fix(bots): close stack regressions and the review findings

[haydenshively]

Stacked on #189. Fixes, not features. Two passes live here:

1. A regression sweep over feat(midnight-liquidation): support loan-as-collateral markets #184/feat(swaps): rank candidates on an interpolated venue cost curve #187/fix(bots): treat a reverted send as economic, not a send failure #188/fix(bots): normalize the position join key across log events #189, asking one narrow question — "did we break what the bots already did?" — which found four answers.
2. The triage of the 20 automated review findings those PRs drew once they went ready. Verified one by one; nine fixed, four declined with reasoning on the threads.

Filed as its own PR so the mistakes and their fixes are legible together rather than rewritten into the PRs that introduced them.

---

Part 1 — the regression sweep

1. Detection-only blue could broadcast liquidations 🔴

	main	stack before this PR
gate order	if (venues.length === 0) return { kind: 'no_config' } first	unwrap resolution first, swap-free branch, then the gate
swap-free guard	resolution.steps.length > 0 && isAddressEqual(…)	isAddressEqual(…) — guard dropped

swapFreePlan returns kind: 'swap', and blue's tick takes that straight to simulate → submit. So with zero venues two paths that were unreachable now reached the broadcaster.

Fix: swapFreeWithoutVenues on composeMultiVenueQuoting, default false — a caller with no swap-free path refuses immediately. Midnight opts in. Default-deny lives in the package deliberately, so a future third caller inherits the safe posture rather than repeating this.

2. …and armed backoff on a transient read failure

Same reorder: an unwrapper throw became kind: 'failed' instead of no_config, and blue's tick arms per-position exponential backoff on failed. Refusing before the unwrap chain fixes this and #1 together, and spends no reads doing it.

3. A sibling's execution revert cancelled a real backoff

backoffExempt is keyed by position, so an execution revert on candidate B suppressed the backoff candidate A's sendRejected (nonce / funds / RPC) had armed. New backoffForced set overrides the exemption: an economic verdict on one candidate's plan refutes nothing about broken machinery.

4. Phase A.5 spent RPC on suppressed positions

On main both suppression gates preceded quoteFor, so a suppressed position cost zero I/O. prepareRoutes now takes a suppressed predicate, and isCooled/isBackedOff are defined once so the two phases cannot drift. Suppressed candidates map to unknown, not no_route — claiming they need no route would price them at zero and let them outrank a costed sibling.

---

Part 2 — the review triage

Fixed

5. The venue-less swap-free exception was still too broad (caught on this PR — a hole in fix #1). swapFreePlan serves two shapes, and the other one — an unwrap chain that merely lands on the loan token, PT-USDC in a USDC market — still moves assets. With Midnight wiring both an ERC-4626 and a Pendle unwrapper on Base, an ALLOW_BAD_DEBT_ONLY deployment could broadcast an ordinary liquidation. The exception is now zero-step only; venue-enabled callers keep both shapes.

6. Candidate ranking trusted curves that quoting refuses. costRoutes checked clamped but not ageMs and not completeness, while estimatedOut is consumed there as an absolute level against a current oracle — the one term staleness decays. A stale or partial curve therefore drove the position_cap and fall_through_bound cutoffs. Both consumers now share one exported curveIsTrusted(estimates, venues), so the divergence is gone structurally rather than patched twice. (MAX_PREDICTION_AGE_MS is consolidated into MAX_COST_LEVEL_AGE_MS, which is the same question with the same answer.)

7. Pendle PT routes were resolved twice per tick — both rate-limited hosted API calls, the first discarded. New optional Unwrapper.previewTokenOut returns the post-unwrap token without building calldata: Pendle answers from its TTL-cached markets list with zero HTTP, ERC-4626 from its memoized asset(). Phase A.5 only ever needed the pair. Resolution itself stays uncached, since the calldata is amount-bound. If any unwrapper lacks the seam the preview returns null and the caller falls back to a full resolve, so a partial walk can never report the wrong pair.

8. Phase A.5 resolved routes serially, in discovery order, with the whole phase awaited before ranking — so one slow route delayed every later candidate. Now partitioned synchronously and fanned out through Promise.all.

9. A retry-worthy sibling no longer loses to a suppressed one. Every suppression set is keyed by position while candidates are per (slot, mode), so a sibling's no_route suppressed a position whose other candidate ended floor_unmet — the one outcome meant to retry every block as the LIF ramps. New retryWorthy set, with backoffForced still overriding.

10. The cooldown verdict is snapshotted for the tick. Unlike block-keyed backoff, CooldownStore.shouldSkip is wall-clock and could flip between phases, leaving a candidate quoted with a route never warmed — which, because scoreNetOfRouteCost fails open per position, drops the whole alternative set to gross ordering.

11. Revert-streak state expires between episodes. Labels are market:borrower and outlive a borrow, so a stale startedAt made the first revert of a new episode report a false 15-minute crossing — or, if the old entry had escalated, yield ongoing forever and never warn. New REVERT_STREAK_EPISODE_GAP_MS, deliberately separate from the escalation threshold: silence and streak length are unrelated quantities.

12. tx.submit_failed carries a candidate discriminator. Optional SubmitArgs.correlation, spread beside id. Additive and inert for the other four callers; stops short of PendingEntry, since a send that fails here never reaches pending.

13. Docs and conventions. The swap-free "iff" guarantee (passesRouteQuality is a floor, not a band); the selectorConstant overclaim (all Error(string) share one selector); two stale README rows (ALLOW_BAD_DEBT_ONLY, and mode fall-through); four new test helpers to arrow constants plus a JSDoc an inserted const had orphaned.

Declined, with reasoning on the threads

• Narrow the execution-revert backoff exemption to postMaturityMode === true (fix(bots): treat a reverted send as economic, not a send failure #188, both reviewers). Would be a regression: backoffExempt is keyed per position while the mode is per candidate — a matured-and-unhealthy position is sized in both at once — and normal mode wins early in the ramp, so it would arm backoff exactly in the contested window the exemption protects. The premise is also wrong: only the LIF is static in normal mode; the repay cap grows with accrual.
• stopAfterWinner can skip a viable runner-up (feat(swaps): rank candidates on an interpolated venue cost curve #187). Deliberate call-budget tradeoff, and fix 6 narrows the window further.
• Sub-1e-18 venue rates truncate to zero (feat(swaps): rank candidates on an interpolated venue cost curve #187). Needs an 18-decimal collateral priced under $0.000001. Folded the cheap half in: curveIsTrusted requires estimatedOut > 0n.
• Exemption not cleared after a later transport rejection (fix(bots): treat a reverted send as economic, not a send failure #188). Already fixed by backoffForced above; that review ran on a commit predating it.

---

Verification

23 new tests, each proven against the mutation that should break it — the source reverted to this branch's parent while the new tests stood, and every non-control assertion failed.

• Typecheck clean across swaps / bot-kit / both liquidators; pnpm lint 0 warnings 0 errors; knip clean.
• pnpm test: 2895 passed. The 4 fork/e2e suites fail locally on a missing RPC_URL_8453 only — identical set before and after; CI holds the secret and runs them.
• One test the sweep flagged as weakened is restored: expect(unwrapper.probed).toHaveLength(0) had become toBeGreaterThan(0), i.e. updated to match the new behavior rather than catching it. It is now a pair — one per posture.
• TIB-2026-08-28-midnight-loan-as-collateral.md is amended twice: the pre-gate ordering is opt-in, and the exception is zero-step only.

Deliberately not changed

With venues enabled, a collateral === loan market now yields a swap-free plan where main fell through to a doomed aggregator quote. That is main's unwrapOnlyPlan extended to the zero-step case, it is strictly better, and blue's sweepCalls already handles the duplicate-skim. Flagging rather than reverting.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T04:01:54.356717Z	93b3597	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae3a024d6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".