtime command strings, ecosystem regeneration comments, and test assertions. Includes repo-root alternative notes (./pm2/./unlock) preserved in CLI entry points (pm2.ts, unlock.ts, dexbot.ts, credential-daemon.ts, scripts/update.ts, modules/dexbot_class.ts, modules/launcher/*.ts, modules/constants.ts, claw/modules/claw_launcher.ts, 4 test files).
• Fix: correct all repo-root alternative notes from node unlock/node pm2 (which don't work — no .js at root) to ./unlock/./pm2. Affected unlock.ts, pm2.ts (×2), dexbot.ts, docs/docker.md, README.md.
• Fix: replace fragile CLI strings in claw/modules/claw_launcher.ts command: fields (dexbot unlock <name>, dexbot pm2 claw-only, etc.) with CLI-agnostic mode labels ('unlock', 'pm2 (claw-only)', 'test', 'drystart').
• Fix: remove browser-safe typeof __filename guard in market_adapter.ts — always available at runtime, no browser path (market_adapter/market_adapter.ts).
• Fix: update claw/package.json test script from compiled .js paths to npx tsx for .ts source files (all 16 test targets). Tests now run on source directly rather than compiled dist/ output.
• Fix: remove stale dexbot ignore rule from .gitignore (no longer needed with intentional symlinks).
• Docs: update 17 documentation files — README.md, docs/, claw/docs/, claw/skills/, claw/README.md, analysis/README.md — with CLI invocation fixes, dexbot unlock/dexbot pm2 as primary commands, repo-root alternative notes, version references updated to 1.3.0, position-health zone model correction (5-zone → 3-zone), green zone CR range fix (2.0 → 1.7–3.0), trend detector source correction, tradingview path correction, and module path clarifications.
• Docs: restructure README.md Quick Start into 3 self-contained copy-paste paths (global install, clone+npm link, clone+local wrappers). Add npm link/npx guidance to scripts/postinstall.js for local installs.
• Docs: update scripts/README.md entry-point table to show ./dexbot/./unlock/./pm2.
• Docs: add JSDoc blocks to _resolveMpaFeedPrice and _resolveCreditConversionRate in modules/credit_runtime.ts. Refresh inline doc-comment exports listings in modules/account_bots.ts, modules/chain_orders.ts, modules/bitshares_client.ts, modules/chain_keys.ts, modules/account_orders.ts, modules/order/format.ts, modules/order/utils/order.ts. Fix stale comment in analysis/analyze_kalman.ts. Fix comment paths in market_adapter/inputs/fetch_lp_data.ts, market_adapter/lp_chart_runner.ts, claw/modules/position_discovery.ts.
• Chore: classify market_adapter/market_adapter.ts as Node-only in AGENTS.md and package.json "browser": false map (uses __filename, path, file-system paths — never browser-safe). Remove unused ORDER_STATES.FILLED constant from modules/constants.ts.

[1.2.7] - 2026-07-23 - CLI Invocation Fix, ALS Re-Entrancy Test Fix

2026-07-23

• Fix: correct two AsyncLock tests for ALS-based re-entrant detection — Test 4 in test_async_lock_force_release.ts now calls nested acquire() from inside the lock's callback (same ALS context) and verifies concurrent callers queue; F6-T3 in test_contention_and_dedup.ts now expects contention detection from a different async context (tests/test_async_lock_force_release.ts, tests/test_contention_and_dedup.ts).
• Docs: replace node dexbot with dexbot across all user-facing documentation and help text — the node dexbot pattern does not work for globally installed npm packages since Node resolves arguments as file paths, not PATH binaries. Updated README.md, docs/WORKFLOW.md, docs/GRID_RECALCULATION.md, market_adapter/README.md, scripts/README.md, scripts/reset-settings.sh, dexbot.ts, claw/modules/claw_launcher.ts, claw/modules/launcher_mode_detector.ts.
• Docs: clarify npm i -g dexbot (was npm i dexbot) as required for global install; add note about repo-root users using ./scripts/dexbot instead (README.md).

[1.2.6] - 2026-07-23 - Batch Fill Sync, Crash-Durable Dedup, Ghost Batch Cancel, Config Overrides

2026-07-23

• Feat: batch fill history sync (syncFromFillHistoryBatch) — processes multiple fill-history events acquiring _gridLock once, batches drift refetch into single get_objects RPC via batchReadOrders, acquires all order locks once up-front, pauses fund recalc once. Replaces per-fill loop in dexbot_class.ts for 2+ fills in a block (modules/order/sync_engine.ts, modules/chain_orders.ts).
• Feat: crash-durable fill dedup window — persists recently-queued fill keys alongside master grid snapshot via new _getRecentFillKeysSnapshot(), restores at startup into _recentlyQueuedFills, merges with previous snapshot to avoid eviction loss between persist cycles (modules/account_orders.ts, modules/order/utils/system.ts, modules/order/manager.ts).
• Feat: ghost order batch cancellation — builds all cancel ops with Promise.allSettled for per-ID error tolerance, executes in chunks of MAX_OPS_PER_TX, marks successfully cancelled IDs per-chunk to avoid redundant re-attempts, falls back to individual cancelOrder on batch failure (modules/order/sync_engine.ts).
• Feat: grid lock contention telemetry — AsyncLock onContention callback fires on queue build-up and in _processQueue after callback completion, replaces removed invariantViolations metric (modules/order/manager.ts).
• Feat: fund sizing from allocated balances — _getSizingContext, calculateAvailableFundsValue, getSideBudget prefer funds.allocated.{buy,sell} over accountTotals.{buyFree,sellFree} (modules/order/grid.ts, modules/order/utils/math.ts, modules/order/utils/order.ts).
• Feat: runtime-config overrides — resolveBotRuntimeSettings includes fillProcessing, pipelineTiming, apiLimits with full override cascade (globals/market/pair/bot); PIPELINE_TIMING and FILL_PROCESSING lookups go through config with fallback to constants; new TS interfaces (BotFillProcessingOverrides, BotPipelineTimingOverrides, BotApiLimitsOverrides) (modules/dexbot_fill_runtime.ts).
• Fix: deduplicate syncFromFillHistory vs syncFromFillHistoryBatch — extracted three shared helpers (_findMatchingGridOrder, _computeFillContext, _computeFillTransitionResult) eliminating ~300 lines of nearly-identical drift-detection, ghost-detection, and state-transition logic (modules/order/sync_engine.ts).
• Fix: _logThrottled unbounded suppressed counter — capped at 1M to prevent pathological overflow; removed throwaway object on cache miss; removed redundant Map.set() on suppression path; removed dead lastMessage field (modules/order/accounting.ts).
• Fix: route all _recoveryState writes through setter — replaced x._recoveryState = x._recoveryState || {}; x._recoveryState.Y = Z and direct field mutations with x._recoveryState = { ...x._recoveryState, Y: Z } across 13 sites (modules/dexbot_class.ts, dexbot_maintenance_runtime.ts, modules/order/accounting.ts, modules/order/manager.ts).
• Fix: _illegalStateSignal direct write routed through _lastIllegalState setter (modules/order/manager.ts:926).
• Fix: stale-entry pruning in _lastBlacklistWarnMs when Map exceeds 64 entries (modules/node_manager.ts:388).
• Fix: removed StrategyEngine fee-event dedup subsystem (_settledFeeEvents map, _pruneSettledFeeEvents, _buildFeeEventId) — dedup now handled by manager.processedFillTracker upstream (modules/order/strategy.ts).
• Fix: removed hasEquivalentRawOnChainOrder (unused), _getDriftToleranceMultiplier (inlined), _rollbackBalanceAdjustments (dead code), totalOnly param from adjustTotalBalance (modules/order/sync_engine.ts, modules/order/manager.ts, modules/order/accounting.ts).
• Fix: consolidated _shutdownStarted → _shuttingDown (single guard flag) (modules/dexbot_class.ts).
• Chore: hoist dynamic require('../chain_orders') calls — replaced 3 lazy requires inside method bodies with single top-level const, uses module namespace object (not destructuring) so test monkey-patching continues to work (modules/order/sync_engine.ts).
• Chore: add _recentFillKeysSnapshot type — any → Record<string, number> | null (modules/order/manager.ts:272).
• Chore: update TABLE OF CONTENTS in sync_engine.ts to list syncFromFillHistoryBatch as method #6.
• Test: new test_contention_and_dedup.ts — AsyncLock contention callback, crash-durable fill key snapshot/restore.
• Test: new test_sync_fill_history_batch.ts — 9 coverage cases for batch sync.
• Test: chunk-boundary tests (F8-T1: 201 IDs → 2 batches, F8-T2: 200 IDs → single batch, F8-T3: empty → 0 batches).
• Test: updated test_accounting_logic.ts for inlined tracker access.
• Test: updated assertion for requiresOpenOrdersSync behavior.
• Fix: refresh dynamic weight distribution before all fill-rebalance paths — added _refreshDynamicWeightDistribution calls to three sites that previously relied on periodic refresh alone: _consumeFillQueue (live fill subscription), post-reconnect safety-net sync, and _syncOpenOrdersAndProcessFills. Weights can become stale between periodic refresh cycles, causing rebalances to use outdated weight distributions (modules/dexbot_class.ts).
• Fix: periodic blockchain fetch now refreshes dynamic weight distribution before processing fills — added refreshDynamicWeightDistribution call inside the fill-processing lock in setupBlockchainFetchInterval (modules/dexbot_maintenance_runtime.ts).
• Test: fix test_periodic_sync_fill_rebalance.ts — the test mock of syncMarketAdapterOnPeriodicConfigCheck via module-export assignment had no effect on the internal closure reference in the same file; added weight refresh before fill processing makes the flow consistent.
• Test: fix test_market_adapter_service.ts — three restart-backfill AMA3 test cases used oldRawCount = 1836, but the v1.1.3 AMA refit reduced warmup bars from 1927 to 1758, making missingCount negative. Updated oldRawCount to 1700 (tests/test_market_adapter_service.ts).
• Docs: fix stale numbers in EVOLUTION.md (commit count 1,743 → 1,827, LoC ~58,000 → ~54,000, release entries 62 → 70).

[1.2.5] - 2026-07-22 - Redundant Open-Orders Sync Fix, Supervisor Updater Override, Base58 Deduplication, KeyStore Cleanup

2026-07-22

• Fix: redundant open-orders sync in _processFillsCore — fillsWithoutBlock could set requiresOpenOrdersSync=true and run an inline sync, but the fallback guard at line 2112 triggered a second identical sync. Now sets anyRequiresSync=true after processValidFills(fillsWithoutBlock) when the flag is active (modules/dexbot_class.ts).
• Fix: supervisor updater override — added updaterActive option to createBotSupervisor so callers can enable the updater job without mutating the frozen UPDATER constant. Threaded through buildSupervisedApps (modules/launcher/bot_supervisor.ts).
• Fix: waitForStableStartup event-loop hang — removed .unref() from poll timer so it keeps the event loop alive when all other handles close (modules/launcher/bot_supervisor.ts).
• Fix: unref credit/dust intervals — .unref() on _creditWatchdogInterval and _dustHealthCheckTimer so they don't prevent clean event-loop exit, matching existing _credentialDaemonWatchdogInterval pattern (modules/dexbot_class.ts).
• Fix: deduplicate inline base58 encode/decode — delegate ecc.ts and ecc.browser.ts to shared modules/utils/base58check.ts; export base58Encode/base58Decode for shared use (modules/bitshares-native/crypto/ecc.ts, ecc.browser.ts, modules/utils/base58check.ts).
• Fix: remove pure-delegation pass-through methods from KeyStore interface and both implementations — callers already use chainKeys directly (modules/key_store.ts).
• Fix: set resolvedBotName to null when clawOnly is true — no bot to resolve in claw-only mode (modules/launcher/launch_modes.ts).
• Chore: import roundToDecimals from order/utils/math directly instead of re-export shim in cr_planner.ts and credit_runtime.ts.
• Test: align 9 test files with recent production changes and fix pre-existing hanging-test failures (tests/test_browser_abstractions.ts, test_dexbot_maintenance_runtime_dynamic_weights.ts, test_dexbot_start_master_password_failure_output.ts, test_dexbot_startup_dynamic_weight_wiring.ts, test_dust_cancel_delay_config_migration.ts, test_fill_batch_chunking.ts, test_grid_reconcile_regressions.ts, test_launcher_exports.ts, test_main_loop_sync_fill_rebalance.ts).

[1.2.4] - 2026-07-21 - Credential Daemon Memory - Signing Client Cache, Dispose(), Session Purge, Shallow Policy Copy

2026-07-21

• Fix: credential daemon memory — replace JSON.parse(JSON.stringify(BUILTIN_DEFAULT_POLICY)) with shallow spread copy in credential_policy.ts:667, avoiding 50k+ deep-copy allocations daily (credential_policy.ts).
• Fix: simplify queueAuditLogWork — remove redundant promise wrapper + microtask per audit entry (credential-daemon.ts:214-216).
• Fix: hoist wifToBuffer to module scope with _disposed guard flag on SigningClient — dispose() now actually zeros WIF bytes; newTx()/broadcast() throw after dispose (signing_client.ts).
• Feat: add signingClientCache in credential daemon — keyed by accountName:keyFingerprint(wif), 30-min TTL pruning, cache-aware broadcastWithRetry skips client creation on hit, detects key rotation via fingerprint (credential-daemon.ts).
• Feat: session lifecycle — setInterval(purgeExpiredSessions, 300000) replaces inline purge; sessionPurgeInterval cleared in shutdown (credential-daemon.ts).
• Feat: shutdown iterates signing client cache, disposes every entry, clears map (credential-daemon.ts:1126-1131).
• Fix: reconnect path disposes all cache entries before clear for heap-dump safety (credential-daemon.ts).

[1.2.3] - 2026-07-21 - Uncertain-Broadcast Grid Corruption Fix, Unmatched-Order Adoption, Grid-Bloat Loop Fix

2026-07-21

• Fix: prevent grid corruption from uncertain broadcasts — discarded CREATEs in _reconcileAfterUncertainBroadcast left virtual slots stuck at size=0 (no follow-up rebalance). Now restores target size on virtual slots with no orderId (modules/dexbot_class.ts).
• Fix: unmatched chain orders no longer auto-cancelled — old guard destroyed legitimate on-chain positions to unblock CREATE batches. Replaced with syncFromOpenOrders adoption + unconditional structural resync. Preserves positions and prevents permanent gaps (modules/dexbot_class.ts).
• Fix: _lastUnmatchedChainOrders only overwritten when sync actually processed orders (>0 filled+updated+corrected). Prevents dropping stale entries on force-release or lock-contention early exits (modules/dexbot_class.ts).
• Fix: isGridBloated formula false-flagged full-rail grids (many virtual slots outside active window). Changed from placedCount + gapSlots + 1 to estimatedRailSize + gapSlots + MIN_SPREAD_ORDERS. Prevents infinite bloat-resync loop (modules/order/grid.ts).
• Fix: loadGrid reassigns stale SPREAD/BUY/SELL types on virtual slots from old boundary positions — types are corrected on every grid load (modules/order/grid.ts).
• Fix: _recoverFromPersistedGrid returns { success: false } when grid still bloated after reload, so requestStructuralGridResync falls through to full requestGridReset (modules/dexbot_class.ts).
• Fix: empty-side spread correction never fired — shouldFlagOutOfSpread returned 0 when either side had zero on-chain orders. Now returns nominal gap slot count so correction activates a SPREAD slot (modules/order/utils/order.ts).
• Fix: boundary-at-rail-edge triggers structural resync — when boundary crawl clamps to 0 or allSlots.length-1, fill pressure could wipe out a side. checkSpreadCondition now triggers requestStructuralGridResync when one side is empty and boundary leaves <2 slots (modules/order/grid.ts).
• Fix: TOCTOU silent abort in spread correction — when funds changed between lock release and broadcast, correction silently aborted indefinitely. Now re-plans with fresh funds instead (modules/order/grid.ts).
• Fix: budget dilution from virtual slots in calculateGeometricSizeForSpreadCorrection — counted all orders including hundreds of virtual slots, diluting correction size to dust. Now counts only on-chain (ACTIVE+PARTIAL) orders (modules/order/grid.ts).
• Fix: adjustBudgetForBtsFees regression — c3c0fcdc refactor clamped non-BTS budget to 0 when sideFree=0 (all capital committed). Restored deduction against allocated, matching original semantic (modules/order/utils/order.ts).
• Fix: pending-broadcasts path extracted to a clean separate block in COW guard — no behavioral change, improves readability (modules/dexbot_class.ts).
• Fix: unmatched order sample logged for operator visibility — top 3 unmatched entries included in COW CREATE rejection log (modules/dexbot_class.ts).
• Fix: _recoverFromPersistedGrid rejects when unmatched chain orders remain after sync — prevents stale persisted grid from being accepted when it produces inconsistent state (modules/dexbot_class.ts).
• Fix: _autoCancelOneUnmatchedOrphan narrowed to only cancel price-drift-orphan entries — all other unmatched types (duplicate-price-level, already-matched-slot, etc.) are adoptable positions preserved for structural resync (modules/dexbot_class.ts).
• Fix: structural resync safeguard after skipAccounting restore in uncertain broadcast — schedules resync when discarded CREATEs were restored, ensuring fund accounting is recalculated (modules/dexbot_class.ts).
• Fix: performGridResync explicitly clears _lastUnmatchedChainOrders after successful rebuild — prevents COW guard from holding stale unmatched entries from before resync (modules/dexbot_maintenance_runtime.ts).
• Fix: improved logging when sync returns without processing in COW guard — distinguishes lock contention (debug) from stale unmatched entries (warn); updates _lastUnmatchedChainOrders when sync result has different unmatched count (modules/dexbot_class.ts).
• Test: test_grid_logic.ts — fixed FreshinitializeGrid typo (5 sites), updated shouldFlagOutOfSpread empty-side assertion from 0 to 4 (tests/test_grid_logic.ts).
• Test: test_spread_redistribution_fallback.ts — fixed by adjustBudgetForBtsFees regression fix above (tests/test_spread_redistribution_fallback.ts).
• Test: test_cow_structural_resync.ts — updated "auto-cancel succeeds" to test adoption path (cancel not called, batch rejected, resync requested) (tests/test_cow_structural_resync.ts).
• Test: test_uncertain_broadcast.ts — updated 3 existing tests to use price-drift-orphan reason; added 2 new tests: testAutoCancelOnlyPriceDriftOrphans and testRecoverFromPersistedGridUnmatchedRemain (tests/test_uncertain_broadcast.ts).
• Test: test_grid_bloat.ts — full-rail 290-slot "not bloated" case, loadGrid stale-virtual-slot type reassignment test (tests/test_grid_bloat.ts).

[1.2.2] - 2026-07-21 - Invariant Sabotage Prevention, Regression Hardening, Code-Review Cleanup

2026-07-21

• Fix: prevent 3 invariant sabotage vectors in filled-order handling — (1) ghost-order virtualization defeats duplicate-CREATE guard: skip slots with size===0 in processFillsOnly; (2) two-pass sync releases committed capital without fill proceeds: hardcode skipAccounting=true in pass-2; (3) fee-deduction failure silently over-credits accountTotals: escalate fee-fallback log from warn to error with explicit "fund tracking will over-credit" language. Also fix TOCTOU where processFillAccounting runs before order lock, and add isMaker default observability warning (modules/order/accounting.ts, modules/order/strategy.ts, modules/order/sync_engine.ts).
• Fix: harden 3 regression vectors from accounting/lock/maker-default fixes — (1) skipAccounting variable leak in sync-engine pass-2: hardcode true instead of passing local variable; (2) TOCTOU in POST-RESET and BOOTSTRAP tracked-fill paths: wrap processFillAccounting calls in per-order lock acquire/release with try/finally; (3) is_maker silent default observability: add _warn in orphan-fill fallback key builder, fix log label consistency (modules/dexbot_class.ts, modules/dexbot_fill_runtime.ts, modules/order/sync_engine.ts).
• Fix: orphan-fill tolerance widening disconnected — _orphanFillsCreditedAt declared on DEXBot but read from OrderManager; moved field + init to OrderManager, removed orphaned declaration/init from DEXBot (modules/order/manager.ts, modules/dexbot_class.ts).
• Fix: requiresOpenOrdersSync flag lost for filtered-out fills — per-block-group reset overwrote the flag before filtered fills entered any block; captured pre-loop as initialRequiresSync, preserved post-loop, added fallback sync pass (modules/dexbot_class.ts).
• Fix: remove dead code and misleading comment in fill-processing fallback block — requiresOpenOrdersSync = false reset was unused after fallback sync; replaced with accurate scope-exit comment (modules/dexbot_class.ts).
• Fix: correct arithmetic comment in orphan-fill death spiral test — // receives.amount=500000 at precision 5 → 5.0 (tests/test_orphan_fill_death_spiral.ts).
• Fix: remove stale (mgr as any) casts on _orphanFillsCreditedAt — both mgr and bot.manager are already typed any; casts were redundant noise (modules/order/accounting.ts, tests/test_orphan_fill_death_spiral.ts).
• Fix: remove stale package.json browser entry for ./dist/modules/order/runner.js — source file deleted, build artifact no longer produced (package.json).
• Chore: delete modules/cli_whitelist_args.ts + tests/test_cli_whitelist_args.ts (unused CLI arg builder).
• Chore: delete modules/order/runner.ts (moved to scripts/runner.ts as standalone CLI grid calc debugger).
• Chore: remove lazy-loaded runOrderManagerCalculation re-export from modules/order/index.ts.
• Refactor: move roundTo, fixedTo, roundToDecimals from modules/utils/math_utils.ts to modules/order/utils/math.ts with re-export shim.
• Docs: update docs/COW_INVARIANTS.md, docs/developer_guide.md, docs/FUND_MOVEMENT_AND_ACCOUNTING.md for AsyncLock re-entrancy — removed fillLockAlreadyHeld parameter references.
• Test: add tests/test_orphan_fill_death_spiral.ts — regression coverage for orphan-fill tolerance widening and missing-history-ID fill handling.

[1.2.1] - 2026-07-20 - Code-Review Fixes, Stale-Totals Safety, Correction Reliability, StateManager Inline

2026-07-20

• Fix: only shift boundary for adopted CREATEs in uncertain broadcast recovery — previously all planned CREATEs (including discarded ones) shifted the grid boundary, causing phantom order positions on next cycle (modules/dexbot_class.ts, tests/).
• Fix: stale accountTotals no longer HARD-ABORTs COW commit — transient staleness logs WARN and schedules recovery instead of throwing ACCOUNTING_COMMITMENT_FAILED. Also refresh totals after bootstrap to prevent unnecessary full recovery on first maintenance cycle (modules/order/accounting.ts, modules/dexbot_class.ts).
• Fix: credential daemon memory leak — socket.end() after final write; socket.destroy() on close/error to prevent socket half-close accumulation (210MB RSS growth over 7d). Also switch credential policy's assetRefResolutionCache from unbounded Map to LRUCache (credential-daemon.ts, modules/credential_policy.ts).
• Fix: order correction reliability — deduplicate orphan cancels by filtering _lastUnmatchedChainOrders after successful cancel; retain entries in ordersNeedingPriceCorrection on transient errors (don't drop from retry queue); skip redundant sequential fallback when recovery already resolved all pending updates (modules/order/sync_engine.ts, modules/order/utils/order.ts, modules/order/grid_reconcile.ts).
• Test: add regression coverage for stale accounting and orderGone dedup paths.
• Refactor: inline StateManager class into OrderManager — removes ~220 lines of wrapper delegation. State fields become direct OrderManager fields; public methods (isBootstrapping, isBroadcastingActive, etc.) move directly onto the manager. Backward-compat getter/setter pairs retained for _recoveryState, _gridRegenState, _lastIllegalState, _lastAccountingFailure (modules/order/manager.ts).
• Refactor: merge SyncResult and FillHistoryResult into a single SyncResult type with optional fields. Rename StateManagerState → ManagerStateSnapshot in types. Update JSDoc references (modules/types.ts, modules/order/sync_engine.ts).
• Fix: pauseRecalcLogging timer leak on nested calls — now clears the old watchdog before setting a new one (modules/order/manager.ts).
• Fix: force-released sync mutations no longer persist orphaned entries in ordersNeedingPriceCorrection — snapshot queue length before sync, truncate on generation-mismatch discard (modules/order/sync_engine.ts).
• Fix: false-positive recovery after stale-totals COW commit — refresh accountTotals before recalculateFunds() when the last accounting failure was 'stale' (modules/order/manager.ts).
• Fix: isPlanningActive() side-effect widened — extracted auto-clear to _clearStaleBroadcastFlag() called once per maintenance tick; isBroadcastingActive() is now a pure getter with no side-effects (modules/order/manager.ts, modules/dexbot_maintenance_runtime.ts).
• Fix: remove dead argument to _markGridDirty at boundary adjustment site (modules/dexbot_class.ts).

[1.2.0] - 2026-07-19 - Credit-Only Mode, Boundary Shift Recovery, Order System Hardening

2026-07-19

• Feat: add creditOnly: true bot flag — skips all grid trading infrastructure (validation, orders, fills, sync) and runs only the credit runtime for MPA position management and credit offer maintenance (modules/constants.ts, modules/bot_settings.ts, modules/dexbot_class.ts, modules/launcher/launch_modes.ts, unlock.ts).
• Feat: node unlock credit — auto-discovers the first active credit-only bot, skips monolithic background daemon (unlock.ts).
• Feat: add LRU fee cache to get_required_fees calls — tx/tx_cache.ts with configurable TTL (default 24h, env TX_BUILDER_FEE_CACHE_TTL_MS); builder.ts:setRequiredFees checks cache before RPC, stores on success; signing_client.ts invalidates on broadcast errors matching /fee/i (modules/bitshares-native/tx/tx_cache.ts, modules/bitshares-native/tx/builder.ts, modules/bitshares-native/signing_client.ts).
• Feat: extract LRUCache from resolvers.ts to own module lru_cache.ts (modules/bitshares-native/lru_cache.ts, modules/bitshares-native/resolvers.ts).
• Fix: recover lost boundary shift after uncertain broadcast discard — when COW broadcast fails with BROADCAST_DEADLINE, the recovery discards unconfirmed CREATEs but never applies the boundary shift the fill cycle's COW plan would have committed. Now calculates net boundary shift from all planned CREATEs and applies it directly (modules/dexbot_class.ts:3199-3244).
• Fix: effectiveBotName used in MONOLITHIC_BOT_INFO_FILE instead of raw botName (unlock.ts:630).
• Fix: restore missing v1.1.13 header in CHANGELOG.md (CHANGELOG.md).
• Fix: mgr.startPrice → mgr.config.startPrice in fund recalculation — SPREAD orders would silently be excluded from fund totals if they ever carried positive size (modules/order/accounting.ts:391-392).
• Fix: remove dead typeof workingGrid.getBaseVersion === 'function' guard — WorkingGrid has no such method, fallback always triggered (modules/order/utils/validate.ts:966).
• Fix: _applySync cancelOrder dual-signature — normalized from bare-string/object overload to canonical object form ({ orderId, clearSize? }). Changed grid_reconcile.ts:387 bare-string call; simplified sync_engine.ts dispatch (modules/order/sync_engine.ts, modules/order/grid_reconcile.ts).
• Fix: _rebalanceState.toLowerCase() null guard — _rebalanceState is always initialized but now has defensive || '' (modules/order/manager.ts:1056).
• Fix: stale broadcast flag permanently blocking rebalancing — isPlanningActive() now delegates to _state.isBroadcastingActive() which auto-clears after 120s instead of using raw isBroadcasting() which never cleared (modules/order/manager.ts).
• Fix: orphan-fill tolerance widening consumed on first invariant check — _orphanFillsCreditedAt no longer consumed inside _verifyFundInvariants; persists through full fill cycle so all recalculateFunds calls see consistent tolerance (modules/order/accounting.ts).
• Fix: grid-bloat resync loop in loadGrid — added Grid.isGridBloatGraceActive() and Grid.clearGridBloatFlag() shared helpers; loadGrid checks grace window before requesting resync; maintenance runtime deduplicates inline grace logic (modules/order/grid.ts, modules/dexbot_maintenance_runtime.ts).
• Fix: AsyncLock forceRelease orphaned timers — clearTimeout(timer) before rejecting queued items to prevent stale no-op callbacks lingering in the event loop (modules/order/async_lock.ts).
• Fix: parallel node connect with Promise.any — fastest node wins; slow perpetual retry after max attempts stays in slow mode instead of looping back to exponential (modules/bitshares-native/transport.ts).
• Fix: subscription re-entrancy guard — prevents concurrent history scan races; per-page timeout + total deadline for fetchFillHistoryEntries with proper timer cleanup (no timer leak) (modules/bitshares-native/subscriptions.ts).
• Fix: fund accounting stale-fetch guard — refuses optimistic deduction when accountTotals exceeds MAX_ACCOUNT_TOTALS_AGE_MS; deduplicated in-flight recovery via stored _pendingRecovery promise (modules/order/accounting.ts).
• Fix: sync generation counter force-releases orphan callbacks; order ID re-verification before locking in reconciliation (modules/order/sync_engine.ts).
• Fix: getOnChainAssetBalances gains includeCreditDeals option to subtract credit deal collateral from free balance (opt-in, backward-compatible) (modules/chain_orders.ts).
• Fix: credit runtime TTL-gated staleness for MPA feed prices, credit conversion rates, and _getOfferById cache — stale cache returns null instead of silently using outdated values (modules/credit_runtime.ts).
• Fix: order logger drain deadline — discards remaining lines after 10s; flush() accepts configurable timeout (modules/order/logger.ts).
• Fix: restore fillOp.order_id in dedup log messages — _isNewFillKey lost orderId context during dedup extraction refactor; added optional orderId param so logs read "Skipping duplicate fill for X" instead of bare message (modules/dexbot_class.ts).
• Fix: replace hardcoded 'buy'/'sell' string literals with ORDER_TYPES constants in checkFundDrift (modules/order/utils/validate.ts).
• Refactor: convert Grid class (28 static methods, zero instance state) to plain exported functions. Self-calls use direct function references. No behavioral change (modules/order/grid.ts, all callers).
• Refactor: extract shared adjustBudgetForBtsFees() to eliminate BTS fee-reservation logic duplicated between Grid._getSizingContext() and getSideBudget(). Both call sites now use the same canonical math. Preserves the Math.min(allocated, sideFree - btsDeficit * share) cap from getSideBudget. Consolidates the calculateOrderCreationFees call (previously duplicated across both branches) into a single site (modules/order/utils/order.ts, modules/order/grid.ts).
• Refactor: split grid_reconcile.ts (1550 lines) — extracted 22 internal helpers into grid_reconcile_internal.ts (1067 lines). Main file reduced to 454 lines with the 3 public exports plus imports (modules/order/grid_reconcile.ts, modules/order/grid_reconcile_internal.ts).
• Refactor: make AsyncLock re-entrant — added _holding flag + isReentrant() check so acquire() from within the same execution context runs the callback directly instead of queueing (which would deadlock). Eliminates the fillLockAlreadyHeld: true parameter threaded through 25+ call sites across dexbot_class.ts, dexbot_maintenance_runtime.ts, sync_engine.ts, grid_reconcile.ts, grid_reconcile_internal.ts, grid.ts, accounting.ts, and the CR runtime. All callers now rely on the lock's intrinsic isReentrant() check; the gridLockAlreadyHeld flag (a separate grid-level re-entry flag) is kept only for syncFromOpenOrders / _applySync caller-skip semantics which is not replaced by lock-level reentrancy (modules/order/async_lock.ts, all callers).
• Fix: getSideBudget BTS BTS_RESERVATION_MULTIPLIER fallback — when config.feeParams.BTS_RESERVATION_MULTIPLIER is missing, falls back to FEE_PARAMETERS.BTS_RESERVATION_MULTIPLIER instead of returning undefined (which propagated as NaN through fee calculations). Both branches in getSideBudget now use the same default-safe path; the adjustBudgetForBtsFees helper callee already had this fallback (modules/order/utils/order.ts:1156).
• Chore: replace hardcoded 'active'/'partial' string literals with ORDER_STATES.ACTIVE/PARTIAL in calculateRequiredFunds (modules/order/utils/validate.ts:200).
• Chore: replace hardcoded 'buy'/'sell' string literals with ORDER_TYPES.BUY/SELL in same function (modules/order/utils/validate.ts:202-203).
• Chore: document pauseFundRecalc/pauseRecalcLogging coupling — JSDoc explains when to pair them vs use independently (modules/order/manager.ts:838-868).
• Chore: safety watchdog on pauseRecalcLogging — auto-resets after SAFETY_PAUSE_TIMEOUT_MS to prevent permanent debug-log suppression from missed finally block (modules/order/manager.ts).
• Chore: make protectCommittedOrders always-on in syncFromOpenOrders — _committedOrderIds is atomically rebuilt on every COW commit and is self-cleaning; the flag was only ever true at call sites that already held the fill lock, and was removed along with fillLockAlreadyHeld as part of AsyncLock reentrancy cleanup (modules/order/sync_engine.ts).
• Chore: rename OPERATIONS.LIQUIDITY_POOL → LIQUIDITY_POOL_EXCHANGE for consistency with core protocol naming; add OP_LIQUIDITY_POOL_EXCHANGE and OPERATION_NAMES[63] (modules/bitshares-native/serial/chain_constants.ts).
• Chore: reduce SUBSCRIPTION_SILENT_THRESHOLD_MS from 5min to 2min for faster dead-subscription detection (modules/constants.ts).
• Docs: new Credit-Only Mode section in docs/MPA_CREDIT_USAGE.md; removed redundant sections from AGENTS.md (template, quick commands), shortened Browser-Safe Surface, collapsed Node-only list.
• Test: test_bot_settings.ts covers creditOnly validation positive and required-fields negative cases.
• Test: happy-path and edge-case coverage for COW auto-cancel unmatched orders (tests/test_cow_structural_resync.ts).