feat(worker): alert when a held position has no protective stop resting

The existing protective-stop alert is shaped around one cause: the
exchange's price band refuses the stop. Every other way a stop fails to
reach the exchange produced a condition row the strategy re-reported on
every tick and nothing ever escalated, so a position could sit unguarded
indefinitely without the operator being told.

Add an outcome-shaped alert beside it: whatever the cause, this position
is held and nothing is resting that would sell it. It fires off the
exit-blocked row carrying the unplaced code, gated on that row's age, so
it cannot page about a position that opened moments ago.

It fails closed on an undated span, unlike the band alert. That one has
an independent span-free signal for a permanent fault; this one does not,
and without the age it cannot be told apart from a fresh entry. The row
is re-read next tick, so a lost write costs a tick of delay, not the
alert.

It is suppressed on any tick the band alert already fired, since both
describe the same unguarded coin and the band one carries the more
specific instruction, and it takes its own throttle key so the two alerts
cannot mute each other on exactly the coin where both matter.

The band explanation is now parsed before its throttle window opens; a
detail it could not parse previously threw after the key was set, losing
that alert and muting the next hour of them.

Also closes a detached-fill leak: the reconciler's own terminal-status
set omitted the self-trade-prevention status, so such a row was never
closed and held its live slot and open exposure forever.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YRceiDYdzzHo6aLFr4sZPj

Author: chrisleekr

apps/worker/__tests__/boot/builders/notifiers.test.ts

@@ -25,6 +25,7 @@ describe('buildNotifiers', () => {
       'orderFailedThrottle',
       'orderRefusalLoopThrottle',
       'protectiveStopBlockedThrottle',
+      'protectiveStopUnplacedThrottle',
     ]);
     expect(typeof n.accountNotify).toBe('function');
     expect(typeof n.notifyEvent).toBe('function');

apps/worker/__tests__/boot/builders/tick-handler-override-deps.test.ts

@@ -101,6 +101,7 @@ const buildDeps = (): TickHandlerDeps => {
     orderFailedThrottle: { allow: async () => true } as never,
     orderRefusalLoopThrottle: { allow: async () => true } as never,
     protectiveStopBlockedThrottle: { allow: async () => true } as never,
+    protectiveStopUnplacedThrottle: { allow: async () => true } as never,
     auditShipper: anyProxy(),
   });
   const deps = captured.deps;

apps/worker/__tests__/boot/builders/tick-handler.test.ts

@@ -34,12 +34,14 @@ interface Built {
   readonly deps: TickHandlerDeps;
   readonly events: Record<string, unknown>[];
   readonly stopKeys: string[];
+  readonly unplacedKeys: string[];
   readonly refusalKeys: string[];
 }
 
 const build = (allowStop = true, allowRefusal = true): Built => {
   const events: Record<string, unknown>[] = [];
   const stopKeys: string[] = [];
+  const unplacedKeys: string[] = [];
   const refusalKeys: string[] = [];
   const slice = buildTickHandler({
     env: ENV,
@@ -70,11 +72,17 @@ const build = (allowStop = true, allowRefusal = true): Built => {
         return allowStop;
       },
     } as never,
+    protectiveStopUnplacedThrottle: {
+      allow: async (key: string) => {
+        unplacedKeys.push(key);
+        return allowStop;
+      },
+    } as never,
     auditShipper: anyProxy(),
   });
   const deps = captured.deps;
   if (!deps) throw new Error('buildTickHandler did not construct a tick handler');
-  return { slice, deps, events, stopKeys, refusalKeys };
+  return { slice, deps, events, stopKeys, unplacedKeys, refusalKeys };
 };
 
 const BAND = {
@@ -208,6 +216,36 @@ describe('buildTickHandler — the order-refusal-loop notifier', () => {
   });
 });
 
+describe('buildTickHandler — the order-failed notifier', () => {
+  it('reports a failed replacement as an unguarded position with the replace action label', async () => {
+    const { deps, events } = build();
+    const notify = deps.notifyOrderFailed;
+    if (!notify) throw new Error('the builder did not wire notifyOrderFailed');
+
+    await notify({
+      operatorId: OPERATOR,
+      accountId: ACCOUNT,
+      profileId: PROFILE,
+      symbol: SYMBOL,
+      decisionType: 'replace-order',
+      result: {
+        ok: false,
+        retryable: false,
+        phase: 'rejected',
+        reason: 'cancelReplace: naked after -2021, re-place failed',
+      },
+      willRetry: false,
+    });
+
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      category: 'order-failed',
+      body: 'The bot could not re-arm a protective stop, and the position is currently unguarded. Check it on Binance.',
+      fields: expect.arrayContaining([{ label: 'Action', value: 'Replace order' }]),
+    });
+  });
+});
+
 describe('buildTickHandler — the protective-stop-blocked notifier', () => {
   it('keys the throttle on the escalation level so the two never mute each other', async () => {
     // "Wait for the price to come back" and "no price ever arms this stop" are
@@ -313,3 +351,144 @@ describe('buildTickHandler — the protective-stop-blocked notifier', () => {
     expect(event.fields.map((f) => f.label)).not.toContain('Blocked for');
   });
 });
+
+describe('buildTickHandler — the protective-stop-unplaced notifier', () => {
+  const unplaced = (over: Record<string, unknown> = {}) => ({
+    operatorId: OPERATOR,
+    accountId: ACCOUNT,
+    profileId: PROFILE,
+    symbol: SYMBOL,
+    sinceMs: Date.now() - 2 * 3_600_000,
+    detail: { stop: '11.5511' },
+    ...over,
+  });
+
+  it('keys the throttle on the coin alone, with no escalation level to split', async () => {
+    // Unlike the band refusal there is one thing to say here — nothing is guarding this position — so a second key segment would only split one message into two alerts an hour apart.
+    const { deps, unplacedKeys } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced());
+
+    expect(unplacedKeys).toEqual([`${PROFILE}:${SYMBOL}`]);
+  });
+
+  it('sends nothing when the throttle window is already open', async () => {
+    const { deps, events } = build(false);
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced());
+
+    expect(events).toEqual([]);
+  });
+
+  it('files under order-failed, which already covers a stop that never reached the exchange', async () => {
+    // That category is severity error and defaults ON, so the alert about an unguarded position is not behind a switch the operator has to find first.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced());
+
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({ category: 'order-failed', symbol: SYMBOL });
+  });
+
+  it('leads with the exposure and how long it has run, then what to check', async () => {
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced());
+
+    const event = events[0] as { body: string; fields: { label: string; value: string }[] };
+    expect(event.body).toContain('no protective stop on Binance for 2 hours');
+    expect(event.body).toContain('Nothing on the exchange will sell it if the price falls');
+    expect(event.body).toContain('another order is holding the coins');
+    expect(event.fields).toContainEqual({ label: 'Unprotected for', value: '2 hours' });
+    expect(event.fields).toContainEqual({ label: 'Wanted stop', value: '11.5511' });
+  });
+
+  it('omits the wanted stop when the strategy could not price one', async () => {
+    // The strategy publishes `stop: null` when it could not derive a level at all, and a field reading "null" tells the operator nothing while implying a number exists.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced({ detail: { stop: null } }));
+
+    const event = events[0] as { fields: { label: string }[] };
+    expect(event.fields.map((f) => f.label)).not.toContain('Wanted stop');
+  });
+
+  it('names the trailing-stop refusal and the distance Binance would not take', async () => {
+    // The cause this alert exists for: a native-trail profile on a symbol whose trailingDelta filter has no step for the wanted distance never places anything, and no price move clears that. The distance is quoted in the percent the settings screen shows, not the fraction the strategy records.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(
+      unplaced({ detail: { stop: '11.5511', nativeUnavailable: true, distancePct: '0.037' } }),
+    );
+
+    const event = events[0] as { fields: { label: string; value: string }[] };
+    const why = event.fields.find((f) => f.label === 'Why');
+    expect(why?.value).toContain('3.7% below the high');
+    expect(why?.value).toContain('follows the price up');
+    expect(why?.value).toContain("Switch this profile's protective stop mode to priced");
+  });
+
+  it('drops the distance from the refusal rather than quote one it cannot read', async () => {
+    // `distancePct` is null whenever the strategy could not derive the distance at all, and the bag has crossed a JSON round-trip besides. The lever still has to be named, so the clause loses the number and keeps the advice.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced({ detail: { stop: '11.5511', nativeUnavailable: true } }));
+    await notify(
+      unplaced({ detail: { stop: '11.5511', nativeUnavailable: true, distancePct: 0.037 } }),
+    );
+    await notify(
+      unplaced({ detail: { stop: '11.5511', nativeUnavailable: true, distancePct: 'soon' } }),
+    );
+
+    for (const raw of events) {
+      const event = raw as { fields: { label: string; value: string }[] };
+      const why = event.fields.find((f) => f.label === 'Why');
+      expect(why?.value).toContain('at the distance your settings ask for');
+      expect(JSON.stringify(event)).not.toContain('undefined');
+      expect(JSON.stringify(event)).not.toContain('%');
+    }
+  });
+
+  it('still reports the exposure when the detail bag did not survive the round-trip', async () => {
+    // The duration is the whole signal and it comes off the input, not the bag, so a bag that arrived as null must cost the operator its optional fields and nothing else.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced({ detail: null }) as never);
+
+    const event = events[0] as { body: string; fields: { label: string }[] };
+    expect(event.body).toContain('no protective stop on Binance for 2 hours');
+    expect(event.fields).toEqual([{ label: 'Unprotected for', value: '2 hours' }]);
+  });
+
+  it('says nothing about trailing stops when that is not what blocked this one', async () => {
+    // The ordinary unplaced case has no named cause, and inventing one would send an operator to a setting that is not theirs: a priced-mode profile has no trail distance to change.
+    const { deps, events } = build();
+    const notify = deps.notifyProtectiveStopUnplaced;
+    if (!notify) throw new Error('the builder did not wire notifyProtectiveStopUnplaced');
+
+    await notify(unplaced());
+
+    const event = events[0] as { fields: { label: string; value: string }[] };
+    expect(event.fields.map((f) => f.label)).not.toContain('Why');
+    expect(event.fields).toEqual([
+      { label: 'Unprotected for', value: '2 hours' },
+      { label: 'Wanted stop', value: '11.5511' },
+    ]);
+  });
+});

apps/worker/__tests__/executor/fill-adopter-detached-terminal.test.ts

@@ -0,0 +1,160 @@
+// Which statuses close a DETACHED order's ledger row.
+//
+// `reconcileDetachedFill` is the only thing that ever stamps `closed_at` on an order whose profile was deleted. A status it does not recognise as terminal leaves the row open forever: it keeps its `orders_one_live_per_intent` live slot and keeps counting toward the account's open exposure, which backs the delete-account guard. So the set of statuses it accepts is a contract, and it must be the SHARED one — the same predicate the open-orders cache eviction and the boot reaper read. `EXPIRED_IN_MATCH` is the status that proves it: Binance stamps it when self-trade prevention kills an order, which on a shared account wallet is exactly what a sibling profile's BUY crossing our resting SELL produces.
+
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import type { Logger } from 'pino';
+import type { Queue } from 'bullmq';
+
+import { asAccountId, asUserId } from '@app/contracts';
+
+import { createFillAdopter, type DetachedOrderEvent } from '../../src/executor/fill-adopter.js';
+import { createChainByKey } from '../../src/lib/chain-by-key.js';
+import type { StatePort } from '../../src/state/state-port.js';
+import type { SymbolInfoCache } from '../../src/tick/symbol-info-cache.js';
+
+const OPERATOR_ID = asUserId('00000000-0000-0000-0000-0000000705a1');
+const ACCOUNT_ID = asAccountId('00000000-0000-0000-0000-0000000705c1');
+const SYMBOL = 'XPLUSDT';
+// Above 2^32 so a lossy number/bigint hop surfaces as a miss rather than a pass.
+const ORDER_ID = 8_700_000_705;
+
+const repoMocks = vi.hoisted(() => ({
+  ordersFindByBinanceOrderId: vi.fn(),
+  ordersCloseByBinanceOrderId: vi.fn(async () => 1),
+  ordersMarkFilledByBinanceOrderId: vi.fn(async () => 1),
+}));
+
+const accountScope = { db: undefined as unknown, operatorId: OPERATOR_ID, accountId: ACCOUNT_ID };
+
+vi.mock('@app/db', async (importOriginal) => {
+  const orig = await importOriginal<typeof import('@app/db')>();
+  return {
+    ...orig,
+    scopeAccount: vi.fn(async () => accountScope),
+    accountRepoFromScope: vi.fn(() => ({
+      orders: {
+        findByBinanceOrderId: repoMocks.ordersFindByBinanceOrderId,
+        closeByBinanceOrderId: repoMocks.ordersCloseByBinanceOrderId,
+        markFilledByBinanceOrderId: repoMocks.ordersMarkFilledByBinanceOrderId,
+      },
+    })),
+  };
+});
+
+const noopLogger = {
+  info: () => undefined,
+  warn: () => undefined,
+  error: () => undefined,
+  debug: () => undefined,
+} as unknown as Logger;
+
+/**
+ * The production adopter with its position-side deps rigged to THROW. The detached path is the ledger half of adoption with the strategy half deliberately absent, so a regression that starts seeding cost basis or strategy state here fails loudly instead of quietly handing a deleted profile's position to a stranger.
+ */
+const makeAdopter = () =>
+  createFillAdopter({
+    db: {} as never,
+    chain: createChainByKey(),
+    logger: noopLogger,
+    statePort: {
+      mutate: () => {
+        throw new Error('detached reconcile must not touch strategy state');
+      },
+    } as unknown as StatePort,
+    registry: {
+      get: () => {
+        throw new Error('detached reconcile must not resolve a strategy');
+      },
+    },
+    pipelineQueue: {
+      add: () => {
+        throw new Error('detached reconcile must not enqueue an archive');
+      },
+    } as unknown as Queue,
+    symbolInfo: {
+      get: () => {
+        throw new Error('detached reconcile must not read symbol info');
+      },
+    } as unknown as SymbolInfoCache,
+  });
+
+const eventWith = (orderStatus: string): DetachedOrderEvent => ({
+  operatorId: OPERATOR_ID,
+  accountId: ACCOUNT_ID,
+  symbol: SYMBOL,
+  orderId: ORDER_ID,
+  orderStatus,
+  cumQty: '0',
+  cumQuoteQty: '0',
+  eventTimeMs: 1_735_000_000_000,
+});
+
+describe('reconcileDetachedFill — terminal-status vocabulary', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // A detached row: present, and `profileId` null is what makes it ours to close.
+    repoMocks.ordersFindByBinanceOrderId.mockResolvedValue({ profileId: null });
+    repoMocks.ordersCloseByBinanceOrderId.mockResolvedValue(1);
+    repoMocks.ordersMarkFilledByBinanceOrderId.mockResolvedValue(1);
+  });
+
+  it('closes the row on EXPIRED_IN_MATCH, the self-trade-prevention terminator', async () => {
+    await makeAdopter().reconcileDetachedFill(eventWith('EXPIRED_IN_MATCH'));
+
+    expect(repoMocks.ordersCloseByBinanceOrderId).toHaveBeenCalledTimes(1);
+    expect(repoMocks.ordersCloseByBinanceOrderId).toHaveBeenCalledWith(
+      BigInt(ORDER_ID),
+      'EXPIRED_IN_MATCH',
+      1_735_000_000_000,
+    );
+    // The exchange's own status is what lands on the row, so the ledger records WHY the order left the book.
+    expect(repoMocks.ordersMarkFilledByBinanceOrderId).not.toHaveBeenCalled();
+  });
+
+  it.each(['CANCELED', 'EXPIRED', 'REJECTED'])('closes the row on %s', async (status) => {
+    await makeAdopter().reconcileDetachedFill(eventWith(status));
+
+    expect(repoMocks.ordersCloseByBinanceOrderId).toHaveBeenCalledTimes(1);
+    expect(repoMocks.ordersCloseByBinanceOrderId).toHaveBeenCalledWith(
+      BigInt(ORDER_ID),
+      status,
+      1_735_000_000_000,
+    );
+  });
+
+  it('routes FILLED to the totals-merging close, not the plain one', async () => {
+    await makeAdopter().reconcileDetachedFill({
+      ...eventWith('FILLED'),
+      cumQty: '12',
+      cumQuoteQty: '340',
+    });
+
+    expect(repoMocks.ordersMarkFilledByBinanceOrderId).toHaveBeenCalledTimes(1);
+    expect(repoMocks.ordersMarkFilledByBinanceOrderId).toHaveBeenCalledWith(
+      BigInt(ORDER_ID),
+      { executedQty: '12', cummulativeQuoteQty: '340' },
+      1_735_000_000_000,
+    );
+    expect(repoMocks.ordersCloseByBinanceOrderId).not.toHaveBeenCalled();
+  });
+
+  it.each(['NEW', 'PARTIALLY_FILLED', 'PENDING_CANCEL', 'SOME_STATUS_BINANCE_ADDS_TOMORROW'])(
+    'leaves the row open on %s — a still-live commitment SHOULD keep counting toward exposure',
+    async (status) => {
+      await makeAdopter().reconcileDetachedFill(eventWith(status));
+
+      expect(repoMocks.ordersFindByBinanceOrderId).not.toHaveBeenCalled();
+      expect(repoMocks.ordersCloseByBinanceOrderId).not.toHaveBeenCalled();
+      expect(repoMocks.ordersMarkFilledByBinanceOrderId).not.toHaveBeenCalled();
+    },
+  );
+
+  it('refuses to close a row that still has a profile, whatever the status says', async () => {
+    repoMocks.ordersFindByBinanceOrderId.mockResolvedValue({ profileId: 'still-owned' });
+
+    await makeAdopter().reconcileDetachedFill(eventWith('EXPIRED_IN_MATCH'));
+
+    expect(repoMocks.ordersCloseByBinanceOrderId).not.toHaveBeenCalled();
+  });
+});