nautilus_lighter/

execution.rs

// -------------------------------------------------------------------------------------------------
//  Copyright (C) 2015-2026 Nautech Systems Pty Ltd. All rights reserved.
//  https://nautechsystems.io
//
//  Licensed under the GNU Lesser General Public License Version 3.0 (the "License");
//  You may not use this file except in compliance with the License.
//  You may obtain a copy of the License at https://www.gnu.org/licenses/lgpl-3.0.en.html
//
//  Unless required by applicable law or agreed to in writing, software
//  distributed under the License is distributed on an "AS IS" BASIS,
//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//  See the License for the specific language governing permissions and
//  limitations under the License.
// -------------------------------------------------------------------------------------------------

//! Live execution client for the Lighter adapter.
//!
//! This module hosts the [`LighterExecutionClient`] that wires the platform
//! execution engine to the Lighter L2 sequencer. Order submission,
//! cancellation, and modification use signed WebSocket trading transactions.
//! Reconciliation and report generation combine Lighter's account WebSocket
//! streams with the HTTP read endpoints.
//!
//! Auth-token rotation is owned by this execution client and refreshes the
//! private account-stream subscriptions on
//! [`crate::websocket::client::LighterWebSocketClient`].

use std::{
    collections::{BTreeMap, BTreeSet},
    future::Future,
    ops::ControlFlow,
    sync::{
        Arc,
        atomic::{AtomicBool, AtomicU64, Ordering},
    },
    time::Duration,
};

use ahash::{AHashMap, AHashSet};
use anyhow::Context;
use async_trait::async_trait;
use futures_util::{StreamExt, stream};
#[cfg(test)]
use nautilus_common::live::get_runtime;
use nautilus_common::{
    clients::{ExecutionClient, ExecutionReportTask},
    enums::{LogColor, LogLevel},
    live::runner::{get_exec_event_sender, try_get_exec_event_sender},
    log_debug,
    messages::{
        ExecutionReport,
        execution::{
            BatchCancelOrders, BatchModifyOrders, CancelAllOrders, CancelOrder,
            GenerateFillReports, GenerateOrderStatusReport, GenerateOrderStatusReports,
            GeneratePositionStatusReports, ModifyOrder, QueryAccount, QueryOrder, SubmitOrder,
            SubmitOrderList,
        },
    },
    msgbus::{self, TypedHandler},
};
use nautilus_core::{
    DurationNanos, UUID4, UnixNanos,
    datetime::unix_nanos_to_iso8601,
    params::Params,
    string::secret::SecretString,
    time::{AtomicTime, get_atomic_clock_realtime},
};
use nautilus_execution::reconciliation::{
    inferred_reconciliation_trade_ids, is_inferred_reconciliation_trade_id_format,
};
use nautilus_live::{
    ExecutionClientCore, ExecutionEventEmitter, SocketControlFactory,
    book::DEFAULT_BOOK_SNAPSHOT_TIMEOUT_SECS,
    execution::failure::CommandFailure,
    task::{TaskGroup, TaskGroupGuard, TaskJoinOutcome, TaskSlot, TaskSpawner, finish_task},
};
use nautilus_model::{
    accounts::AccountAny,
    enums::{
        AccountType, ContingencyType, OmsType, OrderSide, OrderStatus, OrderType, PositionSide,
        TimeInForce,
    },
    events::{OrderAccepted, OrderDeniedReason, OrderEventAny, OrderFilled, OrderTriggered},
    identifiers::{
        AccountId, ClientId, ClientOrderId, InstrumentId, StrategyId, TradeId, TraderId, Venue,
        VenueOrderId,
    },
    instruments::{Instrument, InstrumentAny},
    orders::{LIMIT_ORDER_TYPES, Order, OrderAny, STOP_ORDER_TYPES, TRIGGERABLE_ORDER_TYPES},
    reports::{ExecutionMassStatus, FillReport, OrderStatusReport, PositionStatusReport},
    types::{AccountBalance, MarginBalance, Quantity},
};
use nautilus_network::error::SendError;
use parking_lot::Mutex;
use rust_decimal::Decimal;
use serde::Deserialize;
use tokio_util::sync::CancellationToken;
use zeroize::Zeroizing;

use crate::{
    common::{
        consts::{
            DISCONNECT_TIMEOUT, LIGHTER_ERROR_CODE_INVALID_NONCE, LIGHTER_MAX_BATCH_TX,
            SCHEDULED_CANCEL_MAX_DELAY_SECS, SCHEDULED_CANCEL_MIN_DELAY_SECS,
            SCHEDULED_CANCEL_REQUEST_TIMEOUT,
        },
        credential::{Credential, scrub_auth},
        deployment,
        enums::{
            LighterAccountTier, LighterCancelAllTimeInForce, LighterGroupingType,
            LighterOrderStatus, LighterPositionMarginMode, LighterProductType,
            LighterSelfTradeBehaviorMode, LighterSelfTradeEqualityMode, LighterTxStatus,
            LighterTxType,
        },
        parse::{parse_price_from_ticks, parse_quantity_from_ticks, quantity_from_decimal},
        rate_limit::{LighterTxRateLimiter, await_tx_quota, build_tx_rate_limiter, resolve_quota},
        symbol::{MarketRegistry, product_type_from_instrument_id},
    },
    config::{LighterExecutionClientConfig, validate_scheduled_cancel_timeout},
    http::{
        client::{LIGHTER_REST_PAGE_SIZE, LighterHttpClient, LighterRawHttpClient},
        error::LighterHttpError,
        models::{
            LighterAccountDetail, LighterOrder, LighterSendTxRequest, LighterTrade, LighterTx,
        },
        query::{
            LighterAccountActiveOrdersQuery, LighterAccountInactiveOrdersQuery,
            LighterSortDirection, LighterTradeSortBy, LighterTradesQuery,
        },
    },
    signing::{
        auth_token::{build_auth_token_for, fresh_k},
        nonce::NonceError,
        tx::{
            ApproveIntegratorTxInfo, CancelAllOrdersTxInfo, CancelOrderTxInfo,
            CreateGroupedOrdersTxInfo, CreateOrderTxInfo, L2TxAttributes, ModifyOrderTxInfo,
            OrderInfo, TxContext, TxInfoJson, UpdateLeverageTxInfo, sign_tx,
        },
    },
    websocket::{
        LighterWsError, USER_STREAMS_ENDPOINT,
        client::{LighterWebSocketClient, RetainedTaskSlot, TaskRetentionGuard},
        dispatch::{
            DeferredOrderEvents, LIGHTER_INSTRUMENT_CACHE, MAX_RECONCILIATION_PAGES, OrderIdentity,
            OrderReportLookup, OrderShapeSnapshot, PendingOrderAction, PendingSendTx,
            PendingSendTxKind, PendingTerminal, TradeDedupSource, WsDispatchState,
            cache_instruments_for_reports, collect_order, collect_order_while_pending,
            derive_market_order_price_ticks, evict_terminal_mappings, fills_for_order,
            lookup_create_order_status_report, nautilus_to_lighter_order_type,
            nautilus_to_lighter_tif, order_expiry_for, parse_http_order_to_report, price_to_ticks,
            quantity_to_ticks,
        },
        messages::{
            AccountStream, ExecutionReport as LighterExecutionReport, LighterWsChannel,
            NautilusWsMessage, SendTxRejectionSource, TX_BATCH_ID_PREFIX,
        },
        parse::{
            LighterCommissionError, OpenFrameContext, ParsedOrderEvent, is_order_triggered,
            lighter_order_shape, parse_lighter_order_event, parse_lighter_order_filled,
            parse_lighter_order_updated, parse_lighter_trade_id, parse_ws_fill_report,
            parse_ws_order_status_report,
        },
    },
};

/// Default `expired_at` window applied to a signed tx if the order does not
/// supply its own GTD expiry: 5 minutes from wall-clock at submission time.
const DEFAULT_TX_EXPIRY_MS: i64 = 5 * 60 * 1_000;

/// Delay between venue lookups for an acknowledged order.
const ACKED_ORDER_LOOKUP_DELAY: Duration = Duration::from_secs(2);
const ACKED_ORDER_PROBE_ATTEMPTS: usize = 3;
const TERMINAL_FILL_DELAY: Duration = Duration::from_secs(2);
const TERMINAL_RECOVERY_TIMEOUT: Duration = Duration::from_secs(2);
const TERMINAL_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(7);
const ORDER_EVENTS_PATTERN: &str = "events.order.*";
const BATCH_ACK_TIMEOUT: Duration = Duration::from_secs(10);
const ACCOUNT_CANCEL_CONFIRM_TIMEOUT: Duration = Duration::from_secs(10);

const STRATEGY_REASON_MAX_CHARS: usize = 512;

/// Refresh the auth token this far before its issuance deadline. The
/// [`crate::signing::auth_token::DEFAULT_AUTH_TOKEN_TTL_SECS`] is 7 hours;
/// rotating at 6 hours leaves an hour of headroom for transient refresh
/// failures.
const AUTH_TOKEN_REFRESH_INTERVAL: std::time::Duration =
    std::time::Duration::from_secs(6 * 60 * 60);

// Refresh interval must stay below the token TTL, or rotation hands out already-expired tokens
const _: () = assert!(
    AUTH_TOKEN_REFRESH_INTERVAL.as_secs()
        < crate::signing::auth_token::DEFAULT_AUTH_TOKEN_TTL_SECS as u64,
    "AUTH_TOKEN_REFRESH_INTERVAL must stay below DEFAULT_AUTH_TOKEN_TTL_SECS",
);

// Retry budget after a scheduled rotation failure: 7 h TTL minus the 6 h
// refresh cadence leaves one hour before the old token expires.
const AUTH_TOKEN_REFRESH_RETRY_WINDOW: Duration = Duration::from_secs(60 * 60);
const AUTH_TOKEN_REFRESH_RETRY_INITIAL_DELAY: Duration = Duration::from_secs(30);

// Also used as the cadence after a retry window is exhausted
const AUTH_TOKEN_REFRESH_RETRY_MAX_DELAY: Duration = Duration::from_secs(5 * 60);
const AUTH_TOKEN_REFRESH_BACKOFF: AuthTokenRefreshBackoff = AuthTokenRefreshBackoff {
    initial_delay: AUTH_TOKEN_REFRESH_RETRY_INITIAL_DELAY,
    max_delay: AUTH_TOKEN_REFRESH_RETRY_MAX_DELAY,
    window: AUTH_TOKEN_REFRESH_RETRY_WINDOW,
};
const NONCE_REFRESH_RETRY_INITIAL_DELAY: Duration = Duration::from_secs(1);
const NONCE_REFRESH_RETRY_MAX_DELAY: Duration = Duration::from_secs(30);
// Bounds the startup account snapshot so a slow or failing `/account`
// endpoint cannot stall connect for the HTTP retry budget.
const ACCOUNT_SNAPSHOT_TIMEOUT: Duration = Duration::from_secs(10);
const REFERRAL_ATTRIBUTION_TIMEOUT: Duration = Duration::from_secs(10);

/// Attribution window for a bare venue error frame. The frame carries no
/// `tx_hash` or cloid; if the oldest pending sendTx was submitted within
/// this window we attribute and emit `OrderRejected`. Outside the window
/// the existing submit-timeout drives expiry.
const SENDTX_BARE_ERROR_WINDOW_MS: u64 = 1_000;
const INTEGRATOR_AUTO_APPROVAL_MAX_TTL_MS: i64 = 5 * 365 * 24 * 60 * 60 * 1_000;
const INTEGRATOR_AUTO_APPROVAL_MAX_FEE_TICK: u32 = 0;
const NONCE_CONNECTION_EPOCH_UNAVAILABLE: u64 = u64::MAX;

#[derive(Debug)]
pub struct LighterExecutionClient {
    core: ExecutionClientCore,
    clock: &'static AtomicTime,
    config: LighterExecutionClientConfig,
    emitter: ExecutionEventEmitter,
    credential: Option<Credential>,
    http_client: LighterHttpClient,
    ws_client: LighterWebSocketClient,
    tx_rate_limiter: Arc<LighterTxRateLimiter>,
    tx_send_sequencer: TxSendSequencer,
    nonce_submission_gate: Arc<tokio::sync::RwLock<()>>,
    nonce_ready_connection_epoch: Arc<AtomicU64>,
    registry: Arc<MarketRegistry>,
    socket_factory: SocketControlFactory,
    pending_tasks: TaskGroup,
    ws_stream_handle: TaskSlot<()>,
    terminal_recovery_handle: TaskSlot<()>,
    terminal_producers_stopped: CancellationToken,
    fills_applied: Option<AppliedFillSubscription>,
    ws_disconnect_handle: TaskSlot<Result<(), LighterWsError>>,
    ws_handler_retained: Arc<RetainedTaskSlot>,
    auth_refresh_handle: TaskSlot<()>,
    scheduled_cancel_handle: TaskSlot<()>,
    scheduled_cancel_notify: Arc<tokio::sync::Notify>,
    shutdown_errors: Vec<String>,
    cancellation_token: CancellationToken,
    dispatch: WsDispatchState,
    nonce_recovery_inflight: Arc<AtomicBool>,
    auth_refresh_notify: Arc<tokio::sync::Notify>,
}

impl LighterExecutionClient {
    fn log_report_receipt(count: usize, report_type: &str, log_level: LogLevel) {
        let plural = if count == 1 { "" } else { "s" };
        let message = format!("Received {count} {report_type}{plural}");

        match log_level {
            LogLevel::Off => {}
            LogLevel::Trace => log::trace!("{message}"),
            LogLevel::Debug => log::debug!("{message}"),
            LogLevel::Info => log::info!("{message}"),
            LogLevel::Warning => log::warn!("{message}"),
            LogLevel::Error => log::error!("{message}"),
        }
    }

    /// Creates a new [`LighterExecutionClient`] instance.
    ///
    /// Resolves credentials from `config` or the matching environment
    /// variables (see [`crate::common::credential`]). Missing credentials
    /// degrade to an unauthenticated client that can bootstrap instruments
    /// but cannot submit transactions; the constructor returns an error if
    /// supplied values are malformed.
    ///
    /// # Errors
    ///
    /// Returns an error if configuration or supplied credentials are invalid,
    /// or if the HTTP client fails to initialize.
    pub fn new(
        core: ExecutionClientCore,
        config: LighterExecutionClientConfig,
    ) -> anyhow::Result<Self> {
        validate_scheduled_cancel_timeout(config.scheduled_cancel_timeout_secs)?;
        anyhow::ensure!(
            core.venue == config.resolved_venue(),
            "Lighter execution core venue {} does not match configured venue {}",
            core.venue,
            config.resolved_venue(),
        );

        anyhow::ensure!(
            config.account_id.get_issuer() == core.venue,
            "Lighter account ID issuer {} does not match configured venue {}",
            config.account_id.get_issuer(),
            core.venue,
        );

        let credential = Credential::resolve_for_deployment(
            config.private_key.clone().map(SecretString::into_inner),
            config.account_index,
            config.api_key_index,
            config.deployment,
            config.environment,
        )
        .context("failed to resolve Lighter credentials")?;

        let registry = Arc::new(MarketRegistry::new_with_venue_and_settlement_currency(
            core.venue,
            config.settlement_currency(),
        ));
        let socket_factory = SocketControlFactory::new(core.client_id, Some(core.venue));

        // One transaction limiter shared across the HTTP and WebSocket sendTx
        // paths so their combined rate honors the single per-account venue bucket.
        let tx_rate_limiter = build_tx_rate_limiter(config.sendtx_quota_per_min);

        let raw_http = LighterRawHttpClient::new_with_quotas(
            config.environment,
            Some(config.http_url()),
            config.http_timeout_secs,
            config
                .proxy_url
                .as_ref()
                .map(|value| value.expose_secret().to_owned()),
            resolve_quota(config.rest_quota_per_min),
            Some(Arc::clone(&tx_rate_limiter)),
        )
        .context("failed to construct Lighter raw HTTP client")?;

        let http_client =
            LighterHttpClient::from_raw_with_registry(raw_http, Arc::clone(&registry));

        let ws_client = Self::create_ws_client(&config, Arc::clone(&registry), &socket_factory);

        let clock = get_atomic_clock_realtime();

        let mut emitter = ExecutionEventEmitter::new(
            clock,
            core.trader_id,
            core.account_id,
            AccountType::Margin,
            None,
        );

        if let Some(sender) = try_get_exec_event_sender() {
            emitter.set_sender(sender);
        }

        let pending_tasks = TaskGroup::new();

        Ok(Self {
            core,
            clock,
            config,
            emitter,
            credential,
            http_client,
            ws_client,
            tx_rate_limiter,
            tx_send_sequencer: TxSendSequencer::new(),
            nonce_submission_gate: Arc::new(tokio::sync::RwLock::new(())),
            nonce_ready_connection_epoch: Arc::new(AtomicU64::new(0)),
            registry,
            socket_factory,
            cancellation_token: pending_tasks.cancellation_token(),
            pending_tasks,
            ws_stream_handle: TaskSlot::new(),
            terminal_recovery_handle: TaskSlot::new(),
            terminal_producers_stopped: CancellationToken::new(),
            fills_applied: None,
            ws_disconnect_handle: TaskSlot::new(),
            ws_handler_retained: Arc::new(RetainedTaskSlot::new()),
            auth_refresh_handle: TaskSlot::new(),
            scheduled_cancel_handle: TaskSlot::new(),
            scheduled_cancel_notify: Arc::new(tokio::sync::Notify::new()),
            shutdown_errors: Vec::new(),
            dispatch: WsDispatchState::new(),
            nonce_recovery_inflight: Arc::new(AtomicBool::new(false)),
            auth_refresh_notify: Arc::new(tokio::sync::Notify::new()),
        })
    }

    /// Returns a reference to the configuration.
    #[must_use]
    pub fn config(&self) -> &LighterExecutionClientConfig {
        &self.config
    }

    /// Returns `true` when the client holds resolved Lighter credentials.
    #[must_use]
    pub fn has_credentials(&self) -> bool {
        self.credential.is_some()
    }

    /// Returns `true` when every retained background task has completed.
    /// Useful in tests to wait for fire-and-forget HTTP work.
    #[must_use]
    pub fn pending_tasks_all_finished(&self) -> bool {
        self.pending_tasks.all_finished()
    }

    /// Cancels all open orders across the account's markets and strategies, including uncached orders.
    ///
    /// Does not close positions or change instrument-scoped `CancelAllOrders`.
    ///
    /// # Submission
    ///
    /// Returns an accepted transaction hash; venue updates confirm cancellation.
    /// Dropping the future does not stop submission, even while rate limited.
    /// Shutdown can discard unsent work. Transport, confirmation, or shutdown failures
    /// can leave the outcome unknown.
    ///
    /// # Errors
    ///
    /// Returns an error if:
    /// - Credentials or nonce readiness are unavailable, or signing fails.
    /// - Submission or confirmation fails, including shutdown or venue rejection.
    pub async fn cancel_all_orders_account(&self) -> anyhow::Result<String> {
        self.send_cancel_all(LighterCancelAllTimeInForce::Immediate, 0)
            .await
    }

    /// Arms, replaces, or revokes account-wide scheduled cancellation of open orders.
    ///
    /// # Deadline
    ///
    /// `Some(time)` sets or replaces a Unix timestamp in milliseconds, five minutes to fifteen days
    /// ahead of the local clock. Allow headroom for latency, rate limits, and clock skew.
    /// `None` revokes it. Armed schedules survive disconnect or exit, without automatic renewal.
    ///
    /// # Submission
    ///
    /// Returns an accepted hash, not proof of arming, replacement, or revocation.
    /// Account scope and submission behavior follow [`Self::cancel_all_orders_account`],
    /// including when the future is dropped.
    ///
    /// # Errors
    ///
    /// Returns an error if:
    /// - The deadline is outside the supported window.
    /// - Preparation, submission, or confirmation fails.
    pub async fn schedule_cancel(&self, time: Option<u64>) -> anyhow::Result<String> {
        let (time_in_force, scheduled_time_ms) = match time {
            Some(time) => {
                let now = self.clock.get_time_ms();
                let delay = time
                    .checked_sub(now)
                    .context("scheduled cancellation is in the past")?;
                anyhow::ensure!(
                    (SCHEDULED_CANCEL_MIN_DELAY_SECS * 1_000
                        ..=SCHEDULED_CANCEL_MAX_DELAY_SECS * 1_000)
                        .contains(&delay),
                    "scheduled cancellation must be between five minutes and fifteen days ahead",
                );
                let time = i64::try_from(time)
                    .context("scheduled cancellation timestamp overflows milliseconds")?;
                (LighterCancelAllTimeInForce::Scheduled, time)
            }
            None => (LighterCancelAllTimeInForce::AbortScheduled, 0),
        };

        self.send_cancel_all(time_in_force, scheduled_time_ms).await
    }

    async fn send_cancel_all(
        &self,
        time_in_force: LighterCancelAllTimeInForce,
        scheduled_time_ms: i64,
    ) -> anyhow::Result<String> {
        let credential = self
            .credential
            .as_ref()
            .context("Lighter account cancellation requires credentials")?;
        self.fanout_dispatch_context(credential)
            .context("failed to spawn Lighter account cancellation")?
            .send_cancel_all(
                time_in_force,
                scheduled_time_ms,
                false,
                self.cancellation_token.clone(),
            )
            .await
    }

    async fn start_scheduled_cancel(&mut self) -> anyhow::Result<()> {
        let Some(timeout_secs) = self.config.scheduled_cancel_timeout_secs else {
            return Ok(());
        };

        let credential = self
            .credential
            .as_ref()
            .context("scheduled cancellation requires credentials")?;
        let context = self.fanout_dispatch_context(credential)?;
        context
            .refresh_scheduled_cancel(timeout_secs)
            .await
            .context("failed to arm Lighter scheduled cancellation")?;
        let cancellation = self.cancellation_token.clone();
        let notify = Arc::clone(&self.scheduled_cancel_notify);
        let refresh_interval =
            Duration::from_secs(((timeout_secs - SCHEDULED_CANCEL_MIN_DELAY_SECS) / 3).min(60));

        self.scheduled_cancel_handle.spawn(async move {
            let mut interval = tokio::time::interval_at(tokio::time::Instant::now() + refresh_interval, refresh_interval);
            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);

            loop {
                tokio::select! {
                    biased;
                    () = cancellation.cancelled() => break,
                    () = notify.notified() => {},
                    _ = interval.tick() => {},
                }

                if !context.ws_client.is_active()
                    || context.nonce_ready_connection_epoch.load(Ordering::Acquire) != context.ws_client.connection_epoch() {
                    continue;
                }

                tokio::select! {
                    biased;
                    () = cancellation.cancelled() => break,
                    result = context.refresh_scheduled_cancel(timeout_secs) => {
                        if let Err(e) = result {
                            log::error!("Scheduled cancellation refresh failed; the last deadline may expire: {e:#}");
                        }
                    }
                }
            }
        })?;

        log::info!("Scheduled cancellation armed: timeout_secs={timeout_secs}");
        Ok(())
    }

    fn create_ws_client(
        config: &LighterExecutionClientConfig,
        registry: Arc<MarketRegistry>,
        socket_factory: &SocketControlFactory,
    ) -> LighterWebSocketClient {
        let ws_client = LighterWebSocketClient::new(
            Some(config.ws_url()),
            config.environment,
            registry,
            config.transport_backend,
            config.ws_timeout_secs,
            // The execution socket carries no book channels; the shared default stays inert.
            Duration::from_secs(DEFAULT_BOOK_SNAPSHOT_TIMEOUT_SECS),
            config
                .proxy_url
                .as_ref()
                .map(|value| value.expose_secret().to_owned()),
        );

        ws_client.with_socket_control(socket_factory.control(USER_STREAMS_ENDPOINT))
    }

    fn take_ws_client(&mut self) -> LighterWebSocketClient {
        let cached_instruments = self.ws_client.instruments_cache();
        let ws_cache = cached_instruments
            .iter()
            .map(|entry| (*entry.key(), entry.value().clone()))
            .collect();
        let replacement = Self::create_ws_client(
            &self.config,
            Arc::clone(&self.registry),
            &self.socket_factory,
        );
        replacement.cache_instruments(ws_cache);

        std::mem::replace(&mut self.ws_client, replacement)
    }

    fn spawn_task<F>(&self, description: &'static str, fut: F)
    where
        F: std::future::Future<Output = anyhow::Result<()>> + Send + 'static,
    {
        let future = async move {
            if let Err(e) = fut.await {
                log::warn!("{description} failed: {e:?}");
            }
        };

        if let Err(e) = self.pending_tasks.spawn(future) {
            log::warn!("Skipping Lighter {description} after shutdown began: {e}");
        }
    }

    fn subscribe_applied_fills(&mut self) {
        if self.fills_applied.is_some() {
            return;
        }

        let core = self.core.clone();
        let dispatch = self.dispatch.clone();
        let emitter = self.emitter.clone();

        let handler = TypedHandler::from(move |event: &OrderEventAny| {
            let OrderEventAny::Filled(fill) = event else {
                return;
            };

            if fill.account_id != core.account_id || fill.trader_id != core.trader_id {
                return;
            }

            let Some(identity) = dispatch.order_identity(&fill.client_order_id) else {
                return;
            };

            if identity.strategy_id != fill.strategy_id
                || identity.instrument_id != fill.instrument_id
            {
                return;
            }

            let cache = core.cache();

            let Some(order) = cache.order(&fill.client_order_id) else {
                return;
            };

            if !order.is_duplicate_fill(fill) {
                return;
            }

            let events = dispatch.order_events.lock();

            if is_inferred_reconciliation_trade_id_format(&fill.trade_id) {
                identity.sync_fills(&order);
            }

            if identity.has_inferred_fills() {
                return;
            }

            identity.publish_fill(fill);
            identity.publication_pending(Some(&order));
            dispatch.mark_trade_reconciled(fill.trade_id);
            release_terminal(fill.client_order_id, false, &dispatch, &emitter, &events);
        });

        msgbus::subscribe_order_events(ORDER_EVENTS_PATTERN.into(), handler.clone(), Some(10));
        self.fills_applied = Some(AppliedFillSubscription(handler));
    }

    fn begin_session_shutdown(&mut self) {
        self.pending_tasks.begin_shutdown();
        self.cancellation_token.cancel();
        self.ws_client.begin_shutdown();
        self.core.set_disconnected();

        if self.ws_disconnect_handle.is_none()
            && (self.ws_client.is_active() || self.ws_stream_handle.is_some())
        {
            let ws_client = self.take_ws_client();
            let retained = Arc::clone(&self.ws_handler_retained);

            if let Err(e) = self
                .ws_disconnect_handle
                .spawn(ws_client.disconnect_with_task_retention(retained))
            {
                log::error!("Failed to start Lighter WebSocket disconnect task: {e}");
            }
        }
    }

    fn session_tasks_finished(&self) -> bool {
        self.ws_stream_handle.is_none()
            && self.terminal_recovery_handle.is_none()
            && self.ws_disconnect_handle.is_none()
            && self.ws_handler_retained.is_empty()
            && self.auth_refresh_handle.is_none()
            && self.scheduled_cancel_handle.is_none()
            && self.pending_tasks.is_empty()
            && self.shutdown_errors.is_empty()
    }

    async fn finish_session_shutdown(&mut self) -> anyhow::Result<()> {
        self.pending_tasks.begin_shutdown();

        Self::finish_disconnect_task(
            &mut self.ws_disconnect_handle,
            "WebSocket disconnect",
            &mut self.shutdown_errors,
        )
        .await;

        if let Err(e) = self.ws_handler_retained.finish().await {
            self.shutdown_errors.push(e.to_string());
        }
        Self::finish_owned_task(
            &mut self.ws_stream_handle,
            "execution consumer",
            &mut self.shutdown_errors,
        )
        .await;

        Self::finish_owned_task(
            &mut self.auth_refresh_handle,
            "auth-token refresh",
            &mut self.shutdown_errors,
        )
        .await;

        if let Err(e) = self
            .pending_tasks
            .finish_shutdown(Duration::from_secs(1), DISCONNECT_TIMEOUT)
            .await
        {
            self.shutdown_errors
                .push(format!("client-owned tasks failed: {e}"));
        }

        Self::finish_owned_task(
            &mut self.scheduled_cancel_handle,
            "scheduled cancellation refresh",
            &mut self.shutdown_errors,
        )
        .await;

        if self.ws_disconnect_handle.is_none()
            && self.ws_handler_retained.is_empty()
            && self.ws_stream_handle.is_none()
            && self.pending_tasks.is_empty()
        {
            self.terminal_producers_stopped.cancel();

            if let Some(outcome) = finish_task(
                &mut self.terminal_recovery_handle,
                TERMINAL_SHUTDOWN_TIMEOUT + DISCONNECT_TIMEOUT,
                DISCONNECT_TIMEOUT,
            )
            .await
                && !matches!(outcome, TaskJoinOutcome::Completed(()))
            {
                self.shutdown_errors
                    .push(format!("terminal recovery task failed: {outcome:?}"));
            }
        }

        if self.session_tasks_finished() {
            self.fills_applied = None;
        }

        let stale = self.dispatch.take_pending_sendtx();
        warn_pending_sendtx_unknown(&stale, "session shutdown");
        self.nonce_recovery_inflight.store(false, Ordering::Release);

        if !self.shutdown_errors.is_empty() {
            let errors = std::mem::take(&mut self.shutdown_errors);
            anyhow::bail!("Failed to terminate Lighter tasks: {}", errors.join("; "));
        }
        Ok(())
    }

    async fn finish_owned_task(
        slot: &mut TaskSlot<()>,
        description: &str,
        errors: &mut Vec<String>,
    ) {
        let Some(outcome) = finish_task(slot, DISCONNECT_TIMEOUT, DISCONNECT_TIMEOUT).await else {
            return;
        };

        match outcome {
            TaskJoinOutcome::Completed(()) => {
                log::debug!("Lighter {description} task completed");
            }
            TaskJoinOutcome::Aborted => {
                log::debug!("Lighter {description} task cancelled");
            }
            TaskJoinOutcome::Failed(e) => {
                errors.push(format!("{description} task failed: {e}"));
            }
            TaskJoinOutcome::Incomplete => {
                errors.push(format!("{description} task did not stop after abort"));
            }
        }
    }

    async fn finish_disconnect_task(
        slot: &mut TaskSlot<Result<(), LighterWsError>>,
        description: &str,
        errors: &mut Vec<String>,
    ) {
        let Some(outcome) = finish_task(slot, DISCONNECT_TIMEOUT, DISCONNECT_TIMEOUT).await else {
            return;
        };

        match outcome {
            TaskJoinOutcome::Completed(Ok(())) | TaskJoinOutcome::Aborted => {}
            TaskJoinOutcome::Completed(Err(e)) => {
                errors.push(format!("{description} failed: {e}"));
            }
            TaskJoinOutcome::Failed(e) => {
                errors.push(format!("{description} task failed: {e}"));
            }
            TaskJoinOutcome::Incomplete => {
                errors.push(format!("{description} task did not stop after abort"));
            }
        }
    }

    async fn ensure_instruments_initialized_async(&self) -> anyhow::Result<()> {
        if self.core.instruments_initialized() {
            return Ok(());
        }

        let instruments = self
            .http_client
            .request_instruments()
            .await
            .context("failed to request Lighter instruments")?;

        let ws_cache: Vec<(i64, InstrumentAny)> = instruments
            .iter()
            .filter_map(|instrument| {
                self.registry
                    .market_index(&instrument.id())
                    .map(|market_index| (market_index, instrument.clone()))
            })
            .collect();
        self.ws_client.cache_instruments(ws_cache);
        cache_instruments_for_reports(&instruments);

        log::debug!(
            "Bootstrapped {} Lighter instruments ({} registry entries)",
            instruments.len(),
            self.registry.len(),
        );

        self.core.set_instruments_initialized();
        Ok(())
    }

    async fn await_account_streams_ready(&self, timeout_secs: f64) -> anyhow::Result<()> {
        let timeout = Duration::from_secs_f64(timeout_secs);
        self.dispatch.account_streams_ready.await_all(timeout).await
    }

    async fn refresh_nonce(&self) -> anyhow::Result<()> {
        let Some(credential) = &self.credential else {
            return Ok(());
        };
        self.nonce_ready_connection_epoch
            .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);
        let _refresh_guard = self.nonce_submission_gate.write().await;

        let response = self
            .http_client
            .get_next_nonce(credential.account_index(), credential.api_key_index())
            .await
            .context("failed to fetch Lighter nextNonce")?;

        self.dispatch.nonce_manager.refresh(
            credential.account_index(),
            credential.api_key_index(),
            response.nonce,
        );

        // Release the latch in case a disconnect aborted recovery mid-task
        self.nonce_recovery_inflight.store(false, Ordering::Release);

        log::debug!(
            "Refreshed Lighter nonce baseline: account_index={}, api_key_index={}, next_nonce={}",
            credential.account_index(),
            credential.api_key_index(),
            response.nonce,
        );
        Ok(())
    }

    async fn sync_nonce_from_venue(&self) -> anyhow::Result<()> {
        let Some(credential) = &self.credential else {
            return Ok(());
        };

        let _refresh_guard = self.nonce_submission_gate.write().await;
        let response = self
            .http_client
            .get_next_nonce(credential.account_index(), credential.api_key_index())
            .await
            .context("failed to fetch Lighter nextNonce")?;
        self.dispatch.nonce_manager.sync_from_venue(
            credential.account_index(),
            credential.api_key_index(),
            response.nonce,
        )?;
        Ok(())
    }

    async fn fetch_account_detail(&self) -> Option<LighterAccountDetail> {
        let Some(credential) = &self.credential else {
            return None;
        };
        let account_index = credential.account_index();

        match tokio::time::timeout(
            ACCOUNT_SNAPSHOT_TIMEOUT,
            self.http_client.get_account_detail(account_index),
        )
        .await
        {
            Ok(Ok(detail)) => Some(detail),
            Ok(Err(e)) => {
                log::warn!(
                    "Failed to fetch Lighter account detail for account_index={account_index}; \
                     continuing startup without account metadata: {e}"
                );
                None
            }
            Err(_) => {
                log::warn!(
                    "Lighter account detail timed out after {}s for account_index={account_index}; \
                     continuing startup without account metadata",
                    ACCOUNT_SNAPSHOT_TIMEOUT.as_secs()
                );
                None
            }
        }
    }

    // Logs the venue-reported account tier in blue. Informational only: the
    // active quotas are resolved from config at construction, never raised here
    // (the higher venue limits require registering the caller IP, so the tier
    // alone does not guarantee them).
    fn log_account_tier(&self, detail: &LighterAccountDetail) {
        let account_index = detail.account_index;
        let code = detail.account_type;
        let tier = LighterAccountTier::from_code(code);
        let standard_rest = LighterAccountTier::Standard
            .documented_rest_quota_per_min()
            .unwrap_or(60);
        let (active_rest, cross_check) =
            tier_quota_report(tier, self.config.rest_quota_per_min, standard_rest);

        log_debug!(
            "Lighter execution account {account_index} reported tier {tier} \
             (account_type={code}); active REST quota {active_rest} req/min",
            color = LogColor::Blue
        );

        match cross_check {
            Some(TierCrossCheck::AboveTier { documented }) => {
                log::warn!(
                    "Configured Lighter rest_quota_per_min={active_rest} exceeds the {tier} tier \
                     limit of {documented} req/min; the venue may reject requests unless the \
                     caller IP is registered for the higher limit"
                );
            }
            Some(TierCrossCheck::RaiseHint { documented }) => {
                log_debug!(
                    "Lighter {tier} tier permits up to {documented} REST req/min; set \
                     rest_quota_per_min (and register the caller IP with Lighter) to use it",
                    color = LogColor::Blue
                );
            }
            None => {}
        }
    }

    fn integrator_account_index(&self) -> Option<u64> {
        deployment::integrator_account_index(self.config.deployment, self.config.environment)
    }

    async fn apply_referral_attribution(
        &self,
        detail: &LighterAccountDetail,
    ) -> anyhow::Result<()> {
        let Some(referral_code) =
            deployment::referral_code(self.config.deployment, self.config.environment)
        else {
            return Ok(());
        };

        let Some(credential) = &self.credential else {
            return Ok(());
        };

        anyhow::ensure!(
            !detail.l1_address.trim().is_empty(),
            "Lighter account detail returned an empty L1 address"
        );

        let auth_token = build_auth_token_for(credential)
            .context("failed to mint Lighter auth token for referral attribution")?;
        let referral_code = Zeroizing::new(referral_code.to_string());

        self.http_client
            .use_referral(&detail.l1_address, referral_code.as_str(), &auth_token)
            .await
            .context("failed to apply Lighter referral code")?;

        Ok(())
    }

    /// Returns `Ok(true)` if this credential's `api_key_index` is maker-only.
    /// Maker-only keys cannot submit `ApproveIntegrator`, so the caller skips
    /// the integrator auto-approval when `true`.
    async fn is_maker_only_api_key(&self, credential: &Credential) -> anyhow::Result<bool> {
        let auth_token = build_auth_token_for(credential)
            .context("failed to mint Lighter auth token for maker-only check")?;
        let response = self
            .http_client
            .get_maker_only_api_keys(credential.account_index(), auth_token)
            .await
            .context("failed to query getMakerOnlyApiKeys")?;
        let api_key_index = i64::from(credential.api_key_index());
        Ok(response.api_key_indexes.contains(&api_key_index))
    }

    async fn submit_integrator_auto_approval(&self) -> anyhow::Result<()> {
        let Some(integrator_account_index) = self.integrator_account_index() else {
            return Ok(());
        };

        let Some(credential) = &self.credential else {
            return Ok(());
        };

        let mut maker_only_check_failed = false;

        match self.is_maker_only_api_key(credential).await {
            Ok(true) => {
                log::warn!(
                    "Skipping Lighter integrator auto-approval: api_key_index={} is maker-only; \
                     ensure the account has been approved by a non-maker-only key",
                    credential.api_key_index(),
                );
                return Ok(());
            }
            Ok(false) => {}
            Err(e) => {
                maker_only_check_failed = true;

                log::debug!(
                    "Unable to determine whether the Lighter API key is maker-only; proceeding \
                     with integrator auto-approval: {e:?}"
                );
            }
        }

        let mut approval =
            self.prepare_integrator_auto_approval(credential, integrator_account_index)?;

        let request = LighterSendTxRequest::new(
            LighterTxType::ApproveIntegrator as u8,
            approval.tx_info.clone(),
        );

        approval.send_reservation.wait_for_turn().await;

        let response = match self.http_client.send_tx(&request).await {
            Ok(response) => response,
            Err(e) => {
                if lighter_http_error_is_definite_api_rejection(&e) {
                    let _ = self.dispatch.nonce_manager.ack_failure_if_latest(
                        credential.account_index(),
                        approval.api_key_index,
                        approval.nonce,
                    );
                }
                approval.send_reservation.release();
                let hint = if maker_only_check_failed {
                    " (maker-only pre-flight check failed earlier; venue may reject with 62007 \
                     if this key is maker-only)"
                } else {
                    ""
                };
                return Err(anyhow::Error::new(e).context(format!(
                    "failed to submit Lighter integrator approval nonce={} api_key_index={}{hint}",
                    approval.nonce, approval.api_key_index,
                )));
            }
        };

        let _ = self.dispatch.nonce_manager.ack_success(
            credential.account_index(),
            approval.api_key_index,
            approval.nonce,
        );
        approval.send_reservation.release();

        log::debug!(
            "Submitted Lighter integrator approval: integrator={}, nonce={}, \
             api_key_index={}, approval_expiry={}, tx_hash={}",
            integrator_account_index,
            approval.nonce,
            approval.api_key_index,
            approval.approval_expiry,
            response.tx_hash,
        );
        Ok(())
    }

    fn prepare_integrator_auto_approval(
        &self,
        credential: &Credential,
        integrator_account_index: u64,
    ) -> anyhow::Result<PreparedIntegratorApproval> {
        let ReservedTxContext {
            context,
            send_reservation,
        } = self.build_tx_context(credential)?;

        let now_ms = (self.clock.get_time_ns().as_u64() as i64) / 1_000_000;
        let approval_expiry = now_ms.saturating_add(INTEGRATOR_AUTO_APPROVAL_MAX_TTL_MS);
        let nonce = context.nonce;
        let api_key_index = context.api_key_index;

        let tx = ApproveIntegratorTxInfo {
            context,
            integrator_account_index: integrator_account_index as i64,
            max_perps_taker_fee: INTEGRATOR_AUTO_APPROVAL_MAX_FEE_TICK,
            max_perps_maker_fee: INTEGRATOR_AUTO_APPROVAL_MAX_FEE_TICK,
            max_spot_taker_fee: INTEGRATOR_AUTO_APPROVAL_MAX_FEE_TICK,
            max_spot_maker_fee: INTEGRATOR_AUTO_APPROVAL_MAX_FEE_TICK,
            approval_expiry,
            skip_nonce: 0,
        };

        let signed = sign_tx(
            &tx,
            self.config.chain_id(),
            &credential.private_key()?,
            fresh_k(),
        )?;

        let tx_info = TxInfoJson::approve_integrator(&tx, &signed, "");

        Ok(PreparedIntegratorApproval {
            tx_info,
            nonce,
            api_key_index,
            approval_expiry,
            send_reservation,
        })
    }

    async fn spawn_ws_consumer(&mut self) -> anyhow::Result<()> {
        // Local clone owns the handler `task_handle` until post-connect
        // setup succeeds. Transferring earlier would leave failures unable
        // to drain the task through the clone's `disconnect()`.
        let mut ws_guard = TaskRetentionGuard::new(
            self.ws_client.clone(),
            Arc::clone(&self.ws_handler_retained),
        );
        ws_guard
            .client_mut()
            .connect_with_cancellation(self.cancellation_token.clone())
            .await
            .context("failed to connect to Lighter WebSocket")?;

        // Wrapped so any failure routes through the clone's `disconnect()`
        // (which still owns the handler task); mirrors Hyperliquid's
        // `post_ws` block.
        let post_connect = async {
            ws_guard
                .client_mut()
                .wait_until_active()
                .await
                .context("Lighter WebSocket did not reach active state")?;

            if let Some(credential) = &self.credential {
                let auth_token = build_auth_token_for(credential)
                    .context("failed to mint Lighter auth token")?;
                let account_index = credential.account_index();

                ws_guard
                    .client_mut()
                    .set_execution_context(self.core.account_id, account_index)
                    .await
                    .map_err(|e| anyhow::anyhow!("failed to set Lighter execution context: {e}"))?;

                // Subscribe to the five account-scoped streams the consumption
                // loop converts into typed reports. The handler merges
                // `account_all_assets` and `user_stats` into a single
                // AccountState (see websocket/account_state.rs).
                let channels = [
                    LighterWsChannel::AccountAllOrders(account_index),
                    LighterWsChannel::AccountAllTrades(account_index),
                    LighterWsChannel::AccountAllPositions(account_index),
                    LighterWsChannel::AccountAllAssets(account_index),
                    LighterWsChannel::UserStats(account_index),
                ];

                for channel in channels {
                    ws_guard
                        .client_mut()
                        .subscribe_account(channel.clone(), auth_token.clone())
                        .await
                        .map_err(|e| {
                            anyhow::anyhow!(
                                "failed to subscribe to Lighter account channel {channel:?}: {e}",
                            )
                        })?;
                }

                log::debug!("Subscribed to Lighter account streams: account_index={account_index}",);
            } else {
                log::warn!(
                    "Lighter execution client has no credentials: account streams not subscribed; \
                     typed execution reports will not flow"
                );
            }

            Ok::<(), anyhow::Error>(())
        };

        if let Err(e) = post_connect.await {
            log::warn!("Lighter post-connect setup failed, tearing down WS: {e}");
            let ws_client = ws_guard.disarm();
            let mut rollback_errors = Vec::new();

            if let Err(e) = ws_client
                .disconnect_with_task_retention(Arc::clone(&self.ws_handler_retained))
                .await
            {
                rollback_errors.push(e.to_string());
            }

            if let Err(e) = self.ws_handler_retained.finish().await {
                rollback_errors.push(e.to_string());
            }

            if rollback_errors.is_empty() {
                return Err(e);
            }
            return Err(e.context(format!(
                "Lighter post-connect rollback failed: {}",
                rollback_errors.join("; ")
            )));
        }

        let mut ws_client = ws_guard.disarm();
        self.ws_client.set_task_slot(ws_client.take_task_slot());

        let cancellation_token = self.cancellation_token.clone();
        let emitter = self.emitter.clone();
        let dispatch = self.dispatch.clone();
        let credential_for_loop = self.credential.clone();
        let http_client_for_loop = self.http_client.clone();
        let registry_for_loop = Arc::clone(&self.registry);
        let auth_refresh_notify = Arc::clone(&self.auth_refresh_notify);
        let nonce_submission_gate = Arc::clone(&self.nonce_submission_gate);
        let nonce_ready_connection_epoch = Arc::clone(&self.nonce_ready_connection_epoch);
        let scheduled_cancel_notify = Arc::clone(&self.scheduled_cancel_notify);
        let pending_tasks_for_loop = self
            .pending_tasks
            .spawner()
            .context("Lighter task admission is closed")?;
        let account_id_for_loop = self.core.account_id;
        let clock_for_loop = self.clock;

        let orders_cached = {
            let cache = self.core.cache();
            cache
                .orders_open_refs(
                    Some(&self.core.venue),
                    None,
                    None,
                    Some(&self.core.account_id),
                    None,
                )
                .into_iter()
                .map(|order| order.clone())
                .collect()
        };

        dispatch.seed_order_restorations(orders_cached);

        let nonce_refresh_retry = NonceRefreshRetry {
            http_client: self.http_client.clone(),
            dispatch: self.dispatch.clone(),
            credential: self.credential.clone(),
            submission_gate: Arc::clone(&self.nonce_submission_gate),
            ready_connection_epoch: Arc::clone(&self.nonce_ready_connection_epoch),
            ws_client: ws_client.clone(),
            cancellation_token: self.cancellation_token.clone(),
            pending_tasks: pending_tasks_for_loop.clone(),
        };

        let child_context = credential_for_loop
            .as_ref()
            .map(|credential| AckedOrderProbeContext {
                http_client: http_client_for_loop.clone(),
                registry: Arc::clone(&registry_for_loop),
                credential: credential.clone(),
                dispatch: dispatch.clone(),
                account_id: account_id_for_loop,
                clock: clock_for_loop,
                emitter: emitter.clone(),
                connection_epoch: ws_client.connection_epoch_atomic(),
                cancellation_token: cancellation_token.clone(),
                pending_tasks: pending_tasks_for_loop.clone(),
            });

        if let Some(context) = child_context.clone() {
            self.terminal_producers_stopped = CancellationToken::new();

            self.terminal_recovery_handle.spawn(run_terminal_recovery(
                context,
                self.terminal_producers_stopped.clone(),
            ))?;
        }

        self.ws_stream_handle.spawn(async move {
            log::debug!("Lighter execution WebSocket consumption loop started");

            loop {
                tokio::select! {
                    biased;
                    () = cancellation_token.cancelled() => {
                        log::debug!("Lighter execution consumption loop cancelled");
                        break;
                    }
                    msg_opt = ws_client.next_event() => {
                        match msg_opt {
                            Some(NautilusWsMessage::ExecutionReports(reports)) => {
                                let mut order_count = 0_usize;
                                let mut fill_count = 0_usize;
                                let trader_id = emitter.trader_id();
                                let account_index = credential_for_loop
                                    .as_ref()
                                    .map(|c| c.account_index());

                                for report in reports {
                                    match report {
                                        LighterExecutionReport::Order(order) => {
                                            order_count += 1;
                                            dispatch_lighter_order(
                                                &order,
                                                &dispatch,
                                                &emitter,
                                                &registry_for_loop,
                                                account_id_for_loop,
                                                trader_id,
                                                clock_for_loop.get_time_ns(),
                                            );
                                        }
                                        LighterExecutionReport::Fill(trade) => {
                                            fill_count += 1;
                                            dispatch_lighter_trade(
                                                &trade,
                                                &dispatch,
                                                &emitter,
                                                &registry_for_loop,
                                                account_id_for_loop,
                                                trader_id,
                                                account_index,
                                                clock_for_loop.get_time_ns(),
                                            );
                                        }
                                    }
                                }

                                if let Some(context) = &child_context {
                                    spawn_child_recoveries(context);
                                }
                                log::debug!(
                                    "Lighter execution batch: orders={order_count} fills={fill_count}",
                                );
                            }
                            Some(NautilusWsMessage::PositionSnapshot {
                                reports,
                                skipped_market_ids,
                            }) => {
                                // Replace even when empty, but keep rows the
                                // handler could not parse or map.
                                for r in &reports {
                                    if let Some(idx) =
                                        registry_for_loop.market_index(&r.instrument_id)
                                    {
                                        dispatch.note_active_market(idx);
                                    }
                                }
                                let position_count = reports.len();
                                let retained_positions: Vec<InstrumentId> = skipped_market_ids
                                    .iter()
                                    .filter_map(|market_id| {
                                        registry_for_loop.instrument_id(*market_id)
                                    })
                                    .collect();
                                let removed = dispatch.replace_position_snapshot(
                                    &reports,
                                    &retained_positions,
                                    &skipped_market_ids,
                                );
                                log::debug!(
                                    "Lighter position snapshot: positions={position_count}, skipped_markets={}, removed={}",
                                    skipped_market_ids.len(),
                                    removed.len(),
                                );
                                emit_lighter_position_reports(
                                    reports,
                                    removed,
                                    &emitter,
                                    account_id_for_loop,
                                    clock_for_loop.get_time_ns(),
                                );
                            }
                            Some(NautilusWsMessage::PositionUpdate {
                                reports,
                                closed_market_ids,
                                skipped_market_ids,
                            }) => {
                                let mut covered_market_ids = closed_market_ids.clone();

                                for report in &reports {
                                    if let Some(market_id) =
                                        registry_for_loop.market_index(&report.instrument_id)
                                    {
                                        dispatch.note_active_market(market_id);
                                        covered_market_ids.push(market_id);
                                    }
                                }
                                let position_count = reports.len();
                                let closed_positions: Vec<InstrumentId> = closed_market_ids
                                    .iter()
                                    .filter_map(|market_id| {
                                        registry_for_loop.instrument_id(*market_id)
                                    })
                                    .collect();
                                let removed = dispatch.apply_position_update(
                                    &reports,
                                    &closed_positions,
                                    &covered_market_ids,
                                    &skipped_market_ids,
                                );
                                log::debug!(
                                    "Lighter position update: positions={position_count}, closed_markets={}, skipped_markets={}, removed={}",
                                    closed_market_ids.len(),
                                    skipped_market_ids.len(),
                                    removed.len(),
                                );
                                emit_lighter_position_reports(
                                    reports,
                                    removed,
                                    &emitter,
                                    account_id_for_loop,
                                    clock_for_loop.get_time_ns(),
                                );
                            }
                            Some(NautilusWsMessage::AccountState(state)) => {
                                log::debug!(
                                    "Lighter AccountState: balances={} margins={}",
                                    state.balances.len(),
                                    state.margins.len(),
                                );
                                // Cache so query_account can serve a recent
                                // snapshot without a REST round-trip; Lighter
                                // does not currently expose a REST account
                                // endpoint that would make a fresh fetch
                                // possible.
                                dispatch.cache_account_state((*state).clone());
                                emitter.send_account_state(*state);
                            }
                            Some(NautilusWsMessage::Reconnected { connection_epoch }) => {
                                dispatch.terminals_recover.notify_one();
                                dispatch.invalidate_position_snapshot();
                                dispatch.stop_cancel_probes_before(connection_epoch);
                                nonce_ready_connection_epoch.store(
                                    NONCE_CONNECTION_EPOCH_UNAVAILABLE,
                                    Ordering::Release,
                                );
                                // Subscriptions are restored by
                                // `LighterWebSocketClient`'s reconnect logic;
                                // the execution context is preserved by the
                                // handler across reconnects. Refresh the nonce
                                // baseline since the venue's expected next
                                // nonce may have advanced while we were
                                // disconnected.
                                log::debug!("Lighter WebSocket reconnected (execution stream)");
                                auth_refresh_notify.notify_one();

                                // No cache touch here: the next venue
                                // `account_all_positions` snapshot is
                                // authoritative and drives the diff. A
                                // synthetic flat from the lifecycle would
                                // produce a false close+reopen on a healthy
                                // flap. Trade-off: between reconnect and the
                                // next snapshot (~<1s typically),
                                // `generate_position_status_reports` may
                                // return stale data.

                                // Drained creates have unknown outcomes;
                                // reconciliation resolves them, so warn
                                // rather than emit rejections.
                                let refresh_guard = nonce_submission_gate.write().await;
                                let disconnected_epoch = connection_epoch.saturating_sub(1);
                                let stale = dispatch.drain_pending_sendtx(disconnected_epoch);
                                warn_pending_sendtx_unknown(&stale, "reconnect");

                                if let Some(credential) = &credential_for_loop {
                                    match http_client_for_loop
                                        .get_next_nonce(
                                            credential.account_index(),
                                            credential.api_key_index(),
                                        )
                                        .await
                                    {
                                        Ok(response) => {
                                            dispatch.nonce_manager.refresh(
                                                credential.account_index(),
                                                credential.api_key_index(),
                                                response.nonce,
                                            );
                                            nonce_ready_connection_epoch
                                                .store(connection_epoch, Ordering::Release);
                                            drop(refresh_guard);
                                            scheduled_cancel_notify.notify_one();
                                            log::debug!(
                                                "Refreshed Lighter nonce after reconnect: \
                                                 account_index={}, next_nonce={}",
                                                credential.account_index(),
                                                response.nonce,
                                            );
                                        }
                                        Err(e) => {
                                            log::warn!(
                                                "Failed to refresh Lighter nonce after reconnect: {e}",
                                            );
                                            nonce_refresh_retry
                                                .clone()
                                                .spawn(connection_epoch);
                                        }
                                    }
                                }
                            }
                            Some(message @ (NautilusWsMessage::SendTxAck { .. } | NautilusWsMessage::SendTxBatchResult { .. })) => {
                                let account_index = credential_for_loop.as_ref().map(|c| c.account_index());
                                let acked = match message {
                                    NautilusWsMessage::SendTxAck { connection_epoch, tx_hash, code } => {
                                        handle_send_tx_ack_for_connection(&dispatch, account_index, connection_epoch, code, tx_hash.as_deref()).into_iter().collect()
                                    }
                                    NautilusWsMessage::SendTxBatchResult { connection_epoch, id, code, message, tx_hashes } => {
                                        let (acked, resync) = handle_send_tx_batch_result(
                                            &dispatch, &emitter, account_index, connection_epoch,
                                            clock_for_loop.get_time_ns(), &id, code, &message, &tx_hashes,
                                        );

                                        if resync && ws_client.connection_epoch() == connection_epoch {
                                            nonce_ready_connection_epoch.store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);

                                            nonce_refresh_retry.clone().spawn(connection_epoch);
                                        }
                                        acked
                                    }
                                    _ => unreachable!("matched transaction response"),
                                };

                                for pending in acked {
                                    let Some(credential) = credential_for_loop.clone() else { continue; };

                                    if matches!(pending.kind, PendingSendTxKind::Modify { .. }) { continue; }
                                    spawn_acked_order_probe(
                                        &pending,
                                        AckedOrderProbeContext {
                                            http_client: http_client_for_loop.clone(),
                                            registry: Arc::clone(&registry_for_loop),
                                            credential,
                                            dispatch: dispatch.clone(),
                                            account_id: account_id_for_loop,
                                            clock: clock_for_loop,
                                            emitter: emitter.clone(),
                                            connection_epoch: ws_client.connection_epoch_atomic(),
                                            cancellation_token: cancellation_token.clone(),
                                            pending_tasks: pending_tasks_for_loop.clone(),
                                        },
                                    );
                                }
                            }
                            Some(NautilusWsMessage::SendTxRejected {
                                connection_epoch,
                                source,
                                code,
                                message,
                                tx_hash,
                            }) => {
                                let account_index = credential_for_loop
                                    .as_ref()
                                    .map(|c| c.account_index());
                                let needs_nonce_resync = handle_send_tx_rejection_for_connection(
                                    &dispatch,
                                    &emitter,
                                    account_index,
                                    connection_epoch,
                                    clock_for_loop.get_time_ns(),
                                    source,
                                    code,
                                    &message,
                                    tx_hash.as_deref(),
                                );

                                // Invalid nonce means the sequential stream is
                                // wedged on a burned nonce; only a hard refresh
                                // moves allocation back down.
                                if needs_nonce_resync
                                    && let Some(credential) = &credential_for_loop
                                {
                                    if ws_client.connection_epoch() != connection_epoch {
                                        log::warn!(
                                            "Skipping stale Lighter nonce rejection from connection \
                                             epoch {connection_epoch}",
                                        );
                                        continue;
                                    }
                                    nonce_ready_connection_epoch.store(
                                        NONCE_CONNECTION_EPOCH_UNAVAILABLE,
                                        Ordering::Release,
                                    );
                                    let _refresh_guard = nonce_submission_gate.write().await;

                                    match http_client_for_loop
                                        .get_next_nonce(
                                            credential.account_index(),
                                            credential.api_key_index(),
                                        )
                                        .await
                                    {
                                        Ok(response) => {
                                            dispatch.nonce_manager.refresh(
                                                credential.account_index(),
                                                credential.api_key_index(),
                                                response.nonce,
                                            );
                                            nonce_ready_connection_epoch
                                                .store(connection_epoch, Ordering::Release);
                                            log::debug!(
                                                "Hard-refreshed Lighter nonce after invalid-nonce \
                                                 rejection: account_index={}, next_nonce={}",
                                                credential.account_index(),
                                                response.nonce,
                                            );
                                        }
                                        Err(e) => {
                                            log::warn!(
                                                "Failed to refresh Lighter nonce after \
                                                 invalid-nonce rejection: {e}",
                                            );
                                            nonce_refresh_retry
                                                .clone()
                                                .spawn(connection_epoch);
                                        }
                                    }
                                }
                            }
                            Some(NautilusWsMessage::Raw(value)) => {
                                log::debug!("Unhandled Lighter raw frame on execution stream: {value}");
                            }
                            Some(NautilusWsMessage::AccountStreamFirstFrame(stream)) => {
                                // FIFO with preceding reports on the same
                                // channel: any typed reports the handler
                                // emitted for this frame have already been
                                // applied by the cases above, so marking
                                // here is safe to unblock `await_all`.
                                match stream {
                                    AccountStream::Orders => {
                                        dispatch.account_streams_ready.mark_orders();
                                    }
                                    AccountStream::Trades => {
                                        dispatch.account_streams_ready.mark_trades();
                                    }
                                    AccountStream::Positions => {
                                        dispatch.account_streams_ready.mark_positions();
                                    }
                                    AccountStream::Assets => {
                                        dispatch.account_streams_ready.mark_assets();
                                    }
                                    AccountStream::UserStats => {
                                        dispatch.account_streams_ready.mark_user_stats();
                                    }
                                }
                            }
                            // Public market data variants reach the execution
                            // stream only if the user shares a websocket clone
                            // with the data client (no production caller does).
                            Some(
                                NautilusWsMessage::Trades(_)
                                | NautilusWsMessage::Quote(_)
                                | NautilusWsMessage::Deltas(_)
                                | NautilusWsMessage::Depth(_)
                                | NautilusWsMessage::Bar(_)
                                | NautilusWsMessage::MarkPrice(_)
                                | NautilusWsMessage::IndexPrice(_)
                                | NautilusWsMessage::FundingRate(_),
                            ) => {}
                            None => {
                                log::debug!("Lighter execution next_event returned None");
                                tokio::select! {
                                    () = cancellation_token.cancelled() => {
                                        log::debug!(
                                            "Lighter execution consumption loop cancelled"
                                        );
                                        break;
                                    }
                                    () = tokio::time::sleep(Duration::from_secs(1)) => {}
                                }
                            }
                        }
                    }
                }
            }

            log::debug!("Lighter execution WebSocket consumption loop finished");
        })?;

        if let Some(credential) = &self.credential {
            self.spawn_auth_token_refresh(credential.clone())?;
        }

        Ok(())
    }

    fn spawn_auth_token_refresh(&mut self, credential: Credential) -> anyhow::Result<()> {
        let ws_client = self.ws_client.clone();
        let cancellation_token = self.cancellation_token.clone();
        let account_index = credential.account_index();
        let channels = auth_token_rotation_channels(account_index);
        let refresh_notify = Arc::clone(&self.auth_refresh_notify);

        self.auth_refresh_handle.spawn(async move {
            log::debug!(
                "Lighter auth-token refresh task started: interval={}s, account_index={account_index}",
                AUTH_TOKEN_REFRESH_INTERVAL.as_secs(),
            );

            let mut next_refresh_delay = AUTH_TOKEN_REFRESH_INTERVAL;

            loop {
                tokio::select! {
                    biased;
                    () = cancellation_token.cancelled() => {
                        log::debug!("Lighter auth-token refresh task cancelled");
                        break;
                    }
                    () = refresh_notify.notified() => {
                        log::debug!(
                            "Refreshing Lighter auth token immediately after reconnect: account_index={account_index}",
                        );
                    }
                    () = tokio::time::sleep(next_refresh_delay) => {}
                }

                let outcome = refresh_auth_token_until_rotated(
                    &credential,
                    &channels,
                    &cancellation_token,
                    AUTH_TOKEN_REFRESH_BACKOFF,
                    build_auth_token_for,
                    |channel, token| {
                        let ws_client = ws_client.clone();
                        async move { ws_client.subscribe_account(channel, token).await }
                    },
                )
                .await;

                if let Some(delay) = auth_token_refresh_next_delay(outcome) {
                    if outcome == AuthTokenRefreshOutcome::Exhausted {
                        log::error!(
                            "Lighter auth-token rotation exhausted retry window; retrying again in {}s: account_index={account_index}",
                            delay.as_secs(),
                        );
                    }
                    next_refresh_delay = delay;
                } else {
                    log::debug!("Lighter auth-token refresh task cancelled");
                    break;
                }
            }
        })?;
        Ok(())
    }

    // Per-order `params["market_order_slippage_bps"]` overrides the config default.
    fn resolve_slippage_bps(&self, params: Option<&Params>) -> u32 {
        params
            .and_then(|p| p.get_u64("market_order_slippage_bps"))
            .map_or(self.config.market_order_slippage_bps, |v| v as u32)
    }

    fn build_tx_context(&self, credential: &Credential) -> anyhow::Result<ReservedTxContext> {
        let connection_epoch = self.ws_client.connection_epoch();
        anyhow::ensure!(
            self.nonce_ready_connection_epoch.load(Ordering::Acquire) == connection_epoch,
            TxPreparationError::NonceRefreshPending(connection_epoch),
        );
        let nonce_guard = Arc::clone(&self.nonce_submission_gate)
            .try_read_owned()
            .context("Lighter nonce refresh is in progress")?;
        anyhow::ensure!(
            self.ws_client.connection_epoch() == connection_epoch
                && self.nonce_ready_connection_epoch.load(Ordering::Acquire) == connection_epoch,
            TxPreparationError::StateChanged,
        );

        let send_reservation = match self.tx_send_sequencer.reserve(
            credential.account_index(),
            credential.api_key_index(),
            || {
                self.dispatch
                    .nonce_manager
                    .next_nonce(credential.account_index(), credential.api_key_index())
            },
        ) {
            Ok(reservation) => reservation,
            Err(e @ NonceError::SkipWindowExhausted { .. }) => {
                self.spawn_nonce_window_recovery(credential);
                anyhow::bail!("failed to allocate Lighter nonce: {e}");
            }
            Err(e) => anyhow::bail!("failed to allocate Lighter nonce: {e}"),
        };

        let nonce = send_reservation.nonce;

        let now_ns = self.clock.get_time_ns().as_u64() as i64;
        let expired_at = (now_ns / 1_000_000).saturating_add(DEFAULT_TX_EXPIRY_MS);
        let send_reservation = send_reservation.with_nonce_ownership(nonce_guard, connection_epoch);

        let context = TxContext {
            account_index: credential.account_index(),
            api_key_index: credential.api_key_index(),
            nonce,
            expired_at,
        };

        Ok(ReservedTxContext {
            context,
            send_reservation,
        })
    }

    fn spawn_nonce_window_recovery(&self, credential: &Credential) {
        if self.nonce_recovery_inflight.swap(true, Ordering::AcqRel) {
            return;
        }

        let inflight = Arc::clone(&self.nonce_recovery_inflight);
        let http_client = self.http_client.clone();
        let dispatch = self.dispatch.clone();
        let nonce_submission_gate = Arc::clone(&self.nonce_submission_gate);
        let account_index = credential.account_index();
        let api_key_index = credential.api_key_index();

        self.spawn_task("nonce_window_recovery", async move {
            let _refresh_guard = nonce_submission_gate.write().await;
            let result = http_client
                .get_next_nonce(account_index, api_key_index)
                .await;
            inflight.store(false, Ordering::Release);

            match result {
                Ok(response) => {
                    // Monotonic sync, not `refresh`: a hard reset could
                    // reissue nonces already signed into in-flight txs.
                    let _ = dispatch.nonce_manager.sync_from_venue(
                        account_index,
                        api_key_index,
                        response.nonce,
                    );
                    log::debug!(
                        "Resynced Lighter nonce baseline after skip-window exhaustion: \
                         account_index={account_index}, api_key_index={api_key_index}, \
                         next_nonce={}",
                        response.nonce,
                    );
                }
                Err(e) => {
                    log::error!(
                        "Failed to resync Lighter nonce after skip-window exhaustion: {e}",
                    );
                }
            }
            Ok(())
        });
    }

    fn dispatch_create_order_plan(
        &self,
        plan: &CreateOrderPlan,
        credential: &Credential,
    ) -> anyhow::Result<()> {
        let context = self.fanout_dispatch_context(credential)?;
        let prepared = context.sign_create_order(plan)?;
        self.spawn_task("submit_order", async move {
            context.send_create_order(prepared).await;
            Ok(())
        });

        Ok(())
    }

    fn prepare_create_order_plan(
        &self,
        order: &OrderAny,
        slippage_bps: u32,
        params: Option<&Params>,
    ) -> anyhow::Result<CreateOrderPlan> {
        let attributes = self.resolve_create_attributes(params)?;
        let instrument_id = order.instrument_id();
        let market_index = self.registry.market_index(&instrument_id).ok_or_else(|| {
            anyhow::anyhow!("no Lighter market_index registered for instrument {instrument_id}")
        })?;

        let instrument = self.core.cache().try_instrument(&instrument_id)?.clone();

        let order_kind = nautilus_to_lighter_order_type(order.order_type())?;

        let tif = nautilus_to_lighter_tif(
            order.order_type(),
            order.time_in_force(),
            order.is_post_only(),
        )?;
        let now_ms = (self.clock.get_time_ns().as_u64() / 1_000_000) as i64;
        let order_expiry = order_expiry_for(
            order.order_type(),
            &order.time_in_force(),
            order.expire_time(),
            now_ms,
            self.config.use_gtd,
        )?;

        let base_amount = quantity_to_ticks(&order.quantity(), instrument.size_precision())?;

        // `quantity_to_ticks` floors sub-precision quantities to 0.
        anyhow::ensure!(
            base_amount > 0,
            "quantity `{}` rounds to 0 ticks at size_precision {}",
            order.quantity(),
            instrument.size_precision(),
        );
        let price_precision = instrument.price_precision();
        let is_buy = matches!(order.order_side(), OrderSide::Buy);

        // Lighter requires `price` on market-style orders as the worst
        // acceptable cap; derive it from far-side quote or trigger.
        let price_ticks = match order.order_type() {
            OrderType::Market => {
                let quote = self
                    .core
                    .cache()
                    .quote(&instrument_id)
                    .copied()
                    .ok_or_else(|| {
                        anyhow::anyhow!(
                            "no cached quote for {instrument_id}: subscribe to quotes before submitting MARKET orders",
                        )
                    })?;
                let base = if is_buy {
                    quote.ask_price.as_decimal()
                } else {
                    quote.bid_price.as_decimal()
                };
                derive_market_order_price_ticks(base, is_buy, price_precision, slippage_bps)?
            }
            OrderType::StopMarket | OrderType::MarketIfTouched => {
                let trigger = order.trigger_price().ok_or_else(|| {
                    anyhow::anyhow!("{:?} orders require a trigger_price", order.order_type(),)
                })?;
                derive_market_order_price_ticks(
                    trigger.as_decimal(),
                    is_buy,
                    price_precision,
                    slippage_bps,
                )?
            }
            _ => order
                .price()
                .map(|p| price_to_ticks(&p, price_precision))
                .transpose()?
                .unwrap_or(0),
        };

        let trigger_price_ticks = order
            .trigger_price()
            .map(|p| price_to_ticks(&p, price_precision))
            .transpose()?
            .unwrap_or(0);

        // Conditional types: `price_to_ticks` floors sub-tick triggers to 0,
        // which Lighter would then reject.
        if matches!(
            order.order_type(),
            OrderType::StopMarket
                | OrderType::StopLimit
                | OrderType::MarketIfTouched
                | OrderType::LimitIfTouched
        ) {
            anyhow::ensure!(
                trigger_price_ticks > 0,
                "trigger_price `{:?}` rounds to 0 ticks at precision {price_precision}",
                order.trigger_price(),
            );
        }
        validate_order_amount(&instrument, order.quantity(), price_ticks, price_precision)?;

        Ok(CreateOrderPlan {
            order: order.clone(),
            market_index,
            base_amount,
            price: price_ticks,
            order_type: order_kind as u8,
            time_in_force: tif as u8,
            trigger_price: trigger_price_ticks,
            order_expiry,
            attributes,
        })
    }

    fn resolve_create_attributes(&self, params: Option<&Params>) -> anyhow::Result<L2TxAttributes> {
        let mut attributes = integrator_attributes(self.integrator_account_index());

        let behavior = match params.and_then(|p| p.get("self_trade_behavior_mode")) {
            Some(value) => value
                .as_str()
                .context("Lighter self_trade_behavior_mode must be a string")?
                .parse::<LighterSelfTradeBehaviorMode>()
                .context("invalid Lighter self_trade_behavior_mode")?,
            None => LighterSelfTradeBehaviorMode::default(),
        };

        let equality = match params.and_then(|p| p.get("self_trade_equality_mode")) {
            Some(value) => value
                .as_str()
                .context("Lighter self_trade_equality_mode must be a string")?
                .parse::<LighterSelfTradeEqualityMode>()
                .context("invalid Lighter self_trade_equality_mode")?,
            None => LighterSelfTradeEqualityMode::default(),
        };

        attributes.self_trade_behavior_mode = Some(behavior);
        attributes.self_trade_equality_mode = Some(equality);
        attributes.validate()?;
        Ok(attributes)
    }

    fn prepare_create_group_plan(
        &self,
        orders: &[OrderAny],
        slippage_bps: u32,
        params: Option<&Params>,
    ) -> anyhow::Result<CreateGroupPlan> {
        let (grouping_type, indices) = grouped_order_indices(orders)?;
        let mut plans = Vec::with_capacity(indices.len());
        for index in indices {
            let order = &orders[index];
            let instrument = self
                .core
                .cache()
                .instrument(&order.instrument_id())
                .cloned();

            if let Some(reason) = local_submit_denial_reason(order, instrument.as_ref()) {
                return Err(reason);
            }

            anyhow::ensure!(
                !is_lighter_spot_order(order, instrument.as_ref()),
                "Lighter grouped orders require perpetual markets"
            );
            plans.push(self.prepare_create_order_plan(order, slippage_bps, params)?);
        }

        prepare_group_bodies(grouping_type, &mut plans, self.config.use_gtd)?;
        Ok(CreateGroupPlan {
            grouping_type,
            orders: plans,
        })
    }

    fn fanout_dispatch_context(
        &self,
        credential: &Credential,
    ) -> anyhow::Result<FanoutDispatchContext> {
        let pending_tasks = self
            .pending_tasks
            .spawner()
            .context("Lighter task admission is closed")?;
        Ok(FanoutDispatchContext {
            clock: self.clock,
            chain_id: self.config.chain_id(),
            integrator_account_index: self.integrator_account_index(),
            emitter: self.emitter.clone(),
            credential: credential.clone(),
            http_client: self.http_client.clone(),
            registry: Arc::clone(&self.registry),
            ws_client: self.ws_client.clone(),
            tx_rate_limiter: Arc::clone(&self.tx_rate_limiter),
            tx_send_sequencer: self.tx_send_sequencer.clone(),
            nonce_submission_gate: Arc::clone(&self.nonce_submission_gate),
            nonce_ready_connection_epoch: Arc::clone(&self.nonce_ready_connection_epoch),
            dispatch: self.dispatch.clone(),
            nonce_recovery_inflight: Arc::clone(&self.nonce_recovery_inflight),
            pending_tasks,
        })
    }

    fn dispatch_signed_cancel_order(&self, cmd: &CancelOrder, credential: &Credential) {
        let context = match self.fanout_dispatch_context(credential) {
            Ok(context) => context,
            Err(e) => {
                log::warn!("Skipping Lighter cancel_order after shutdown began: {e}");
                return;
            }
        };
        self.dispatch
            .set_pending_order_action(cmd.client_order_id, PendingOrderAction::Cancel);
        let emit_cancel_rejected = self.can_emit_order_cancel_rejected(&cmd.client_order_id);
        if !emit_cancel_rejected {
            self.dispatch
                .clear_pending_order_action_if(&cmd.client_order_id, PendingOrderAction::Cancel);
        }

        let prepared = match self
            .prepare_cancel_order_plan(cmd)
            .and_then(|plan| context.sign_cancel_order(&plan))
        {
            Ok(prepared) => prepared,
            Err(e) => {
                self.dispatch.clear_pending_order_action_if(
                    &cmd.client_order_id,
                    PendingOrderAction::Cancel,
                );
                let reason = format!("Lighter cancel_order failed: {e}");
                if emit_cancel_rejected {
                    log::warn!("{reason} for {}", cmd.client_order_id);
                    self.emitter.emit_order_cancel_rejected_event(
                        cmd.strategy_id,
                        cmd.instrument_id,
                        cmd.client_order_id,
                        cmd.venue_order_id,
                        &reason,
                        self.clock.get_time_ns(),
                    );
                } else {
                    log::warn!(
                        "{reason} for {}; suppressing OrderCancelRejected because order is not PendingCancel",
                        cmd.client_order_id,
                    );
                }
                return;
            }
        };

        self.spawn_task("cancel_order", async move {
            context
                .send_cancel_order(prepared, emit_cancel_rejected)
                .await;
            Ok(())
        });
    }

    fn dispatch_cancel_orders(&self, cancels: &[CancelOrder]) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot cancel without credentials")
        })?;

        if cancels.is_empty() {
            log::debug!("batch_cancel_orders called with empty cancel list");
            return Ok(());
        }

        let context = self.fanout_dispatch_context(credential)?;

        let emit_cancel_rejected: Vec<bool> = cancels
            .iter()
            .map(|cancel| self.can_emit_order_cancel_rejected(&cancel.client_order_id))
            .collect();

        let mut plans = Vec::with_capacity(cancels.len());

        for (cancel, emit_cancel_rejected) in cancels.iter().zip(emit_cancel_rejected) {
            let action = PendingOrderAction::cancel(emit_cancel_rejected);
            self.dispatch
                .set_pending_order_action(cancel.client_order_id, action);

            match self.prepare_cancel_order_plan(cancel) {
                Ok(plan) => {
                    let group = self
                        .prepare_oco_cancel_plans(cancel)
                        .unwrap_or_else(|| vec![plan]);
                    plans.extend(group.into_iter().map(|plan| {
                        let emit = self.can_emit_order_cancel_rejected(&plan.client_order_id);
                        (plan, emit)
                    }));
                }
                Err(e) => {
                    self.dispatch
                        .clear_pending_order_action_if(&cancel.client_order_id, action);
                    let reason = format!("Lighter cancel_order failed: {e}");

                    if emit_cancel_rejected {
                        self.emitter.emit_order_cancel_rejected_event(
                            cancel.strategy_id,
                            cancel.instrument_id,
                            cancel.client_order_id,
                            cancel.venue_order_id,
                            &reason,
                            self.clock.get_time_ns(),
                        );
                    } else {
                        log::warn!(
                            "{reason} for {}; suppressing OrderCancelRejected because order is not PendingCancel",
                            cancel.client_order_id,
                        );
                    }
                }
            }
        }

        let mut seen = AHashSet::new();
        plans.retain(|(plan, _)| seen.insert(plan.client_order_id));
        for (plan, emit) in &plans {
            self.dispatch
                .set_pending_order_action(plan.client_order_id, PendingOrderAction::cancel(*emit));
        }

        if plans.is_empty() {
            return Ok(());
        }

        self.spawn_task("batch_cancel_orders", async move {
            context
                .dispatch_batch_plans(
                    plans
                        .into_iter()
                        .map(|(plan, emit)| BatchOrderPlan::Cancel(plan, emit))
                        .collect(),
                )
                .await;
            Ok(())
        });

        Ok(())
    }

    fn can_emit_order_cancel_rejected(&self, client_order_id: &ClientOrderId) -> bool {
        self.core
            .cache()
            .order(client_order_id)
            .is_none_or(|order| order.is_pending_cancel())
    }

    fn prepare_cancel_order_plan(&self, cmd: &CancelOrder) -> anyhow::Result<CancelOrderPlan> {
        let market_index = self
            .registry
            .market_index(&cmd.instrument_id)
            .ok_or_else(|| {
                anyhow::anyhow!(
                    "no Lighter market_index registered for instrument {}",
                    cmd.instrument_id,
                )
            })?;

        self.core.cache().try_order(&cmd.client_order_id)?;

        // Lighter cancel_order targets a single order by venue order_id.
        // The map is populated on the first OrderStatusReport for the cloid.
        let voi = cmd
            .venue_order_id
            .or_else(|| self.dispatch.lookup_venue_order_id(&cmd.client_order_id))
            .ok_or_else(|| {
                anyhow::anyhow!(
                    "cannot cancel Lighter order {}: venue order_id not yet known \
                     (await OrderAccepted before issuing cancel)",
                    cmd.client_order_id,
                )
            })?;

        let venue_index: i64 = voi
            .as_str()
            .parse()
            .with_context(|| format!("Lighter venue_order_id `{voi}` is not an integer index"))?;

        Ok(CancelOrderPlan {
            client_order_id: cmd.client_order_id,
            strategy_id: cmd.strategy_id,
            instrument_id: cmd.instrument_id,
            venue_order_id: Some(voi),
            market_index,
            venue_index,
        })
    }

    fn dispatch_signed_modify_order(&self, cmd: &ModifyOrder, credential: &Credential) {
        let probe_context = match self.fanout_dispatch_context(credential) {
            Ok(context) => context.probe_context(),
            Err(e) => {
                log::warn!("Lighter modify probe unavailable: {e}");
                return;
            }
        };

        if !self.admit_modify_order(cmd) {
            return;
        }

        let prepared = match self.prepare_signed_modify_order(cmd, credential) {
            Ok(prepared) => prepared,
            Err(e) => {
                let mut events = self.dispatch.order_events.lock();
                self.dispatch
                    .clear_pending_modify_if_command(&cmd.client_order_id, cmd.command_id);
                let reason = format!("Lighter modify_order failed: {e}");
                log::warn!("{reason} for {}", cmd.client_order_id);
                self.emitter.emit_order_modify_rejected_event(
                    cmd.strategy_id,
                    cmd.instrument_id,
                    cmd.client_order_id,
                    cmd.venue_order_id,
                    &reason,
                    self.clock.get_time_ns(),
                );

                if let Some(deferred) = events.remove(&cmd.client_order_id) {
                    flush_modify_events(
                        cmd.client_order_id,
                        deferred,
                        &self.dispatch,
                        &self.emitter,
                        &mut events,
                    );
                }

                return;
            }
        };
        let PreparedModifyOrder {
            client_order_id,
            strategy_id,
            instrument_id,
            venue_order_id,
            tx_info,
            nonce,
            api_key_index,
            tx_hash,
            mut send_reservation,
        } = prepared;
        let connection_epoch = send_reservation.connection_epoch;

        let ws_client = self.ws_client.clone();
        let dispatch = self.dispatch.clone();
        let credential = credential.clone();
        let emitter = self.emitter.clone();
        let clock = self.clock;

        let tx_rate_limiter = self.tx_rate_limiter.clone();

        self.spawn_task("modify_order", async move {
            send_reservation.wait_for_turn().await;
            await_tx_quota(&tx_rate_limiter).await;

            let pending = PendingSendTx {
                batch_id: None,
                connection_epoch,
                kind: PendingSendTxKind::Modify {
                    strategy_id,
                    instrument_id,
                    client_order_id,
                    venue_order_id,
                },
                submitted_at: clock.get_time_ns(),
                nonce,
                api_key_index,
                tx_hash,
            };

            dispatch.enqueue_pending_sendtx(pending.clone());
            spawn_acked_order_probe(&pending, probe_context);

            if let Err(e) = ws_client
                .send_tx_on_connection(LighterTxType::ModifyOrder as u8, tx_info, connection_epoch)
                .await
            {
                let failure = classify_lighter_ws_command_failure("modify_order", &e);
                let reason = command_failure_reason(&failure);
                if matches!(&failure, CommandFailure::Ambiguous(_)) {
                    log::warn!(
                        "Lighter modify_order dispatch outcome unknown for {client_order_id}: {reason}; \
                         retaining pending state for venue reconciliation; diagnostic={e:?}",
                    );
                } else {
                    log::warn!("{reason} for {client_order_id}; diagnostic={e:?}");
                    dispatch.remove_pending_sendtx_by_nonce(connection_epoch, nonce);
                    rollback_tx_dispatch(&dispatch, &credential, None, nonce);
                    reject_modify_order(&dispatch, &emitter, &pending, reason, clock.get_time_ns());
                }
            }
            send_reservation.release();
            Ok(())
        });
    }

    fn admit_modify_order(&self, cmd: &ModifyOrder) -> bool {
        let _events = self.dispatch.order_events.lock();

        let publication_pending = self
            .dispatch
            .order_identity(&cmd.client_order_id)
            .is_some_and(|identity| {
                identity
                    .publication_pending(self.core.cache().order(&cmd.client_order_id).as_deref())
            });

        if !publication_pending && self.dispatch.set_pending_modify_action(cmd) {
            return true;
        }

        self.emitter.emit_order_modify_rejected_event(
            cmd.strategy_id,
            cmd.instrument_id,
            cmd.client_order_id,
            cmd.venue_order_id,
            "Lighter permits one unresolved modification per order; wait for its update or rejection",
            self.clock.get_time_ns(),
        );
        false
    }

    fn prepare_signed_modify_order(
        &self,
        cmd: &ModifyOrder,
        credential: &Credential,
    ) -> anyhow::Result<PreparedModifyOrder> {
        let plan = self.prepare_modify_order_plan(cmd)?;
        let context = self.fanout_dispatch_context(credential)?;
        let reserved = self.build_tx_context(credential)?;
        context.sign_modify_order(&plan, reserved)
    }

    fn prepare_modify_order_plan(&self, cmd: &ModifyOrder) -> anyhow::Result<ModifyOrderPlan> {
        let market_index = self
            .registry
            .market_index(&cmd.instrument_id)
            .ok_or_else(|| {
                anyhow::anyhow!(
                    "no Lighter market_index registered for instrument {}",
                    cmd.instrument_id,
                )
            })?;

        let voi = cmd
            .venue_order_id
            .or_else(|| self.dispatch.lookup_venue_order_id(&cmd.client_order_id))
            .ok_or_else(|| {
                anyhow::anyhow!(
                    "cannot modify Lighter order {}: venue order_id not yet known \
                     (await OrderAccepted before issuing modify)",
                    cmd.client_order_id,
                )
            })?;

        let venue_index: i64 = voi
            .as_str()
            .parse()
            .with_context(|| format!("Lighter venue_order_id `{voi}` is not an integer index"))?;

        let order = self.core.cache().try_order_owned(&cmd.client_order_id)?;
        let instrument = self
            .core
            .cache()
            .try_instrument(&cmd.instrument_id)?
            .clone();

        let new_qty = cmd.quantity.unwrap_or(order.quantity());
        anyhow::ensure!(
            !(order.parent_order_id().is_some()
                && self
                    .dispatch
                    .snapshot_for(&cmd.client_order_id)
                    .is_some_and(|shape| shape.quantity.is_zero())),
            "Lighter cannot modify an OTO child while it waits for parent execution"
        );
        let price_precision = instrument.price_precision();
        let new_trigger = cmd.trigger_price.or(order.trigger_price());
        let triggered = order.is_triggered() == Some(true)
            || self.dispatch.triggered_was_emitted(&cmd.client_order_id);
        anyhow::ensure!(
            !triggered || cmd.trigger_price.is_none(),
            "Lighter cannot modify a trigger price after the order has triggered"
        );

        // Market-style stops carry no limit price; Lighter still needs a worst-
        // acceptable `price` cap, derived from the trigger and slippage like submit.
        let price_ticks = match order.order_type() {
            OrderType::StopMarket | OrderType::MarketIfTouched => {
                let trigger = new_trigger.ok_or_else(|| {
                    anyhow::anyhow!("{:?} orders require a trigger_price", order.order_type())
                })?;
                let is_buy = matches!(order.order_side(), OrderSide::Buy);
                let slippage_bps = self.resolve_slippage_bps(cmd.params.as_ref());

                derive_market_order_price_ticks(
                    trigger.as_decimal(),
                    is_buy,
                    price_precision,
                    slippage_bps,
                )?
            }
            _ => {
                let new_price = cmd.price.or(order.price()).ok_or_else(|| {
                    anyhow::anyhow!("modify_order requires a price (none on order or command)")
                })?;

                price_to_ticks(&new_price, price_precision)?
            }
        };

        let base_amount = quantity_to_ticks(&new_qty, instrument.size_precision())?;
        anyhow::ensure!(
            base_amount > 0,
            "quantity `{new_qty}` rounds to 0 ticks at size_precision {}",
            instrument.size_precision(),
        );

        // Lighter amendments retain previously netted amounts in their initial size
        let reduced_qty = self
            .dispatch
            .order_identity(&cmd.client_order_id)
            .map_or(Decimal::ZERO, |identity| identity.reduced_qty());
        let reduced_qty = quantity_from_decimal(reduced_qty, instrument.size_precision())?;
        let reduced_amount = quantity_to_ticks(&reduced_qty, instrument.size_precision())?;
        let base_amount = base_amount
            .checked_add(reduced_amount)
            .context("Lighter modified quantity overflow")?;

        let trigger_price_ticks = match new_trigger.filter(|_| !triggered) {
            Some(trigger) if !trigger.is_zero() => price_to_ticks(&trigger, price_precision)?,
            _ => 0,
        };

        if !triggered
            && matches!(
                order.order_type(),
                OrderType::StopMarket
                    | OrderType::StopLimit
                    | OrderType::MarketIfTouched
                    | OrderType::LimitIfTouched
            )
        {
            anyhow::ensure!(
                trigger_price_ticks > 0,
                "trigger_price `{new_trigger:?}` rounds to 0 ticks at precision {price_precision}",
            );
        }
        validate_order_amount(&instrument, new_qty, price_ticks, price_precision)?;
        self.dispatch.set_pending_modify_shape(
            cmd,
            OrderShapeSnapshot {
                quantity: parse_quantity_from_ticks(base_amount, instrument.size_precision())?,
                price: LIMIT_ORDER_TYPES
                    .contains(&order.order_type())
                    .then(|| parse_price_from_ticks(price_ticks, price_precision))
                    .transpose()?,
                trigger_price: STOP_ORDER_TYPES
                    .contains(&order.order_type())
                    .then(|| {
                        if triggered {
                            Ok(None)
                        } else {
                            parse_price_from_ticks(trigger_price_ticks, price_precision).map(Some)
                        }
                    })
                    .transpose()?
                    .flatten(),
            },
        );

        Ok(ModifyOrderPlan {
            command_id: cmd.command_id,
            client_order_id: cmd.client_order_id,
            strategy_id: cmd.strategy_id,
            instrument_id: cmd.instrument_id,
            venue_order_id: Some(voi),
            market_index,
            venue_index,
            base_amount,
            price: price_ticks,
            trigger_price: trigger_price_ticks,
        })
    }

    /// Submit Lighter's native `UpdateLeverage` tx (`tx_type = 20`).
    ///
    /// Changes the initial margin fraction and the position margin mode for
    /// the given market. `initial_margin_fraction` is in venue ticks
    /// (1e-4 fraction): `500` = 5% initial margin = 20x leverage,
    /// `1000` = 10% = 10x, etc. Valid range is `1..=10_000`
    /// (the upstream `MarginFractionTick` cap).
    ///
    /// Nautilus does not expose a `set_leverage` command on the execution
    /// trait, so this method is callable directly from strategy or bootstrap
    /// code.
    ///
    /// # Errors
    ///
    /// Returns an error if credentials are missing, the instrument is not
    /// registered, `initial_margin_fraction` is outside `1..=10_000`, or
    /// the dispatch pre-flight (nonce allocation, signing) fails. Transport
    /// errors after dispatch are logged but not returned synchronously.
    pub fn update_leverage(
        &self,
        instrument_id: InstrumentId,
        initial_margin_fraction: u16,
        margin_mode: LighterPositionMarginMode,
    ) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot update leverage without credentials")
        })?;

        let market_index = self.registry.market_index(&instrument_id).ok_or_else(|| {
            anyhow::anyhow!("no Lighter market_index registered for instrument {instrument_id}")
        })?;

        anyhow::ensure!(
            (1..=10_000).contains(&initial_margin_fraction),
            "initial_margin_fraction must be in 1..=10_000, was {initial_margin_fraction}",
        );

        let ReservedTxContext {
            context,
            mut send_reservation,
        } = self.build_tx_context(credential)?;

        let connection_epoch = send_reservation.connection_epoch;

        let captured_nonce = context.nonce;
        let captured_api_key_index = context.api_key_index;
        let mut rollback_guard =
            TxDispatchGuard::new(self.dispatch.clone(), credential, None, captured_nonce);

        let tx = UpdateLeverageTxInfo {
            context,
            market_index,
            initial_margin_fraction,
            margin_mode: margin_mode as u8,
            skip_nonce: 0,
        };

        let signed = sign_tx(
            &tx,
            self.config.chain_id(),
            &credential.private_key()?,
            fresh_k(),
        )?;

        let tx_info_str = TxInfoJson::update_leverage(&tx, &signed);
        let tx_info = serde_json::value::RawValue::from_string(tx_info_str)
            .context("failed to wrap signed Lighter update_leverage tx_info JSON")?;

        rollback_guard.disarm();
        let captured_tx_hash = signed.tx_hash_hex();

        let ws_client = self.ws_client.clone();
        let dispatch = self.dispatch.clone();
        let credential = credential.clone();
        let clock = self.clock;

        let tx_rate_limiter = self.tx_rate_limiter.clone();

        self.spawn_task("update_leverage", async move {
            send_reservation.wait_for_turn().await;
            await_tx_quota(&tx_rate_limiter).await;
            dispatch.enqueue_pending_sendtx(PendingSendTx {
                batch_id: None,
                connection_epoch,
                kind: PendingSendTxKind::Other,
                submitted_at: clock.get_time_ns(),
                nonce: captured_nonce,
                api_key_index: captured_api_key_index,
                tx_hash: captured_tx_hash,
            });

            if let Err(e) = ws_client
                .send_tx_on_connection(
                    LighterTxType::UpdateLeverage as u8,
                    tx_info,
                    connection_epoch,
                )
                .await
            {
                let failure = classify_lighter_ws_command_failure("update_leverage", &e);
                let reason = command_failure_reason(&failure);
                if matches!(&failure, CommandFailure::Ambiguous(_)) {
                    log::warn!(
                        "Lighter update_leverage dispatch outcome unknown for {instrument_id}: \
                         {reason}; retaining pending nonce for venue reconciliation; diagnostic={e:?}",
                    );
                } else {
                    log::error!("{reason} for {instrument_id}; diagnostic={e:?}");
                    dispatch.remove_pending_sendtx_by_nonce(connection_epoch, captured_nonce);
                    rollback_tx_dispatch(&dispatch, &credential, None, captured_nonce);
                }
            }
            send_reservation.release();
            Ok(())
        });

        Ok(())
    }
}

fn emit_lighter_position_reports(
    reports: Vec<PositionStatusReport>,
    removed: Vec<InstrumentId>,
    emitter: &ExecutionEventEmitter,
    account_id: AccountId,
    now: UnixNanos,
) {
    for report in reports {
        log::debug!(
            "Lighter PositionStatusReport: instrument={} side={:?} qty={}",
            report.instrument_id,
            report.position_side,
            report.quantity,
        );
        emitter.send_position_report(report);
    }

    // Emit Flat so the engine observes positions the venue reports as closed
    for instrument_id in removed {
        let flat = PositionStatusReport::new(
            account_id,
            instrument_id,
            PositionSide::Flat,
            Quantity::zero(0),
            now,
            now,
            Some(UUID4::new()),
            None,
            None,
        );
        emitter.send_position_report(flat);
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum AuthTokenRefreshOutcome {
    Rotated,
    Cancelled,
    Exhausted,
}

#[derive(Debug, Clone, Copy)]
struct AuthTokenRefreshBackoff {
    initial_delay: Duration,
    max_delay: Duration,
    window: Duration,
}

#[derive(Clone)]
struct NonceRefreshRetry {
    http_client: LighterHttpClient,
    dispatch: WsDispatchState,
    credential: Option<Credential>,
    submission_gate: Arc<tokio::sync::RwLock<()>>,
    ready_connection_epoch: Arc<AtomicU64>,
    ws_client: LighterWebSocketClient,
    cancellation_token: CancellationToken,
    pending_tasks: TaskSpawner,
}

impl NonceRefreshRetry {
    fn spawn(self, connection_epoch: u64) {
        let pending_tasks = self.pending_tasks.clone();

        let future = async move {
            let Some(credential) = self.credential else {
                return;
            };
            let mut retry_delay = NONCE_REFRESH_RETRY_INITIAL_DELAY;

            loop {
                tokio::select! {
                    () = self.cancellation_token.cancelled() => return,
                    () = tokio::time::sleep(retry_delay) => {}
                }

                if self.ws_client.connection_epoch() != connection_epoch
                    || self.ready_connection_epoch.load(Ordering::Acquire) == connection_epoch
                {
                    return;
                }

                let _refresh_guard = tokio::select! {
                    () = self.cancellation_token.cancelled() => return,
                    guard = self.submission_gate.write() => guard,
                };

                if self.ws_client.connection_epoch() != connection_epoch
                    || self.ready_connection_epoch.load(Ordering::Acquire) == connection_epoch
                {
                    return;
                }

                let result = tokio::select! {
                    () = self.cancellation_token.cancelled() => return,
                    result = self.http_client.get_next_nonce(
                        credential.account_index(),
                        credential.api_key_index(),
                    ) => result,
                };

                match result {
                    Ok(response) => {
                        if self.ws_client.connection_epoch() != connection_epoch {
                            return;
                        }
                        self.dispatch.nonce_manager.refresh(
                            credential.account_index(),
                            credential.api_key_index(),
                            response.nonce,
                        );
                        self.ready_connection_epoch
                            .store(connection_epoch, Ordering::Release);
                        log::info!(
                            "Recovered Lighter nonce refresh: account_index={}, \
                             connection_epoch={connection_epoch}, next_nonce={}",
                            credential.account_index(),
                            response.nonce,
                        );
                        return;
                    }
                    Err(e) => {
                        log::warn!(
                            "Failed to retry Lighter nonce refresh for connection epoch \
                             {connection_epoch}: {e}",
                        );
                    }
                }

                retry_delay = retry_delay
                    .saturating_mul(2)
                    .min(NONCE_REFRESH_RETRY_MAX_DELAY);
            }
        };

        if let Err(e) = pending_tasks.spawn(future) {
            log::debug!("Skipping Lighter nonce refresh retry during shutdown: {e}");
        }
    }
}

fn auth_token_rotation_channels(account_index: i64) -> [LighterWsChannel; 5] {
    [
        LighterWsChannel::AccountAllOrders(account_index),
        LighterWsChannel::AccountAllTrades(account_index),
        LighterWsChannel::AccountAllPositions(account_index),
        LighterWsChannel::AccountAllAssets(account_index),
        LighterWsChannel::UserStats(account_index),
    ]
}

async fn refresh_auth_token_until_rotated<MintToken, Subscribe, SubscribeFuture>(
    credential: &Credential,
    channels: &[LighterWsChannel],
    cancellation_token: &CancellationToken,
    backoff: AuthTokenRefreshBackoff,
    mut mint_token: MintToken,
    mut subscribe: Subscribe,
) -> AuthTokenRefreshOutcome
where
    MintToken: FnMut(&Credential) -> anyhow::Result<SecretString>,
    Subscribe: FnMut(LighterWsChannel, SecretString) -> SubscribeFuture,
    SubscribeFuture: Future<Output = Result<(), crate::websocket::error::LighterWsError>>,
{
    let retry_started = tokio::time::Instant::now();
    let mut retry_delay = backoff.initial_delay.min(backoff.max_delay);
    let mut attempt = 1_u32;

    loop {
        match rotate_auth_token_once(credential, channels, &mut mint_token, &mut subscribe).await {
            Ok(()) => {
                log::debug!(
                    "Lighter auth-token rotated for account_index={}, attempts={attempt}",
                    credential.account_index(),
                );
                return AuthTokenRefreshOutcome::Rotated;
            }
            Err(e) => {
                log::warn!("Lighter auth-token rotation attempt {attempt} failed: {e:#}");
            }
        }

        let Some(remaining) = backoff.window.checked_sub(retry_started.elapsed()) else {
            log::error!(
                "Lighter auth-token rotation retry window exhausted: account_index={}, attempts={attempt}",
                credential.account_index(),
            );
            return AuthTokenRefreshOutcome::Exhausted;
        };

        if remaining.as_nanos() == 0 {
            log::error!(
                "Lighter auth-token rotation retry window exhausted: account_index={}, attempts={attempt}",
                credential.account_index(),
            );
            return AuthTokenRefreshOutcome::Exhausted;
        }

        let delay = retry_delay.min(remaining);
        log::warn!(
            "Retrying Lighter auth-token rotation in {:.3}s: account_index={}, attempts={attempt}",
            delay.as_secs_f64(),
            credential.account_index(),
        );

        if !sleep_or_auth_token_refresh_cancelled(delay, cancellation_token).await {
            return AuthTokenRefreshOutcome::Cancelled;
        }

        retry_delay = next_auth_token_refresh_retry_delay(retry_delay, backoff.max_delay);
        attempt = attempt.saturating_add(1);
    }
}

async fn rotate_auth_token_once<MintToken, Subscribe, SubscribeFuture>(
    credential: &Credential,
    channels: &[LighterWsChannel],
    mint_token: &mut MintToken,
    subscribe: &mut Subscribe,
) -> anyhow::Result<()>
where
    MintToken: FnMut(&Credential) -> anyhow::Result<SecretString>,
    Subscribe: FnMut(LighterWsChannel, SecretString) -> SubscribeFuture,
    SubscribeFuture: Future<Output = Result<(), crate::websocket::error::LighterWsError>>,
{
    let token =
        mint_token(credential).context("failed to mint Lighter auth token during rotation")?;
    let mut first_error = None;

    for channel in channels {
        if let Err(e) = subscribe(channel.clone(), token.clone()).await {
            log::debug!("Lighter auth-token rotation: re-subscribe failed for {channel:?}: {e}",);
            first_error.get_or_insert_with(|| format!("{channel:?}: {e}"));
        }
    }

    if let Some(error) = first_error {
        anyhow::bail!("failed to re-subscribe Lighter account channels: {error}");
    }

    Ok(())
}

async fn sleep_or_auth_token_refresh_cancelled(
    duration: Duration,
    cancellation_token: &CancellationToken,
) -> bool {
    tokio::select! {
        () = cancellation_token.cancelled() => false,
        () = tokio::time::sleep(duration) => true,
    }
}

fn auth_token_refresh_next_delay(outcome: AuthTokenRefreshOutcome) -> Option<Duration> {
    match outcome {
        AuthTokenRefreshOutcome::Rotated => Some(AUTH_TOKEN_REFRESH_INTERVAL),
        AuthTokenRefreshOutcome::Cancelled => None,
        AuthTokenRefreshOutcome::Exhausted => Some(AUTH_TOKEN_REFRESH_RETRY_MAX_DELAY),
    }
}

fn next_auth_token_refresh_retry_delay(current: Duration, max: Duration) -> Duration {
    current.checked_mul(2).unwrap_or(max).min(max)
}

#[derive(Debug)]
struct ReservedTxContext {
    context: TxContext,
    send_reservation: TxSendReservation,
}

#[derive(Debug, Clone)]
struct TxSendSequencer {
    state: Arc<Mutex<TxSendSequencerState>>,
    version: Arc<AtomicU64>,
    changed: tokio::sync::watch::Sender<u64>,
}

impl TxSendSequencer {
    fn new() -> Self {
        let (changed, _) = tokio::sync::watch::channel(0);
        Self {
            state: Arc::new(Mutex::new(TxSendSequencerState::default())),
            version: Arc::new(AtomicU64::new(0)),
            changed,
        }
    }

    fn reserve(
        &self,
        account_index: i64,
        api_key_index: u8,
        allocate_nonce: impl FnOnce() -> Result<i64, NonceError>,
    ) -> Result<TxSendReservation, NonceError> {
        let key = TxSendKey {
            account_index,
            api_key_index,
        };

        let mut state = self.state.lock();
        let nonce = allocate_nonce()?;
        *state
            .pending
            .entry(key)
            .or_default()
            .entry(nonce)
            .or_default() += 1;
        drop(state);
        self.notify_waiters();
        Ok(TxSendReservation {
            sequencer: self.clone(),
            key,
            nonce,
            released: false,
            nonce_guard: None,
            connection_epoch: 0,
        })
    }

    async fn wait_for_turn(&self, key: TxSendKey, nonce: i64) {
        let mut changed = self.changed.subscribe();

        loop {
            if self.ready_to_send(key, nonce) {
                return;
            }

            if changed.changed().await.is_err() {
                tokio::task::yield_now().await;
            }
        }
    }

    fn release(&self, key: TxSendKey, nonce: i64) {
        let mut state = self.state.lock();

        let should_notify = if let Some(pending) = state.pending.get_mut(&key) {
            let removed = if let Some(count) = pending.get_mut(&nonce) {
                *count -= 1;
                if *count == 0 {
                    pending.remove(&nonce);
                }

                true
            } else {
                false
            };

            if pending.is_empty() {
                state.pending.remove(&key);
            }
            removed
        } else {
            false
        };
        drop(state);

        if should_notify {
            self.notify_waiters();
        }
    }

    fn ready_to_send(&self, key: TxSendKey, nonce: i64) -> bool {
        let state = self.state.lock();
        state
            .pending
            .get(&key)
            .and_then(|pending| pending.first_key_value())
            .is_none_or(|(first, _)| *first >= nonce)
    }

    fn notify_waiters(&self) {
        let version = self.version.fetch_add(1, Ordering::AcqRel) + 1;
        let _ = self.changed.send(version);
    }
}

#[derive(Debug, Default)]
struct TxSendSequencerState {
    pending: BTreeMap<TxSendKey, BTreeMap<i64, usize>>,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
struct TxSendKey {
    account_index: i64,
    api_key_index: u8,
}

#[derive(Debug)]
struct TxSendReservation {
    sequencer: TxSendSequencer,
    key: TxSendKey,
    nonce: i64,
    released: bool,
    nonce_guard: Option<tokio::sync::OwnedRwLockReadGuard<()>>,
    connection_epoch: u64,
}

impl TxSendReservation {
    fn with_nonce_ownership(
        mut self,
        nonce_guard: tokio::sync::OwnedRwLockReadGuard<()>,
        connection_epoch: u64,
    ) -> Self {
        self.nonce_guard = Some(nonce_guard);
        self.connection_epoch = connection_epoch;
        self
    }

    async fn wait_for_turn(&self) {
        self.sequencer.wait_for_turn(self.key, self.nonce).await;
    }

    fn release(&mut self) {
        if self.released {
            return;
        }

        self.sequencer.release(self.key, self.nonce);
        self.nonce_guard.take();
        self.released = true;
    }
}

impl Drop for TxSendReservation {
    fn drop(&mut self) {
        self.release();
    }
}

#[cfg(test)]
async fn wait_for_tx_send_reservations(reservations: &[&TxSendReservation]) {
    let Some(first) = reservations.first() else {
        return;
    };

    debug_assert!(
        reservations
            .iter()
            .all(|reservation| reservation.key == first.key),
        "batch send reservations must share one nonce stream",
    );

    let nonce = reservations
        .iter()
        .map(|reservation| reservation.nonce)
        .min()
        .expect("reservations is non-empty");
    first.sequencer.wait_for_turn(first.key, nonce).await;
}

struct PreparedCreateOrder {
    order: OrderAny,
    client_order_index: i64,
    tx_info: Box<serde_json::value::RawValue>,
    nonce: i64,
    api_key_index: u8,
    tx_hash: String,
    send_reservation: TxSendReservation,
}

struct CreateOrderPlan {
    order: OrderAny,
    market_index: i64,
    base_amount: i64,
    price: u32,
    order_type: u8,
    time_in_force: u8,
    trigger_price: u32,
    order_expiry: i64,
    attributes: L2TxAttributes,
}

impl CreateOrderPlan {
    fn order_info(&self, client_order_index: i64) -> OrderInfo {
        OrderInfo {
            market_index: self.market_index,
            client_order_index,
            base_amount: self.base_amount,
            price: self.price,
            is_ask: self.order.order_side() == OrderSide::Sell,
            order_type: self.order_type,
            time_in_force: self.time_in_force,
            reduce_only: self.order.is_reduce_only(),
            trigger_price: self.trigger_price,
            order_expiry: self.order_expiry,
        }
    }
}

struct CreateGroupPlan {
    grouping_type: LighterGroupingType,
    orders: Vec<CreateOrderPlan>,
}

struct PreparedCancelOrder {
    client_order_id: ClientOrderId,
    strategy_id: StrategyId,
    instrument_id: InstrumentId,
    venue_order_id: Option<VenueOrderId>,
    tx_info: Box<serde_json::value::RawValue>,
    nonce: i64,
    api_key_index: u8,
    tx_hash: String,
    send_reservation: TxSendReservation,
}

struct CancelOrderPlan {
    client_order_id: ClientOrderId,
    strategy_id: StrategyId,
    instrument_id: InstrumentId,
    venue_order_id: Option<VenueOrderId>,
    market_index: i64,
    venue_index: i64,
}

#[derive(Clone)]
struct FanoutDispatchContext {
    clock: &'static AtomicTime,
    chain_id: u32,
    integrator_account_index: Option<u64>,
    emitter: ExecutionEventEmitter,
    credential: Credential,
    http_client: LighterHttpClient,
    registry: Arc<MarketRegistry>,
    ws_client: LighterWebSocketClient,
    tx_rate_limiter: Arc<LighterTxRateLimiter>,
    tx_send_sequencer: TxSendSequencer,
    nonce_submission_gate: Arc<tokio::sync::RwLock<()>>,
    nonce_ready_connection_epoch: Arc<AtomicU64>,
    dispatch: WsDispatchState,
    nonce_recovery_inflight: Arc<AtomicBool>,
    pending_tasks: TaskSpawner,
}

impl FanoutDispatchContext {
    async fn refresh_scheduled_cancel(&self, timeout_secs: u64) -> anyhow::Result<()> {
        let deadline = self
            .clock
            .get_time_ms()
            .checked_add(timeout_secs * 1_000)
            .and_then(|deadline| i64::try_from(deadline).ok())
            .context("scheduled cancellation deadline overflows milliseconds")?;
        let cancellation = self.pending_tasks.cancellation_token().child_token();
        let _guard = cancellation.clone().drop_guard();
        tokio::time::timeout(
            SCHEDULED_CANCEL_REQUEST_TIMEOUT,
            self.send_cancel_all(
                LighterCancelAllTimeInForce::Scheduled,
                deadline,
                true,
                cancellation,
            ),
        )
        .await
        .context("scheduled cancellation request timed out")??;
        Ok(())
    }

    async fn send_cancel_all(
        &self,
        time_in_force: LighterCancelAllTimeInForce,
        scheduled_time_ms: i64,
        require_execution: bool,
        cancellation: CancellationToken,
    ) -> anyhow::Result<String> {
        let credential = &self.credential;
        let ReservedTxContext {
            context,
            mut send_reservation,
        } = self.build_tx_context()?;
        let mut rollback_guard =
            TxDispatchGuard::new(self.dispatch.clone(), credential, None, context.nonce);

        let tx = CancelAllOrdersTxInfo {
            context,
            time_in_force: time_in_force as u8,
            scheduled_time_ms,
            skip_nonce: 0,
        };

        let signed = sign_tx(&tx, self.chain_id, &credential.private_key()?, fresh_k())?;
        let tx_info = TxInfoJson::cancel_all_orders(&tx, &signed);
        let tx_info = serde_json::value::RawValue::from_string(tx_info)
            .context("failed to wrap signed Lighter account cancellation JSON")?;
        let tx_hash = signed.tx_hash_hex();
        let connection_epoch = send_reservation.connection_epoch;
        let ws_client = self.ws_client.clone();
        let dispatch = self.dispatch.clone();
        let credential = credential.clone();
        let clock = self.clock;
        let tx_rate_limiter = self.tx_rate_limiter.clone();
        let dispatched_hash = tx_hash.clone();
        let (response_tx, response_rx) = tokio::sync::oneshot::channel();

        self.pending_tasks
            .spawn(async move {
                {
                    let ready = async {
                        send_reservation.wait_for_turn().await;
                        await_tx_quota(&tx_rate_limiter).await;
                    };

                    tokio::pin!(ready);
                    tokio::select! {
                        biased;
                        () = cancellation.cancelled() => {
                            // Later signed commands depend on a non-tail nonce reaching the venue
                            if matches!(dispatch.nonce_manager.ack_failure_if_latest(
                                context.account_index, context.api_key_index, context.nonce,
                            ), Ok(true)) {
                                rollback_guard.disarm();
                                return;
                            }
                            ready.await;
                        }
                        () = &mut ready => {},
                    }
                }

                dispatch.enqueue_pending_sendtx(PendingSendTx {
                    batch_id: None,
                    connection_epoch,
                    kind: PendingSendTxKind::Other,
                    submitted_at: clock.get_time_ns(),
                    nonce: context.nonce,
                    api_key_index: context.api_key_index,
                    tx_hash: dispatched_hash.clone(),
                });

                rollback_guard.disarm();
                let response = ws_client.send_tx_on_connection(
                    LighterTxType::CancelAllOrders as u8, tx_info, connection_epoch,
                ).await;

                if let Err(e) = &response {
                    let failure =
                        classify_lighter_ws_command_failure("cancel_all_orders_account", e);
                    log::warn!(
                        "Lighter account cancellation transaction {dispatched_hash} dispatch failed, nonce={}: {failure:?}; diagnostic={e}",
                        context.nonce,
                    );

                    if !matches!(failure, CommandFailure::Ambiguous(_)) {
                        dispatch.remove_pending_sendtx_by_hash(connection_epoch, &dispatched_hash);
                        rollback_tx_dispatch(&dispatch, &credential, None, context.nonce);
                    }
                }

                send_reservation.release();
                let _ = response_tx.send(response);
            })
            .context("failed to spawn Lighter account cancellation")?;

        let response = response_rx.await.with_context(|| {
            format!("Lighter account cancellation transaction {tx_hash} dispatch outcome unknown after session shutdown")
        })?;

        response.with_context(|| {
            format!("failed to submit Lighter account cancellation transaction {tx_hash}")
        })?;

        let confirmation = async {
            loop {
                match self.http_client.get_tx(tx_hash.clone()).await {
                    Ok(tx) => {
                        anyhow::ensure!(
                            tx.status != LighterTxStatus::Failed,
                            "Lighter account cancellation transaction {tx_hash} failed: {}",
                            tx.event_info,
                        );

                        if require_execution && tx.status != LighterTxStatus::Executed {
                            tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY).await;
                            continue;
                        }

                        let event = parse_acked_tx_event(&tx.event_info).with_context(|| {
                            format!("failed to parse Lighter account cancellation transaction {tx_hash} event")
                        })?;

                        anyhow::ensure!(
                            event.app_error.is_empty(),
                            "Lighter account cancellation transaction {tx_hash} failed: {}",
                            event.app_error,
                        );

                        anyhow::ensure!(
                            !require_execution
                                || (tx_hash_matches(&tx.hash, &tx_hash)
                                    && tx.tx_type == LighterTxType::CancelAllOrders as u8
                                    && tx.account_index == self.credential.account_index()
                                    && tx.api_key_index == self.credential.api_key_index()
                                    && tx.nonce == context.nonce),
                            "Lighter scheduled cancellation transaction identity mismatch",
                        );
                        return Ok(tx_hash.clone());
                    }
                    Err(LighterHttpError::Venue { code: 21500, .. }) => {}
                    Err(e) => {
                        return Err(e).with_context(|| {
                            format!("failed to look up Lighter account cancellation transaction {tx_hash}")
                        });
                    }
                }

                tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY).await;
            }
        };

        tokio::time::timeout(
            if require_execution {
                SCHEDULED_CANCEL_REQUEST_TIMEOUT
            } else {
                ACCOUNT_CANCEL_CONFIRM_TIMEOUT
            },
            confirmation,
        )
        .await
        .with_context(|| {
            format!("Lighter account cancellation transaction {tx_hash} confirmation timed out")
        })?
    }

    async fn dispatch_batch_plans(&self, plans: Vec<BatchOrderPlan>) {
        for chunk in plans.chunks(LIGHTER_MAX_BATCH_TX) {
            let mut batch = Vec::with_capacity(chunk.len());
            let mut remaining = chunk.iter().peekable();
            let mut retry_delay = NONCE_REFRESH_RETRY_INITIAL_DELAY;

            while let Some(plan) = remaining.peek() {
                match self.sign_batch_plan(plan) {
                    Ok(prepared) => {
                        batch.push(prepared);
                        retry_delay = NONCE_REFRESH_RETRY_INITIAL_DELAY;
                    }
                    Err(e) if should_retry_batch_signing(&e) => {
                        self.send_batch(std::mem::take(&mut batch)).await;
                        tokio::time::sleep(retry_delay).await;
                        retry_delay = (retry_delay * 2).min(NONCE_REFRESH_RETRY_MAX_DELAY);
                        continue;
                    }
                    Err(e) => self.reject_batch_plan(plan, &e.to_string()),
                }

                remaining.next();
            }

            self.send_batch(batch).await;
        }
    }

    fn probe_context(&self) -> AckedOrderProbeContext {
        AckedOrderProbeContext {
            http_client: self.http_client.clone(),
            registry: Arc::clone(&self.registry),
            credential: self.credential.clone(),
            dispatch: self.dispatch.clone(),
            account_id: self.emitter.account_id(),
            clock: self.clock,
            emitter: self.emitter.clone(),
            connection_epoch: self.ws_client.connection_epoch_atomic(),
            cancellation_token: self.pending_tasks.cancellation_token(),
            pending_tasks: self.pending_tasks.clone(),
        }
    }

    fn sign_batch_plan(&self, plan: &BatchOrderPlan) -> anyhow::Result<PreparedBatchTx> {
        match plan {
            BatchOrderPlan::Create(plan) => self.sign_create_order(plan).map(PreparedBatchTx::from),
            BatchOrderPlan::CreateGroup(plan) => self.sign_create_group(plan),
            BatchOrderPlan::Modify(plan) => {
                let reserved = self.build_tx_context()?;
                self.sign_modify_order(plan, reserved)
                    .map(PreparedBatchTx::from)
            }
            BatchOrderPlan::Cancel(plan, emit) => self
                .sign_cancel_order(plan)
                .map(|prepared| PreparedBatchTx::from((prepared, *emit))),
        }
    }

    fn reject_batch_plan(&self, plan: &BatchOrderPlan, error: &str) {
        match plan {
            BatchOrderPlan::CreateGroup(plan) => {
                for leg in &plan.orders {
                    self.emitter.emit_order_denied(
                        &leg.order,
                        &format!("Lighter grouped submit failed: {error}"),
                    );
                }
            }
            BatchOrderPlan::Create(plan) => {
                let reason = OrderDeniedReason::SubmitFailed {
                    detail: format!("Lighter submit_order_list failed: {error}"),
                };

                self.emitter
                    .emit_order_denied(&plan.order, &reason.to_string());
            }
            BatchOrderPlan::Modify(plan) => {
                let mut events = self.dispatch.order_events.lock();

                if self
                    .dispatch
                    .clear_pending_modify_if_command(&plan.client_order_id, plan.command_id)
                {
                    self.emitter.emit_order_modify_rejected_event(
                        plan.strategy_id,
                        plan.instrument_id,
                        plan.client_order_id,
                        plan.venue_order_id,
                        &format!("Lighter modify_order failed: {error}"),
                        self.clock.get_time_ns(),
                    );

                    if let Some(deferred) = events.remove(&plan.client_order_id) {
                        flush_modify_events(
                            plan.client_order_id,
                            deferred,
                            &self.dispatch,
                            &self.emitter,
                            &mut events,
                        );
                    }
                }
            }
            BatchOrderPlan::Cancel(plan, emit) => {
                self.dispatch.clear_pending_order_action_if(
                    &plan.client_order_id,
                    PendingOrderAction::cancel(*emit),
                );
                let reason = format!("Lighter cancel_order failed: {error}");

                if *emit {
                    self.emitter.emit_order_cancel_rejected_event(
                        plan.strategy_id,
                        plan.instrument_id,
                        plan.client_order_id,
                        plan.venue_order_id,
                        &reason,
                        self.clock.get_time_ns(),
                    );
                } else {
                    log::warn!(
                        "{reason} for {}; suppressing OrderCancelRejected because order is not PendingCancel",
                        plan.client_order_id
                    );
                }
            }
        }
    }

    fn build_tx_context(&self) -> anyhow::Result<ReservedTxContext> {
        let connection_epoch = self.ws_client.connection_epoch();
        anyhow::ensure!(
            self.nonce_ready_connection_epoch.load(Ordering::Acquire) == connection_epoch,
            TxPreparationError::NonceRefreshPending(connection_epoch),
        );
        let nonce_guard = Arc::clone(&self.nonce_submission_gate)
            .try_read_owned()
            .context("Lighter nonce refresh is in progress")?;
        anyhow::ensure!(
            self.ws_client.connection_epoch() == connection_epoch
                && self.nonce_ready_connection_epoch.load(Ordering::Acquire) == connection_epoch,
            TxPreparationError::StateChanged,
        );

        let send_reservation = match self.tx_send_sequencer.reserve(
            self.credential.account_index(),
            self.credential.api_key_index(),
            || {
                self.dispatch.nonce_manager.next_nonce(
                    self.credential.account_index(),
                    self.credential.api_key_index(),
                )
            },
        ) {
            Ok(reservation) => reservation,
            Err(e @ NonceError::SkipWindowExhausted { .. }) => {
                self.spawn_nonce_window_recovery();
                let reason = format!("failed to allocate Lighter nonce: {e}");
                return Err(anyhow::Error::new(e).context(reason));
            }
            Err(e) => anyhow::bail!("failed to allocate Lighter nonce: {e}"),
        };

        let nonce = send_reservation.nonce;

        let now_ns = self.clock.get_time_ns().as_u64() as i64;
        let expired_at = (now_ns / 1_000_000).saturating_add(DEFAULT_TX_EXPIRY_MS);
        let send_reservation = send_reservation.with_nonce_ownership(nonce_guard, connection_epoch);

        Ok(ReservedTxContext {
            context: TxContext {
                account_index: self.credential.account_index(),
                api_key_index: self.credential.api_key_index(),
                nonce,
                expired_at,
            },
            send_reservation,
        })
    }

    fn spawn_nonce_window_recovery(&self) {
        if self.nonce_recovery_inflight.swap(true, Ordering::AcqRel) {
            return;
        }

        let inflight = Arc::clone(&self.nonce_recovery_inflight);
        let http_client = self.http_client.clone();
        let dispatch = self.dispatch.clone();
        let nonce_submission_gate = Arc::clone(&self.nonce_submission_gate);
        let account_index = self.credential.account_index();
        let api_key_index = self.credential.api_key_index();

        let future = async move {
            let _refresh_guard = nonce_submission_gate.write().await;
            let result = http_client
                .get_next_nonce(account_index, api_key_index)
                .await;
            inflight.store(false, Ordering::Release);

            match result {
                Ok(response) => {
                    let _ = dispatch.nonce_manager.sync_from_venue(
                        account_index,
                        api_key_index,
                        response.nonce,
                    );
                    log::debug!(
                        "Resynced Lighter nonce baseline after skip-window exhaustion: \
                         account_index={account_index}, api_key_index={api_key_index}, \
                         next_nonce={}",
                        response.nonce,
                    );
                }
                Err(e) => {
                    log::error!("Failed to resync Lighter nonce after skip-window exhaustion: {e}");
                }
            }
        };

        if let Err(e) = self.pending_tasks.spawn(future) {
            self.nonce_recovery_inflight.store(false, Ordering::Release);
            log::warn!("Skipping Lighter nonce recovery after shutdown began: {e}");
        }
    }

    fn sign_create_order(&self, plan: &CreateOrderPlan) -> anyhow::Result<PreparedCreateOrder> {
        let cloid = plan.order.client_order_id();
        let client_order_index = self.dispatch.register_create_identity(&plan.order)?;

        let ReservedTxContext {
            context,
            send_reservation,
        } = match self.build_tx_context() {
            Ok(context) => context,
            Err(e) => {
                self.dispatch.forget_cloid(client_order_index);
                self.dispatch.forget_order_identity(&cloid);
                return Err(e);
            }
        };

        let nonce = context.nonce;
        let api_key_index = context.api_key_index;
        let mut rollback_guard = TxDispatchGuard::new(
            self.dispatch.clone(),
            &self.credential,
            Some(client_order_index),
            nonce,
        )
        .with_order_identity(cloid);

        let tx = CreateOrderTxInfo {
            context,
            order: plan.order_info(client_order_index),
            attributes: plan.attributes,
        };

        let signed = sign_tx(
            &tx,
            self.chain_id,
            &self.credential.private_key()?,
            fresh_k(),
        )?;

        let tx_info =
            serde_json::value::RawValue::from_string(TxInfoJson::create_order(&tx, &signed))
                .context("failed to wrap signed Lighter tx_info JSON")?;

        rollback_guard.disarm();

        Ok(PreparedCreateOrder {
            order: plan.order.clone(),
            client_order_index,
            tx_info,
            nonce,
            api_key_index,
            tx_hash: signed.tx_hash_hex(),
            send_reservation,
        })
    }

    fn sign_create_group(&self, plan: &CreateGroupPlan) -> anyhow::Result<PreparedBatchTx> {
        let reserved = self.build_tx_context()?;
        let mut guards = Vec::with_capacity(plan.orders.len());
        let mut orders = Vec::with_capacity(plan.orders.len());
        let mut bodies = Vec::with_capacity(plan.orders.len());

        let mut nonce_guard = TxDispatchGuard::new(
            self.dispatch.clone(),
            &self.credential,
            None,
            reserved.context.nonce,
        );

        for leg in &plan.orders {
            let index = self.dispatch.register_create_identity(&leg.order)?;
            guards.push(
                TxDispatchGuard::new(
                    self.dispatch.clone(),
                    &self.credential,
                    Some(index),
                    reserved.context.nonce,
                )
                .with_order_identity(leg.order.client_order_id()),
            );
            bodies.push(leg.order_info(index));
            orders.push((leg.order.clone(), index));
        }

        let tx = CreateGroupedOrdersTxInfo {
            context: reserved.context,
            grouping_type: plan.grouping_type,
            orders: bodies,
            attributes: plan.orders[0].attributes,
        };

        let signed = sign_tx(
            &tx,
            self.chain_id,
            &self.credential.private_key()?,
            fresh_k(),
        )?;
        let tx_info = serde_json::value::RawValue::from_string(TxInfoJson::create_grouped_orders(
            &tx, &signed,
        ))
        .context("failed to wrap signed Lighter grouped tx_info JSON")?;

        for guard in &mut guards {
            guard.disarm();
        }

        nonce_guard.disarm();
        Ok(PreparedBatchTx {
            tx_type: LighterTxType::CreateGroupedOrders as u8,
            tx_info,
            pending: PendingSendTx {
                batch_id: None,
                connection_epoch: reserved.send_reservation.connection_epoch,
                kind: PendingSendTxKind::CreateGroup { orders },
                submitted_at: UnixNanos::default(),
                nonce: reserved.context.nonce,
                api_key_index: reserved.context.api_key_index,
                tx_hash: signed.tx_hash_hex(),
            },
            send_reservation: reserved.send_reservation,
        })
    }

    async fn send_create_order(&self, prepared: PreparedCreateOrder) {
        let PreparedCreateOrder {
            order,
            client_order_index,
            tx_info,
            nonce,
            api_key_index,
            tx_hash,
            mut send_reservation,
        } = prepared;
        let connection_epoch = send_reservation.connection_epoch;
        let client_order_id = order.client_order_id();

        self.emitter.emit_order_submitted(&order);
        log::debug!("Lighter submit_order: queueing CreateOrder tx for {client_order_id}");
        send_reservation.wait_for_turn().await;
        await_tx_quota(&self.tx_rate_limiter).await;
        self.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch,
            kind: PendingSendTxKind::Create {
                order: Box::new(order.clone()),
                client_order_index,
            },
            submitted_at: self.clock.get_time_ns(),
            nonce,
            api_key_index,
            tx_hash,
        });

        if let Err(e) = self
            .ws_client
            .send_tx_on_connection(LighterTxType::CreateOrder as u8, tx_info, connection_epoch)
            .await
        {
            let failure = classify_lighter_ws_command_failure("submit_order", &e);
            let reason = command_failure_reason(&failure);
            if matches!(&failure, CommandFailure::Ambiguous(_)) {
                log::warn!(
                    "Lighter submit_order dispatch outcome unknown for {client_order_id}: {reason}; \
                     retaining pending state for venue reconciliation; diagnostic={e:?}",
                );
            } else {
                log::warn!("{reason} for {client_order_id}; diagnostic={e:?}");
                self.dispatch
                    .remove_pending_sendtx_by_nonce(connection_epoch, nonce);
                rollback_tx_dispatch_create(
                    &self.dispatch,
                    &self.credential,
                    Some(client_order_index),
                    &client_order_id,
                    nonce,
                );
                self.emitter
                    .emit_order_rejected(&order, reason, self.clock.get_time_ns(), false);
            }
        }
        send_reservation.release();
    }

    fn sign_modify_order(
        &self,
        plan: &ModifyOrderPlan,
        reserved: ReservedTxContext,
    ) -> anyhow::Result<PreparedModifyOrder> {
        let ReservedTxContext {
            context,
            send_reservation,
        } = reserved;

        let captured_nonce = context.nonce;
        let captured_api_key_index = context.api_key_index;

        let mut rollback_guard = TxDispatchGuard::new(
            self.dispatch.clone(),
            &self.credential,
            None,
            captured_nonce,
        );

        let tx = ModifyOrderTxInfo {
            context,
            market_index: plan.market_index,
            index: plan.venue_index,
            base_amount: plan.base_amount,
            price: plan.price,
            trigger_price: plan.trigger_price,
            attributes: integrator_attributes(self.integrator_account_index),
        };

        let signed = sign_tx(
            &tx,
            self.chain_id,
            &self.credential.private_key()?,
            fresh_k(),
        )?;

        let tx_info_str = TxInfoJson::modify_order(&tx, &signed);
        let tx_info = serde_json::value::RawValue::from_string(tx_info_str)
            .context("failed to wrap signed Lighter modify tx_info JSON")?;

        self.dispatch.set_pending_modify_nonce(
            &plan.client_order_id,
            plan.command_id,
            send_reservation.connection_epoch,
            captured_nonce,
        );
        rollback_guard.disarm();

        Ok(PreparedModifyOrder {
            client_order_id: plan.client_order_id,
            strategy_id: plan.strategy_id,
            instrument_id: plan.instrument_id,
            venue_order_id: plan.venue_order_id,
            tx_info,
            nonce: captured_nonce,
            api_key_index: captured_api_key_index,
            tx_hash: signed.tx_hash_hex(),
            send_reservation,
        })
    }

    fn sign_cancel_order(&self, plan: &CancelOrderPlan) -> anyhow::Result<PreparedCancelOrder> {
        let ReservedTxContext {
            context,
            send_reservation,
        } = self.build_tx_context()?;

        let nonce = context.nonce;
        let api_key_index = context.api_key_index;
        let mut rollback_guard =
            TxDispatchGuard::new(self.dispatch.clone(), &self.credential, None, nonce);

        let tx = CancelOrderTxInfo {
            context,
            market_index: plan.market_index,
            index: plan.venue_index,
            skip_nonce: 0,
        };

        let signed = sign_tx(
            &tx,
            self.chain_id,
            &self.credential.private_key()?,
            fresh_k(),
        )?;

        let tx_info =
            serde_json::value::RawValue::from_string(TxInfoJson::cancel_order(&tx, &signed))
                .context("failed to wrap signed Lighter cancel tx_info JSON")?;

        rollback_guard.disarm();

        Ok(PreparedCancelOrder {
            client_order_id: plan.client_order_id,
            strategy_id: plan.strategy_id,
            instrument_id: plan.instrument_id,
            venue_order_id: plan.venue_order_id,
            tx_info,
            nonce,
            api_key_index,
            tx_hash: signed.tx_hash_hex(),
            send_reservation,
        })
    }

    async fn send_cancel_order(
        &self,
        mut prepared: PreparedCancelOrder,
        emit_cancel_rejected: bool,
    ) {
        let connection_epoch = prepared.send_reservation.connection_epoch;
        prepared.send_reservation.wait_for_turn().await;
        await_tx_quota(&self.tx_rate_limiter).await;
        self.enqueue_cancel_order(&prepared, emit_cancel_rejected);
        if let Err(e) = self
            .ws_client
            .send_tx_on_connection(
                LighterTxType::CancelOrder as u8,
                prepared.tx_info.clone(),
                connection_epoch,
            )
            .await
        {
            self.handle_cancel_send_failure(&prepared, emit_cancel_rejected, &e);
        }

        prepared.send_reservation.release();
    }

    async fn send_batch(&self, mut batch: Vec<PreparedBatchTx>) {
        let mut batch_ids = Vec::new();

        while !batch.is_empty() {
            // Other commands can allocate nonces concurrently. Only consecutive
            // nonces from one connection can share a venue batch.
            let count = batch
                .windows(2)
                .position(|pair| {
                    pair[1].pending.nonce != pair[0].pending.nonce + 1
                        || pair[1].send_reservation.connection_epoch
                            != pair[0].send_reservation.connection_epoch
                })
                .map_or(batch.len(), |index| index + 1);

            let mut group: Vec<_> = batch.drain(..count).collect();
            let connection_epoch = group[0].send_reservation.connection_epoch;
            let id = format!("{TX_BATCH_ID_PREFIX}{}", group[0].pending.tx_hash);
            group[0].send_reservation.wait_for_turn().await;
            await_tx_quota(&self.tx_rate_limiter).await;

            let data = crate::websocket::messages::LighterWsSendTxBatch {
                id: id.clone(),
                tx_types: serde_json::to_string(
                    &group
                        .iter()
                        .map(|prepared| prepared.tx_type)
                        .collect::<Vec<_>>(),
                )
                .expect("transaction types serialize"),
                tx_infos: serde_json::to_string(
                    &group
                        .iter()
                        .map(|prepared| prepared.tx_info.get())
                        .collect::<Vec<_>>(),
                )
                .expect("transaction strings serialize"),
            };

            for prepared in &mut group {
                prepared.pending.batch_id = Some(id.clone());
                prepared.pending.submitted_at = self.clock.get_time_ns();
                self.enqueue_batch_tx(prepared);
            }

            if let Err(e) = self
                .ws_client
                .send_tx_batch_on_connection(data, connection_epoch)
                .await
            {
                for prepared in group.iter().rev() {
                    self.handle_batch_send_failure(prepared, &e);
                }
            }

            for prepared in &mut group {
                prepared.send_reservation.release();
            }

            batch_ids.push(id);
        }

        // Release every signed reservation before waiting so nonce refresh can proceed
        let wait = async {
            while self.dispatch.pending_sendtx.lock().iter().any(|pending| {
                pending
                    .batch_id
                    .as_ref()
                    .is_some_and(|id| batch_ids.contains(id))
            }) {
                tokio::time::sleep(Duration::from_millis(10)).await;
            }
        };

        if tokio::time::timeout(BATCH_ACK_TIMEOUT, wait).await.is_err() {
            log::warn!("Lighter batch acknowledgement timed out: ids={batch_ids:?}");
        }
    }

    fn enqueue_batch_tx(&self, prepared: &PreparedBatchTx) {
        for (order, _) in prepared.pending.kind.creates() {
            self.emitter.emit_order_submitted(order);
        }

        if let PendingSendTxKind::Cancel {
            client_order_id,
            emit_cancel_rejected,
            ..
        } = &prepared.pending.kind
        {
            self.dispatch.set_pending_cancel_nonce(
                client_order_id,
                prepared.send_reservation.connection_epoch,
                prepared.pending.nonce,
                *emit_cancel_rejected,
            );
        }

        self.dispatch
            .enqueue_pending_sendtx(prepared.pending.clone());
        if matches!(prepared.pending.kind, PendingSendTxKind::Modify { .. }) {
            spawn_acked_order_probe(&prepared.pending, self.probe_context());
        }
    }

    fn handle_batch_send_failure(&self, prepared: &PreparedBatchTx, error: &LighterWsError) {
        let action = match prepared.pending.kind {
            PendingSendTxKind::Create { .. } | PendingSendTxKind::CreateGroup { .. } => {
                "submit_order"
            }
            PendingSendTxKind::Modify { .. } => "modify_order",
            PendingSendTxKind::Cancel { .. } => "cancel_order",
            PendingSendTxKind::Other => {
                unreachable!("order batches contain only order transactions")
            }
        };

        let failure = classify_lighter_ws_command_failure(action, error);
        let reason = command_failure_reason(&failure);

        if matches!(failure, CommandFailure::Ambiguous(_)) {
            log::warn!("{reason}; retaining batch transaction for reconciliation");
            return;
        }

        if let Some(pending) = self.dispatch.remove_pending_sendtx_by_hash(
            prepared.pending.connection_epoch,
            &prepared.pending.tx_hash,
        ) {
            reject_pending_sendtx(
                &self.dispatch,
                &self.emitter,
                Some(self.credential.account_index()),
                &pending,
                reason,
                self.clock.get_time_ns(),
                false,
            );
        }
    }

    fn enqueue_cancel_order(&self, prepared: &PreparedCancelOrder, emit_cancel_rejected: bool) {
        self.dispatch.set_pending_cancel_nonce(
            &prepared.client_order_id,
            prepared.send_reservation.connection_epoch,
            prepared.nonce,
            emit_cancel_rejected,
        );
        self.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: prepared.send_reservation.connection_epoch,
            kind: if emit_cancel_rejected {
                PendingSendTxKind::Cancel {
                    emit_cancel_rejected,
                    strategy_id: prepared.strategy_id,
                    instrument_id: prepared.instrument_id,
                    client_order_id: prepared.client_order_id,
                    venue_order_id: prepared.venue_order_id,
                }
            } else {
                PendingSendTxKind::Other
            },
            submitted_at: self.clock.get_time_ns(),
            nonce: prepared.nonce,
            api_key_index: prepared.api_key_index,
            tx_hash: prepared.tx_hash.clone(),
        });
    }

    fn handle_cancel_send_failure(
        &self,
        prepared: &PreparedCancelOrder,
        emit_cancel_rejected: bool,
        error: &LighterWsError,
    ) {
        let failure = classify_lighter_ws_command_failure("cancel_order", error);
        let reason = command_failure_reason(&failure);

        if matches!(failure, CommandFailure::Ambiguous(_)) {
            log::warn!(
                "Lighter cancel_order outcome unknown for {}: {reason}; retaining pending state for venue reconciliation",
                prepared.client_order_id
            );
            return;
        }

        log::warn!(
            "{reason} for {}; diagnostic={error:?}",
            prepared.client_order_id
        );

        self.dispatch.remove_pending_sendtx_by_nonce(
            prepared.send_reservation.connection_epoch,
            prepared.nonce,
        );
        let current = self.dispatch.clear_pending_cancel_if_nonce(
            &prepared.client_order_id,
            prepared.send_reservation.connection_epoch,
            prepared.nonce,
        );
        rollback_tx_dispatch(&self.dispatch, &self.credential, None, prepared.nonce);

        if current && emit_cancel_rejected {
            self.emitter.emit_order_cancel_rejected_event(
                prepared.strategy_id,
                prepared.instrument_id,
                prepared.client_order_id,
                prepared.venue_order_id,
                reason,
                self.clock.get_time_ns(),
            );
        } else {
            log::warn!(
                "{reason} for {}; suppressing OrderCancelRejected because order is not PendingCancel",
                prepared.client_order_id
            );
        }
    }
}

fn should_retry_batch_signing(error: &anyhow::Error) -> bool {
    error.is::<TxPreparationError>()
        || error.is::<tokio::sync::TryLockError>()
        || matches!(
            error.downcast_ref::<NonceError>(),
            Some(NonceError::SkipWindowExhausted { .. })
        )
}

#[derive(Debug, thiserror::Error)]
enum TxPreparationError {
    #[error("Lighter nonce refresh is pending for connection epoch {0}")]
    NonceRefreshPending(u64),
    #[error("Lighter connection or nonce state changed during transaction preparation")]
    StateChanged,
}

struct PreparedModifyOrder {
    client_order_id: ClientOrderId,
    strategy_id: StrategyId,
    instrument_id: InstrumentId,
    venue_order_id: Option<VenueOrderId>,
    tx_info: Box<serde_json::value::RawValue>,
    nonce: i64,
    api_key_index: u8,
    tx_hash: String,
    send_reservation: TxSendReservation,
}

struct ModifyOrderPlan {
    command_id: UUID4,
    client_order_id: ClientOrderId,
    strategy_id: StrategyId,
    instrument_id: InstrumentId,
    venue_order_id: Option<VenueOrderId>,
    market_index: i64,
    venue_index: i64,
    base_amount: i64,
    price: u32,
    trigger_price: u32,
}

enum BatchOrderPlan {
    Create(Box<CreateOrderPlan>),
    CreateGroup(CreateGroupPlan),
    Modify(ModifyOrderPlan),
    Cancel(CancelOrderPlan, bool),
}

struct PreparedBatchTx {
    tx_type: u8,
    tx_info: Box<serde_json::value::RawValue>,
    pending: PendingSendTx,
    send_reservation: TxSendReservation,
}

impl From<PreparedCreateOrder> for PreparedBatchTx {
    fn from(prepared: PreparedCreateOrder) -> Self {
        Self {
            tx_type: LighterTxType::CreateOrder as u8,
            tx_info: prepared.tx_info,
            pending: PendingSendTx {
                batch_id: None,
                connection_epoch: prepared.send_reservation.connection_epoch,
                kind: PendingSendTxKind::Create {
                    order: Box::new(prepared.order),
                    client_order_index: prepared.client_order_index,
                },
                submitted_at: UnixNanos::default(),
                nonce: prepared.nonce,
                api_key_index: prepared.api_key_index,
                tx_hash: prepared.tx_hash,
            },
            send_reservation: prepared.send_reservation,
        }
    }
}

impl From<PreparedModifyOrder> for PreparedBatchTx {
    fn from(prepared: PreparedModifyOrder) -> Self {
        Self {
            tx_type: LighterTxType::ModifyOrder as u8,
            tx_info: prepared.tx_info,
            pending: PendingSendTx {
                batch_id: None,
                connection_epoch: prepared.send_reservation.connection_epoch,
                kind: PendingSendTxKind::Modify {
                    client_order_id: prepared.client_order_id,
                    strategy_id: prepared.strategy_id,
                    instrument_id: prepared.instrument_id,
                    venue_order_id: prepared.venue_order_id,
                },
                submitted_at: UnixNanos::default(),
                nonce: prepared.nonce,
                api_key_index: prepared.api_key_index,
                tx_hash: prepared.tx_hash,
            },
            send_reservation: prepared.send_reservation,
        }
    }
}

impl From<(PreparedCancelOrder, bool)> for PreparedBatchTx {
    fn from((prepared, emit_cancel_rejected): (PreparedCancelOrder, bool)) -> Self {
        Self {
            tx_type: LighterTxType::CancelOrder as u8,
            tx_info: prepared.tx_info,
            pending: PendingSendTx {
                batch_id: None,
                connection_epoch: prepared.send_reservation.connection_epoch,
                kind: PendingSendTxKind::Cancel {
                    emit_cancel_rejected,
                    client_order_id: prepared.client_order_id,
                    strategy_id: prepared.strategy_id,
                    instrument_id: prepared.instrument_id,
                    venue_order_id: prepared.venue_order_id,
                },
                submitted_at: UnixNanos::default(),
                nonce: prepared.nonce,
                api_key_index: prepared.api_key_index,
                tx_hash: prepared.tx_hash,
            },
            send_reservation: prepared.send_reservation,
        }
    }
}

struct PreparedIntegratorApproval {
    tx_info: String,
    nonce: i64,
    api_key_index: u8,
    approval_expiry: i64,
    send_reservation: TxSendReservation,
}

// Cross-check between a detected account tier and the configured REST quota:
// AboveTier when the override exceeds the tier limit, RaiseHint when the tier
// allows more than standard but no override is set.
#[derive(Debug, PartialEq, Eq)]
enum TierCrossCheck {
    AboveTier { documented: u32 },
    RaiseHint { documented: u32 },
}

// Computes the active REST quota to report and any cross-check advisory from the
// detected tier and the raw override. A zero override resolves to the standard
// default (matching resolve_quota), so the reported quota always matches the
// limiter. Pure so the reporting decision is unit-testable without log capture.
fn tier_quota_report(
    tier: LighterAccountTier,
    rest_quota_per_min: Option<u32>,
    standard_rest: u32,
) -> (u32, Option<TierCrossCheck>) {
    let configured = rest_quota_per_min.filter(|&n| n > 0);
    let active_rest = configured.unwrap_or(standard_rest);
    let cross_check = match (tier.documented_rest_quota_per_min(), configured) {
        (Some(documented), Some(configured)) if configured > documented => {
            Some(TierCrossCheck::AboveTier { documented })
        }
        (Some(documented), None) if documented > standard_rest => {
            Some(TierCrossCheck::RaiseHint { documented })
        }
        _ => None,
    };
    (active_rest, cross_check)
}

struct TxDispatchGuard {
    dispatch: WsDispatchState,
    account_index: i64,
    api_key_index: u8,
    client_order_index: Option<i64>,
    client_order_id: Option<ClientOrderId>,
    nonce: i64,
    armed: bool,
}

impl TxDispatchGuard {
    fn new(
        dispatch: WsDispatchState,
        credential: &Credential,
        client_order_index: Option<i64>,
        nonce: i64,
    ) -> Self {
        Self {
            dispatch,
            account_index: credential.account_index(),
            api_key_index: credential.api_key_index(),
            client_order_index,
            client_order_id: None,
            nonce,
            armed: true,
        }
    }

    fn with_order_identity(mut self, client_order_id: ClientOrderId) -> Self {
        self.client_order_id = Some(client_order_id);
        self
    }

    fn disarm(&mut self) {
        self.armed = false;
    }
}

impl Drop for TxDispatchGuard {
    fn drop(&mut self) {
        if self.armed {
            rollback_tx_dispatch_indices(
                &self.dispatch,
                self.account_index,
                self.api_key_index,
                self.client_order_index,
                self.client_order_id.as_ref(),
                self.nonce,
            );
        }
    }
}

// SendTxAck: remove by echoed tx_hash when present. A hashless ack is safe to
// attribute only when one transaction is pending. An echoed hash is
// authoritative: on a miss the entry was already consumed or never enqueued,
// and a fallback would attribute the ack to the wrong tx.
fn handle_send_tx_ack_for_connection(
    dispatch: &WsDispatchState,
    account_index: Option<i64>,
    connection_epoch: u64,
    code: i64,
    tx_hash: Option<&str>,
) -> Option<PendingSendTx> {
    let popped = match tx_hash {
        Some(hash) => {
            let matched = dispatch.remove_pending_sendtx_by_hash(connection_epoch, hash);
            if matched.is_none() {
                log::warn!("Lighter sendTx ack unmatched: tx_hash={hash} code={code}");
            }
            matched
        }
        None => dispatch.pop_pending_sendtx_if_only(connection_epoch),
    };

    if let (Some(pending), Some(account_index)) = (&popped, account_index) {
        let _ =
            dispatch
                .nonce_manager
                .ack_success(account_index, pending.api_key_index, pending.nonce);
    }

    log::debug!(
        "Lighter sendTx ack: code={code} tx_hash={tx_hash:?} popped_nonce={:?}",
        popped.as_ref().map(|p| p.nonce),
    );

    popped
}

#[expect(
    clippy::too_many_arguments,
    reason = "batch response shares the single-transaction rejection sink"
)]
fn handle_send_tx_batch_result(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_index: Option<i64>,
    connection_epoch: u64,
    now: UnixNanos,
    id: &str,
    code: i64,
    message: &str,
    tx_hashes: &[String],
) -> (Vec<PendingSendTx>, bool) {
    let mut pending: Vec<_> = dispatch
        .pending_sendtx
        .lock()
        .iter()
        .filter(|pending| {
            pending.connection_epoch == connection_epoch && pending.batch_id.as_deref() == Some(id)
        })
        .cloned()
        .collect();

    if pending.is_empty() {
        log::warn!("Ignoring unmatched Lighter batch response: id={id}");
        return (Vec::new(), false);
    }

    if code == 200 {
        let acked = pending
            .iter()
            .filter(|pending| tx_hashes.contains(&pending.tx_hash))
            .filter_map(|pending| {
                handle_send_tx_ack_for_connection(
                    dispatch,
                    account_index,
                    connection_epoch,
                    code,
                    Some(&pending.tx_hash),
                )
            })
            .collect();

        if pending
            .iter()
            .any(|pending| !tx_hashes.contains(&pending.tx_hash))
        {
            log::warn!(
                "Incomplete Lighter batch acknowledgement: id={id}; retaining unmatched transactions for reconciliation"
            );
        }

        return (acked, false);
    }

    // Roll back newest first so a rejected contiguous batch releases every nonce
    pending.sort_unstable_by_key(|pending| std::cmp::Reverse(pending.nonce));
    let mut resync = false;
    for pending in pending {
        resync |= handle_send_tx_rejection_for_connection(
            dispatch,
            emitter,
            account_index,
            connection_epoch,
            now,
            SendTxRejectionSource::Ack,
            Some(code),
            message,
            Some(&pending.tx_hash),
        );
    }

    (Vec::new(), resync)
}

fn spawn_acked_order_probe(pending: &PendingSendTx, context: AckedOrderProbeContext) {
    if let PendingSendTxKind::CreateGroup { orders } = &pending.kind {
        for (order, index) in orders {
            let mut leg = pending.clone();

            leg.kind = PendingSendTxKind::Create {
                order: Box::new(order.clone()),
                client_order_index: *index,
            };

            spawn_acked_order_probe(&leg, context.clone());
        }

        return;
    }

    let action = matches!(
        pending.kind,
        PendingSendTxKind::Modify { .. } | PendingSendTxKind::Cancel { .. }
    )
    .then(|| pending.clone());
    let probe = AckedOrderProbe::from_pending(pending);
    if action.is_none() && probe.is_none() {
        return;
    }

    let pending_tasks = context.pending_tasks.clone();

    let future = async move {
        tokio::select! {
            () = context.cancellation_token.cancelled() => return,
            () = tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY) => {}
        }

        if let Some(pending) = action {
            let result = if let PendingSendTxKind::Cancel {
                client_order_id, ..
            } = pending.kind
            {
                let Some(token) = context.dispatch.pending_cancel_token(
                    &client_order_id,
                    pending.connection_epoch,
                    pending.nonce,
                ) else {
                    return;
                };

                tokio::select! {
                    biased;
                    () = context.cancellation_token.cancelled() => return,
                    () = token.cancelled() => return,
                    result = probe_acked_action(&pending,&context) => result,
                }
            } else {
                probe_acked_action(&pending, &context).await
            };

            if let Err(e) = result {
                log::warn!("Lighter acknowledged action probe failed: {e}");
            }

            return;
        }

        if let Some(probe) = probe
            && let Err(e) = probe_acked_create(&probe, &context).await
        {
            log::warn!("Lighter acknowledged order probe failed: {e:?}");
        }
    };

    if let Err(e) = pending_tasks.spawn(future) {
        log::debug!("Skipping Lighter acknowledged-order probe during shutdown: {e}");
    }
}

#[derive(Clone)]
struct AckedOrderProbeContext {
    http_client: LighterHttpClient,
    registry: Arc<MarketRegistry>,
    credential: Credential,
    dispatch: WsDispatchState,
    account_id: AccountId,
    clock: &'static AtomicTime,
    emitter: ExecutionEventEmitter,
    connection_epoch: Arc<AtomicU64>,
    cancellation_token: CancellationToken,
    pending_tasks: TaskSpawner,
}

async fn probe_acked_action(
    pending: &PendingSendTx,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<()> {
    let (client_order_id, _) = acked_action_identity(pending)?;
    for attempt in 1..=ACKED_ORDER_PROBE_ATTEMPTS {
        if !acked_action_is_pending(pending, context) {
            return Ok(());
        }

        match context.http_client.get_tx(pending.tx_hash.clone()).await {
            Ok(tx) => match resolve_acked_action(pending, context, tx).await {
                Ok(true) => return Ok(()),
                Ok(false) => {}
                Err(e) => log::warn!("Lighter action confirmation unavailable: {e}"),
            },
            Err(LighterHttpError::Venue { code: 21500, .. }) => {}
            Err(e) => log::warn!("Lighter acknowledged action transaction lookup failed: {e}"),
        }

        if attempt < ACKED_ORDER_PROBE_ATTEMPTS {
            tokio::select! {
                () = context.cancellation_token.cancelled() => return Ok(()),
                () = tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY) => {}
            }
        }
    }

    log::warn!(
        "Lighter acknowledged action outcome unresolved for {client_order_id}; retaining pending action for reconciliation"
    );
    Ok(())
}

fn acked_action_identity(
    pending: &PendingSendTx,
) -> anyhow::Result<(ClientOrderId, LighterTxType)> {
    match pending.kind {
        PendingSendTxKind::Cancel {
            client_order_id, ..
        } => Ok((client_order_id, LighterTxType::CancelOrder)),
        PendingSendTxKind::Modify {
            client_order_id, ..
        } => Ok((client_order_id, LighterTxType::ModifyOrder)),
        _ => anyhow::bail!("acknowledged action requires a cancel or modify transaction"),
    }
}

fn acked_action_is_pending(pending: &PendingSendTx, context: &AckedOrderProbeContext) -> bool {
    let submission = match pending.kind {
        PendingSendTxKind::Cancel {
            client_order_id, ..
        } => context.dispatch.pending_cancel_nonce(&client_order_id),
        PendingSendTxKind::Modify {
            client_order_id, ..
        } => context.dispatch.pending_modify_nonce(&client_order_id),
        _ => return false,
    };

    (matches!(pending.kind, PendingSendTxKind::Modify { .. })
        || context.connection_epoch.load(Ordering::Acquire) == pending.connection_epoch)
        && submission == Some((pending.connection_epoch, pending.nonce))
}

async fn resolve_acked_action(
    pending: &PendingSendTx,
    context: &AckedOrderProbeContext,
    tx: LighterTx,
) -> anyhow::Result<bool> {
    let (_, tx_type) = acked_action_identity(pending)?;
    anyhow::ensure!(
        tx_hash_matches(&tx.hash, &pending.tx_hash)
            && tx.tx_type == tx_type as u8
            && tx.account_index == context.credential.account_index()
            && tx.api_key_index == pending.api_key_index
            && tx.nonce == pending.nonce,
        "Lighter transaction lookup did not match acknowledged action identity"
    );

    let is_modify = tx_type == LighterTxType::ModifyOrder;

    if !acked_action_is_pending(pending, context) {
        return Ok(true);
    }

    let event = match parse_acked_tx_event(&tx.event_info) {
        Ok(event) => event,
        Err(e) if tx.status == LighterTxStatus::Failed => {
            log::warn!("Lighter failed transaction carried invalid event_info: {e}");
            AckedTxEvent::default()
        }
        Err(e) => return Err(e),
    };

    if tx.status == LighterTxStatus::Failed || !event.app_error.is_empty() {
        let action = if is_modify { "modify" } else { "cancel" };
        let detail = acked_tx_error_detail(&event.app_error);
        let reason = format!("Lighter {action} transaction failed: {detail}");
        log::warn!("{reason} for nonce={}", pending.nonce);

        match pending.kind {
            PendingSendTxKind::Modify { .. } => reject_modify_order(
                &context.dispatch,
                &context.emitter,
                pending,
                &reason,
                context.clock.get_time_ns(),
            ),
            PendingSendTxKind::Cancel { .. } => reject_cancel_order(
                &context.dispatch,
                &context.emitter,
                pending,
                &reason,
                context.clock.get_time_ns(),
            ),
            _ => unreachable!("validated acknowledged action"),
        }

        // Execution failures consume their nonce, unlike pre-admission rejections
        return Ok(true);
    }

    if tx.status == LighterTxStatus::Executed {
        return recover_acked_action_report(pending, context).await;
    }

    Ok(false)
}

async fn recover_acked_action_report(
    pending: &PendingSendTx,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<bool> {
    let (instrument_id, client_order_id, venue_order_id) = match pending.kind {
        PendingSendTxKind::Cancel {
            instrument_id,
            client_order_id,
            venue_order_id,
            ..
        }
        | PendingSendTxKind::Modify {
            instrument_id,
            client_order_id,
            venue_order_id,
            ..
        } => (instrument_id, client_order_id, venue_order_id),
        _ => return Ok(true),
    };

    let lookup = OrderReportLookup::new(
        &context.registry,
        &context.dispatch,
        Some(instrument_id),
        Some(&client_order_id),
        venue_order_id.as_ref(),
    )?;

    anyhow::ensure!(
        matches!(pending.kind, PendingSendTxKind::Modify { .. })
            || !context.dispatch.has_pending_modify(&client_order_id),
        "Lighter cancellation waits for modification confirmation"
    );
    let order = collect_order_while_pending(
        &context.http_client,
        &context.registry,
        &context.credential,
        &lookup,
        || acked_action_is_pending(pending, context),
    )
    .await?;

    if !acked_action_is_pending(pending, context) {
        return Ok(true);
    }

    let Some(order) = order else {
        return Ok(false);
    };

    if matches!(pending.kind, PendingSendTxKind::Modify { .. }) {
        confirm_modify_order(pending, context, &order)?;
        return Ok(true);
    }

    recover_report_fills(&order, context).await?;

    let events = context.dispatch.order_events.lock();
    if context
        .dispatch
        .terminals_pending
        .lock()
        .contains_key(&client_order_id)
        || events.get(&client_order_id).is_some_and(|deferred| {
            deferred
                .order
                .as_ref()
                .is_some_and(|order| order.status.is_terminal())
        })
        || context
            .dispatch
            .order_identity(&client_order_id)
            .is_some_and(|identity| position_fills_pending(&identity, &events, &context.dispatch))
    {
        return Ok(false);
    }

    let report = lookup.parse(
        &order,
        &context.registry,
        context.account_id,
        context.clock.get_time_ns(),
        &context.dispatch,
    )?;
    let report = lookup.translate(&context.dispatch, report);
    if context
        .dispatch
        .order_identity(&client_order_id)
        .is_some_and(|identity| {
            !identity.report_fills_covered(&report, &[]) || identity.has_publication()
        })
    {
        return Ok(false);
    }

    let resolved = report.order_status.is_closed();

    let current = if resolved {
        context.dispatch.clear_pending_cancel_if_nonce(
            &client_order_id,
            pending.connection_epoch,
            pending.nonce,
        )
    } else {
        context.dispatch.pending_cancel_nonce(&client_order_id)
            == Some((pending.connection_epoch, pending.nonce))
    };

    if !current {
        return Ok(true);
    }

    let report = if report.order_status.is_closed() {
        report
    } else {
        context.dispatch.preserve_pending_order_status(report)
    };

    context.emitter.send_order_status_report(report);
    Ok(resolved)
}

fn confirm_modify_order(
    pending: &PendingSendTx,
    context: &AckedOrderProbeContext,
    order: &crate::http::models::LighterOrder,
) -> anyhow::Result<()> {
    let (cloid, _) = acked_action_identity(pending)?;
    let mut events = context.dispatch.order_events.lock();
    if !acked_action_is_pending(pending, context) {
        return Ok(());
    }

    let identity = context
        .dispatch
        .order_identity(&cloid)
        .context("missing modified order identity")?;
    let instrument = LIGHTER_INSTRUMENT_CACHE
        .get(&identity.instrument_id)
        .context("missing modified order instrument")?;
    let shape = lighter_order_shape(order, &instrument, identity.order_type)?;
    let mut requested_shape = shape.clone();
    requested_shape.quantity =
        quantity_from_decimal(order.initial_base_amount, instrument.size_precision())?;
    anyhow::ensure!(
        context.dispatch.pending_modify_shape(&cloid).as_ref() == Some(&requested_shape),
        "Lighter executed modification shape is not available yet"
    );
    identity.record_reduction(order.initial_base_amount - shape.quantity.as_decimal());
    let updated = parse_lighter_order_updated(
        order,
        &instrument,
        &identity,
        cloid,
        context.account_id,
        context.emitter.trader_id(),
        context.clock.get_time_ns(),
    )?;
    context.dispatch.store_snapshot(cloid, shape);
    identity.publish_update(updated.event_id);
    context
        .emitter
        .send_order_event(OrderEventAny::Updated(updated));
    context
        .dispatch
        .clear_pending_modify_if_nonce(&cloid, pending.connection_epoch, pending.nonce);
    let mut deferred = events.remove(&cloid).unwrap_or_default();
    if deferred.order.is_none() {
        deferred.store_order(order);
    }

    flush_modify_events(
        cloid,
        deferred,
        &context.dispatch,
        &context.emitter,
        &mut events,
    );
    drop(events);
    spawn_child_recoveries(context);
    Ok(())
}

fn flush_modify_events(
    cloid: ClientOrderId,
    deferred: DeferredOrderEvents,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    events: &mut AHashMap<ClientOrderId, DeferredOrderEvents>,
) {
    if dispatch
        .order_identity(&cloid)
        .is_some_and(|identity| identity.child_fill_baseline().is_some())
        && let Some(order) = deferred
            .order
            .as_ref()
            .filter(|order| is_order_triggered(order))
    {
        dispatch_deferred_order(cloid, order, dispatch, emitter);
    }

    events.insert(cloid, deferred);
    publish_child_recovery(cloid, events, dispatch, emitter);
}

fn flush_order_terminal(
    cloid: ClientOrderId,
    deferred: DeferredOrderEvents,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
) {
    for fill in deferred.fills {
        if dispatch.mark_trade_seen(fill.trade_id) {
            dispatch_lighter_fill(fill, emitter, dispatch, events);
        }
    }

    let Some(order) = deferred.order else {
        return;
    };

    dispatch_deferred_order(cloid, &order, dispatch, emitter);
}

fn dispatch_deferred_order(
    cloid: ClientOrderId,
    order: &crate::http::models::LighterOrder,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
) {
    let Some(identity) = dispatch
        .order_identities
        .get(&cloid)
        .map(|entry| entry.value().clone())
    else {
        return;
    };

    let Some(instrument) = LIGHTER_INSTRUMENT_CACHE.get(&identity.instrument_id) else {
        return;
    };

    let ts_init = get_atomic_clock_realtime().get_time_ns();

    if order.status == crate::common::enums::LighterOrderStatus::Filled {
        dispatch_owned_order(
            order,
            &instrument,
            &identity,
            cloid,
            VenueOrderId::new(&order.order_id),
            dispatch,
            emitter,
            emitter.account_id(),
            emitter.trader_id(),
            ts_init,
        );
        return;
    }

    let context = OpenFrameContext {
        accepted_already_emitted: dispatch.accepted_was_emitted(&cloid),
        triggered_already_emitted: dispatch.triggered_was_emitted(&cloid),
        shape_changed: false,
    };

    match parse_lighter_order_event(
        order,
        &instrument,
        &identity,
        cloid,
        emitter.account_id(),
        emitter.trader_id(),
        context,
        ts_init,
    ) {
        Ok(Some(event)) => {
            let Some(event) = defer_terminal(order, event, &identity, cloid, dispatch) else {
                return;
            };

            dispatch_tracked_order_event(
                event,
                cloid,
                VenueOrderId::new(&order.order_id),
                &identity,
                emitter.account_id(),
                emitter.trader_id(),
                emitter,
                dispatch,
                ts_init,
            );
        }
        Ok(None) => {}
        Err(e) => log::error!("Failed to parse deferred Lighter order for {cloid}: {e}"),
    }
}

async fn probe_acked_create(
    probe: &AckedOrderProbe,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<()> {
    let AckedOrderProbe {
        order,
        client_order_index,
        connection_epoch,
        nonce,
        ..
    } = probe;

    let client_order_id = order.client_order_id();
    let mut transaction_executed = false;

    for attempt in 1..=ACKED_ORDER_PROBE_ATTEMPTS {
        if context.connection_epoch.load(Ordering::Acquire) != *connection_epoch {
            log::warn!(
                "Lighter acknowledged create outcome unresolved after reconnect for {client_order_id}; retaining identity for reconciliation",
            );
            return Ok(());
        }

        if !context.dispatch.create_submission_is_pending(
            &client_order_id,
            *client_order_index,
            *nonce,
        ) {
            return Ok(());
        }

        if probe_acked_create_report(probe, context, attempt).await {
            return Ok(());
        }

        match probe_acked_create_tx(probe, context, attempt).await? {
            ControlFlow::Break(()) => return Ok(()),
            ControlFlow::Continue(executed) => transaction_executed |= executed,
        }

        if attempt < ACKED_ORDER_PROBE_ATTEMPTS {
            tokio::select! {
                () = context.cancellation_token.cancelled() => return Ok(()),
                () = tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY) => {}
            }
        }
    }

    if transaction_executed {
        let _ = context.dispatch.confirm_create_submission(
            &client_order_id,
            *client_order_index,
            *nonce,
        );
        log::warn!(
            "Lighter acknowledged create transaction executed without a queryable order for {client_order_id}; retaining identity for reconciliation",
        );
    } else {
        log::warn!(
            "Lighter acknowledged create outcome unresolved after {ACKED_ORDER_PROBE_ATTEMPTS} transaction lookups for {client_order_id}; retaining identity for reconciliation",
        );
    }
    Ok(())
}

async fn probe_acked_create_report(
    probe: &AckedOrderProbe,
    context: &AckedOrderProbeContext,
    attempt: usize,
) -> bool {
    let AckedOrderProbe {
        order,
        client_order_index,
        nonce,
        ..
    } = probe;

    let client_order_id = order.client_order_id();

    let report = match lookup_create_order_status_report(
        &context.http_client,
        &context.registry,
        &context.credential,
        context.account_id,
        order.instrument_id(),
        client_order_id,
        *client_order_index,
        *nonce,
        &context.dispatch,
        context.clock,
    )
    .await
    {
        Ok(report) => report,
        Err(e) => {
            log::warn!(
                "Lighter acknowledged create order lookup failed for {client_order_id} on attempt {attempt}: {e:?}",
            );
            None
        }
    };

    if let Some(report) = report {
        let _events = context.dispatch.order_events.lock();
        if context
            .dispatch
            .order_identity(&client_order_id)
            .is_some_and(|identity| {
                !identity.report_fills_covered(&report, &[]) || identity.has_publication()
            })
        {
            return false;
        }

        if context.dispatch.observe_create_submission(
            &client_order_id,
            *client_order_index,
            *nonce,
            report.venue_order_id,
        ) {
            context.dispatch.seed_accepted_from_report(&report);
            context.emitter.send_order_status_report(report);
        }

        return true;
    }

    false
}

async fn probe_acked_create_tx(
    probe: &AckedOrderProbe,
    context: &AckedOrderProbeContext,
    attempt: usize,
) -> anyhow::Result<ControlFlow<(), bool>> {
    let AckedOrderProbe {
        order,
        client_order_index,
        connection_epoch,
        nonce,
        api_key_index,
        tx_hash,
    } = probe;

    let client_order_id = order.client_order_id();

    let tx = match context.http_client.get_tx(tx_hash.clone()).await {
        Ok(tx) => tx,
        Err(LighterHttpError::Venue { code: 21500, .. }) => {
            return Ok(ControlFlow::Continue(false));
        }
        Err(e) => {
            log::warn!(
                "Lighter acknowledged create transaction lookup failed for {client_order_id} on attempt {attempt}: {e}",
            );
            return Ok(ControlFlow::Continue(false));
        }
    };

    validate_acked_create_tx(
        &tx,
        context.credential.account_index(),
        *api_key_index,
        *client_order_index,
        *nonce,
        tx_hash,
    )?;

    let event = parse_acked_tx_event(&tx.event_info).unwrap_or_else(|e| {
        log::warn!(
            "Lighter create transaction carried invalid event_info for {client_order_id}: {e}",
        );
        AckedTxEvent::default()
    });

    if tx.status == LighterTxStatus::Failed || !event.app_error.is_empty() {
        let detail = acked_tx_error_detail(&event.app_error);
        let reason = format!(
            "Lighter sequencer rejected acknowledged create transaction {tx_hash}: {detail}",
        );
        reject_create_order(
            &context.dispatch,
            &context.emitter,
            order,
            *client_order_index,
            *nonce,
            &reason,
            context.clock.get_time_ns(),
            lighter_reason_indicates_post_only_rejection(detail),
            Some((&context.connection_epoch, *connection_epoch)),
        );
        return Ok(ControlFlow::Break(()));
    }

    Ok(ControlFlow::Continue(
        tx.status == LighterTxStatus::Executed,
    ))
}

#[derive(Deserialize)]
struct AckedCreateTxInfo {
    #[serde(rename = "ClientOrderIndex")]
    client_order_index: i64,
}

#[derive(Deserialize)]
struct AckedCreateGroupTxInfo {
    #[serde(rename = "Orders")]
    orders: Vec<AckedCreateTxInfo>,
}

#[derive(Default, Deserialize)]
struct AckedTxEvent {
    #[serde(default, rename = "ae")]
    app_error: String,
}

fn validate_acked_create_tx(
    tx: &crate::http::models::LighterTx,
    account_index: i64,
    api_key_index: u8,
    client_order_index: i64,
    nonce: i64,
    tx_hash: &str,
) -> anyhow::Result<()> {
    anyhow::ensure!(
        tx_hash_matches(&tx.hash, tx_hash)
            && matches!(tx.tx_type, value if value == LighterTxType::CreateOrder as u8 || value == LighterTxType::CreateGroupedOrders as u8)
            && tx.account_index == account_index
            && tx.api_key_index == api_key_index
            && tx.nonce == nonce,
        "Lighter transaction lookup did not match acknowledged create identity",
    );

    if tx.tx_type == LighterTxType::CreateGroupedOrders as u8 {
        let info: AckedCreateGroupTxInfo = serde_json::from_str(&tx.info)
            .context("failed to parse Lighter grouped transaction info")?;
        anyhow::ensure!(
            info.orders
                .iter()
                .any(|order| order.client_order_index == client_order_index),
            "Lighter transaction lookup did not include acknowledged client_order_index {client_order_index}"
        );
        return Ok(());
    }

    let info: AckedCreateTxInfo = serde_json::from_str(&tx.info)
        .context("failed to parse Lighter create transaction info")?;
    anyhow::ensure!(
        info.client_order_index == client_order_index,
        "Lighter transaction lookup returned client_order_index {} for acknowledged create {client_order_index}",
        info.client_order_index,
    );
    Ok(())
}

fn tx_hash_matches(left: &str, right: &str) -> bool {
    let left = left
        .strip_prefix("0x")
        .or_else(|| left.strip_prefix("0X"))
        .unwrap_or(left);
    let right = right
        .strip_prefix("0x")
        .or_else(|| right.strip_prefix("0X"))
        .unwrap_or(right);
    left.eq_ignore_ascii_case(right)
}

fn parse_acked_tx_event(event_info: &str) -> anyhow::Result<AckedTxEvent> {
    if event_info.trim().is_empty() {
        return Ok(AckedTxEvent::default());
    }

    serde_json::from_str(event_info).context("failed to parse Lighter transaction event")
}

fn acked_tx_error_detail(app_error: &str) -> &str {
    if app_error.is_empty() {
        "transaction failed without an application error"
    } else {
        app_error
    }
}

#[derive(Debug, Clone)]
struct AckedOrderProbe {
    order: Box<OrderAny>,
    client_order_index: i64,
    connection_epoch: u64,
    nonce: i64,
    api_key_index: u8,
    tx_hash: String,
}

impl AckedOrderProbe {
    fn from_pending(pending: &PendingSendTx) -> Option<Self> {
        let PendingSendTxKind::Create {
            order,
            client_order_index,
        } = &pending.kind
        else {
            return None;
        };

        Some(Self {
            order: order.clone(),
            client_order_index: *client_order_index,
            connection_epoch: pending.connection_epoch,
            nonce: pending.nonce,
            api_key_index: pending.api_key_index,
            tx_hash: pending.tx_hash.clone(),
        })
    }
}

// SendTxRejected: attribute by echoed tx_hash when present (authoritative,
// no fallback on a miss); otherwise pop only when one transaction is pending
// for Ack, or head-within-window for BareError. Create emits OrderRejected,
// cancel/modify emit their typed rejections, and Other recovers via
// reconciliation. All attributed rejections roll the nonce back when still
// the latest issuance.
// Returns true on an invalid-nonce code: the sequential stream is wedged and
// needs a hard refresh.
#[expect(
    clippy::too_many_arguments,
    reason = "shared terminal create transition keeps cleanup and event attribution together"
)]
fn reject_create_order(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    order: &OrderAny,
    client_order_index: i64,
    nonce: i64,
    reason: &str,
    now: UnixNanos,
    due_post_only: bool,
    connection_epoch: Option<(&AtomicU64, u64)>,
) -> bool {
    let cloid = order.client_order_id();
    if !dispatch.reject_create_submission(&cloid, client_order_index, nonce, connection_epoch) {
        log::warn!(
            "Ignored stale Lighter create rejection for cloid={cloid} client_order_index={client_order_index} nonce={nonce}",
        );
        return false;
    }
    emitter.emit_order_rejected(order, reason, now, due_post_only);
    true
}

#[expect(
    clippy::too_many_arguments,
    reason = "consumer-loop sink that flattens one SendTxRejected message without a wrapper struct"
)]
fn handle_send_tx_rejection_for_connection(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_index: Option<i64>,
    connection_epoch: u64,
    now: UnixNanos,
    source: SendTxRejectionSource,
    code: Option<i64>,
    message: &str,
    tx_hash: Option<&str>,
) -> bool {
    let needs_nonce_resync = code == Some(LIGHTER_ERROR_CODE_INVALID_NONCE);
    let failure = venue_rejection_failure(code, message);
    let reason = command_failure_reason(&failure);

    let pending = match tx_hash {
        Some(hash) => dispatch.remove_pending_sendtx_by_hash(connection_epoch, hash),
        None => match source {
            SendTxRejectionSource::Ack => dispatch.pop_pending_sendtx_if_only(connection_epoch),
            SendTxRejectionSource::BareError => dispatch.pop_pending_sendtx_if_only_within(
                connection_epoch,
                now,
                SENDTX_BARE_ERROR_WINDOW_MS,
            ),
        },
    };
    let Some(pending) = pending else {
        log::warn!(
            "Lighter sendTx rejection unattributed (source={source:?} code={code:?}): {message:?}",
        );
        return needs_nonce_resync;
    };

    reject_pending_sendtx(
        dispatch,
        emitter,
        account_index,
        &pending,
        reason,
        now,
        lighter_reason_indicates_post_only_rejection(message),
    );
    needs_nonce_resync
}

fn reject_pending_sendtx(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_index: Option<i64>,
    pending: &PendingSendTx,
    reason: &str,
    now: UnixNanos,
    due_post_only: bool,
) {
    log::warn!(
        "{reason}, nonce={} api_key_index={}",
        pending.nonce,
        pending.api_key_index
    );

    if let Some(account_index) = account_index {
        let _ = dispatch.nonce_manager.ack_failure_if_latest(
            account_index,
            pending.api_key_index,
            pending.nonce,
        );
    }

    for (order, client_order_index) in pending.kind.creates() {
        reject_create_order(
            dispatch,
            emitter,
            order,
            client_order_index,
            pending.nonce,
            reason,
            now,
            due_post_only,
            None,
        );
    }

    match &pending.kind {
        PendingSendTxKind::Create { .. } | PendingSendTxKind::CreateGroup { .. } => {}
        PendingSendTxKind::Cancel { .. } => {
            reject_cancel_order(dispatch, emitter, pending, reason, now);
        }
        PendingSendTxKind::Modify { .. } => {
            reject_modify_order(dispatch, emitter, pending, reason, now);
        }
        PendingSendTxKind::Other => {}
    }
}

fn reject_cancel_order(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    pending: &PendingSendTx,
    reason: &str,
    now: UnixNanos,
) {
    let PendingSendTxKind::Cancel {
        emit_cancel_rejected,
        strategy_id,
        instrument_id,
        client_order_id,
        venue_order_id,
    } = pending.kind
    else {
        return;
    };

    if dispatch.clear_pending_cancel_if_nonce(
        &client_order_id,
        pending.connection_epoch,
        pending.nonce,
    ) && emit_cancel_rejected
    {
        emitter.emit_order_cancel_rejected_event(
            strategy_id,
            instrument_id,
            client_order_id,
            venue_order_id,
            reason,
            now,
        );
    }
}

fn reject_modify_order(
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    pending: &PendingSendTx,
    reason: &str,
    now: UnixNanos,
) {
    let PendingSendTxKind::Modify {
        strategy_id,
        instrument_id,
        client_order_id,
        venue_order_id,
    } = pending.kind
    else {
        return;
    };

    let mut events = dispatch.order_events.lock();
    if dispatch.clear_pending_modify_if_nonce(
        &client_order_id,
        pending.connection_epoch,
        pending.nonce,
    ) {
        emitter.emit_order_modify_rejected_event(
            strategy_id,
            instrument_id,
            client_order_id,
            venue_order_id,
            reason,
            now,
        );

        if let Some(deferred) = events.remove(&client_order_id) {
            flush_modify_events(client_order_id, deferred, dispatch, emitter, &mut events);
        }
    }
}

fn lighter_reason_indicates_post_only_rejection(reason: &str) -> bool {
    let normalized: String = reason
        .chars()
        .filter_map(|ch| {
            if ch == '-' || ch == '_' || ch.is_whitespace() {
                None
            } else {
                Some(ch.to_ascii_lowercase())
            }
        })
        .collect();

    normalized.contains("postonly") || normalized.contains("postwouldexecute")
}

fn lighter_http_error_is_definite_api_rejection(error: &LighterHttpError) -> bool {
    match error {
        LighterHttpError::RateLimit { .. } | LighterHttpError::Venue { .. } => true,
        LighterHttpError::Http { status, .. } => *status < 500,
        LighterHttpError::Network(_)
        | LighterHttpError::HistoryIncomplete { .. }
        | LighterHttpError::Parse(_) => false,
    }
}

fn rollback_tx_dispatch(
    dispatch: &WsDispatchState,
    credential: &Credential,
    client_order_index: Option<i64>,
    nonce: i64,
) {
    rollback_tx_dispatch_indices(
        dispatch,
        credential.account_index(),
        credential.api_key_index(),
        client_order_index,
        None,
        nonce,
    );
}

fn rollback_tx_dispatch_create(
    dispatch: &WsDispatchState,
    credential: &Credential,
    client_order_index: Option<i64>,
    client_order_id: &ClientOrderId,
    nonce: i64,
) {
    rollback_tx_dispatch_indices(
        dispatch,
        credential.account_index(),
        credential.api_key_index(),
        client_order_index,
        Some(client_order_id),
        nonce,
    );
}

// Roll back only while still the latest issuance: decrementing past a newer
// signed tx would duplicate its nonce on the wire. Skipped rollbacks heal
// via the baseline advance or venue resync.
fn rollback_tx_dispatch_indices(
    dispatch: &WsDispatchState,
    account_index: i64,
    api_key_index: u8,
    client_order_index: Option<i64>,
    client_order_id: Option<&ClientOrderId>,
    nonce: i64,
) {
    let _ = dispatch
        .nonce_manager
        .ack_failure_if_latest(account_index, api_key_index, nonce);

    if let Some(client_order_index) = client_order_index {
        dispatch.forget_cloid(client_order_index);
    }

    if let Some(cloid) = client_order_id {
        dispatch.forget_order_identity(cloid);
    }
}

fn integrator_attributes(integrator_account_index: Option<u64>) -> L2TxAttributes {
    integrator_account_index.map_or_else(L2TxAttributes::default, |integrator_account_index| {
        L2TxAttributes {
            integrator_account_index,
            ..Default::default()
        }
    })
}

fn command_failure_reason(failure: &CommandFailure) -> &str {
    match failure {
        CommandFailure::NotSent(reason)
        | CommandFailure::Ambiguous(reason)
        | CommandFailure::VenueRejected(reason) => reason,
    }
}

fn warn_pending_sendtx_unknown(pending_sendtx: &[PendingSendTx], context: &str) {
    if pending_sendtx.is_empty() {
        return;
    }

    log::warn!(
        "Discarded {} pending sendTx entries during {context}; order state recovers via \
         reconciliation",
        pending_sendtx.len(),
    );

    for pending in pending_sendtx {
        for (order, _) in pending.kind.creates() {
            log::warn!(
                "Lighter sendTx outcome unknown during {context} for {}",
                order.client_order_id(),
            );
        }
    }
}

fn classify_lighter_ws_command_failure(action: &str, error: &LighterWsError) -> CommandFailure {
    let fallback = format!("Lighter {action} dispatch failed");
    let reason = sanitize_strategy_reason(&format!("{fallback}: {error}"))
        .unwrap_or_else(|| fallback.clone());

    match error {
        LighterWsError::SendTxOutcomeUnknown(_)
        | LighterWsError::Network(_)
        | LighterWsError::Parse(_)
        | LighterWsError::Transport(SendError::WriteTimeout | SendError::BrokenPipe(_)) => {
            CommandFailure::ambiguous(reason)
        }
        LighterWsError::Transport(
            SendError::InvalidInput(_)
            | SendError::BufferFull
            | SendError::Closed
            | SendError::Timeout
            | SendError::ConnectionChanged,
        )
        | LighterWsError::Authentication(_)
        | LighterWsError::Client(_) => CommandFailure::not_sent(reason),
    }
}

fn venue_rejection_failure(code: Option<i64>, message: &str) -> CommandFailure {
    let clean_message = sanitize_strategy_reason(message);
    let reason = match (code, clean_message) {
        (Some(code), Some(message)) => format!("LIGHTER_{code}: {message}"),
        (Some(code), None) => format!("LIGHTER_{code}"),
        (None, Some(message)) => message,
        (None, None) => "Lighter venue rejected sendTx".to_string(),
    };
    let reason = sanitize_strategy_reason(&reason)
        .unwrap_or_else(|| "Lighter venue rejected sendTx".to_string());
    CommandFailure::venue_rejected(reason)
}

fn sanitize_strategy_reason(input: &str) -> Option<String> {
    let mut output = String::new();
    let mut inside_markup = false;
    let mut pending_space = false;
    let mut char_count = 0;
    let mut chars = input.chars().peekable();

    while let Some(ch) = chars.next() {
        if inside_markup {
            if ch == '>' {
                inside_markup = false;
            }
            continue;
        }

        match ch {
            '<' if chars.peek().is_some_and(|next| {
                next.is_ascii_alphabetic() || matches!(next, '/' | '!' | '?')
            }) =>
            {
                inside_markup = true;
                pending_space = !output.is_empty();
            }
            _ if ch.is_control() || is_unicode_format_control(ch) || ch.is_whitespace() => {
                pending_space = !output.is_empty();
            }
            _ => {
                if pending_space && char_count < STRATEGY_REASON_MAX_CHARS {
                    output.push(' ');
                    char_count += 1;
                }
                pending_space = false;

                if char_count == STRATEGY_REASON_MAX_CHARS {
                    break;
                }
                output.push(ch);
                char_count += 1;
            }
        }
    }

    let output = output.trim().to_string();
    (!output.is_empty()).then_some(output)
}

fn is_unicode_format_control(ch: char) -> bool {
    matches!(
        ch,
        '\u{00ad}'
            | '\u{061c}'
            | '\u{06dd}'
            | '\u{070f}'
            | '\u{08e2}'
            | '\u{180e}'
            | '\u{feff}'
            | '\u{fff9}'..='\u{fffb}'
            | '\u{0600}'..='\u{0605}'
            | '\u{0890}'..='\u{0891}'
            | '\u{200b}'..='\u{200f}'
            | '\u{202a}'..='\u{202e}'
            | '\u{2060}'..='\u{206f}'
            | '\u{110bd}'
            | '\u{110cd}'
            | '\u{13430}'..='\u{1343f}'
            | '\u{1bca0}'..='\u{1bca3}'
            | '\u{1d173}'..='\u{1d17a}'
            | '\u{e0001}'
            | '\u{e0020}'..='\u{e007f}'
    )
}

/// Format a `start_secs-end_secs` window for Lighter's `between_timestamps`
/// query parameter. Returns `None` when neither bound is set; an unset end
/// defaults to the current time so the venue scopes pagination to the
/// half-open window.
fn format_between_timestamps(
    start: Option<UnixNanos>,
    end: Option<UnixNanos>,
    ts_now: UnixNanos,
) -> Option<String> {
    let (start, end) = match (start, end) {
        (None, None) => return None,
        (Some(s), Some(e)) => (s, e),
        (Some(s), None) => (s, ts_now),
        (None, Some(e)) => (UnixNanos::from(0), e),
    };
    let start_secs = start.as_u64() / 1_000_000_000;
    let end_secs = end.as_u64() / 1_000_000_000;
    Some(format!("{start_secs}-{end_secs}"))
}

#[async_trait(?Send)]
impl ExecutionClient for LighterExecutionClient {
    fn is_connected(&self) -> bool {
        self.core.is_connected()
    }

    fn client_id(&self) -> ClientId {
        self.core.client_id
    }

    fn account_id(&self) -> AccountId {
        self.core.account_id
    }

    fn venue(&self) -> Venue {
        self.core.venue
    }

    fn oms_type(&self) -> OmsType {
        self.core.oms_type
    }

    fn get_account(&self) -> Option<AccountAny> {
        self.core.cache().account_owned(&self.core.account_id)
    }

    fn generate_account_state(
        &self,
        balances: Vec<AccountBalance>,
        margins: Vec<MarginBalance>,
        reported: bool,
        ts_event: UnixNanos,
        info: Option<Params>,
    ) -> anyhow::Result<()> {
        self.emitter
            .emit_account_state(balances, margins, reported, ts_event, info);
        Ok(())
    }

    fn start(&mut self) -> anyhow::Result<()> {
        let sender = get_exec_event_sender();
        self.emitter.set_sender(sender);
        self.subscribe_applied_fills();

        if self.core.is_started() {
            return Ok(());
        }

        self.core.set_started();

        log::info!(
            "Started Lighter execution client: client_id={}, account_id={}, environment={:?}, has_credentials={}",
            self.core.client_id,
            self.core.account_id,
            self.config.environment,
            self.has_credentials(),
        );

        Ok(())
    }

    fn stop(&mut self) -> anyhow::Result<()> {
        if self.core.is_stopped() && self.core.is_disconnected() && self.session_tasks_finished() {
            return Ok(());
        }

        log::info!("Stopping Lighter execution client {}", self.core.client_id);

        self.begin_session_shutdown();

        self.core.set_stopped();

        log::info!("Lighter execution client stopped");
        Ok(())
    }

    fn reset(&mut self) -> anyhow::Result<()> {
        log::debug!("Resetting Lighter execution client {}", self.core.client_id);
        self.begin_session_shutdown();
        Ok(())
    }

    fn dispose(&mut self) -> anyhow::Result<()> {
        log::debug!("Disposing Lighter execution client {}", self.core.client_id);
        self.stop()
    }

    async fn connect(&mut self) -> anyhow::Result<()> {
        if self.core.is_connected() && self.pending_tasks.is_open() {
            return Ok(());
        }

        // Without credentials the engine would accept the connection and
        // then deny every order per-submission. Fail before any WS/REST
        // work so reconciliation and strategies never start.
        if !self.has_credentials() {
            anyhow::bail!(
                "Lighter execution client requires credentials; \
                 set private_key, account_index, and api_key_index in the config \
                 or use the deployment-specific credential environment variables"
            );
        }

        log::info!(
            "Connecting Lighter execution client {}",
            self.core.client_id
        );

        // Synchronous stop/reset can only initiate teardown. Complete it before
        // publishing a replacement socket or sharing its connection epoch.
        if !self.session_tasks_finished() || !self.pending_tasks.is_open() {
            self.begin_session_shutdown();
            self.finish_session_shutdown().await?;
        }

        if !self.pending_tasks.is_open() {
            self.pending_tasks
                .start_generation()
                .map_err(|e| anyhow::anyhow!("Failed to start Lighter task generation: {e}"))?;
            self.cancellation_token = self.pending_tasks.cancellation_token();
        }

        let ws_client = self.ws_client.clone();
        let setup_guard = TaskGroupGuard::new(&[&self.pending_tasks], move || {
            ws_client.begin_shutdown();
        });
        self.auth_refresh_notify = Arc::new(tokio::sync::Notify::new());
        self.scheduled_cancel_notify = Arc::new(tokio::sync::Notify::new());

        // Reset the readiness gate and clear derived position/account caches
        // so a prior session's state cannot leak past the strict-await gate.
        // The Reconnected path (WS-layer transparent reconnect) is unaffected:
        // it does not re-enter `connect()`. Its next `account_all_positions`
        // frame replaces the position cache through the consumption loop.
        self.dispatch.account_streams_ready.reset();
        self.dispatch.clear_position_cache();
        self.dispatch.clear_account_state_cache();

        self.ensure_instruments_initialized_async().await?;
        self.refresh_nonce().await?;

        // Auto-approval is an HTTP transaction prepared before the replacement WebSocket exists
        self.nonce_ready_connection_epoch
            .store(self.ws_client.connection_epoch(), Ordering::Release);
        let account_detail = self.fetch_account_detail().await;

        if let Some(detail) = &account_detail {
            self.log_account_tier(detail);

            let _ = tokio::time::timeout(
                REFERRAL_ATTRIBUTION_TIMEOUT,
                self.apply_referral_attribution(detail),
            )
            .await;
        }

        if let Err(e) = self.submit_integrator_auto_approval().await {
            // Bail on venue 21149 ("integrator is not approved") so the
            // operator catches it at startup rather than at first order.
            // Other failures are tolerated: approval is account-scoped and
            // may already be in place, or a reconnect can retry.
            let is_unapproved = e.chain().any(|cause| {
                matches!(
                    cause.downcast_ref::<LighterHttpError>(),
                    Some(LighterHttpError::Venue { code: 21149, .. }),
                )
            });

            if is_unapproved {
                self.nonce_ready_connection_epoch
                    .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);
                return Err(e.context(
                    "Lighter account is not integrator-approved (venue 21149); \
                     orders cannot be placed",
                ));
            }

            log::warn!("Lighter integrator approval failed; continuing startup: {e:?}");
        }

        self.nonce_ready_connection_epoch
            .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);

        if let Err(e) = self.sync_nonce_from_venue().await {
            log::debug!(
                "Failed to sync Lighter nonce after integrator approval; continuing startup: {e:?}"
            );
        }

        self.subscribe_applied_fills();

        if let Err(e) = self.spawn_ws_consumer().await {
            self.begin_session_shutdown();
            return match self.finish_session_shutdown().await {
                Ok(()) => Err(e),
                Err(shutdown_error) => Err(anyhow::anyhow!(
                    "{e}; failed to roll back partial Lighter connection: {shutdown_error}"
                )),
            };
        }
        self.nonce_ready_connection_epoch
            .store(self.ws_client.connection_epoch(), Ordering::Release);

        let ready = async {
            self.await_account_streams_ready(30.0).await?;
            self.start_scheduled_cancel().await
        }
        .await;

        if let Err(e) = ready {
            log::warn!("Connect failed after WS started, tearing down: {e}");
            self.begin_session_shutdown();

            if let Err(shutdown_error) = self.finish_session_shutdown().await {
                log::warn!("Failed to finish partial Lighter connection: {shutdown_error}");
            }

            return Err(e);
        }

        setup_guard.disarm();
        self.core.set_connected();

        log::info!("Connected: client_id={}", self.core.client_id);
        Ok(())
    }

    async fn disconnect(&mut self) -> anyhow::Result<()> {
        if self.core.is_disconnected() && self.session_tasks_finished() {
            return Ok(());
        }

        log::info!(
            "Disconnecting Lighter execution client {}",
            self.core.client_id
        );

        self.begin_session_shutdown();
        let tasks_result = self.finish_session_shutdown().await;

        self.core.set_disconnected();

        log::info!("Disconnected: client_id={}", self.core.client_id);
        tasks_result
    }

    fn submit_order(&self, cmd: SubmitOrder) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot submit without credentials")
        })?;

        let order = self.core.cache().try_order_owned(&cmd.client_order_id)?;

        if order.is_closed() {
            log::warn!("Cannot submit closed order {}", order.client_order_id());
            return Ok(());
        }

        let cached_instrument = self
            .core
            .cache()
            .instrument(&order.instrument_id())
            .cloned();

        if let Some(reason) = local_submit_denial_reason(&order, cached_instrument.as_ref()) {
            self.emitter.emit_order_denied(&order, &reason.to_string());
            return Ok(());
        }

        let slippage_bps = self.resolve_slippage_bps(cmd.params.as_ref());

        let plan = match self.prepare_create_order_plan(&order, slippage_bps, cmd.params.as_ref()) {
            Ok(plan) => plan,
            Err(e) => {
                let reason = OrderDeniedReason::ValidationFailed {
                    detail: format!("Lighter submit_order failed: {e}"),
                };
                self.emitter.emit_order_denied(&order, &reason.to_string());
                return Ok(());
            }
        };

        if let Err(e) = self.dispatch_create_order_plan(&plan, credential) {
            let reason = OrderDeniedReason::SubmitFailed {
                detail: format!("Lighter submit_order failed: {e}"),
            };
            self.emitter.emit_order_denied(&order, &reason.to_string());
        }

        Ok(())
    }

    fn submit_order_list(&self, cmd: SubmitOrderList) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot submit without credentials")
        })?;

        if cmd.order_list.client_order_ids.is_empty() {
            log::debug!("submit_order_list called with empty order list");
            return Ok(());
        }

        let orders = self.core.get_orders_for_list(&cmd.order_list)?;

        if orders.iter().any(is_grouped_order) {
            let result = self
                .prepare_create_group_plan(
                    &orders,
                    self.resolve_slippage_bps(cmd.params.as_ref()),
                    cmd.params.as_ref(),
                )
                .and_then(|plan| {
                    let context = self.fanout_dispatch_context(credential)?;
                    self.spawn_task("submit_grouped_orders", async move {
                        context
                            .dispatch_batch_plans(vec![BatchOrderPlan::CreateGroup(plan)])
                            .await;
                        Ok(())
                    });

                    Ok(())
                });

            if let Err(e) = result {
                let reason = grouped_submit_denial_reason(&e);
                for order in &orders {
                    self.emitter.emit_order_denied(order, &reason);
                }
            }
            return Ok(());
        }

        let slippage_bps = self.resolve_slippage_bps(cmd.params.as_ref());
        let mut plans = Vec::with_capacity(orders.len());

        for order in orders {
            if order.is_closed() {
                log::warn!("Cannot submit closed order {}", order.client_order_id());
                continue;
            }

            let cached_instrument = self
                .core
                .cache()
                .instrument(&order.instrument_id())
                .cloned();

            if let Some(reason) = local_submit_denial_reason(&order, cached_instrument.as_ref()) {
                self.emitter.emit_order_denied(&order, &reason.to_string());
                continue;
            }

            match self.prepare_create_order_plan(&order, slippage_bps, cmd.params.as_ref()) {
                Ok(plan) => plans.push(plan),
                Err(e) => {
                    let reason = OrderDeniedReason::ValidationFailed {
                        detail: format!("Lighter submit_order_list failed: {e}"),
                    }
                    .to_string();

                    self.emitter.emit_order_denied(&order, &reason);
                }
            }
        }

        if plans.is_empty() {
            log::warn!(
                "Lighter submit_order_list: no supported orders to dispatch for {}",
                cmd.order_list.id,
            );
            return Ok(());
        }

        let context = self.fanout_dispatch_context(credential)?;
        self.spawn_task("submit_order_list", async move {
            context
                .dispatch_batch_plans(
                    plans
                        .into_iter()
                        .map(|plan| BatchOrderPlan::Create(Box::new(plan)))
                        .collect(),
                )
                .await;
            Ok(())
        });

        Ok(())
    }

    fn modify_order(&self, cmd: ModifyOrder) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot modify without credentials")
        })?;
        self.dispatch_signed_modify_order(&cmd, credential);
        Ok(())
    }

    fn batch_modify_orders(&self, cmd: BatchModifyOrders) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot modify without credentials")
        })?;

        let context = self.fanout_dispatch_context(credential)?;
        let mut plans = Vec::with_capacity(cmd.modifies.len());
        for modify in &cmd.modifies {
            if !self.admit_modify_order(modify) {
                continue;
            }

            match self.prepare_modify_order_plan(modify) {
                Ok(plan) => plans.push(BatchOrderPlan::Modify(plan)),
                Err(e) => {
                    let mut events = self.dispatch.order_events.lock();
                    self.dispatch.clear_pending_modify_if_command(
                        &modify.client_order_id,
                        modify.command_id,
                    );
                    self.emitter.emit_order_modify_rejected_event(
                        modify.strategy_id,
                        modify.instrument_id,
                        modify.client_order_id,
                        modify.venue_order_id,
                        &format!("Lighter modify_order failed: {e}"),
                        self.clock.get_time_ns(),
                    );

                    if let Some(deferred) = events.remove(&modify.client_order_id) {
                        flush_modify_events(
                            modify.client_order_id,
                            deferred,
                            &self.dispatch,
                            &self.emitter,
                            &mut events,
                        );
                    }
                }
            }
        }

        if !plans.is_empty() {
            self.spawn_task("batch_modify_orders", async move {
                context.dispatch_batch_plans(plans).await;
                Ok(())
            });
        }

        Ok(())
    }

    fn cancel_order(&self, cmd: CancelOrder) -> anyhow::Result<()> {
        let credential = self.credential.as_ref().ok_or_else(|| {
            anyhow::anyhow!("Lighter execution client cannot cancel without credentials")
        })?;

        if let Some(plans) = self.prepare_oco_cancel_plans(&cmd) {
            let context = self.fanout_dispatch_context(credential)?;

            let plans = plans
                .into_iter()
                .map(|plan| {
                    let emit = self.can_emit_order_cancel_rejected(&plan.client_order_id);
                    self.dispatch.set_pending_order_action(
                        plan.client_order_id,
                        PendingOrderAction::cancel(emit),
                    );
                    BatchOrderPlan::Cancel(plan, emit)
                })
                .collect();

            self.spawn_task("cancel_oco_orders", async move {
                context.dispatch_batch_plans(plans).await;
                Ok(())
            });

            return Ok(());
        }

        self.dispatch_signed_cancel_order(&cmd, credential);
        Ok(())
    }

    fn cancel_all_orders(&self, cmd: CancelAllOrders) -> anyhow::Result<()> {
        // Native cancel-all has no side filter, and the local signing schema
        // carries no market restriction, so batch explicit per-order cancellations.
        let cancels: Vec<_> = self
            .core
            .cache()
            .orders_open(
                None,
                Some(&cmd.instrument_id),
                None,
                Some(&self.core.account_id),
                cmd.order_side,
            )
            .into_iter()
            .map(|order| {
                cancel_order_from_cancel_all(&cmd, order.client_order_id(), order.strategy_id())
            })
            .collect();

        if cancels.is_empty() {
            return Ok(());
        }

        self.dispatch_cancel_orders(&cancels)
    }

    fn batch_cancel_orders(&self, cmd: BatchCancelOrders) -> anyhow::Result<()> {
        self.dispatch_cancel_orders(&cmd.cancels)
    }

    fn query_account(&self, _cmd: QueryAccount) -> anyhow::Result<()> {
        // Lighter has no public REST endpoint that returns a snapshot of
        // account balances and margins; the only authoritative source is the
        // `account_all_assets` WebSocket stream. Replay the most recent
        // cached state so the engine sees something synchronously. The
        // cache is populated by the consumption loop on every venue push.
        let cached = self.dispatch.snapshot_account_state();
        match cached {
            Some(state) => {
                log::debug!("Lighter query_account replaying cached AccountState");
                self.emitter.send_account_state(state);
            }
            None => {
                log::warn!(
                    "Lighter query_account: no AccountState cached yet \
                     (account_all_assets stream has not pushed since connect)",
                );
            }
        }
        Ok(())
    }

    fn query_order(&self, cmd: QueryOrder) -> anyhow::Result<()> {
        let credential = self
            .credential
            .as_ref()
            .ok_or_else(|| anyhow::anyhow!("Lighter query_order requires credentials"))?
            .clone();
        let registry = Arc::clone(&self.registry);
        let http_client = self.http_client.clone();
        let emitter = self.emitter.clone();
        let core_account_id = self.core.account_id;
        let dispatch = self.dispatch.clone();
        let clock = self.clock;

        if let Some(order) = self.core.cache().order_owned(&cmd.client_order_id) {
            self.dispatch.seed_order_restoration(order);
        }

        let _ = order_shape_pending(&self.core, &self.dispatch, &cmd.client_order_id);
        let child_context = self.child_probe_context();
        self.spawn_task("query_order", async move {
            let lookup = OrderReportLookup::new(
                &registry,
                &dispatch,
                Some(cmd.instrument_id),
                Some(&cmd.client_order_id),
                cmd.venue_order_id.as_ref(),
            )?;

            let report = if let Some(order) =
                collect_order(&http_client, &registry, &credential, &lookup).await?
            {
                if !dispatch.restore_cached_order(
                    VenueOrderId::new(&order.order_id),
                    order.client_order_index,
                    cmd.instrument_id,
                ) {
                    return Ok(());
                }

                if let Some(context) = &child_context {
                    recover_report_fills(&order, context).await?;
                }

                let parsed = lookup.parse(
                    &order,
                    &registry,
                    core_account_id,
                    clock.get_time_ns(),
                    &dispatch,
                )?;
                let report = lookup.finish(&dispatch, parsed);
                if dispatch
                    .order_identity(&cmd.client_order_id)
                    .is_some_and(|identity| identity.child_fill_baseline().is_some())
                {
                    if let Some(context) = &child_context {
                        spawn_child_recovery(cmd.client_order_id, context);
                    }

                    return Ok(());
                }

                Some(report)
            } else {
                None
            };

            let events = dispatch.order_events.lock();
            if dispatch
                .terminals_pending
                .lock()
                .contains_key(&cmd.client_order_id)
                || events.get(&cmd.client_order_id).is_some_and(|deferred| {
                    deferred
                        .order
                        .as_ref()
                        .is_some_and(|order| order.status.is_terminal())
                })
                || dispatch
                    .order_identity(&cmd.client_order_id)
                    .is_some_and(|identity| {
                        position_fills_pending(&identity, &events, &dispatch)
                            || dispatch.any_order_identity(|_, other, _| {
                                other.strategy_id == identity.strategy_id
                                    && other.instrument_id == identity.instrument_id
                                    && other.has_publication()
                            })
                    })
                || dispatch.has_pending_modify(&cmd.client_order_id)
                || dispatch
                    .order_identity(&cmd.client_order_id)
                    .is_some_and(|identity| identity.has_publication())
            {
                return Ok(());
            }

            match report {
                Some(report) => {
                    if dispatch
                        .order_identity(&cmd.client_order_id)
                        .is_some_and(|identity| !identity.report_fills_covered(&report, &[]))
                    {
                        return Ok(());
                    }

                    log::debug!(
                        "Lighter query_order returning report for {}",
                        cmd.client_order_id
                    );
                    dispatch.seed_accepted_from_report(&report);
                    emitter.send_order_status_report(report);
                }
                None => {
                    log::warn!(
                        "Lighter query_order: no order found for {}",
                        cmd.client_order_id,
                    );
                }
            }
            Ok(())
        });
        Ok(())
    }

    fn generate_order_status_report_task(
        &self,
        cmd: &GenerateOrderStatusReport,
    ) -> Option<ExecutionReportTask<Option<OrderStatusReport>>> {
        let credential = self.credential.clone();
        let http = self.http_client.clone();
        let registry = Arc::clone(&self.registry);
        let account_id = self.core.account_id;
        let clock = self.clock;
        let core = self.core.clone();
        let dispatch = self.dispatch.clone();
        let cancellation_token = self.cancellation_token.clone();
        let command = cmd.clone();
        let child_context = self.child_probe_context();
        let collection_context = child_context.clone();
        let lookup_registry = Arc::clone(&registry);

        let lookup = OrderReportLookup::new(
            &registry,
            &dispatch,
            cmd.instrument_id,
            cmd.client_order_id.as_ref(),
            cmd.venue_order_id.as_ref(),
        );
        Some(ExecutionReportTask::new(
            async move {
                let Some(credential) = credential else {
                    log::warn!("Lighter generate_order_status_report: no credentials");
                    return Ok(None);
                };

                if command.client_order_id.is_none() && command.venue_order_id.is_none() {
                    log::warn!(
                        "Lighter generate_order_status_report: must supply client_order_id or venue_order_id"
                    );
                    return Ok(None);
                }

                let lookup = lookup?;
                let order = collect_order(&http, &lookup_registry, &credential, &lookup).await?;
                if let Some(order) = &order
                    && order.status == LighterOrderStatus::Filled
                    && let Some(context) = &collection_context
                {
                    recover_report_fills(order, context).await?;
                }

                Ok(order.map(|order| (lookup, order)))
            },
            move |collected| {
                anyhow::ensure!(
                    !cancellation_token.is_cancelled(),
                    "Lighter report session stopped"
                );

                let report = collected
                    .map(|(lookup, order)| -> anyhow::Result<OrderStatusReport> {
                        let parsed = lookup.parse(
                            &order,
                            &registry,
                            account_id,
                            clock.get_time_ns(),
                            &dispatch,
                        )?;
                        let report = &parsed.0;
                        let pending = core
                            .cache()
                            .client_order_id(&report.venue_order_id)
                            .copied()
                            .is_some_and(|cloid| dispatch.has_pending_modify(&cloid));

                        if !pending {
                            restore_reconciled_order(
                                &core,
                                &dispatch,
                                report.venue_order_id,
                                order.client_order_index,
                                report.order_status.is_closed(),
                            );
                            dispatch.record_order_reduction(
                                order.client_order_index,
                                report.venue_order_id,
                                order.initial_base_amount - report.quantity.as_decimal(),
                            );
                        }

                        let report = lookup.finish(&dispatch, parsed);
                        if let Some(context) = &child_context {
                            request_child_recovery(&core, context, &report);
                        }

                        ensure_order_report_ready(&core, &dispatch, &report)?;
                        Ok(report)
                    })
                    .transpose()?;

                if let Some(report) = &report {
                    dispatch.seed_accepted_from_report(report);
                }

                Ok(report)
            },
        ))
    }

    fn generate_order_status_reports_task(
        &self,
        cmd: &GenerateOrderStatusReports,
    ) -> Option<ExecutionReportTask<Vec<OrderStatusReport>>> {
        let client = self.report_client();
        let core = self.core.clone();
        let dispatch = self.dispatch.clone();
        let cancellation_token = self.cancellation_token.clone();
        let child_context = self.child_probe_context();
        let command = cmd.clone();
        let collection_command = command.clone();
        let collection_context = child_context.clone();
        Some(ExecutionReportTask::new(
            async move {
                let sweep = client
                    .collect_order_status_reports(&collection_command)
                    .await;

                if let Some(context) = &collection_context {
                    recover_filled_reports(&sweep, context).await;
                }

                Ok(sweep)
            },
            move |sweep| {
                anyhow::ensure!(
                    !cancellation_token.is_cancelled(),
                    "Lighter report session stopped"
                );

                if let Some(context) = &child_context {
                    request_child_report_recoveries(&core, context, &sweep);
                }

                finish_order_reports(&core, &dispatch, sweep, &command, None)
            },
        ))
    }

    fn generate_fill_reports_task(
        &self,
        cmd: &GenerateFillReports,
    ) -> Option<ExecutionReportTask<Vec<FillReport>>> {
        let client = self.report_client();
        let instruments = self.report_instruments(cmd.instrument_id);
        let core = self.core.clone();
        let dispatch = self.dispatch.clone();
        let cancellation_token = self.cancellation_token.clone();
        let child_context = self.child_probe_context();
        let command = cmd.clone();
        let cmd_log_level = cmd.log_receipt_level;
        Some(ExecutionReportTask::new(
            async move {
                let mut markets = BTreeSet::new();
                let result = client
                    .collect_fill_reports(&command, &instruments, &mut markets)
                    .await;
                Ok((markets, result))
            },
            move |(markets, result)| {
                anyhow::ensure!(
                    !cancellation_token.is_cancelled(),
                    "Lighter report session stopped"
                );
                let reports = finish_fill_reports(&core, &dispatch, markets, result)?.reports;

                if let Some(context) = &child_context {
                    spawn_child_recoveries(context);
                }

                Self::log_report_receipt(reports.len(), "FillReport", cmd_log_level);
                Ok(reports)
            },
        ))
    }

    fn generate_position_status_reports_task(
        &self,
        cmd: &GeneratePositionStatusReports,
    ) -> Option<ExecutionReportTask<Vec<PositionStatusReport>>> {
        let core = self.core.clone();
        let dispatch = self.dispatch.clone();
        let cancellation_token = self.cancellation_token.clone();
        let registry = Arc::clone(&self.registry);
        let command = cmd.clone();
        Some(ExecutionReportTask::new(async { Ok(()) }, move |()| {
            anyhow::ensure!(
                !cancellation_token.is_cancelled(),
                "Lighter report session stopped"
            );
            let (reports, complete, _) =
                cached_position_reports(&core, &dispatch, &registry, &command)?;
            anyhow::ensure!(
                complete,
                "Lighter position snapshot does not cover the requested instrument scope"
            );
            Self::log_report_receipt(
                reports.len(),
                "PositionStatusReport",
                command.log_receipt_level,
            );
            Ok(reports)
        }))
    }

    async fn generate_order_status_report(
        &self,
        cmd: &GenerateOrderStatusReport,
    ) -> anyhow::Result<Option<OrderStatusReport>> {
        let Some(credential) = &self.credential else {
            log::warn!("Lighter generate_order_status_report: no credentials");
            return Ok(None);
        };

        if cmd.client_order_id.is_none() && cmd.venue_order_id.is_none() {
            log::warn!(
                "Lighter generate_order_status_report: must supply client_order_id or venue_order_id",
            );
            return Ok(None);
        }

        let lookup = OrderReportLookup::new(
            &self.registry,
            &self.dispatch,
            cmd.instrument_id,
            cmd.client_order_id.as_ref(),
            cmd.venue_order_id.as_ref(),
        )?;

        let report = if let Some(order) =
            collect_order(&self.http_client, &self.registry, credential, &lookup).await?
        {
            if order.status == LighterOrderStatus::Filled
                && let Some(context) = self.child_probe_context()
            {
                recover_report_fills(&order, &context).await?;
            }

            let parsed = lookup.parse(
                &order,
                &self.registry,
                self.core.account_id,
                self.clock.get_time_ns(),
                &self.dispatch,
            )?;

            if !self
                .core
                .cache()
                .client_order_id(&parsed.0.venue_order_id)
                .is_some_and(|cloid| self.dispatch.has_pending_modify(cloid))
            {
                restore_reconciled_order(
                    &self.core,
                    &self.dispatch,
                    parsed.0.venue_order_id,
                    order.client_order_index,
                    parsed.0.order_status.is_closed(),
                );
                self.dispatch.record_order_reduction(
                    order.client_order_index,
                    parsed.0.venue_order_id,
                    order.initial_base_amount - parsed.0.quantity.as_decimal(),
                );
            }

            let report = lookup.finish(&self.dispatch, parsed);
            if let Some(context) = self.child_probe_context() {
                request_child_recovery(&self.core, &context, &report);
            }

            ensure_order_report_ready(&self.core, &self.dispatch, &report)?;
            Some(report)
        } else {
            None
        };

        if let Some(report) = &report {
            self.dispatch.seed_accepted_from_report(report);
        }

        Ok(report)
    }

    async fn generate_order_status_reports(
        &self,
        cmd: &GenerateOrderStatusReports,
    ) -> anyhow::Result<Vec<OrderStatusReport>> {
        self.collect_order_reports(cmd, None).await
    }

    async fn generate_fill_reports(
        &self,
        cmd: GenerateFillReports,
    ) -> anyhow::Result<Vec<FillReport>> {
        let reports = self.paginate_fill_reports(&cmd).await?.reports;
        Self::log_report_receipt(reports.len(), "FillReport", cmd.log_receipt_level);
        Ok(reports)
    }

    async fn generate_position_status_reports(
        &self,
        cmd: &GeneratePositionStatusReports,
    ) -> anyhow::Result<Vec<PositionStatusReport>> {
        let (reports, complete, _) = self.cached_position_reports(cmd)?;
        anyhow::ensure!(
            complete,
            "Lighter position snapshot does not cover the requested instrument scope",
        );
        Self::log_report_receipt(reports.len(), "PositionStatusReport", cmd.log_receipt_level);
        Ok(reports)
    }

    async fn generate_mass_status(
        &self,
        lookback_mins: Option<u64>,
    ) -> anyhow::Result<Option<ExecutionMassStatus>> {
        let ts_init = self.clock.get_time_ns();

        // Scope inactive orders at the venue and stop descending trade
        // pagination once it crosses this local lookback boundary.
        let lookback_start = lookback_mins
            .map(DurationNanos::try_from_mins)
            .transpose()?
            .map(|lookback| ts_init.saturating_sub(lookback));

        // open_only = false so the inactive-orders fan-out runs and surfaces
        // canceled / rejected / expired / filled orders that the engine
        // needs for reconciliation. The active markets set bounds the fan-out
        // to markets with known account activity.
        let mut order_cmd = GenerateOrderStatusReports::new(
            UUID4::new(),
            ts_init,
            false,
            None,
            lookback_start,
            None,
            None,
            None,
        );
        order_cmd.log_receipt_level = LogLevel::Debug;
        let fill_cmd = GenerateFillReports::new(
            UUID4::new(),
            ts_init,
            None,
            None,
            lookback_start,
            None,
            None,
            None,
        );
        let position_cmd =
            GeneratePositionStatusReports::new(UUID4::new(), ts_init, None, None, None, None, None);

        let (mut fill_reports, fill_reports_complete, withheld_fills) =
            fill_reports_for_mass_status(self.paginate_fill_reports(&fill_cmd).await)
                .context("Lighter fill reconciliation failed")?;
        Self::log_report_receipt(fill_reports.len(), "FillReport", fill_cmd.log_receipt_level);

        // Preserve successful reports if a later market or history page fails.
        // Retry the active leg only when the failed request produced nothing.
        let mut withheld_instruments = withheld_fills;
        let order_result = self
            .collect_order_reports(&order_cmd, Some(&fill_reports))
            .await;

        let (mut order_reports, mut reports_complete) = match order_result {
            Ok(reports) => (reports, true),
            Err(e) => {
                withheld_instruments.extend(withheld_order_instruments(&e));
                log::warn!(
                    "Lighter order report generation failed: {}",
                    scrub_auth(&format!("{e:#}")),
                );
                let partial = partial_order_reports(&e);
                let reports = if partial.is_empty() {
                    let mut active_cmd = GenerateOrderStatusReports::new(
                        UUID4::new(),
                        ts_init,
                        true,
                        None,
                        None,
                        None,
                        None,
                        None,
                    );
                    active_cmd.log_receipt_level = LogLevel::Debug;
                    let active_result = self
                        .collect_order_reports(&active_cmd, Some(&fill_reports))
                        .await;

                    match active_result {
                        Ok(reports) => reports,
                        Err(e) => {
                            withheld_instruments.extend(withheld_order_instruments(&e));
                            log::warn!(
                                "Lighter active order report generation incomplete: {}",
                                scrub_auth(&format!("{e:#}")),
                            );
                            partial_order_reports(&e)
                        }
                    }
                } else {
                    partial
                };
                (reports, false)
            }
        };

        reports_complete &= fill_reports_complete;
        let mut reported_orders: AHashSet<VenueOrderId> = order_reports
            .iter()
            .map(|report| report.venue_order_id)
            .collect();
        let mut fill_markets: Vec<i64> = fill_reports
            .iter()
            .filter(|report| !reported_orders.contains(&report.venue_order_id))
            .filter_map(|report| self.registry.market_index(&report.instrument_id))
            .collect::<AHashSet<_>>()
            .into_iter()
            .collect();
        fill_markets.sort_unstable();

        for market_index in fill_markets {
            let Some(instrument_id) = self.registry.instrument_id(market_index) else {
                reports_complete = false;
                continue;
            };
            let mut order_cmd = GenerateOrderStatusReports::new(
                UUID4::new(),
                ts_init,
                false,
                Some(instrument_id),
                lookback_start,
                None,
                None,
                None,
            );
            order_cmd.log_receipt_level = LogLevel::Debug;
            let order_result = self
                .collect_order_reports(&order_cmd, Some(&fill_reports))
                .await;
            reports_complete &= order_result.is_ok();
            let reports = match order_result {
                Ok(reports) => reports,
                Err(e) => {
                    withheld_instruments.extend(withheld_order_instruments(&e));
                    log::warn!(
                        "Lighter order report generation failed: {}",
                        scrub_auth(&format!("{e:#}")),
                    );
                    partial_order_reports(&e)
                }
            };
            reported_orders.extend(reports.iter().map(|report| report.venue_order_id));
            order_reports.extend(reports);
        }

        if fill_reports
            .iter()
            .any(|report| !reported_orders.contains(&report.venue_order_id))
        {
            reports_complete = false;
        }

        for fill_report in &mut fill_reports {
            if let Some(client_order_id) = order_reports
                .iter()
                .find(|order_report| order_report.venue_order_id == fill_report.venue_order_id)
                .and_then(|order_report| order_report.client_order_id)
            {
                fill_report.client_order_id = Some(client_order_id);
            }
        }

        self.publish_terminal_fill_bundles(&mut order_reports, &fill_reports)?;

        let position_result = self.cached_position_reports(&position_cmd);

        let (mut position_reports, mut position_coverage) = match position_result {
            Ok((reports, complete, coverage)) => {
                reports_complete &= complete;
                (reports, coverage)
            }
            Err(e) => {
                reports_complete = false;
                log::warn!("Lighter position report generation failed: {e:#}");
                (Vec::new(), None)
            }
        };

        position_reports.retain(|report| !withheld_instruments.contains(&report.instrument_id));

        if let Some(skipped) = &mut position_coverage {
            skipped.extend(
                withheld_instruments
                    .iter()
                    .filter_map(|id| self.registry.market_index(id)),
            );
        }

        Self::log_report_receipt(
            position_reports.len(),
            "PositionStatusReport",
            position_cmd.log_receipt_level,
        );

        if lookback_start.is_some() {
            let touched_instruments: AHashSet<InstrumentId> = order_reports
                .iter()
                .map(|report| report.instrument_id)
                .chain(fill_reports.iter().map(|report| report.instrument_id))
                .collect();
            let position_instruments: AHashSet<InstrumentId> = position_reports
                .iter()
                .map(|report| report.instrument_id)
                .collect();
            let cache = self.core.cache();
            let mut touched_instruments: Vec<InstrumentId> =
                touched_instruments.into_iter().collect();
            touched_instruments.sort_unstable();

            for instrument_id in touched_instruments {
                let Some(instrument) = cache.instrument(&instrument_id) else {
                    reports_complete = false;
                    continue;
                };

                if !matches!(instrument, InstrumentAny::CryptoPerpetual(_)) {
                    continue;
                }
                let Some(market_id) = self.registry.market_index(&instrument_id) else {
                    reports_complete = false;
                    continue;
                };

                if !position_coverage
                    .as_ref()
                    .is_some_and(|skipped| !skipped.contains(&market_id))
                {
                    reports_complete = false;
                    continue;
                }

                if position_instruments.contains(&instrument_id) {
                    continue;
                }

                position_reports.push(PositionStatusReport::new(
                    self.core.account_id,
                    instrument_id,
                    PositionSide::Flat,
                    Quantity::zero(instrument.size_precision()),
                    ts_init,
                    ts_init,
                    Some(UUID4::new()),
                    None,
                    None,
                ));
            }
        }

        let mut mass_status = ExecutionMassStatus::new(
            self.core.client_id,
            self.core.account_id,
            self.core.venue,
            ts_init,
            None,
        );
        mass_status.set_report_window(lookback_start, reports_complete);
        mass_status.add_order_reports(order_reports);
        mass_status.add_fill_reports(fill_reports);
        mass_status.add_position_reports(position_reports);

        log::debug!(
            "Generated Lighter mass status: {} orders, {} fills, {} positions",
            mass_status.order_reports().len(),
            mass_status.fill_reports().len(),
            mass_status.position_reports().len(),
        );

        Ok(Some(mass_status))
    }
}

#[derive(Debug)]
struct AppliedFillSubscription(TypedHandler<OrderEventAny>);

impl Drop for AppliedFillSubscription {
    fn drop(&mut self) {
        msgbus::unsubscribe_order_events(ORDER_EVENTS_PATTERN.into(), &self.0);
    }
}

// `covers_window` is only meaningful for an account-wide sweep. Retention is per
// account, so a market-scoped sweep can serve nothing while older trades for that
// market have already been evicted by newer trades in other markets.
struct FillSweep {
    reports: Vec<FillReport>,
    covers_window: bool,
    withheld_instruments: AHashSet<InstrumentId>,
}

#[derive(Debug, thiserror::Error)]
#[error("incomplete Lighter order reports: {detail}")]
struct IncompleteOrderReports {
    reports: Vec<OrderStatusReport>,
    withheld_instruments: AHashSet<InstrumentId>,
    detail: String,
}

fn incomplete_order_reports(
    reports: Vec<OrderStatusReport>,
    detail: impl Into<String>,
    withheld_instruments: AHashSet<InstrumentId>,
) -> anyhow::Error {
    anyhow::Error::new(IncompleteOrderReports {
        reports,
        withheld_instruments,
        detail: detail.into(),
    })
}

fn partial_order_reports(error: &anyhow::Error) -> Vec<OrderStatusReport> {
    error
        .downcast_ref::<IncompleteOrderReports>()
        .map(|incomplete| incomplete.reports.clone())
        .unwrap_or_default()
}

fn withheld_order_instruments(error: &anyhow::Error) -> AHashSet<InstrumentId> {
    error
        .downcast_ref::<IncompleteOrderReports>()
        .map(|incomplete| incomplete.withheld_instruments.clone())
        .unwrap_or_default()
}

fn is_commission_error(error: &anyhow::Error) -> bool {
    error
        .chain()
        .any(|cause| cause.downcast_ref::<LighterCommissionError>().is_some())
}

fn fill_reports_for_mass_status(
    result: anyhow::Result<FillSweep>,
) -> anyhow::Result<(Vec<FillReport>, bool, AHashSet<InstrumentId>)> {
    match result {
        Ok(sweep) => Ok((
            sweep.reports,
            sweep.covers_window,
            sweep.withheld_instruments,
        )),
        Err(e) if is_commission_error(&e) => Err(e),
        Err(e) => {
            log::warn!(
                "Lighter fill report generation failed: {}",
                scrub_auth(&format!("{e:#}")),
            );
            Ok((Vec::new(), false, AHashSet::new()))
        }
    }
}

impl LighterExecutionClient {
    async fn collect_order_reports(
        &self,
        cmd: &GenerateOrderStatusReports,
        fills: Option<&[FillReport]>,
    ) -> anyhow::Result<Vec<OrderStatusReport>> {
        let sweep = self.report_client().collect_order_status_reports(cmd).await;
        if let Some(context) = self.child_probe_context() {
            request_child_report_recoveries(&self.core, &context, &sweep);
            if fills.is_none() {
                recover_filled_reports(&sweep, &context).await;
            }
        }

        finish_order_reports(&self.core, &self.dispatch, sweep, cmd, fills)
    }

    fn publish_terminal_fill_bundles(
        &self,
        orders: &mut Vec<OrderStatusReport>,
        fills: &[FillReport],
    ) -> anyhow::Result<()> {
        let mut bundled = AHashSet::new();

        for report in orders.iter() {
            if !matches!(
                report.order_status,
                OrderStatus::Canceled | OrderStatus::Expired
            ) || report
                .client_order_id
                .and_then(|id| self.dispatch.order_identity(&id))
                .is_none()
                || !order_report_ready(&self.core, &self.dispatch, report, fills)
                || !fills_for_order(report, fills).any(|fill| fill.ts_event > report.ts_last)
            {
                continue;
            }

            // The mass reconciler sorts timestamps; the paired path applies real fills first
            let paired = fills_for_order(report, fills).cloned().collect();
            let bundle = ExecutionReport::OrderWithFills(Box::new(report.clone()), paired);
            self.emitter.try_send_execution_report(bundle)?;
            bundled.insert(report.venue_order_id);
        }

        orders.retain(|report| !bundled.contains(&report.venue_order_id));
        Ok(())
    }

    fn prepare_oco_cancel_plans(&self, cmd: &CancelOrder) -> Option<Vec<CancelOrderPlan>> {
        let cache = self.core.cache();
        let order = cache.order(&cmd.client_order_id)?;
        if order.contingency_type() != Some(ContingencyType::Oco) || order.is_closed() {
            return None;
        }

        let [peer_id] = order.linked_order_ids()? else {
            return None;
        };

        if *peer_id == order.client_order_id() {
            return None;
        }

        let peer = cache.order(peer_id)?;
        if peer.is_closed()
            || peer.instrument_id() != order.instrument_id()
            || peer.strategy_id() != order.strategy_id()
            || peer.account_id() != order.account_id()
            || validate_oco_links(&order, &peer, order.parent_order_id()).is_err()
        {
            return None;
        }

        let original = self.prepare_cancel_order_plan(cmd).ok()?;

        let expected_venue = order.venue_order_id().or_else(|| {
            self.dispatch
                .lookup_venue_order_id(&order.client_order_id())
        });

        if original.venue_order_id != expected_venue {
            return None;
        }

        let venue_order_id = peer.venue_order_id().or_else(|| {
            self.dispatch
                .order_identity(peer_id)
                .and_then(|identity| identity.venue_order_id())
        });

        // Lighter accepts the registered client index before the peer's venue ID arrives.
        let venue_index = match venue_order_id {
            Some(venue) => venue.as_str().parse().ok()?,
            None => {
                let identity = self.dispatch.order_identity(peer_id)?;
                let original = self.dispatch.order_identity(&order.client_order_id())?;
                if !identity.shares_submission(&original) {
                    return None;
                }

                identity.client_order_index
            }
        };

        Some(vec![
            original,
            CancelOrderPlan {
                client_order_id: *peer_id,
                strategy_id: peer.strategy_id(),
                instrument_id: peer.instrument_id(),
                venue_order_id,
                market_index: self.registry.market_index(&peer.instrument_id())?,
                venue_index,
            },
        ])
    }

    fn child_probe_context(&self) -> Option<AckedOrderProbeContext> {
        let credential = self.credential.as_ref()?;
        self.fanout_dispatch_context(credential)
            .ok()
            .map(|context| context.probe_context())
    }

    fn report_client(&self) -> LighterReportClient {
        LighterReportClient {
            http_client: self.http_client.clone(),
            credential: self.credential.clone(),
            account_id: self.core.account_id,
            registry: Arc::clone(&self.registry),
            clock: self.clock,
            markets: self.dispatch.active_markets.clone(),
            dispatch: self.dispatch.clone(),
        }
    }

    fn report_instruments(
        &self,
        instrument_id: Option<InstrumentId>,
    ) -> AHashMap<InstrumentId, InstrumentAny> {
        let cache = self.core.cache();
        match instrument_id {
            Some(instrument_id) => cache
                .instrument(&instrument_id)
                .map(|instrument| (instrument_id, instrument.clone()))
                .into_iter()
                .collect(),
            None => cache
                .instruments(&self.core.venue, None)
                .into_iter()
                .map(|instrument| (instrument.id(), instrument.clone()))
                .collect(),
        }
    }

    fn cached_position_reports(
        &self,
        cmd: &GeneratePositionStatusReports,
    ) -> anyhow::Result<(Vec<PositionStatusReport>, bool, Option<AHashSet<i64>>)> {
        cached_position_reports(&self.core, &self.dispatch, &self.registry, cmd)
    }

    async fn paginate_fill_reports(&self, cmd: &GenerateFillReports) -> anyhow::Result<FillSweep> {
        let client = self.report_client();
        let instruments = self.report_instruments(cmd.instrument_id);
        let mut markets = BTreeSet::new();
        let result = client
            .collect_fill_reports(cmd, &instruments, &mut markets)
            .await;
        let result = finish_fill_reports(&self.core, &self.dispatch, markets, result);

        if let Some(context) = self.child_probe_context() {
            spawn_child_recoveries(&context);
        }

        result
    }
}

struct LighterReportClient {
    http_client: LighterHttpClient,
    credential: Option<Credential>,
    account_id: AccountId,
    registry: Arc<MarketRegistry>,
    clock: &'static AtomicTime,
    markets: Arc<dashmap::DashSet<i64>>,
    dispatch: WsDispatchState,
}

#[derive(Default)]
struct OrderReportSweep {
    orders: Vec<(i64, OrderStatusReport)>,
    reductions: AHashMap<VenueOrderId, Decimal>,
    markets: BTreeSet<i64>,
    error: Option<anyhow::Error>,
    partial: bool,
}

impl LighterReportClient {
    async fn collect_order_status_reports(
        &self,
        cmd: &GenerateOrderStatusReports,
    ) -> OrderReportSweep {
        let mut sweep = OrderReportSweep {
            markets: self.markets.iter().map(|market| *market).collect(),
            ..Default::default()
        };

        sweep.error = self.collect_orders(cmd, &mut sweep).await.err();
        sweep
    }

    async fn collect_orders(
        &self,
        cmd: &GenerateOrderStatusReports,
        sweep: &mut OrderReportSweep,
    ) -> anyhow::Result<()> {
        let Some(credential) = &self.credential else {
            log::warn!("Lighter generate_order_status_reports: no credentials");

            return Ok(());
        };

        let auth = build_auth_token_for(credential)
            .context("failed to mint Lighter auth token for report fetch")?;
        let ts_init = self.clock.get_time_ns();

        // Lighter exposes accountActiveOrders only per-market. Mass-status
        // requests with no scope iterate over account-active markets rather
        // than fanning out to every registered market, since the venue's REST
        // rate limit (60 req/min) would make a 180-market fan-out take
        // minutes. Account streams seed this set from live order, trade, and
        // position frames; if startup reconciliation reaches this path before
        // any market is known, one unscoped inactive-order page walk seeds it
        // from historical account activity.
        if cmd.instrument_id.is_none() && sweep.markets.is_empty() {
            collect_active_markets_from_inactive_orders(
                &self.http_client,
                &mut sweep.markets,
                credential,
                &auth,
                format_between_timestamps(cmd.start, cmd.end, ts_init),
            )
            .await?;
        }

        sweep
            .markets
            .extend(self.markets.iter().map(|market| *market));

        let market_indices = match cmd.instrument_id {
            Some(id) => match self.registry.market_index(&id) {
                Some(idx) => vec![idx],
                None => {
                    anyhow::bail!("no Lighter market_index for order report instrument {id}",);
                }
            },
            None => sweep.markets.iter().copied().collect::<Vec<_>>(),
        };

        if market_indices.is_empty() {
            log::debug!(
                "Lighter generate_order_status_reports: no active markets yet; returning empty",
            );

            return Ok(());
        }

        sweep.partial = true;
        self.collect_orders_active(market_indices, credential, &auth, ts_init, sweep)
            .await?;

        // Inactive orders (filled / canceled) are required when the engine
        // asks for non-`open_only` reports during a wider reconciliation.
        // Pagination is followed because a single market can hold more than
        // 200 historical inactive orders for a long-running account. The
        // venue-side `between_timestamps` window is set when `cmd.start`
        // / `cmd.end` are present so the venue, not the client, scopes the
        // pagination: important under the 60 req/min REST quota.
        if !cmd.open_only {
            self.collect_orders_inactive(cmd, credential, &auth, ts_init, sweep)
                .await?;
        }

        Ok(())
    }

    async fn collect_orders_active(
        &self,
        market_indices: Vec<i64>,
        credential: &Credential,
        auth: &SecretString,
        ts_init: UnixNanos,
        sweep: &mut OrderReportSweep,
    ) -> anyhow::Result<()> {
        let mut active_errors = Vec::new();

        // Active orders are by definition still open. Returning them
        // unconditionally even when `cmd.start` is set: an open order's
        // last activity can predate the lookback window without changing
        // the fact that the order is currently live and reconciliation
        // needs to know about it.
        for market_index in market_indices {
            let query = Zeroizing::new(LighterAccountActiveOrdersQuery {
                authorization: None,
                auth: Some(auth.clone()),
                account_index: credential.account_index(),
                market_id: market_index,
            });

            let active = match self.http_client.get_account_active_orders(&query).await {
                Ok(response) => response,
                Err(e) => {
                    let detail = format!(
                        "failed to fetch Lighter active orders for market_index={market_index}: {}",
                        scrub_auth(&format!("{e:#}")),
                    );
                    log::warn!("{detail}",);
                    active_errors.push(detail);
                    continue;
                }
            };

            for order in &active.orders {
                sweep.markets.insert(order.market_index);

                let Some(report) = parse_http_order_to_report(
                    order,
                    &self.registry,
                    self.account_id,
                    ts_init,
                    &self.dispatch,
                ) else {
                    let detail = format!(
                        "failed to parse Lighter active order {} for market_index={market_index}",
                        order.order_id,
                    );
                    log::warn!("{detail}");
                    active_errors.push(detail);
                    continue;
                };

                let reduced_qty = order.initial_base_amount - report.quantity.as_decimal();
                if reduced_qty > Decimal::ZERO {
                    sweep.reductions.insert(report.venue_order_id, reduced_qty);
                }

                sweep.orders.push((order.client_order_index, report));
            }
        }

        if !active_errors.is_empty() {
            anyhow::bail!(active_errors.join("; "));
        }

        Ok(())
    }

    async fn collect_orders_inactive(
        &self,
        cmd: &GenerateOrderStatusReports,
        credential: &Credential,
        auth: &SecretString,
        ts_init: UnixNanos,
        sweep: &mut OrderReportSweep,
    ) -> anyhow::Result<()> {
        sweep
            .markets
            .extend(self.markets.iter().map(|market| *market));

        let inactive_markets: Vec<i64> = match cmd.instrument_id {
            Some(id) => self
                .registry
                .market_index(&id)
                .map(|m| vec![m])
                .unwrap_or_default(),
            None => sweep.markets.iter().copied().collect::<Vec<_>>(),
        };

        let between_timestamps = format_between_timestamps(cmd.start, cmd.end, ts_init);

        for market_id in inactive_markets {
            let mut cursor: Option<String> = None;
            let mut seen_cursors = AHashSet::new();
            let mut pages = 0_usize;
            loop {
                pages += 1;
                if pages > MAX_RECONCILIATION_PAGES {
                    anyhow::bail!(
                        "Lighter inactive-order reconciliation exceeded {MAX_RECONCILIATION_PAGES} pages for market_index={market_id}",
                    );
                }

                let query = Zeroizing::new(LighterAccountInactiveOrdersQuery {
                    authorization: None,
                    auth: Some(auth.clone()),
                    account_index: credential.account_index(),
                    market_id: Some(market_id),
                    ask_filter: None,
                    between_timestamps: between_timestamps.clone(),
                    cursor: cursor.clone(),
                    limit: LIGHTER_REST_PAGE_SIZE,
                });

                let inactive = self.http_client.get_account_inactive_orders(&query).await.map_err(|e| {
                    anyhow::anyhow!(
                        "failed to fetch Lighter inactive orders for market_index={market_id}: {}",
                        scrub_auth(&format!("{e:#}")),
                    )
                })?;

                for order in &inactive.orders {
                    let Some(report) = parse_http_order_to_report(
                        order,
                        &self.registry,
                        self.account_id,
                        ts_init,
                        &self.dispatch,
                    ) else {
                        anyhow::bail!(
                            "failed to parse Lighter inactive order {} for market_index={market_id}",
                            order.order_id,
                        );
                    };

                    if cmd.start.is_some_and(|start| report.ts_last < start)
                        || cmd.end.is_some_and(|end| report.ts_last > end)
                    {
                        continue;
                    }

                    sweep.markets.insert(order.market_index);
                    sweep.orders.push((order.client_order_index, report));
                }

                let Some(next) = inactive.next_cursor else {
                    break;
                };

                if next.is_empty() {
                    break;
                }

                anyhow::ensure!(
                    seen_cursors.insert(next.clone()),
                    "Lighter inactive-order reconciliation repeated cursor `{next}` for market_index={market_id}",
                );
                cursor = Some(next);
            }
        }

        Ok(())
    }

    async fn collect_fill_reports(
        &self,
        cmd: &GenerateFillReports,
        instruments: &AHashMap<InstrumentId, InstrumentAny>,
        markets: &mut BTreeSet<i64>,
    ) -> anyhow::Result<FillSweep> {
        let Some(credential) = &self.credential else {
            log::warn!("Lighter generate_fill_reports: no credentials");
            return Ok(FillSweep {
                reports: Vec::new(),
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            });
        };

        collect_fill_reports(
            &self.http_client,
            &self.registry,
            credential,
            self.account_id,
            self.clock,
            cmd,
            instruments,
            markets,
            None,
        )
        .await
    }
}

#[expect(
    clippy::too_many_arguments,
    reason = "ordinary and child-scoped recovery share authenticated fill pagination"
)]
async fn collect_fill_reports(
    http_client: &LighterHttpClient,
    registry: &Arc<MarketRegistry>,
    credential: &Credential,
    account_id: AccountId,
    clock: &AtomicTime,
    cmd: &GenerateFillReports,
    instruments: &AHashMap<InstrumentId, InstrumentAny>,
    markets: &mut BTreeSet<i64>,
    order_index: Option<i64>,
) -> anyhow::Result<FillSweep> {
    let market_id = match cmd.instrument_id {
        Some(instrument_id) => Some(registry.market_index(&instrument_id).ok_or_else(|| {
            anyhow::anyhow!("no Lighter market_index for fill instrument {instrument_id}",)
        })?),
        None => None,
    };

    let auth = build_auth_token_for(credential)
        .context("failed to mint Lighter auth token for fill fetch")?;

    let ts_init = clock.get_time_ns();
    let mut reports = Vec::new();
    let mut cursor: Option<String> = None;
    let mut seen_cursors = AHashSet::new();
    let mut seen_in_call = AHashSet::new();
    let mut pages = 0_usize;
    let mut oldest_served: Option<UnixNanos> = None;
    let mut covers_window = true;

    loop {
        pages += 1;
        anyhow::ensure!(
            pages <= MAX_RECONCILIATION_PAGES,
            "Lighter fill reconciliation exceeded {MAX_RECONCILIATION_PAGES} pages",
        );

        let query = Zeroizing::new(LighterTradesQuery {
            authorization: None,
            auth: Some(auth.clone()),
            market_id,
            account_index: Some(credential.account_index()),
            order_index,
            sort_by: LighterTradeSortBy::Timestamp,
            sort_dir: Some(LighterSortDirection::Desc),
            cursor: cursor.clone(),
            // The venue's `from` parameter is not a timestamp lower bound
            // and can omit the newest trades when given an epoch value.
            from_timestamp: None,
            ask_filter: None,
            role: None,
            trade_type: None,
            limit: LIGHTER_REST_PAGE_SIZE,
            aggregate: None,
        });

        let response = match http_client.get_trades(&query).await {
            Ok(response) => response,
            Err(e) => {
                // `{e:#}` preserves the venue's status/body across the
                // outer context wrap; `scrub_auth` redacts any `auth=`
                // query value the HTTP layer's error included.
                log::warn!(
                    "Lighter get_trades failed (market_id={:?}, account_index={}, cursor={:?}): {}",
                    query.market_id,
                    credential.account_index(),
                    cursor,
                    scrub_auth(&format!("{e:#}")),
                );
                return Err(anyhow::Error::new(e).context("failed to fetch Lighter fills"));
            }
        };

        for trade in &response.trades {
            let Some(report) = parse_scoped_fill_report(
                trade,
                registry,
                instruments,
                credential.account_index(),
                account_id,
                cmd,
                ts_init,
            )?
            else {
                continue;
            };

            if !seen_in_call.insert(report.trade_id) {
                log::debug!(
                    "Lighter duplicate trade {} ignored within HTTP fill pagination",
                    report.trade_id,
                );
                continue;
            }

            markets.insert(trade.market_id);
            reports.push(report);
        }

        let page_oldest = response
            .trades
            .iter()
            .filter_map(|trade| u64::try_from(trade.timestamp).ok())
            .map(|timestamp_ms| UnixNanos::from(timestamp_ms.saturating_mul(1_000_000)))
            .min();

        if let Some(page_oldest) = page_oldest {
            oldest_served = Some(oldest_served.map_or(page_oldest, |ts| ts.min(page_oldest)));
        }

        let reached_start_boundary = cmd
            .start
            .is_some_and(|start| page_oldest.is_some_and(|oldest| oldest < start));

        if reached_start_boundary {
            break;
        }

        match response.next_cursor {
            Some(next) if !next.is_empty() => {
                anyhow::ensure!(
                    seen_cursors.insert(next.clone()),
                    "Lighter fill reconciliation repeated cursor `{next}`",
                );
                cursor = Some(next);
            }
            _ => {
                // The venue retains a bounded number of recent trades per account,
                // so an exhausted cursor ends the retained history rather than the
                // account's. Only a trade older than `start` proves the requested
                // window was served in full; an account-wide sweep that served
                // nothing has no history to retain.
                if let (Some(start), Some(oldest)) = (cmd.start, oldest_served) {
                    covers_window = false;

                    log::warn!(
                        "Lighter fill reports do not cover {} to {}: trade pagination exhausted before the requested start; the venue `export` endpoint serves full history",
                        unix_nanos_to_iso8601(start),
                        unix_nanos_to_iso8601(oldest),
                    );
                }

                break;
            }
        }
    }

    Ok(FillSweep {
        reports,
        covers_window,
        withheld_instruments: AHashSet::new(),
    })
}

fn parse_scoped_fill_report(
    trade: &LighterTrade,
    registry: &MarketRegistry,
    instruments: &AHashMap<InstrumentId, InstrumentAny>,
    account_index: i64,
    account_id: AccountId,
    cmd: &GenerateFillReports,
    ts_init: UnixNanos,
) -> anyhow::Result<Option<FillReport>> {
    let instrument_id = registry.instrument_id(trade.market_id).with_context(|| {
        format!(
            "no Lighter instrument registered for fill market_index={}",
            trade.market_id
        )
    })?;

    let instrument = instruments
        .get(&instrument_id)
        .with_context(|| format!("Lighter fill instrument {instrument_id} missing from cache"))?;

    let Some(report) = parse_ws_fill_report(trade, account_index, instrument, account_id, ts_init)
        .context("failed to parse Lighter fill report")?
    else {
        return Ok(None);
    };

    if cmd.start.is_some_and(|start| report.ts_event < start)
        || cmd.end.is_some_and(|end| report.ts_event > end)
    {
        return Ok(None);
    }

    Ok(Some(report))
}

fn cached_position_reports(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    registry: &Arc<MarketRegistry>,
    cmd: &GeneratePositionStatusReports,
) -> anyhow::Result<(Vec<PositionStatusReport>, bool, Option<AHashSet<i64>>)> {
    // Lighter has no REST position source. The latest complete WebSocket
    // snapshot is authoritative, while a skipped row keeps the retained
    // cache available only as explicitly incomplete mass-status data.
    let (mut reports, mut coverage) = dispatch.snapshot_positions_with_coverage();
    let pending = execution_instruments_pending(core, dispatch);
    reports.retain(|report| !pending.contains(&report.instrument_id));
    if let Some(skipped) = &mut coverage {
        skipped.extend(pending.iter().filter_map(|id| registry.market_index(id)));
    }

    let complete = match cmd.instrument_id {
        Some(instrument_id) => {
            let market_id = registry.market_index(&instrument_id).ok_or_else(|| {
                anyhow::anyhow!(
                    "no Lighter market_index for position report instrument {instrument_id}",
                )
            })?;

            reports.retain(|report| report.instrument_id == instrument_id);
            !pending.contains(&instrument_id)
                && coverage
                    .as_ref()
                    .is_some_and(|skipped| !skipped.contains(&market_id))
        }
        None => pending.is_empty() && coverage.as_ref().is_some_and(|skipped| skipped.is_empty()),
    };

    Ok((reports, complete, coverage))
}

fn execution_instruments_pending(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
) -> AHashSet<InstrumentId> {
    let events = dispatch.order_events.lock();
    let cache = core.cache();
    let mut pending = AHashSet::new();
    dispatch.any_order_identity(|cloid, identity, retired| {
        if (identity.has_inferred_fills()
            && cache.order(cloid).map_or(!retired, |order| {
                !order.is_closed() || inferred_reconciliation_trade_ids(&order).is_err()
            }))
            || dispatch.has_pending_modify(cloid)
            || dispatch.terminals_pending.lock().contains_key(cloid)
            || events.get(cloid).is_some_and(|deferred| {
                !deferred.fills.is_empty()
                    || deferred
                        .order
                        .as_ref()
                        .is_some_and(|order| order.status.is_terminal())
                    || deferred.recovery_epoch.is_some()
            })
            || identity.publication_pending(cache.order(cloid).as_deref())
        {
            pending.insert(identity.instrument_id);
        }

        false
    });

    pending
}

fn finish_order_reports(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    sweep: OrderReportSweep,
    cmd: &GenerateOrderStatusReports,
    fills: Option<&[FillReport]>,
) -> anyhow::Result<Vec<OrderStatusReport>> {
    for market in sweep.markets {
        dispatch.note_active_market(market);
    }

    let mut withheld = AHashSet::new();
    let mut reports = Vec::with_capacity(sweep.orders.len());
    for (client_order_index, report) in sweep.orders {
        let pending_cloid = core
            .cache()
            .client_order_id(&report.venue_order_id)
            .copied()
            .or_else(|| {
                dispatch
                    .resolve_client_order_index_for_venue(client_order_index, report.venue_order_id)
            });

        if pending_cloid
            .as_ref()
            .is_some_and(|cloid| order_shape_pending(core, dispatch, cloid))
        {
            withheld.insert(report.instrument_id);
            continue;
        }

        restore_reconciled_order(
            core,
            dispatch,
            report.venue_order_id,
            client_order_index,
            report.order_status.is_closed(),
        );

        if let Some(reduced_qty) = sweep.reductions.get(&report.venue_order_id) {
            dispatch.record_order_reduction(
                client_order_index,
                report.venue_order_id,
                *reduced_qty,
            );
        }

        let report = dispatch.translate_order_cloid(report);
        let report = dispatch.preserve_pending_order_status(report);
        if report
            .client_order_id
            .as_ref()
            .is_some_and(|cloid| order_shape_pending(core, dispatch, cloid))
        {
            withheld.insert(report.instrument_id);
            continue;
        }

        if !order_report_collectible(core, dispatch, &report, fills) {
            withheld.insert(report.instrument_id);
            continue;
        }

        dispatch.seed_accepted_from_report(&report);
        reports.push(report);
    }

    if let Some(error) = sweep.error {
        return Err(if sweep.partial {
            incomplete_order_reports(reports, error.to_string(), withheld)
        } else {
            error
        });
    }

    if !withheld.is_empty() {
        return Err(incomplete_order_reports(
            reports,
            "Lighter execution confirmation is pending".to_string(),
            withheld,
        ));
    }

    LighterExecutionClient::log_report_receipt(
        reports.len(),
        "OrderStatusReport",
        cmd.log_receipt_level,
    );
    Ok(reports)
}

fn finish_fill_reports(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    markets: BTreeSet<i64>,
    result: anyhow::Result<FillSweep>,
) -> anyhow::Result<FillSweep> {
    for market in markets {
        dispatch.note_active_market(market);
    }

    let mut sweep = result?;
    let mut reports = Vec::with_capacity(sweep.reports.len());

    for mut report in sweep.reports {
        defer_reconciled_fill(core, dispatch, &mut report);

        // Mass-status reconciliation must surface the original
        // Nautilus cloid, not the venue's numeric echo.
        let report = dispatch.translate_fill_cloid(report);
        if report.client_order_id.as_ref().is_some_and(|cloid| {
            order_shape_pending(core, dispatch, cloid)
                || (dispatch
                    .order_identity(cloid)
                    .is_some_and(|identity| identity.child_fill_baseline().is_some())
                    && core
                        .cache()
                        .order(cloid)
                        .is_none_or(|order| !order.is_closed()))
        }) {
            sweep.covers_window = false;
            sweep.withheld_instruments.insert(report.instrument_id);
            continue;
        }

        if matches!(
            dispatch.trade_source(report.trade_id),
            Some(TradeDedupSource::Live)
        ) {
            log::debug!(
                "Lighter trade {} ignored in HTTP fill reports after live delivery",
                report.trade_id
            );
            continue;
        }

        reports.push(report);
    }

    sweep.reports = reports;
    Ok(sweep)
}

fn defer_reconciled_fill(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &mut FillReport,
) {
    let Some((cloid, identity)) = restore_fill_identity(core, dispatch, report) else {
        return;
    };

    report.client_order_id = Some(cloid);

    if identity.has_inferred_fills() {
        return;
    }

    let Some(fill) = child_fill_from_report(report, &identity, core.trader_id) else {
        return;
    };

    if core
        .cache()
        .order(&cloid)
        .is_some_and(|order| order.is_duplicate_fill(&fill))
    {
        return;
    }

    let mut events = dispatch.order_events.lock();
    let baseline = identity.child_fill_baseline();
    let new_fill = baseline
        .as_ref()
        .is_none_or(|baseline| !baseline.trade_ids.contains(&fill.trade_id));
    if new_fill
        && (baseline.is_some()
            || dispatch.has_pending_modify(&cloid)
            || position_fills_pending(&identity, &events, dispatch))
    {
        dispatch.defer_fill(events.entry(cloid).or_default(), fill);
    }
}

fn restore_fill_identity(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &FillReport,
) -> Option<(ClientOrderId, OrderIdentity)> {
    let cached_order = {
        let cache = core.cache();
        cache
            .client_order_id(&report.venue_order_id)
            .and_then(|cloid| cache.order_owned(cloid))
            .filter(|order| {
                !order.strategy_id().is_external()
                    && order.instrument_id() == report.instrument_id
                    && order.account_id() == Some(report.account_id)
            })
    }?;

    let cloid = cached_order.client_order_id();
    if dispatch.order_identity(&cloid).is_none() {
        let index = report
            .client_order_id
            .and_then(|id| id.as_str().parse::<i64>().ok())
            .unwrap_or(0);
        dispatch.seed_order_restoration(cached_order);
        dispatch.restore_cached_order(report.venue_order_id, index, report.instrument_id);
    }

    dispatch
        .order_identity(&cloid)
        .map(|identity| (cloid, identity))
}

fn ensure_order_report_ready(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &OrderStatusReport,
) -> anyhow::Result<()> {
    anyhow::ensure!(
        order_report_collectible(core, dispatch, report, None),
        "Lighter order report deferred until execution state is applied",
    );
    Ok(())
}

fn order_report_collectible(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &OrderStatusReport,
    fills: Option<&[FillReport]>,
) -> bool {
    // Native targeted reconciliation fetches companion fills only for cancellations and expiries
    if fills.is_none()
        && matches!(
            report.order_status,
            OrderStatus::Canceled | OrderStatus::Expired
        )
    {
        order_report_shape_ready(core, dispatch, report)
    } else {
        order_report_ready(core, dispatch, report, fills.unwrap_or_default())
    }
}

fn order_report_ready(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &OrderStatusReport,
    fills: &[FillReport],
) -> bool {
    order_report_shape_ready(core, dispatch, report)
        && report
            .client_order_id
            .and_then(|cloid| dispatch.order_identity(&cloid))
            .is_none_or(|identity| identity.report_fills_covered(report, fills))
}

fn order_report_shape_ready(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    report: &OrderStatusReport,
) -> bool {
    let Some(cloid) = report.client_order_id else {
        return true;
    };

    let pending = order_shape_pending(core, dispatch, &cloid);

    if let Some(identity) = dispatch.order_identity(&cloid)
        && identity.child_fill_baseline().is_some()
        && core
            .cache()
            .order(&cloid)
            .is_none_or(|order| report.filled_qty != order.filled_qty())
    {
        return false;
    }

    if !pending {
        return true;
    }

    report.order_status == OrderStatus::PendingUpdate
        && core.cache().order(&cloid).is_some_and(|order| {
            order.quantity() == report.quantity
                && order.price() == report.price
                && order.trigger_price() == report.trigger_price
                && order.filled_qty() == report.filled_qty
        })
}

fn order_shape_pending(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    cloid: &ClientOrderId,
) -> bool {
    let events = dispatch.order_events.lock();
    if dispatch.has_pending_modify(cloid) {
        return true;
    }

    let Some(identity) = dispatch.order_identity(cloid) else {
        return false;
    };

    if let Some(order) = core.cache().order(cloid) {
        identity.sync_fills(&order);
    }

    if identity.has_inferred_fills() {
        return true;
    }

    if dispatch.terminals_pending.lock().contains_key(cloid) {
        return true;
    }

    if position_fills_pending(&identity, &events, dispatch) {
        return true;
    }

    let cache = core.cache();

    if dispatch.any_order_identity(|id, other, _| {
        other.strategy_id == identity.strategy_id
            && other.instrument_id == identity.instrument_id
            && other.publication_pending(cache.order(id).as_deref())
    }) {
        return true;
    }

    let order = cache.order(cloid);
    let pending = identity.publication_pending(order.as_deref());
    if !pending && order.as_ref().is_some_and(|order| order.is_closed()) {
        dispatch.retire_order_identity(cloid);
    }

    pending
}

fn restore_reconciled_order(
    core: &ExecutionClientCore,
    dispatch: &WsDispatchState,
    venue_order_id: VenueOrderId,
    client_order_index: i64,
    terminal: bool,
) {
    let cached_order = {
        let cache = core.cache();

        let Some(cloid) = cache.client_order_id(&venue_order_id).copied() else {
            return;
        };

        let Some(order) = cache.order_owned(&cloid) else {
            log::warn!(
                "Ignoring reconciled Lighter order missing from cache: cloid={cloid}, venue_order_id={venue_order_id}",
            );
            return;
        };

        order
    };

    if cached_order.instrument_id().venue != core.venue
        || cached_order.account_id() != Some(core.account_id)
    {
        log::warn!(
            "Ignoring reconciled Lighter order outside this client: cloid={}, venue_order_id={venue_order_id}",
            cached_order.client_order_id(),
        );
        return;
    }

    if order_shape_pending(core, dispatch, &cached_order.client_order_id()) {
        return;
    }

    let terminal =
        terminal && (cached_order.parent_order_id().is_none() || cached_order.is_closed());

    if let Err(e) = dispatch.restore_reconciled_order(
        &cached_order,
        client_order_index,
        venue_order_id,
        terminal,
    ) {
        log::warn!(
            "Ignoring conflicting Lighter reconciliation identity: cloid={}, venue_order_id={venue_order_id}, client_order_index={}, error={e}",
            cached_order.client_order_id(),
            client_order_index,
        );
    }
}

fn grouped_submit_denial_reason(error: &anyhow::Error) -> String {
    match error.downcast_ref::<OrderDeniedReason>() {
        Some(reason) => reason.to_string(),
        None => OrderDeniedReason::UnsupportedOrderList {
            detail: format!("Lighter grouped submit failed: {error}"),
        }
        .to_string(),
    }
}

fn local_submit_denial_reason(
    order: &OrderAny,
    instrument: Option<&InstrumentAny>,
) -> Option<anyhow::Error> {
    if instrument.is_none() {
        return Some(anyhow::anyhow!(
            OrderDeniedReason::InstrumentNotFound {
                instrument_id: order.instrument_id(),
            }
            .to_string(),
        ));
    }

    if !is_lighter_supported_order_type(order.order_type()) {
        return Some(anyhow::anyhow!(unsupported_lighter_order_type_reason(
            order.order_type()
        )));
    }

    if is_lighter_limit_style_order(order.order_type()) && order.price().is_none() {
        return Some(anyhow::anyhow!(
            OrderDeniedReason::ValidationFailed {
                detail: "Lighter limit-style orders require a limit price".to_string(),
            }
            .to_string(),
        ));
    }

    if order.is_quote_quantity() {
        return Some(anyhow::anyhow!(
            OrderDeniedReason::unsupported_quote_quantity()
        ));
    }

    if order.display_qty().is_some() {
        return Some(anyhow::anyhow!(
            OrderDeniedReason::ValidationFailed {
                detail: "Lighter orders do not support display_qty iceberg instructions"
                    .to_string(),
            }
            .to_string(),
        ));
    }

    if is_lighter_spot_order(order, instrument) && is_lighter_conditional_order(order.order_type())
    {
        let denied = OrderDeniedReason::UnsupportedOrderType {
            order_type: order.order_type(),
        };

        return Some(anyhow::anyhow!(
            "{denied}; Lighter spot markets do not support conditional orders",
        ));
    }

    nautilus_to_lighter_tif(
        order.order_type(),
        order.time_in_force(),
        order.is_post_only(),
    )
    .err()
    .map(|e| {
        let denied = OrderDeniedReason::UnsupportedTimeInForce(order.time_in_force());
        anyhow::anyhow!("{denied}; {e}")
    })
}

fn unsupported_lighter_order_type_reason(order_type: OrderType) -> String {
    let denied = OrderDeniedReason::UnsupportedOrderType { order_type };
    format!(
        "{denied}; Lighter supports MARKET, LIMIT, STOP_MARKET, STOP_LIMIT, MARKET_IF_TOUCHED, and LIMIT_IF_TOUCHED",
    )
}

fn is_grouped_order(order: &OrderAny) -> bool {
    order.contingency_type().is_some() || order.parent_order_id().is_some()
}

fn grouped_order_indices(orders: &[OrderAny]) -> anyhow::Result<(LighterGroupingType, Vec<usize>)> {
    anyhow::ensure!(
        (2..=3).contains(&orders.len()),
        "Lighter groups require two or three orders"
    );
    let first = &orders[0];
    anyhow::ensure!(
        orders
            .iter()
            .enumerate()
            .all(|(index, order)| orders[..index]
                .iter()
                .all(|other| other.client_order_id() != order.client_order_id())),
        "Lighter groups require unique client order IDs"
    );
    anyhow::ensure!(
        orders.iter().all(|order| !order.is_closed()
            && order.instrument_id() == first.instrument_id()
            && order.strategy_id() == first.strategy_id()
            && order.order_list_id() == first.order_list_id()),
        "Lighter groups require open orders from one instrument, strategy, and order list"
    );
    anyhow::ensure!(
        !orders
            .iter()
            .any(|order| order.contingency_type() == Some(ContingencyType::Ouo)),
        "Lighter native groups do not support Nautilus OUO quantity updates"
    );

    let parents: Vec<_> = orders
        .iter()
        .enumerate()
        .filter(|(_, order)| {
            order.contingency_type() == Some(ContingencyType::Oto)
                && order.parent_order_id().is_none()
        })
        .map(|(index, _)| index)
        .collect();

    if parents.is_empty() {
        anyhow::ensure!(
            orders.len() == 2,
            "Lighter OCO requires exactly two siblings"
        );
        validate_oco_links(&orders[0], &orders[1], None)?;
        return Ok((LighterGroupingType::OneCancelsTheOther, vec![0, 1]));
    }

    anyhow::ensure!(
        parents.len() == 1,
        "Lighter OTO groups require exactly one parent"
    );
    let parent_index = parents[0];
    let parent = &orders[parent_index];
    anyhow::ensure!(
        matches!(parent.order_type(), OrderType::Market | OrderType::Limit),
        "Lighter OTO parents must be MARKET or LIMIT orders"
    );
    let children: Vec<_> = orders
        .iter()
        .enumerate()
        .filter(|(index, _)| *index != parent_index)
        .collect();
    let child_ids: Vec<_> = children
        .iter()
        .map(|(_, order)| order.client_order_id())
        .collect();
    let links = parent
        .linked_order_ids()
        .context("Lighter OTO parent requires linked children")?;
    anyhow::ensure!(
        links.len() == child_ids.len() && child_ids.iter().all(|id| links.contains(id)),
        "Lighter OTO parent links must identify every child exactly once"
    );
    anyhow::ensure!(
        children
            .iter()
            .all(|(_, order)| order.parent_order_id() == Some(parent.client_order_id())),
        "Lighter OTO children must reference their parent"
    );

    let grouping_type = if children.len() == 1 {
        anyhow::ensure!(
            children[0].1.contingency_type().is_none()
                && children[0].1.linked_order_ids().is_none(),
            "Lighter OTO child must not have a sibling contingency"
        );
        LighterGroupingType::OneTriggersTheOther
    } else {
        validate_oco_links(children[0].1, children[1].1, Some(parent.client_order_id()))?;
        LighterGroupingType::OneTriggersOneCancelsTheOther
    };

    Ok((
        grouping_type,
        std::iter::once(parent_index)
            .chain(children.iter().map(|(index, _)| *index))
            .collect(),
    ))
}

fn validate_oco_links(
    first: &OrderAny,
    second: &OrderAny,
    parent: Option<ClientOrderId>,
) -> anyhow::Result<()> {
    let orders = [first, second];
    for (index, order) in orders.iter().enumerate() {
        anyhow::ensure!(
            order.contingency_type() == Some(ContingencyType::Oco)
                && order.parent_order_id() == parent,
            "Lighter OCO siblings must have matching OCO relationships"
        );
        anyhow::ensure!(
            order
                .linked_order_ids()
                .is_some_and(|links| links == [orders[1 - index].client_order_id()]),
            "Lighter OCO siblings must link only to each other"
        );
    }

    Ok(())
}

fn prepare_group_bodies(
    grouping_type: LighterGroupingType,
    plans: &mut [CreateOrderPlan],
    use_gtd: bool,
) -> anyhow::Result<()> {
    let has_parent = grouping_type != LighterGroupingType::OneCancelsTheOther;
    let parent_quantity = plans[0].order.quantity();
    let child_start = usize::from(has_parent);

    let default_expiry = plans
        .iter()
        .find(|plan| {
            plan.order_expiry != 0 && !(plan.order.time_in_force() == TimeInForce::Gtd && use_gtd)
        })
        .map_or(plans[child_start].order_expiry, |plan| plan.order_expiry);

    for plan in plans.iter_mut() {
        if plan.order_expiry != 0 && !(plan.order.time_in_force() == TimeInForce::Gtd && use_gtd) {
            plan.order_expiry = default_expiry;
        }
    }

    let expiry = plans[child_start].order_expiry;
    let parent_side = plans[0].order.order_side();
    for child in &mut plans[child_start..] {
        anyhow::ensure!(
            is_lighter_conditional_order(child.order.order_type()) && child.order.is_reduce_only(),
            "Lighter group children require reduce-only SL/TP orders"
        );
        anyhow::ensure!(
            child.order.quantity() == parent_quantity,
            "Lighter group quantities must match before parent-fill sizing"
        );
        anyhow::ensure!(
            (child.order.order_side() != parent_side) == has_parent,
            "Lighter OTO children must oppose their parent; OCO siblings must have the same side"
        );
        anyhow::ensure!(
            child.order_expiry == expiry && expiry != 0,
            "Lighter group children require matching nonzero expiries"
        );

        if has_parent {
            child.base_amount = 0;
        }
    }

    anyhow::ensure!(
        plans[0].order_expiry == 0 || plans[0].order_expiry == expiry,
        "Lighter parent and child expiries must match"
    );

    if plans.len() - child_start == 2 {
        let stop_count = plans[child_start..]
            .iter()
            .filter(|plan| {
                matches!(
                    plan.order.order_type(),
                    OrderType::StopMarket | OrderType::StopLimit
                )
            })
            .count();

        anyhow::ensure!(
            stop_count == 1,
            "Lighter OCO requires one stop-loss and one take-profit"
        );
    }

    Ok(())
}

fn is_lighter_spot_order(order: &OrderAny, instrument: Option<&InstrumentAny>) -> bool {
    instrument.is_some_and(|instrument| matches!(instrument, InstrumentAny::CurrencyPair(_)))
        || product_type_from_instrument_id(&order.instrument_id()) == Some(LighterProductType::Spot)
}

fn is_lighter_supported_order_type(order_type: OrderType) -> bool {
    matches!(
        order_type,
        OrderType::Market
            | OrderType::Limit
            | OrderType::StopMarket
            | OrderType::StopLimit
            | OrderType::MarketIfTouched
            | OrderType::LimitIfTouched
    )
}

fn is_lighter_limit_style_order(order_type: OrderType) -> bool {
    matches!(
        order_type,
        OrderType::Limit | OrderType::StopLimit | OrderType::LimitIfTouched
    )
}

fn is_lighter_conditional_order(order_type: OrderType) -> bool {
    matches!(
        order_type,
        OrderType::StopMarket
            | OrderType::StopLimit
            | OrderType::MarketIfTouched
            | OrderType::LimitIfTouched
    )
}

async fn collect_active_markets_from_inactive_orders(
    http_client: &LighterHttpClient,
    markets: &mut BTreeSet<i64>,
    credential: &Credential,
    auth: &SecretString,
    between_timestamps: Option<String>,
) -> anyhow::Result<()> {
    let mut cursor: Option<String> = None;
    let mut seen_cursors = AHashSet::new();
    let mut orders_seen = 0_usize;
    let mut pages = 0_usize;
    loop {
        pages += 1;
        anyhow::ensure!(
            pages <= MAX_RECONCILIATION_PAGES,
            "Lighter active-market seed exceeded {MAX_RECONCILIATION_PAGES} pages",
        );

        let query = Zeroizing::new(LighterAccountInactiveOrdersQuery {
            authorization: None,
            auth: Some(auth.clone()),
            account_index: credential.account_index(),
            market_id: None,
            ask_filter: None,
            between_timestamps: between_timestamps.clone(),
            cursor: cursor.clone(),
            limit: LIGHTER_REST_PAGE_SIZE,
        });
        let response = http_client
            .get_account_inactive_orders(&query)
            .await
            .context("failed to seed Lighter active markets from inactive orders")?;

        for order in &response.orders {
            markets.insert(order.market_index);
            orders_seen += 1;
        }

        match response.next_cursor {
            Some(next) if !next.is_empty() => {
                anyhow::ensure!(
                    seen_cursors.insert(next.clone()),
                    "Lighter active-market seed repeated cursor `{next}`",
                );
                cursor = Some(next);
            }
            _ => break,
        }
    }

    if orders_seen > 0 {
        log::debug!("Seeded Lighter active markets from {orders_seen} inactive order report(s)");
    }

    Ok(())
}

fn cancel_order_from_cancel_all(
    cmd: &CancelAllOrders,
    client_order_id: ClientOrderId,
    strategy_id: StrategyId,
) -> CancelOrder {
    CancelOrder {
        trader_id: cmd.trader_id,
        client_id: cmd.client_id,
        strategy_id,
        instrument_id: cmd.instrument_id,
        client_order_id,
        venue_order_id: None,
        command_id: cmd.command_id,
        ts_init: cmd.ts_init,
        params: cmd.params.clone(),
        correlation_id: cmd.correlation_id,
        causation_id: cmd.causation_id,
    }
}

fn validate_order_amount(
    instrument: &InstrumentAny,
    quantity: Quantity,
    price_ticks: u32,
    price_precision: u8,
) -> anyhow::Result<()> {
    if let Some(min_quantity) = instrument.min_quantity() {
        anyhow::ensure!(
            quantity >= min_quantity,
            "quantity `{quantity}` below Lighter min_base_amount `{min_quantity}` for {}",
            instrument.id(),
        );
    }

    if let Some(min_notional) = instrument.min_notional() {
        let price = decimal_from_ticks(price_ticks, price_precision);
        let notional = quantity.as_decimal() * price;
        anyhow::ensure!(
            notional >= min_notional.as_decimal(),
            "order notional `{notional}` below Lighter min_quote_amount `{}` for {}",
            min_notional.as_decimal(),
            instrument.id(),
        );
    }

    Ok(())
}

fn decimal_from_ticks(ticks: u32, decimals: u8) -> Decimal {
    Decimal::from(ticks) / Decimal::from(10_i64.pow(u32::from(decimals)))
}

/// Route a venue `account_orders` payload through the tracked-event path
/// when the cloid is known, otherwise fall back to the existing
/// [`OrderStatusReport`] flow used for externally-managed orders.
fn dispatch_lighter_order(
    order: &crate::http::models::LighterOrder,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    registry: &Arc<MarketRegistry>,
    account_id: AccountId,
    trader_id: TraderId,
    ts_init: UnixNanos,
) {
    let mut events = dispatch.order_events.lock();

    let instrument_id = match registry.instrument_id(order.market_index) {
        Some(id) => id,
        None => {
            log::debug!(
                "Lighter order frame dropped: no instrument for market_index={}",
                order.market_index,
            );
            return;
        }
    };

    dispatch.note_active_market(order.market_index);

    let instrument = match LIGHTER_INSTRUMENT_CACHE.get(&instrument_id) {
        Some(inst) => inst.value().clone(),
        None => {
            log::debug!("Lighter order frame dropped: instrument {instrument_id} not in cache",);
            return;
        }
    };

    let venue_order_id = VenueOrderId::new(order.order_id.as_str());
    if !dispatch.restore_cached_order(venue_order_id, order.client_order_index, instrument_id) {
        return;
    }

    let resolved_cloid =
        dispatch.resolve_live_order_cloid(order.client_order_id.as_str(), venue_order_id);

    let identity = resolved_cloid.and_then(|cid| {
        dispatch
            .order_identities
            .get(&cid)
            .map(|entry| (cid, entry.value().clone()))
    });

    let Some((cloid, identity)) = identity else {
        dispatch_unowned_order(order, &instrument, dispatch, emitter, account_id, ts_init);
        return;
    };

    if identity.instrument_id != instrument_id {
        return;
    }

    if defer_owned_order(order, &identity, cloid, &mut events, dispatch, emitter) {
        return;
    }

    dispatch_owned_order(
        order,
        &instrument,
        &identity,
        cloid,
        venue_order_id,
        dispatch,
        emitter,
        account_id,
        trader_id,
        ts_init,
    );
}

fn defer_owned_order(
    order: &LighterOrder,
    identity: &OrderIdentity,
    cloid: ClientOrderId,
    events: &mut AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
) -> bool {
    if dispatch.has_pending_modify(&cloid) {
        events.entry(cloid).or_default().store_order(order);
        return true;
    }

    if identity.child_fill_baseline().is_some() && !identity.has_inferred_fills() {
        if identity.has_child_publication() {
            return true;
        }

        let deferred = events.entry(cloid).or_default();

        let had_terminal = deferred
            .order
            .as_ref()
            .is_some_and(|prior| prior.status.is_terminal());

        deferred.store_order(order);
        let terminal = order.status.is_terminal();

        if terminal || had_terminal {
            publish_child_recovery(cloid, events, dispatch, emitter);
            return true;
        }
    }

    if position_fills_pending(identity, events, dispatch) && order.status.is_terminal() {
        events.entry(cloid).or_default().store_order(order);
        return true;
    }

    false
}

fn dispatch_unowned_order(
    order: &LighterOrder,
    instrument: &InstrumentAny,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_id: AccountId,
    ts_init: UnixNanos,
) {
    match parse_ws_order_status_report(order, instrument, account_id, ts_init) {
        Ok(mut report) => {
            report = dispatch.apply_order_contingencies(order, report);
            report = dispatch.translate_order_cloid(report);
            report = dispatch.preserve_pending_order_status(report);
            if report
                .client_order_id
                .and_then(|id| dispatch.order_identity(&id))
                .is_some_and(|identity| {
                    !identity.report_fills_covered(&report, &[]) || identity.has_publication()
                })
            {
                return;
            }

            if let Some(cloid) = &report.client_order_id {
                dispatch.venue_id_map.insert(*cloid, report.venue_order_id);
            }

            if report.order_status.is_closed() {
                evict_terminal_mappings(&report, &dispatch.venue_id_map);
            }

            log::debug!(
                "Lighter OrderStatusReport: voi={} status={:?} cloid={:?}",
                report.venue_order_id,
                report.order_status,
                report.client_order_id,
            );
            emitter.send_order_status_report(report);
        }
        Err(e) => {
            log::error!(
                "Failed to parse Lighter order status report: error={e}, order_id={}",
                order.order_id,
            );
        }
    }
}

#[expect(
    clippy::too_many_arguments,
    reason = "tracked order publication uses the same identity and emitter context as stream dispatch"
)]
fn dispatch_owned_order(
    order: &crate::http::models::LighterOrder,
    instrument: &InstrumentAny,
    identity: &OrderIdentity,
    cloid: ClientOrderId,
    venue_order_id: VenueOrderId,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_id: AccountId,
    trader_id: TraderId,
    ts_init: UnixNanos,
) {
    dispatch.venue_id_map.insert(cloid, venue_order_id);

    // Pre-compute the parser's Open-frame context: accepted gate,
    // triggered gate, and shape diff against the stored snapshot.
    // The dispatcher owns the dispatch-state mutation and the parser
    // stays pure.
    let is_live_status = matches!(
        order.status,
        crate::common::enums::LighterOrderStatus::Pending
            | crate::common::enums::LighterOrderStatus::Open,
    );
    let pending_action = dispatch.pending_order_action(&cloid);
    if is_live_status && pending_action == Some(PendingOrderAction::Cancel) {
        log::debug!(
            "Deferring Lighter {:?} frame while cancel is pending for {cloid}",
            order.status,
        );
        return;
    }

    let current_shape = match lighter_order_shape(order, instrument, identity.order_type) {
        Ok(shape) => shape,
        Err(e) => {
            log::error!(
                "Failed to compute Lighter order shape: error={e}, voi={venue_order_id}, cloid={cloid}",
            );
            return;
        }
    };

    let prior_shape = dispatch.snapshot_for(&cloid);
    identity.record_reduction(order.initial_base_amount - current_shape.quantity.as_decimal());
    let shape_changed = prior_shape.map_or_else(
        || current_shape.quantity.as_decimal() < order.initial_base_amount,
        |previous| {
            identity.normalize_shape(previous) != identity.normalize_shape(current_shape.clone())
        },
    );

    if shape_changed
        && !dispatch.accepted_was_emitted(&cloid)
        && (is_live_status || order.status == crate::common::enums::LighterOrderStatus::Filled)
    {
        ensure_accepted_emitted(
            cloid,
            venue_order_id,
            identity,
            account_id,
            trader_id,
            emitter,
            dispatch,
            ts_init,
        );
    }

    let fresh_trigger = is_order_triggered(order)
        && TRIGGERABLE_ORDER_TYPES.contains(&identity.order_type)
        && !dispatch.triggered_was_emitted(&cloid);

    if pending_action == Some(PendingOrderAction::Modify) && fresh_trigger && !shape_changed {
        log::debug!("Deferring Lighter trigger while modify confirmation is pending for {cloid}",);
        return;
    }

    let open_ctx = OpenFrameContext {
        accepted_already_emitted: dispatch.accepted_was_emitted(&cloid),
        triggered_already_emitted: dispatch.triggered_was_emitted(&cloid),
        shape_changed,
    };

    let event_opt = match parse_lighter_order_event(
        order, instrument, identity, cloid, account_id, trader_id, open_ctx, ts_init,
    ) {
        Ok(event) => event,
        Err(e) => {
            log::error!(
                "Failed to parse Lighter order event: error={e}, voi={venue_order_id}, cloid={cloid}"
            );
            return;
        }
    };

    dispatch.store_snapshot(cloid, current_shape);
    if let Some(event) = event_opt {
        let Some(event) = defer_terminal(order, event, identity, cloid, dispatch) else {
            return;
        };

        dispatch_tracked_order_event(
            event,
            cloid,
            venue_order_id,
            identity,
            account_id,
            trader_id,
            emitter,
            dispatch,
            ts_init,
        );
    }

    if order.status == crate::common::enums::LighterOrderStatus::Filled {
        dispatch.clear_pending_order_action(&cloid);
        dispatch.retire_order_identity(&cloid);
    }
}

/// Route a venue `account_trades` payload through the tracked-event path
/// when the cloid is known, otherwise fall back to the existing
/// [`FillReport`] flow. Drops duplicate fill frames keyed by `trade_id`.
#[expect(
    clippy::too_many_arguments,
    reason = "consumption-loop dispatch threads identity and emitter context"
)]
fn dispatch_lighter_trade(
    trade: &crate::http::models::LighterTrade,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    registry: &Arc<MarketRegistry>,
    account_id: AccountId,
    trader_id: TraderId,
    account_index: Option<i64>,
    ts_init: UnixNanos,
) {
    let mut events = dispatch.order_events.lock();

    let Some(account_index) = account_index else {
        log::debug!("Lighter trade frame dropped: no credential / account_index available",);
        return;
    };

    let Some(instrument_id) = registry.instrument_id(trade.market_id) else {
        log::debug!(
            "Lighter trade frame dropped: no instrument for market_id={}",
            trade.market_id,
        );
        return;
    };

    dispatch.note_active_market(trade.market_id);

    let Some(instrument) = LIGHTER_INSTRUMENT_CACHE
        .get(&instrument_id)
        .map(|instrument| instrument.value().clone())
    else {
        log::debug!("Lighter trade frame dropped: instrument {instrument_id} not in cache",);
        return;
    };

    let user_is_bidder = trade.bid_account_id == account_index;
    let user_is_asker = trade.ask_account_id == account_index;
    if !user_is_bidder && !user_is_asker {
        // Defensive: the handler already filters foreign trades, so this
        // branch is rare in practice. Drop silently.
        return;
    }

    // Dedupe before dispatch so a duplicate frame on reconnect does not
    // double-book on either the tracked or untracked path.
    let trade_id = match parse_lighter_trade_id(trade) {
        Ok(id) => id,
        Err(e) => {
            log::error!("Lighter trade has invalid trade_id: {e}");
            return;
        }
    };

    let (raw_client_id, client_order_index, venue_order_id) = if user_is_bidder {
        (
            trade
                .bid_client_id_str
                .as_deref()
                .map_or_else(|| trade.bid_client_id.to_string(), str::to_string),
            trade.bid_client_id,
            trade.bid_id_str.as_deref().map_or_else(
                || VenueOrderId::new(trade.bid_id.to_string()),
                VenueOrderId::new,
            ),
        )
    } else {
        (
            trade
                .ask_client_id_str
                .as_deref()
                .map_or_else(|| trade.ask_client_id.to_string(), str::to_string),
            trade.ask_client_id,
            trade.ask_id_str.as_deref().map_or_else(
                || VenueOrderId::new(trade.ask_id.to_string()),
                VenueOrderId::new,
            ),
        )
    };

    if !dispatch.restore_cached_order(venue_order_id, client_order_index, instrument_id) {
        return;
    }

    let resolved_cloid = dispatch.resolve_live_trade_cloid(raw_client_id.as_str(), venue_order_id);
    let identity = resolved_cloid.and_then(|cid| {
        dispatch
            .order_identity(&cid)
            .map(|identity| (cid, identity))
    });

    let Some((cloid, identity)) = identity else {
        match parse_ws_fill_report(trade, account_index, &instrument, account_id, ts_init) {
            Ok(Some(mut report)) => {
                report = dispatch.translate_fill_cloid(report);
                log::debug!(
                    "Lighter FillReport: voi={} qty={} px={} liq={:?} cloid={:?}",
                    report.venue_order_id,
                    report.last_qty,
                    report.last_px,
                    report.liquidity_side,
                    report.client_order_id,
                );

                if dispatch.mark_trade_seen(trade_id) {
                    emitter.send_fill_report(report);
                }
            }
            Ok(None) => {}
            Err(e) => {
                log::error!("Failed to parse Lighter fill report: error={e}, trade_id={trade_id}",);
            }
        }

        return;
    };

    if identity.instrument_id != instrument_id {
        return;
    }

    dispatch_owned_trade(
        trade,
        &instrument,
        &identity,
        cloid,
        venue_order_id,
        &mut events,
        dispatch,
        emitter,
        account_id,
        trader_id,
        account_index,
        trade_id,
        ts_init,
    );
}

#[expect(
    clippy::too_many_arguments,
    reason = "tracked trade publication uses the stream identity and emitter context"
)]
fn dispatch_owned_trade(
    trade: &crate::http::models::LighterTrade,
    instrument: &InstrumentAny,
    identity: &OrderIdentity,
    cloid: ClientOrderId,
    venue_order_id: VenueOrderId,
    events: &mut AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    account_id: AccountId,
    trader_id: TraderId,
    account_index: i64,
    trade_id: TradeId,
    ts_init: UnixNanos,
) {
    if identity.has_inferred_fills() {
        log::warn!(
            "Withholding Lighter trade {trade_id} for {cloid}: inferred fills require reconciliation"
        );
        return;
    }

    match parse_lighter_order_filled(
        trade,
        instrument,
        identity,
        cloid,
        account_id,
        trader_id,
        account_index,
        ts_init,
    ) {
        Ok(Some(filled)) => {
            ensure_accepted_emitted(
                cloid,
                venue_order_id,
                identity,
                account_id,
                trader_id,
                emitter,
                dispatch,
                ts_init,
            );

            log::debug!(
                "Lighter OrderFilled: voi={} qty={} px={} liq={:?} cloid={cloid}",
                filled.venue_order_id,
                filled.last_qty,
                filled.last_px,
                filled.liquidity_side,
            );

            if let Some(baseline) = identity.child_fill_baseline() {
                if baseline.trade_ids.contains(&trade_id) {
                    return;
                }

                dispatch.defer_fill(events.entry(cloid).or_default(), filled);
                publish_child_recovery(cloid, events, dispatch, emitter);
            } else if dispatch.has_pending_modify(&cloid)
                || position_fills_pending(identity, events, dispatch)
            {
                dispatch.defer_fill(events.entry(cloid).or_default(), filled);
            } else if dispatch.mark_trade_seen(trade_id) {
                dispatch_lighter_fill(filled, emitter, dispatch, events);
            }
        }
        Ok(None) => {}
        Err(e) => {
            log::error!("Failed to parse Lighter typed fill: error={e}, trade_id={trade_id}",);
        }
    }
}

fn spawn_child_recoveries(context: &AckedOrderProbeContext) {
    let candidates = context
        .dispatch
        .order_events
        .lock()
        .iter()
        .filter_map(|(cloid, deferred)| (!deferred.fills.is_empty()).then_some(*cloid))
        .collect::<Vec<_>>();

    for cloid in candidates {
        spawn_child_recovery(cloid, context);
    }
}

fn request_child_report_recoveries(
    core: &ExecutionClientCore,
    context: &AckedOrderProbeContext,
    sweep: &OrderReportSweep,
) {
    for (index, report) in &sweep.orders {
        if !core
            .cache()
            .client_order_id(&report.venue_order_id)
            .is_some_and(|cloid| context.dispatch.has_pending_modify(cloid))
        {
            restore_reconciled_order(
                core,
                &context.dispatch,
                report.venue_order_id,
                *index,
                report.order_status.is_closed(),
            );
        }

        request_child_recovery(core, context, report);
    }
}

fn request_child_recovery(
    core: &ExecutionClientCore,
    context: &AckedOrderProbeContext,
    report: &OrderStatusReport,
) {
    let cache = core.cache();

    let Some(cloid) = cache.client_order_id(&report.venue_order_id).copied() else {
        return;
    };

    let Some(order) = cache.order(&cloid) else {
        return;
    };

    if order.parent_order_id().is_some()
        && !order.is_closed()
        && (report.order_status.is_closed() || report.filled_qty != order.filled_qty())
    {
        spawn_child_recovery(cloid, context);
    }
}

fn spawn_child_recovery(cloid: ClientOrderId, context: &AckedOrderProbeContext) {
    let epoch = context.connection_epoch.load(Ordering::Acquire);
    {
        let mut events = context.dispatch.order_events.lock();

        let Some(identity) = context.dispatch.order_identity(&cloid) else {
            return;
        };

        if identity.child_fill_baseline().is_none()
            || identity.has_inferred_fills()
            || identity.has_child_publication()
            || context.dispatch.has_pending_modify(&cloid)
        {
            return;
        }

        let deferred = events.entry(cloid).or_default();
        if deferred.recovery_epoch == Some(epoch) {
            return;
        }

        deferred.recovery_epoch = Some(epoch);
    }

    let context = context.clone();
    let tasks = context.pending_tasks.clone();
    let dispatch = context.dispatch.clone();

    let future = async move {
        for attempt in 0..ACKED_ORDER_PROBE_ATTEMPTS {
            if context.connection_epoch.load(Ordering::Acquire) != epoch {
                break;
            }

            let result = tokio::select! {
                () = context.cancellation_token.cancelled() => break,
                result = recover_child_order(cloid, epoch, &context) => result,
            };

            match result {
                Ok(true) => break,
                Ok(false) => {}
                Err(e) => log::warn!(
                    "Lighter child recovery unavailable for {cloid}: {}",
                    scrub_auth(&format!("{e:#}"))
                ),
            }

            if attempt + 1 < ACKED_ORDER_PROBE_ATTEMPTS {
                tokio::select! {
                    () = context.cancellation_token.cancelled() => break,
                    () = tokio::time::sleep(ACKED_ORDER_LOOKUP_DELAY) => {},
                }
            }
        }

        let mut events = context.dispatch.order_events.lock();
        if let Some(deferred) = events.get_mut(&cloid)
            && deferred.recovery_epoch == Some(epoch)
        {
            deferred.recovery_epoch = None;
        }
    };

    if let Err(e) = tasks.spawn(future) {
        if let Some(deferred) = dispatch.order_events.lock().get_mut(&cloid) {
            deferred.recovery_epoch = None;
        }

        log::debug!("Skipping Lighter child recovery during shutdown: {e}");
    }
}

async fn recover_child_order(
    cloid: ClientOrderId,
    epoch: u64,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<bool> {
    let Some(identity) = context.dispatch.order_identity(&cloid) else {
        return Ok(true);
    };

    if context.dispatch.has_pending_modify(&cloid)
        || identity.has_inferred_fills()
        || identity.has_child_publication()
    {
        return Ok(true);
    }

    let Some(venue_order_id) = identity.venue_order_id() else {
        return Ok(false);
    };

    let lookup = OrderReportLookup::new(
        &context.registry,
        &context.dispatch,
        Some(identity.instrument_id),
        Some(&cloid),
        Some(&venue_order_id),
    )?;

    let Some(order) = collect_order(
        &context.http_client,
        &context.registry,
        &context.credential,
        &lookup,
    )
    .await?
    else {
        return Ok(false);
    };

    anyhow::ensure!(
        order.owner_account_index == context.credential.account_index()
            && context.registry.instrument_id(order.market_index) == Some(identity.instrument_id)
            && identity.matches_venue_order_id(VenueOrderId::new(&order.order_id)),
        "Lighter child recovery ownership mismatch"
    );
    let instrument = LIGHTER_INSTRUMENT_CACHE
        .get(&identity.instrument_id)
        .context("missing child recovery instrument")?
        .value()
        .clone();
    let report = parse_ws_order_status_report(
        &order,
        &instrument,
        context.account_id,
        context.clock.get_time_ns(),
    )?;

    if !report.order_status.is_closed() {
        return Ok(false);
    }

    let mut instruments = AHashMap::new();
    instruments.insert(identity.instrument_id, instrument.clone());

    let command = GenerateFillReports::new(
        UUID4::new(),
        context.clock.get_time_ns(),
        Some(identity.instrument_id),
        Some(venue_order_id),
        None,
        None,
        None,
        None,
    );
    let sweep = collect_fill_reports(
        &context.http_client,
        &context.registry,
        &context.credential,
        context.account_id,
        context.clock,
        &command,
        &instruments,
        &mut BTreeSet::new(),
        Some(order.order_index),
    )
    .await?;
    let mut events = context.dispatch.order_events.lock();
    if context.connection_epoch.load(Ordering::Acquire) != epoch
        || context.dispatch.has_pending_modify(&cloid)
        || identity.has_inferred_fills()
        || identity.has_child_publication()
    {
        return Ok(true);
    }

    let deferred = events.entry(cloid).or_default();
    deferred.store_order(&order);

    for mut fill in sweep.reports {
        fill.client_order_id = Some(cloid);
        if fill.venue_order_id != venue_order_id {
            continue;
        }

        if let Some(fill) = child_fill_from_report(&fill, &identity, context.emitter.trader_id()) {
            context.dispatch.defer_fill(deferred, fill);
        }
    }

    publish_child_recovery(cloid, &mut events, &context.dispatch, &context.emitter);
    Ok(identity.has_child_publication())
}

fn child_fill_from_report(
    report: &FillReport,
    identity: &OrderIdentity,
    trader_id: TraderId,
) -> Option<OrderFilled> {
    let instrument = LIGHTER_INSTRUMENT_CACHE.get(&identity.instrument_id)?;
    let cloid = report.client_order_id.filter(|_| {
        identity.matches_venue_order_id(report.venue_order_id)
            && identity.instrument_id == report.instrument_id
    })?;

    Some(OrderFilled::new(
        trader_id,
        identity.strategy_id,
        identity.instrument_id,
        cloid,
        report.venue_order_id,
        report.account_id,
        report.trade_id,
        report.order_side,
        identity.order_type,
        report.last_qty,
        report.last_px,
        instrument.quote_currency(),
        report.liquidity_side,
        UUID4::new(),
        report.ts_event,
        report.ts_init,
        false,
        None,
        Some(report.commission),
        None,
    ))
}

fn publish_child_recovery(
    cloid: ClientOrderId,
    events: &mut AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
) {
    let Some(identity) = dispatch.order_identity(&cloid) else {
        return;
    };

    if position_modify_pending(&identity, dispatch) {
        return;
    }

    let Some((ids, children)) = collect_child_recoveries(&identity, events, dispatch, emitter)
    else {
        return;
    };

    let mut fills = Vec::new();
    let mut terminals = Vec::new();

    for id in ids {
        let Some(mut deferred) = events.remove(&id) else {
            continue;
        };

        fills.extend(deferred.fills.drain(..).map(|fill| {
            let sequence = deferred.fill_sequence.remove(&fill.trade_id).unwrap_or(0);
            (fill, sequence)
        }));

        terminals.push((id, deferred));
    }

    publish_child_updates(&children, &terminals, emitter);

    fills.sort_by_key(|(fill, sequence)| (fill.ts_event, *sequence));
    for (fill, _) in fills {
        if dispatch.mark_trade_seen(fill.trade_id) {
            dispatch_lighter_fill(fill, emitter, dispatch, events);
        }
    }

    for child in children {
        let id = child.cloid;
        let bundle = ExecutionReport::OrderWithFills(Box::new(child.report.clone()), Vec::new());

        if let Err(e) = emitter.try_send_execution_report(bundle) {
            log::warn!("Lighter child report publication failed for {id}: {e}");

            let Some(index) = terminals.iter().position(|(cid, _)| *cid == id) else {
                continue;
            };

            let (_, deferred) = terminals.swap_remove(index);
            events.insert(id, deferred);

            continue;
        }

        child.identity.publish_child(&child.report, child.trade_ids);
        dispatch.retire_order_identity(&id);
    }

    for (id, deferred) in terminals {
        if dispatch
            .order_identity(&id)
            .is_some_and(|identity| identity.child_fill_baseline().is_none())
        {
            flush_order_terminal(id, deferred, dispatch, emitter, events);
        }
    }
}

struct ChildRecovery {
    cloid: ClientOrderId,
    identity: OrderIdentity,
    report: OrderStatusReport,
    trade_ids: Vec<TradeId>,
}

fn collect_child_recoveries(
    identity: &OrderIdentity,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
) -> Option<(Vec<ClientOrderId>, Vec<ChildRecovery>)> {
    let mut children = Vec::new();
    let mut ids = Vec::new();

    for (id, deferred) in events {
        let Some(other) = dispatch.order_identity(id) else {
            continue;
        };

        if other.strategy_id != identity.strategy_id
            || other.instrument_id != identity.instrument_id
        {
            continue;
        }

        if dispatch.has_pending_modify(id) {
            return None;
        }

        if other.child_fill_baseline().is_none() {
            ids.push(*id);
            continue;
        }

        if deferred.fills.is_empty()
            && deferred
                .order
                .as_ref()
                .is_none_or(|order| !order.status.is_terminal())
        {
            continue;
        }

        let report = child_recovery_report(*id, events, dispatch, emitter)?;
        let trade_ids = deferred.fills.iter().map(|fill| fill.trade_id).collect();
        children.push(ChildRecovery {
            cloid: *id,
            identity: other,
            report,
            trade_ids,
        });

        ids.push(*id);
    }

    Some((ids, children))
}

fn publish_child_updates(
    children: &[ChildRecovery],
    terminals: &[(ClientOrderId, DeferredOrderEvents)],
    emitter: &ExecutionEventEmitter,
) {
    for child in children {
        if child.trade_ids.is_empty() {
            continue;
        }

        let Some(order) = terminals
            .iter()
            .find(|(cid, _)| *cid == child.cloid)
            .and_then(|(_, deferred)| deferred.order.as_ref())
        else {
            continue;
        };

        let Some(instrument) = LIGHTER_INSTRUMENT_CACHE.get(&child.identity.instrument_id) else {
            continue;
        };

        if let Ok(updated) = parse_lighter_order_updated(
            order,
            &instrument,
            &child.identity,
            child.cloid,
            emitter.account_id(),
            emitter.trader_id(),
            child.report.ts_init,
        ) {
            emitter.send_order_event(OrderEventAny::Updated(updated));
        }
    }
}

fn position_fills_pending(
    identity: &OrderIdentity,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
) -> bool {
    position_modify_pending(identity, dispatch)
        || events.iter().any(|(id, deferred)| {
            !deferred.fills.is_empty()
                && dispatch.order_identity(id).is_some_and(|other| {
                    other.strategy_id == identity.strategy_id
                        && other.instrument_id == identity.instrument_id
                })
        })
}

fn position_modify_pending(identity: &OrderIdentity, dispatch: &WsDispatchState) -> bool {
    dispatch.order_identities.iter().any(|entry| {
        entry.value().strategy_id == identity.strategy_id
            && entry.value().instrument_id == identity.instrument_id
            && dispatch.has_pending_modify(entry.key())
    })
}

fn child_recovery_report(
    cloid: ClientOrderId,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
) -> Option<OrderStatusReport> {
    let identity = dispatch.order_identity(&cloid)?;
    if identity.has_child_publication() || identity.has_inferred_fills() {
        return None;
    }

    let baseline = identity.child_fill_baseline()?;
    let deferred = events.get(&cloid)?;
    let order = deferred.order.as_ref()?;
    if !identity.matches_venue_order_id(VenueOrderId::new(&order.order_id)) {
        return None;
    }

    let instrument = LIGHTER_INSTRUMENT_CACHE.get(&identity.instrument_id)?;
    let report = parse_ws_order_status_report(
        order,
        &instrument,
        emitter.account_id(),
        get_atomic_clock_realtime().get_time_ns(),
    )
    .ok()?;
    let report = dispatch.translate_order_cloid(dispatch.apply_order_contingencies(order, report));
    if !report.order_status.is_closed() || report.filled_qty > report.quantity {
        return None;
    }

    let mut total = baseline.quantity.as_decimal();
    for fill in &deferred.fills {
        if baseline.trade_ids.contains(&fill.trade_id) {
            continue;
        }

        if fill.venue_order_id != report.venue_order_id
            || fill.instrument_id != report.instrument_id
            || fill.account_id != report.account_id
            || Some(fill.order_side) != report.order_side
            || fill.commission.is_none()
        {
            return None;
        }

        total += fill.last_qty.as_decimal();
    }

    (total == report.filled_qty.as_decimal()).then_some(report)
}

fn dispatch_lighter_fill(
    filled: OrderFilled,
    emitter: &ExecutionEventEmitter,
    dispatch: &WsDispatchState,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
) {
    let cloid = filled.client_order_id;
    if let Some(identity) = dispatch.order_identity(&cloid)
        && !identity.publish_fill(&filled)
    {
        return;
    }

    ensure_fill_triggered(&filled, emitter, dispatch);
    emitter.send_order_event(OrderEventAny::Filled(filled));
    release_terminal(cloid, false, dispatch, emitter, events);
}

fn defer_terminal(
    order: &LighterOrder,
    event: ParsedOrderEvent,
    identity: &OrderIdentity,
    cloid: ClientOrderId,
    dispatch: &WsDispatchState,
) -> Option<ParsedOrderEvent> {
    if !matches!(
        event,
        ParsedOrderEvent::Canceled(_) | ParsedOrderEvent::Expired(_)
    ) {
        return Some(event);
    }

    let mut pending = dispatch.terminals_pending.lock();
    if pending.contains_key(&cloid) {
        return None;
    }

    if order.filled_base_amount <= identity.filled_qty() {
        return Some(event);
    }

    pending.insert(
        cloid,
        PendingTerminal {
            order: order.clone(),
            event,
            retry_at: tokio::time::Instant::now() + TERMINAL_FILL_DELAY,
            attempts: 0,
        },
    );

    None
}

fn release_terminal(
    cloid: ClientOrderId,
    force: bool,
    dispatch: &WsDispatchState,
    emitter: &ExecutionEventEmitter,
    events: &AHashMap<ClientOrderId, DeferredOrderEvents>,
) {
    let Some(identity) = dispatch.order_identity(&cloid) else {
        return;
    };

    let terminal = {
        let mut pending = dispatch.terminals_pending.lock();

        let Some(terminal) = pending.get(&cloid) else {
            return;
        };

        if (identity.child_fill_baseline().is_some() && !identity.has_inferred_fills())
            || dispatch.has_pending_modify(&cloid)
            || position_fills_pending(&identity, events, dispatch)
        {
            return;
        }

        if !force && identity.filled_qty() < terminal.order.filled_base_amount {
            return;
        }

        pending.remove(&cloid).expect("pending terminal exists")
    };

    let missing_qty = terminal.order.filled_base_amount - identity.filled_qty();
    if missing_qty > Decimal::ZERO {
        log::error!(
            "Lighter terminal fill recovery exhausted for {cloid}, venue_order_id={}, missing quantity={missing_qty}; releasing terminal for reconciliation",
            terminal.order.order_id,
        );
    }

    dispatch_tracked_order_event(
        terminal.event,
        cloid,
        VenueOrderId::new(&terminal.order.order_id),
        &identity,
        emitter.account_id(),
        emitter.trader_id(),
        emitter,
        dispatch,
        get_atomic_clock_realtime().get_time_ns(),
    );
}

async fn run_terminal_recovery(
    context: AckedOrderProbeContext,
    producers_stopped: CancellationToken,
) {
    let mut interval = tokio::time::interval(Duration::from_millis(100));
    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
    let mut immediate = false;

    loop {
        tokio::select! {
            biased;
            () = context.cancellation_token.cancelled() => break,
            () = context.dispatch.terminals_recover.notified() => immediate = true,
            _ = interval.tick() => {},
        }

        tokio::select! {
            biased;
            () = context.cancellation_token.cancelled() => break,
            () = context.dispatch.terminals_recover.notified() => {
                immediate = true;
                continue;
            }
            () = recover_terminals(&context, immediate) => {},
        }
        immediate = false;
    }

    producers_stopped.cancelled().await;

    let drain = async {
        for _ in 0..ACKED_ORDER_PROBE_ATTEMPTS {
            recover_terminals(&context, true).await;
            if context.dispatch.terminals_pending.lock().is_empty() {
                break;
            }
        }
    };

    let _ = tokio::time::timeout(TERMINAL_SHUTDOWN_TIMEOUT, drain).await;
    let events = context.dispatch.order_events.lock();
    let remaining = context
        .dispatch
        .terminals_pending
        .lock()
        .keys()
        .copied()
        .collect::<Vec<_>>();

    for cloid in remaining {
        release_terminal(cloid, true, &context.dispatch, &context.emitter, &events);
    }
}

async fn recover_terminals(context: &AckedOrderProbeContext, immediate: bool) {
    let now = tokio::time::Instant::now();
    let candidates = context
        .dispatch
        .terminals_pending
        .lock()
        .iter()
        .filter(|(_, terminal)| immediate || terminal.retry_at <= now)
        .map(|(cloid, terminal)| {
            (
                *cloid,
                terminal.order.clone(),
                terminal.attempts >= ACKED_ORDER_PROBE_ATTEMPTS,
            )
        })
        .collect::<Vec<_>>();

    stream::iter(candidates)
        .for_each_concurrent(4, |(cloid, order, exhausted)| async move {
            {
                let events = context.dispatch.order_events.lock();
                release_terminal(
                    cloid,
                    exhausted,
                    &context.dispatch,
                    &context.emitter,
                    &events,
                );

                if exhausted {
                    return;
                }

                let mut pending = context.dispatch.terminals_pending.lock();

                let Some(terminal) = pending.get_mut(&cloid) else {
                    return;
                };

                terminal.attempts += 1;
            }

            let result = tokio::time::timeout(
                TERMINAL_RECOVERY_TIMEOUT,
                recover_terminal_trades(order.market_index, order.order_index, context),
            )
            .await;

            match result {
                Ok(Ok(())) => {}
                Ok(Err(e)) => log::warn!(
                    "Lighter terminal trade lookup failed for {cloid}: {}",
                    scrub_auth(&format!("{e:#}"))
                ),
                Err(_) => log::warn!("Lighter terminal trade lookup timed out for {cloid}"),
            }

            let events = context.dispatch.order_events.lock();
            release_terminal(cloid, false, &context.dispatch, &context.emitter, &events);

            let exhausted = {
                let mut pending = context.dispatch.terminals_pending.lock();

                let Some(terminal) = pending.get_mut(&cloid) else {
                    return;
                };

                terminal.retry_at = tokio::time::Instant::now() + TERMINAL_FILL_DELAY;
                terminal.attempts >= ACKED_ORDER_PROBE_ATTEMPTS
            };

            if exhausted {
                release_terminal(cloid, true, &context.dispatch, &context.emitter, &events);
            }
        })
        .await;
}

async fn recover_filled_reports(sweep: &OrderReportSweep, context: &AckedOrderProbeContext) {
    for (index, report) in &sweep.orders {
        if report.order_status != OrderStatus::Filled
            || !context.dispatch.restore_cached_order(
                report.venue_order_id,
                *index,
                report.instrument_id,
            )
        {
            continue;
        }

        let Some(cloid) = context
            .dispatch
            .resolve_client_order_index_for_venue(*index, report.venue_order_id)
        else {
            continue;
        };

        let Some(identity) = context.dispatch.order_identity(&cloid) else {
            continue;
        };

        if identity.child_fill_baseline().is_some()
            || identity.has_inferred_fills()
            || report.filled_qty.as_decimal() <= identity.filled_qty()
        {
            continue;
        }

        let Some(market_index) = context.registry.market_index(&report.instrument_id) else {
            continue;
        };

        let result = async {
            let order_index = report
                .venue_order_id
                .as_str()
                .parse::<i64>()
                .context("invalid Lighter filled order index")?;
            tokio::time::timeout(
                TERMINAL_RECOVERY_TIMEOUT,
                recover_terminal_trades(market_index, order_index, context),
            )
            .await
            .context("Lighter filled-order trade lookup timed out")?
        }
        .await;

        if let Err(e) = result {
            log::warn!(
                "Lighter filled-order recovery unavailable for {cloid}: {}",
                scrub_auth(&format!("{e:#}"))
            );
        }
    }
}

async fn recover_report_fills(
    order: &LighterOrder,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<()> {
    if !order.status.is_terminal() {
        return Ok(());
    }

    let venue = VenueOrderId::new(&order.order_id);

    let Some(instrument_id) = context.registry.instrument_id(order.market_index) else {
        return Ok(());
    };

    if !context
        .dispatch
        .restore_cached_order(venue, order.client_order_index, instrument_id)
    {
        return Ok(());
    }

    let Some(cloid) = context
        .dispatch
        .resolve_client_order_index_for_venue(order.client_order_index, venue)
    else {
        return Ok(());
    };

    let missing = (order.status == LighterOrderStatus::Filled
        || context.dispatch.order_identities.contains_key(&cloid))
        && context
            .dispatch
            .order_identity(&cloid)
            .is_some_and(|identity| {
                order.filled_base_amount > identity.filled_qty()
                    && (order.status != LighterOrderStatus::Filled
                        || !identity.has_inferred_fills())
            });

    if !missing {
        return Ok(());
    }

    if order.status == LighterOrderStatus::Filled {
        tokio::time::timeout(
            TERMINAL_RECOVERY_TIMEOUT,
            recover_terminal_trades(order.market_index, order.order_index, context),
        )
        .await
        .context("Lighter filled-order trade lookup timed out")??;
    } else {
        dispatch_lighter_order(
            order,
            &context.dispatch,
            &context.emitter,
            &context.registry,
            context.account_id,
            context.emitter.trader_id(),
            context.clock.get_time_ns(),
        );
    }

    Ok(())
}

async fn recover_terminal_trades(
    market_index: i64,
    order_index: i64,
    context: &AckedOrderProbeContext,
) -> anyhow::Result<()> {
    let auth = build_auth_token_for(&context.credential)?;

    let mut query = Zeroizing::new(LighterTradesQuery {
        authorization: None,
        auth: Some(auth),
        market_id: Some(market_index),
        account_index: Some(context.credential.account_index()),
        order_index: Some(order_index),
        sort_by: LighterTradeSortBy::Timestamp,
        sort_dir: Some(LighterSortDirection::Desc),
        cursor: None,
        from_timestamp: None,
        ask_filter: None,
        role: None,
        trade_type: None,
        limit: LIGHTER_REST_PAGE_SIZE,
        aggregate: None,
    });

    let mut cursors = AHashSet::new();
    let mut trades = Vec::new();

    for page in 0..MAX_RECONCILIATION_PAGES {
        let response = context.http_client.get_trades(&query).await?;
        for trade in response.trades {
            let account = context.credential.account_index();
            anyhow::ensure!(
                trade.market_id == market_index
                    && ((trade.bid_account_id == account && trade.bid_id == order_index)
                        || (trade.ask_account_id == account && trade.ask_id == order_index)),
                "Lighter terminal recovery returned a trade outside the requested order"
            );
            trades.push(trade);
        }

        match response.next_cursor.filter(|cursor| !cursor.is_empty()) {
            Some(cursor) => {
                anyhow::ensure!(
                    cursors.insert(cursor.clone()),
                    "Lighter terminal recovery repeated cursor"
                );
                anyhow::ensure!(
                    page + 1 < MAX_RECONCILIATION_PAGES,
                    "Lighter terminal recovery exceeded page limit"
                );
                query.cursor = Some(cursor);
            }
            None => break,
        }
    }

    trades.sort_by_key(|trade| (trade.timestamp, trade.trade_id));
    for trade in trades {
        dispatch_lighter_trade(
            &trade,
            &context.dispatch,
            &context.emitter,
            &context.registry,
            context.account_id,
            context.emitter.trader_id(),
            Some(context.credential.account_index()),
            context.clock.get_time_ns(),
        );
    }

    Ok(())
}

fn ensure_fill_triggered(
    filled: &OrderFilled,
    emitter: &ExecutionEventEmitter,
    dispatch: &WsDispatchState,
) {
    if TRIGGERABLE_ORDER_TYPES.contains(&filled.order_type)
        && dispatch.mark_triggered_emitted(filled.client_order_id)
    {
        let triggered = OrderTriggered::new(
            filled.trader_id,
            filled.strategy_id,
            filled.instrument_id,
            filled.client_order_id,
            UUID4::new(),
            filled.ts_event,
            filled.ts_init,
            false,
            Some(filled.venue_order_id),
            Some(filled.account_id),
        );
        emitter.send_order_event(OrderEventAny::Triggered(triggered));
    }
}

/// Send a [`ParsedOrderEvent`] to the engine and update dispatch state for
/// the originating cloid. Cleans up [`WsDispatchState::order_identities`]
/// on terminal events so subsequent stale frames take the untracked path.
#[expect(
    clippy::too_many_arguments,
    reason = "shared cleanup point across the typed-event variants"
)]
#[expect(
    clippy::needless_pass_by_value,
    reason = "event is destructured into typed OrderEventAny variants that consume the payload"
)]
fn dispatch_tracked_order_event(
    event: ParsedOrderEvent,
    cloid: ClientOrderId,
    venue_order_id: VenueOrderId,
    identity: &OrderIdentity,
    account_id: AccountId,
    trader_id: TraderId,
    emitter: &ExecutionEventEmitter,
    dispatch: &WsDispatchState,
    ts_init: UnixNanos,
) {
    let is_terminal;

    match event {
        ParsedOrderEvent::Accepted(e) => {
            if !dispatch.claim_accepted_emission(&cloid) {
                log::debug!("Skipping duplicate OrderAccepted for {cloid}");
                return;
            }

            is_terminal = false;
            emitter.send_order_event(OrderEventAny::Accepted(e));
        }
        ParsedOrderEvent::Triggered(e) => {
            if !dispatch.mark_triggered_emitted(cloid) {
                log::debug!("Skipping duplicate OrderTriggered for {cloid}");
                return;
            }

            ensure_accepted_emitted(
                cloid,
                venue_order_id,
                identity,
                account_id,
                trader_id,
                emitter,
                dispatch,
                ts_init,
            );
            is_terminal = false;
            emitter.send_order_event(OrderEventAny::Triggered(e));
        }
        ParsedOrderEvent::Updated(e) => {
            // Modify-as-restate: the venue echoes the post-modify order as
            // `Open`; `accepted_was_emitted` already gated parsing to
            // produce `Updated` instead of duplicate `Accepted`. No need
            // to re-synthesize the accept here.
            dispatch.clear_pending_modify_if_update(&cloid, e.quantity, e.price, e.trigger_price);
            is_terminal = false;
            identity.publish_update(e.event_id);
            emitter.send_order_event(OrderEventAny::Updated(e));
        }
        ParsedOrderEvent::UpdatedThenTriggered { updated, triggered } => {
            if !dispatch.mark_triggered_emitted(cloid) {
                log::debug!("Skipping duplicate OrderTriggered for {cloid}");
                return;
            }

            ensure_accepted_emitted(
                cloid,
                venue_order_id,
                identity,
                account_id,
                trader_id,
                emitter,
                dispatch,
                ts_init,
            );
            dispatch.clear_pending_modify_if_update(
                &cloid,
                updated.quantity,
                updated.price,
                updated.trigger_price,
            );
            is_terminal = false;
            identity.publish_update(updated.event_id);
            emitter.send_order_event(OrderEventAny::Updated(updated));
            emitter.send_order_event(OrderEventAny::Triggered(triggered));
        }
        ParsedOrderEvent::Canceled(e) => {
            ensure_accepted_emitted(
                cloid,
                venue_order_id,
                identity,
                account_id,
                trader_id,
                emitter,
                dispatch,
                ts_init,
            );
            is_terminal = true;
            emitter.send_order_event(OrderEventAny::Canceled(e));
        }
        ParsedOrderEvent::Expired(e) => {
            ensure_accepted_emitted(
                cloid,
                venue_order_id,
                identity,
                account_id,
                trader_id,
                emitter,
                dispatch,
                ts_init,
            );
            is_terminal = true;
            emitter.send_order_event(OrderEventAny::Expired(e));
        }
        ParsedOrderEvent::Rejected(e) => {
            is_terminal = true;
            emitter.send_order_event(OrderEventAny::Rejected(e));
        }
    }

    if is_terminal {
        dispatch.clear_pending_order_action(&cloid);
        dispatch.retire_order_identity(&cloid);
    }
}

/// Synthesize an `OrderAccepted` event if one has not yet been emitted for
/// `cloid`. Synthesizes the accepted event the venue does not emit.
#[expect(
    clippy::too_many_arguments,
    reason = "synthesized events need the full identity context to populate the event"
)]
fn ensure_accepted_emitted(
    cloid: ClientOrderId,
    venue_order_id: VenueOrderId,
    identity: &OrderIdentity,
    account_id: AccountId,
    trader_id: TraderId,
    emitter: &ExecutionEventEmitter,
    dispatch: &WsDispatchState,
    ts_init: UnixNanos,
) {
    if !dispatch.claim_accepted_emission(&cloid) {
        return;
    }

    let accepted = OrderAccepted::new(
        trader_id,
        identity.strategy_id,
        identity.instrument_id,
        cloid,
        venue_order_id,
        account_id,
        UUID4::new(),
        ts_init,
        ts_init,
        false,
    );
    emitter.send_order_event(OrderEventAny::Accepted(accepted));
}

#[cfg(test)]
mod tests {
    use std::{
        cell::RefCell,
        rc::Rc,
        sync::{Arc, atomic::AtomicUsize},
    };

    use axum::{
        Router,
        extract::Query,
        routing::{get, post},
    };
    use nautilus_common::{
        cache::Cache,
        clock::{Clock, VirtualClock},
        factories::OrderFactory,
        live::runner::replace_exec_event_sender,
        messages::{ExecutionEvent, ExecutionReport as EngineExecutionReport},
        testing::wait_until_async,
    };
    use nautilus_execution::engine::ExecutionEngine;
    use nautilus_live::manager::{ExecutionManager, ExecutionManagerConfig};
    use nautilus_model::{
        accounts::MarginAccount,
        data::QuoteTick,
        enums::{ContingencyType, LiquiditySide, OrderSide, OrderStatus, TimeInForce},
        events::{
            AccountState, OrderCanceled, OrderEventAny, OrderPendingCancel, OrderSubmitted,
            OrderTriggered,
        },
        identifiers::{
            InstrumentId, OrderListId, PositionId, StrategyId, Symbol, TradeId, TraderId,
            VenueOrderId,
        },
        instruments::CryptoPerpetual,
        orders::{LimitOrder, OrderList, OrderTestBuilder, stubs::TestOrderEventStubs},
        position::Position,
        types::{Currency, Money, Price},
    };
    use rstest::rstest;

    use super::*;
    use crate::{
        common::{
            consts::{
                LIGHTER_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX,
                LIGHTER_ROBINHOOD_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX, LIGHTER_VENUE,
            },
            enums::{LighterDeployment, LighterEnvironment, LighterProductType},
        },
        http::models::{LighterNextNonce, LighterOrders, LighterTx},
        signing::tx::TX_HASH_BYTES,
    };

    const TEST_PRIVATE_KEY: &str =
        "0b8e0f63c24d8baacd9d29ad4e9a4b73c4a8d2bb8b16dc4fa9d7c2e1d3a8b1f0e8d3a4c5b6e7f001";
    const TEST_ACCOUNT_INDEX: u64 = 12345;
    const TEST_ACCOUNT_INDEX_I64: i64 = 12345;
    const TEST_API_KEY_INDEX: u8 = 5;
    const TEST_NEXT_NONCE: i64 = 42;
    const TEST_MARKET_INDEX: i64 = 0;
    const TEST_ORDER_NONCE: i64 = 281_474_720_725_346;
    const TEST_SUBMISSION_NONCE: i64 = 2_042;

    fn handle_send_tx_ack(
        dispatch: &WsDispatchState,
        account_index: Option<i64>,
        code: i64,
        tx_hash: Option<&str>,
    ) -> Option<PendingSendTx> {
        handle_send_tx_ack_for_connection(dispatch, account_index, 0, code, tx_hash)
    }

    #[expect(
        clippy::too_many_arguments,
        reason = "test wrapper preserves the established rejection call shape"
    )]
    fn handle_send_tx_rejection(
        dispatch: &WsDispatchState,
        emitter: &ExecutionEventEmitter,
        account_index: Option<i64>,
        now: UnixNanos,
        source: SendTxRejectionSource,
        code: Option<i64>,
        message: &str,
        tx_hash: Option<&str>,
    ) -> bool {
        handle_send_tx_rejection_for_connection(
            dispatch,
            emitter,
            account_index,
            0,
            now,
            source,
            code,
            message,
            tx_hash,
        )
    }

    fn trader_id() -> TraderId {
        TraderId::from("TRADER-001")
    }

    fn client_id() -> ClientId {
        ClientId::from("LIGHTER")
    }

    fn account_id() -> AccountId {
        AccountId::from("LIGHTER-001")
    }

    fn strategy_id() -> StrategyId {
        StrategyId::from("S-001")
    }

    fn test_credential() -> Credential {
        Credential::new(TEST_API_KEY_INDEX, TEST_PRIVATE_KEY, TEST_ACCOUNT_INDEX).unwrap()
    }

    fn test_config() -> LighterExecutionClientConfig {
        test_config_with_use_gtd(true)
    }

    fn test_config_with_use_gtd(use_gtd: bool) -> LighterExecutionClientConfig {
        LighterExecutionClientConfig {
            account_id: account_id(),
            account_index: Some(TEST_ACCOUNT_INDEX),
            api_key_index: Some(TEST_API_KEY_INDEX),
            private_key: Some(TEST_PRIVATE_KEY.into()),
            base_url_http: Some("http://127.0.0.1:1".to_string()),
            base_url_ws: Some("ws://127.0.0.1:1/stream".to_string()),
            proxy_url: None,
            environment: LighterEnvironment::Testnet,
            deployment: LighterDeployment::Lighter,
            venue: None,
            http_timeout_secs: 1,
            ws_timeout_secs: 1,
            market_order_slippage_bps: 50,
            rest_quota_per_min: None,
            sendtx_quota_per_min: None,
            transport_backend: Default::default(),
            use_gtd,
            scheduled_cancel_timeout_secs: None,
        }
    }

    #[rstest]
    fn format_between_timestamps_uses_lighter_seconds_range() {
        let start = UnixNanos::from(1_700_000_000_123_456_789);
        let end = UnixNanos::from(1_700_003_600_987_654_321);
        let now = UnixNanos::from(1_700_007_200_000_000_000);

        assert_eq!(
            format_between_timestamps(Some(start), Some(end), now),
            Some("1700000000-1700003600".to_string()),
        );
        assert_eq!(
            format_between_timestamps(Some(start), None, now),
            Some("1700000000-1700007200".to_string()),
        );
        assert_eq!(
            format_between_timestamps(None, Some(end), now),
            Some("0-1700003600".to_string()),
        );
        assert_eq!(format_between_timestamps(None, None, now), None);
    }

    #[rstest]
    #[case::write_timeout(LighterWsError::Transport(SendError::WriteTimeout), "Ambiguous")]
    #[case::broken_pipe(
        LighterWsError::Transport(SendError::BrokenPipe("writer closed".to_string())),
        "Ambiguous",
    )]
    #[case::handler_result_lost(
        LighterWsError::SendTxOutcomeUnknown("result sender dropped".to_string()),
        "Ambiguous",
    )]
    #[case::network(LighterWsError::Network("disconnected".to_string()), "Ambiguous")]
    #[case::parse(LighterWsError::Parse("invalid ack".to_string()), "Ambiguous")]
    #[case::invalid_input(
        LighterWsError::Transport(SendError::InvalidInput("invalid payload".to_string())),
        "NotSent",
    )]
    #[case::buffer_full(LighterWsError::Transport(SendError::BufferFull), "NotSent")]
    #[case::closed(LighterWsError::Transport(SendError::Closed), "NotSent")]
    #[case::connection_changed(LighterWsError::Transport(SendError::ConnectionChanged), "NotSent")]
    #[case::wait_timeout(LighterWsError::Transport(SendError::Timeout), "NotSent")]
    #[case::authentication(
        LighterWsError::Authentication("invalid token".to_string()),
        "NotSent",
    )]
    #[case::client_unavailable(
        LighterWsError::Client("handler unavailable".to_string()),
        "NotSent",
    )]
    fn ws_command_failure_classifies_delivery_evidence(
        #[case] error: LighterWsError,
        #[case] expected: &str,
    ) {
        let failure = classify_lighter_ws_command_failure("submit_order", &error);

        let actual = match &failure {
            CommandFailure::NotSent(_) => "NotSent",
            CommandFailure::Ambiguous(_) => "Ambiguous",
            CommandFailure::VenueRejected(_) => "VenueRejected",
        };

        assert_eq!(actual, expected);
        assert!(command_failure_reason(&failure).contains("submit_order"));
    }

    #[rstest]
    fn venue_rejection_reason_is_clean_and_bounded() {
        let oversized = "x".repeat(STRATEGY_REASON_MAX_CHARS + 100);
        let message = format!("<html>\n rejected\0 because   {oversized}</html>");

        let failure = venue_rejection_failure(Some(20_001), &message);
        let reason = command_failure_reason(&failure);

        assert!(matches!(&failure, CommandFailure::VenueRejected(_)));
        assert!(!reason.contains('<'));
        assert!(!reason.contains('\0'));
        assert!(!reason.contains("  "));
        assert_eq!(reason.chars().count(), STRATEGY_REASON_MAX_CHARS);
        assert!(reason.starts_with("LIGHTER_20001: rejected because "));
    }

    #[rstest]
    fn venue_rejection_reason_uses_stable_fallback_for_empty_markup() {
        let failure = venue_rejection_failure(Some(20_001), "<html></html>\n");

        assert_eq!(
            failure,
            CommandFailure::VenueRejected("LIGHTER_20001".to_string()),
        );
    }

    #[rstest]
    fn venue_rejection_reason_preserves_comparison_and_removes_format_controls() {
        let failure = venue_rejection_failure(
            Some(20_001),
            "price must be < 100\u{202e}\u{2066}\u{200b}<strong>now</strong>",
        );

        assert_eq!(
            failure,
            CommandFailure::VenueRejected("LIGHTER_20001: price must be < 100 now".to_string(),),
        );
    }

    #[rstest]
    fn unsupported_order_type_reason_keeps_lighter_capabilities() {
        assert_eq!(
            unsupported_lighter_order_type_reason(OrderType::MarketToLimit),
            "UNSUPPORTED_ORDER_TYPE: MARKET_TO_LIMIT; Lighter supports MARKET, LIMIT, STOP_MARKET, STOP_LIMIT, MARKET_IF_TOUCHED, and LIMIT_IF_TOUCHED",
        );
    }

    #[rstest]
    fn mass_status_propagates_commission_error_and_downgrades_other_fill_errors() {
        let e = anyhow::Error::new(LighterCommissionError::new("invalid precision"))
            .context("failed to parse Lighter fill report");

        let commission_error = fill_reports_for_mass_status(Err(e))
            .expect_err("commission construction must fail mass status");
        let ordinary_error = fill_reports_for_mass_status(Err(anyhow::anyhow!("transport failed")))
            .expect("ordinary source errors make mass status incomplete");

        let complete = fill_reports_for_mass_status(Ok(FillSweep {
            reports: Vec::new(),
            covers_window: true,
            withheld_instruments: AHashSet::new(),
        }))
        .expect("complete fill sweep");

        assert!(is_commission_error(&commission_error));
        assert!(ordinary_error.0.is_empty());
        assert!(!ordinary_error.1);
        assert!(complete.0.is_empty());
        assert!(complete.1);
    }

    fn create_execution_client() -> (
        LighterExecutionClient,
        Rc<RefCell<Cache>>,
        tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
    ) {
        create_execution_client_with_config(test_config())
    }

    #[rstest]
    #[case(419)]
    #[case(1_295_941)]
    #[case(u64::MAX)]
    fn scheduled_cancel_constructor_rejects_invalid_timeout(#[case] timeout: u64) {
        let (client, _, _) = create_execution_client();
        let mut config = test_config();
        config.scheduled_cancel_timeout_secs = Some(timeout);
        let error = LighterExecutionClient::new(client.core, config).unwrap_err();
        assert_eq!(
            error.to_string(),
            "scheduled_cancel_timeout_secs must be in [420, 1295940]"
        );
    }

    #[tokio::test]
    async fn scheduled_cancel_timeout_preserves_non_tail_nonce() {
        let (mut client, _, _) = create_execution_client();
        client.tx_rate_limiter = build_tx_rate_limiter(Some(1));
        let key = ustr::Ustr::from(crate::common::rate_limit::LIGHTER_TX_BUCKET);
        assert!(client.tx_rate_limiter.check_key(&key).is_ok());
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();

        let later = {
            let renewal = context.refresh_scheduled_cancel(420);
            tokio::pin!(renewal);
            tokio::select! {
                result = &mut renewal => panic!("renewal must wait for quota: {result:?}"),
                () = tokio::time::sleep(Duration::from_millis(20)) => {},
            }
            let later = context.build_tx_context().unwrap();
            assert_eq!(later.context.nonce, TEST_NEXT_NONCE + 1);
            assert!(
                tokio::time::timeout(Duration::from_millis(50), &mut renewal)
                    .await
                    .is_err()
            );
            later
        };

        assert!(
            tokio::time::timeout(
                Duration::from_millis(150),
                later.send_reservation.wait_for_turn()
            )
            .await
            .is_err()
        );
        assert!(!client.pending_tasks.all_finished());
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE + 1)
        );
        drop(later);
        client.begin_session_shutdown();
        client.finish_session_shutdown().await.unwrap();
        assert!(client.pending_tasks.is_empty());
    }

    #[tokio::test]
    async fn scheduled_cancel_timeout_cancels_quota_wait_and_releases_nonce() {
        let (mut client, _, _) = create_execution_client();
        client.tx_rate_limiter = build_tx_rate_limiter(Some(1));
        let key = ustr::Ustr::from(crate::common::rate_limit::LIGHTER_TX_BUCKET);
        assert!(client.tx_rate_limiter.check_key(&key).is_ok());
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();
        assert!(
            tokio::time::timeout(
                Duration::from_millis(50),
                context.refresh_scheduled_cancel(420)
            )
            .await
            .is_err()
        );
        tokio::time::timeout(Duration::from_secs(2), async {
            while !client.pending_tasks.all_finished() {
                tokio::task::yield_now().await;
            }
        })
        .await
        .unwrap();

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            TEST_NEXT_NONCE
        );
        client.begin_session_shutdown();
        client.finish_session_shutdown().await.unwrap();
        assert!(client.pending_tasks.is_empty());
    }

    #[rstest]
    #[tokio::test]
    async fn account_cancellation_dropped_during_quota_wait_is_retained_until_shutdown() {
        let (mut client, _, _) = create_execution_client();
        client.tx_rate_limiter = build_tx_rate_limiter(Some(1));
        let key = ustr::Ustr::from(crate::common::rate_limit::LIGHTER_TX_BUCKET);
        assert!(client.tx_rate_limiter.check_key(&key).is_ok());
        {
            let pending = client.cancel_all_orders_account();
            tokio::pin!(pending);
            tokio::select! {
                result = &mut pending => panic!("control must wait for quota: {result:?}"),
                () = tokio::time::sleep(Duration::from_millis(50)) => {}
            }
        }

        assert!(!client.pending_tasks.is_empty());
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);

        client.begin_session_shutdown();
        client.finish_session_shutdown().await.unwrap();

        assert!(client.pending_tasks.is_empty());
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            TEST_NEXT_NONCE,
        );
    }

    #[rstest]
    #[tokio::test]
    async fn account_cancellation_spawn_rejection_releases_latest_nonce() {
        let (client, _, _) = create_execution_client();
        client.pending_tasks.begin_shutdown();

        let error = client.cancel_all_orders_account().await.unwrap_err();

        assert_eq!(
            error.to_string(),
            "failed to spawn Lighter account cancellation"
        );
        assert!(client.pending_tasks.is_empty());
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            TEST_NEXT_NONCE,
        );
    }

    #[rstest]
    #[tokio::test]
    async fn account_cancellation_ambiguous_error_identifies_pending_transaction() {
        let (mut client, _, _) = create_execution_client();
        client.ws_client.drop_next_send_tx_result_for_test().await;

        let error = client.cancel_all_orders_account().await.unwrap_err();
        let pending = client.dispatch.take_pending_sendtx();

        assert_eq!(pending.len(), 1);
        assert_eq!(pending[0].nonce, TEST_NEXT_NONCE);
        assert_eq!(pending[0].api_key_index, TEST_API_KEY_INDEX);
        assert_eq!(
            error.to_string(),
            format!(
                "failed to submit Lighter account cancellation transaction {}",
                pending[0].tx_hash
            ),
        );
        assert!(matches!(
            error.downcast_ref::<LighterWsError>(),
            Some(LighterWsError::SendTxOutcomeUnknown(_)),
        ));
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            TEST_NEXT_NONCE + 1,
        );
        client.begin_session_shutdown();
        client.finish_session_shutdown().await.unwrap();
    }

    #[rstest]
    #[case::definite_failure(false, 0, TEST_NEXT_NONCE + 1)]
    #[case::ambiguous_failure(true, 1, TEST_NEXT_NONCE + 2)]
    #[tokio::test]
    async fn account_cancellation_dropped_caller_preserves_dispatch_failure_handling(
        #[case] ambiguous: bool,
        #[case] pending_count: usize,
        #[case] next_nonce: i64,
    ) {
        let (mut client, _, _) = create_execution_client();
        if ambiguous {
            client.ws_client.drop_next_send_tx_result_for_test().await;
        }

        let mut blocker = client.build_tx_context(&test_credential()).unwrap();
        {
            let pending = client.cancel_all_orders_account();
            tokio::pin!(pending);
            tokio::select! {
                result = &mut pending => panic!("control must wait for its turn: {result:?}"),
                () = tokio::time::sleep(Duration::from_millis(50)) => {}
            }
        }

        assert!(!client.pending_tasks.is_empty());
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        blocker.send_reservation.release();
        wait_until_async(
            || async { client.pending_tasks.is_empty() },
            Duration::from_secs(2),
        )
        .await;

        assert_eq!(client.dispatch.pending_sendtx_len(), pending_count);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            next_nonce,
        );
        client.begin_session_shutdown();
        client.finish_session_shutdown().await.unwrap();
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    #[case::first_start(false)]
    #[case::already_started(true)]
    fn execution_sender_is_available_before_start_and_replaced_on_start(#[case] started: bool) {
        let (client, _cache, _rx) = create_execution_client();
        let (first_sender, mut first_receiver) = tokio::sync::mpsc::unbounded_channel();
        replace_exec_event_sender(first_sender);
        let mut client = LighterExecutionClient::new(client.core, test_config()).unwrap();
        let emitter = client.emitter.clone();

        let submitted = OrderSubmitted::new(
            trader_id(),
            strategy_id(),
            InstrumentId::from("ETH-PERP.LIGHTER"),
            ClientOrderId::from("BEFORE-START"),
            account_id(),
            UUID4::new(),
            UnixNanos::from(17),
            UnixNanos::from(23),
        );
        emitter
            .try_send_order_event(OrderEventAny::Submitted(submitted.clone()))
            .unwrap();

        if started {
            client.start().unwrap();
        }

        let (second_sender, mut second_receiver) = tokio::sync::mpsc::unbounded_channel();
        replace_exec_event_sender(second_sender);
        client.start().unwrap();

        let after_start = OrderSubmitted::new(
            trader_id(),
            strategy_id(),
            InstrumentId::from("BTC-PERP.LIGHTER"),
            ClientOrderId::from("AFTER-START"),
            account_id(),
            UUID4::new(),
            UnixNanos::from(29),
            UnixNanos::from(31),
        );
        emitter
            .try_send_order_event(OrderEventAny::Submitted(after_start.clone()))
            .unwrap();

        for (receiver, expected) in [
            (&mut first_receiver, submitted),
            (&mut second_receiver, after_start),
        ] {
            let ExecutionEvent::Order(OrderEventAny::Submitted(actual)) =
                receiver.try_recv().unwrap()
            else {
                panic!("expected submitted event");
            };

            assert_eq!(actual, expected);
            assert!(receiver.try_recv().is_err());
        }
    }

    fn create_execution_client_with_config(
        config: LighterExecutionClientConfig,
    ) -> (
        LighterExecutionClient,
        Rc<RefCell<Cache>>,
        tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
    ) {
        let cache = Rc::new(RefCell::new(Cache::default()));
        let venue = config.resolved_venue();

        let core = ExecutionClientCore::new(
            trader_id(),
            client_id(),
            venue,
            OmsType::Netting,
            account_id(),
            AccountType::Margin,
            None,
            cache.clone(),
        );

        let mut client = LighterExecutionClient::new(core, config).unwrap();
        client.dispatch.nonce_manager.refresh(
            TEST_ACCOUNT_INDEX_I64,
            TEST_API_KEY_INDEX,
            TEST_NEXT_NONCE,
        );

        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel::<ExecutionEvent>();
        client.emitter.set_sender(sender);

        (client, cache, receiver)
    }

    #[rstest]
    #[case::inline_deferred(false, true)]
    #[case::worker_deferred(true, true)]
    #[case::inline_absent(false, false)]
    #[case::worker_absent(true, false)]
    #[tokio::test]
    async fn single_order_lookup_distinguishes_deferred_report_from_absence(
        #[case] worker: bool,
        #[case] present: bool,
    ) {
        let rig = dispatcher_rig("DEFERRED-PROBE");
        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let venue_order_id = VenueOrderId::from(order.order_id.as_str());
        rig.dispatch.observe_create_submission(
            &rig.cloid,
            order.client_order_index,
            TEST_SUBMISSION_NONCE,
            venue_order_id,
        );
        rig.dispatch
            .order_identity(&rig.cloid)
            .unwrap()
            .publish_update(UUID4::new());

        let response = LighterOrders {
            code: 200,
            message: None,
            next_cursor: None,
            orders: if present { vec![order] } else { Vec::new() },
        };

        let body = serde_json::to_string(&response).unwrap();
        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(move || {
                    let body = body.clone();
                    async move { body }
                }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(|| async {
                    axum::Json(LighterOrders {
                        code: 200,
                        message: None,
                        next_cursor: None,
                        orders: Vec::new(),
                    })
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let config = LighterExecutionClientConfig {
            base_url_http: Some(format!("http://{addr}")),
            ..test_config()
        };

        let (mut client, _cache, mut rx) = create_execution_client_with_config(config);
        client.registry = rig.registry;
        client.dispatch = rig.dispatch;

        let command = GenerateOrderStatusReport::new(
            UUID4::new(),
            UnixNanos::from(1),
            Some(rig.instrument_id),
            Some(rig.cloid),
            Some(venue_order_id),
            None,
            None,
        );

        let result = if worker {
            let task = client.generate_order_status_report_task(&command).unwrap();
            task.collection.await;
            (task.finish)()
        } else {
            client.generate_order_status_report(&command).await
        };

        server.abort();
        let _ = server.await;

        if present {
            assert_eq!(
                result.unwrap_err().to_string(),
                "Lighter order report deferred until execution state is applied"
            );
        } else {
            assert_eq!(result.unwrap(), None);
        }

        assert!(
            client
                .dispatch
                .order_identity(&rig.cloid)
                .unwrap()
                .has_publication()
        );
        assert!(rx.try_recv().is_err());
    }

    fn register_test_instrument(
        client: &LighterExecutionClient,
        cache: &Rc<RefCell<Cache>>,
    ) -> InstrumentId {
        let instrument_id =
            client
                .registry
                .insert(TEST_MARKET_INDEX, "ETH", LighterProductType::Perp);
        let instrument = InstrumentAny::CryptoPerpetual(
            CryptoPerpetual::builder()
                .instrument_id(instrument_id)
                .raw_symbol(Symbol::new("ETH-PERP"))
                .base_currency(Currency::from("ETH"))
                .quote_currency(Currency::from("USDC"))
                .settlement_currency(Currency::from("USDC"))
                .is_inverse(false)
                .price_precision(2)
                .size_precision(4)
                .price_increment(Price::from("0.01"))
                .size_increment(Quantity::from("0.0001"))
                .min_notional(Money::from("10.000000 USDC"))
                .ts_event(UnixNanos::default())
                .ts_init(UnixNanos::default())
                .build()
                .unwrap(),
        );

        cache.borrow_mut().add_instrument(instrument).unwrap();

        instrument_id
    }

    fn test_order_factory() -> OrderFactory {
        let clock = Rc::new(RefCell::new(VirtualClock::new()));

        OrderFactory::new(
            trader_id(),
            strategy_id(),
            Some(0),
            Some(0),
            clock,
            false,
            false,
        )
    }

    fn test_limit_order(
        factory: &mut OrderFactory,
        instrument_id: InstrumentId,
        client_order_id: &str,
    ) -> OrderAny {
        test_limit_order_with(
            factory,
            instrument_id,
            client_order_id,
            OrderSide::Buy,
            TimeInForce::Gtc,
            None,
            false,
        )
    }

    fn test_limit_order_with(
        factory: &mut OrderFactory,
        instrument_id: InstrumentId,
        client_order_id: &str,
        side: OrderSide,
        tif: TimeInForce,
        expire_time: Option<UnixNanos>,
        reduce_only: bool,
    ) -> OrderAny {
        factory.limit(
            instrument_id,
            side,
            Quantity::from("0.1000"),
            Price::from("2361.31"),
            Some(tif),
            expire_time,
            Some(false),
            Some(reduce_only),
            None,
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from(client_order_id)),
        )
    }

    fn cache_order(cache: &Rc<RefCell<Cache>>, order: OrderAny) {
        cache
            .borrow_mut()
            .add_order(order, None, Some(client_id()), false)
            .unwrap();
    }

    fn cache_accepted_order(
        cache: &Rc<RefCell<Cache>>,
        order: OrderAny,
        venue_order_id: VenueOrderId,
        client_id: Option<ClientId>,
    ) -> (InstrumentId, ClientOrderId) {
        let instrument_id = order.instrument_id();
        let client_order_id = order.client_order_id();
        cache
            .borrow_mut()
            .add_order(order, None, client_id, false)
            .unwrap();

        let accepted = OrderEventAny::Accepted(OrderAccepted::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            client_order_id,
            venue_order_id,
            account_id(),
            UUID4::new(),
            UnixNanos::default(),
            UnixNanos::default(),
            false,
        ));
        cache.borrow_mut().update_order(&accepted).unwrap();

        (instrument_id, client_order_id)
    }

    fn cache_pending_cancel_order(
        cache: &Rc<RefCell<Cache>>,
        order: OrderAny,
        venue_order_id: VenueOrderId,
    ) {
        let (instrument_id, client_order_id) =
            cache_accepted_order(cache, order, venue_order_id, Some(client_id()));

        let pending_cancel = OrderEventAny::PendingCancel(OrderPendingCancel::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(account_id()),
            UUID4::new(),
            UnixNanos::default(),
            UnixNanos::default(),
            false,
            Some(venue_order_id),
        ));
        cache.borrow_mut().update_order(&pending_cancel).unwrap();
    }

    fn submit_order_list_command(orders: &[OrderAny], order_list_id: &str) -> SubmitOrderList {
        let order_list = OrderList::new(
            OrderListId::from(order_list_id),
            orders[0].instrument_id(),
            strategy_id(),
            orders.iter().map(|order| order.client_order_id()).collect(),
            UnixNanos::default(),
        );
        let order_inits = orders
            .iter()
            .map(|order| order.init_event().clone())
            .collect();

        SubmitOrderList::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            order_list,
            order_inits,
            None,
            None,
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
        )
    }

    fn test_contingent_limit_order(
        instrument_id: InstrumentId,
        client_order_id: &str,
        order_list_id: &str,
        linked_order_id: &str,
    ) -> OrderAny {
        OrderAny::Limit(LimitOrder::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            ClientOrderId::from(client_order_id),
            OrderSide::Buy,
            Quantity::from("0.1000"),
            Price::from("2361.31"),
            TimeInForce::Gtc,
            None,
            false,
            false,
            false,
            None,
            None,
            None,
            Some(ContingencyType::Oco),
            Some(OrderListId::from(order_list_id)),
            Some(vec![ClientOrderId::from(linked_order_id)]),
            None,
            None,
            None,
            None,
            None,
            UUID4::new(),
            UnixNanos::default(),
        ))
    }

    async fn recv_order_event(
        rx: &mut tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
    ) -> OrderEventAny {
        let event = tokio::time::timeout(Duration::from_secs(2), rx.recv())
            .await
            .expect("timed out waiting for execution event")
            .expect("execution event channel closed");

        match event {
            ExecutionEvent::Order(event) => event,
            event => panic!("expected order event, was {event:?}"),
        }
    }

    async fn assert_modify_rejected_reason(
        rx: &mut tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
        reason_part: &str,
    ) {
        match recv_order_event(rx).await {
            OrderEventAny::ModifyRejected(event) => {
                assert!(
                    event.reason.contains(reason_part),
                    "expected modify rejection containing `{reason_part}`, was `{}`",
                    event.reason,
                );
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }
    }

    fn assert_nonce_reusable(dispatch: &WsDispatchState) {
        assert_eq!(
            dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE - 1),
        );
        assert_eq!(
            dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            TEST_NEXT_NONCE,
        );
    }

    #[tokio::test]
    async fn auth_token_rotation_retries_failed_mint() {
        let credential = test_credential();
        let channels = auth_token_rotation_channels(TEST_ACCOUNT_INDEX_I64);
        let cancellation_token = CancellationToken::new();
        let mint_attempts = Arc::new(AtomicUsize::new(0));
        let subscribe_attempts = Arc::new(AtomicUsize::new(0));

        let outcome = tokio::time::timeout(
            Duration::from_secs(3),
            refresh_auth_token_until_rotated(
                &credential,
                &channels,
                &cancellation_token,
                AuthTokenRefreshBackoff {
                    initial_delay: Duration::from_millis(10),
                    max_delay: Duration::from_millis(20),
                    window: Duration::from_secs(1),
                },
                {
                    let mint_attempts = Arc::clone(&mint_attempts);
                    move |_| {
                        let attempt = mint_attempts.fetch_add(1, Ordering::AcqRel);
                        if attempt == 0 {
                            Err(anyhow::anyhow!("mint unavailable"))
                        } else {
                            Ok(format!("token-{attempt}").into())
                        }
                    }
                },
                {
                    let subscribe_attempts = Arc::clone(&subscribe_attempts);
                    move |_channel, _token| {
                        let subscribe_attempts = Arc::clone(&subscribe_attempts);
                        async move {
                            subscribe_attempts.fetch_add(1, Ordering::AcqRel);
                            Ok::<(), crate::websocket::error::LighterWsError>(())
                        }
                    }
                },
            ),
        )
        .await
        .expect("rotation retry must complete within the test window");

        assert_eq!(outcome, AuthTokenRefreshOutcome::Rotated);
        assert_eq!(
            mint_attempts.load(Ordering::Acquire),
            2,
            "failed mint must retry before the next refresh interval",
        );
        assert_eq!(
            subscribe_attempts.load(Ordering::Acquire),
            channels.len(),
            "subscriptions must wait until token mint succeeds",
        );
    }

    #[tokio::test]
    async fn auth_token_rotation_retries_failed_resubscribe() {
        let credential = test_credential();
        let channels = auth_token_rotation_channels(TEST_ACCOUNT_INDEX_I64);
        let cancellation_token = CancellationToken::new();
        let mint_attempts = Arc::new(AtomicUsize::new(0));
        let subscribe_attempts = Arc::new(AtomicUsize::new(0));

        let outcome = tokio::time::timeout(
            Duration::from_secs(3),
            refresh_auth_token_until_rotated(
                &credential,
                &channels,
                &cancellation_token,
                AuthTokenRefreshBackoff {
                    initial_delay: Duration::from_millis(10),
                    max_delay: Duration::from_millis(20),
                    window: Duration::from_secs(1),
                },
                {
                    let mint_attempts = Arc::clone(&mint_attempts);
                    move |_| {
                        let attempt = mint_attempts.fetch_add(1, Ordering::AcqRel);
                        Ok(format!("token-{attempt}").into())
                    }
                },
                {
                    let subscribe_attempts = Arc::clone(&subscribe_attempts);
                    move |_channel, _token| {
                        let subscribe_attempts = Arc::clone(&subscribe_attempts);
                        async move {
                            let attempt = subscribe_attempts.fetch_add(1, Ordering::AcqRel);
                            if attempt == 0 {
                                Err(crate::websocket::error::LighterWsError::Client(
                                    "handler unavailable".to_string(),
                                ))
                            } else {
                                Ok(())
                            }
                        }
                    }
                },
            ),
        )
        .await
        .expect("rotation retry must complete within the test window");

        assert_eq!(outcome, AuthTokenRefreshOutcome::Rotated);
        assert_eq!(
            mint_attempts.load(Ordering::Acquire),
            2,
            "failed resubscribe must trigger a fresh auth-token mint",
        );
        assert_eq!(
            subscribe_attempts.load(Ordering::Acquire),
            channels.len() * 2,
            "failed resubscribe must retry the private account-channel set",
        );
    }

    #[tokio::test]
    async fn auth_token_rotation_exhausts_retry_window() {
        let credential = test_credential();
        let channels = auth_token_rotation_channels(TEST_ACCOUNT_INDEX_I64);
        let cancellation_token = CancellationToken::new();
        let mint_attempts = Arc::new(AtomicUsize::new(0));

        let refresh = refresh_auth_token_until_rotated(
            &credential,
            &channels,
            &cancellation_token,
            AuthTokenRefreshBackoff {
                initial_delay: Duration::from_millis(100),
                max_delay: Duration::from_millis(100),
                window: Duration::from_secs(1),
            },
            {
                let mint_attempts = Arc::clone(&mint_attempts);
                move |_| {
                    mint_attempts.fetch_add(1, Ordering::AcqRel);
                    Err(anyhow::anyhow!("mint unavailable"))
                }
            },
            |_channel, _token| async { Ok::<(), crate::websocket::error::LighterWsError>(()) },
        );
        let observe_retry = wait_until_async(
            || async { mint_attempts.load(Ordering::Acquire) > 1 },
            Duration::from_secs(2),
        );

        let (outcome, ()) = tokio::time::timeout(Duration::from_secs(3), async {
            tokio::join!(refresh, observe_retry)
        })
        .await
        .expect("rotation retry exhaustion must complete within the test window");

        assert_eq!(outcome, AuthTokenRefreshOutcome::Exhausted);
        assert!(
            mint_attempts.load(Ordering::Acquire) > 1,
            "persistent mint failure must retry until the window is exhausted",
        );
    }

    #[tokio::test]
    async fn auth_token_rotation_cancels_during_retry_backoff() {
        let credential = test_credential();
        let channels = auth_token_rotation_channels(TEST_ACCOUNT_INDEX_I64);
        let cancellation_token = CancellationToken::new();
        let mint_attempts = Arc::new(AtomicUsize::new(0));

        let cancel = cancellation_token.clone();
        let cancel_after_first_attempt = wait_until_async(
            || async { mint_attempts.load(Ordering::Acquire) > 0 },
            Duration::from_secs(2),
        );

        let refresh = refresh_auth_token_until_rotated(
            &credential,
            &channels,
            &cancellation_token,
            AuthTokenRefreshBackoff {
                initial_delay: Duration::from_secs(2),
                max_delay: Duration::from_secs(2),
                window: Duration::from_secs(5),
            },
            {
                let mint_attempts = Arc::clone(&mint_attempts);
                move |_| {
                    mint_attempts.fetch_add(1, Ordering::AcqRel);
                    Err(anyhow::anyhow!("mint unavailable"))
                }
            },
            |_channel, _token| async { Ok::<(), crate::websocket::error::LighterWsError>(()) },
        );

        let cancel_task = async move {
            cancel_after_first_attempt.await;
            cancel.cancel();
        };

        let (outcome, ()) = tokio::time::timeout(Duration::from_secs(6), async {
            tokio::join!(refresh, cancel_task)
        })
        .await
        .expect("rotation cancellation must complete within the test window");

        assert_eq!(outcome, AuthTokenRefreshOutcome::Cancelled);
        assert_eq!(
            mint_attempts.load(Ordering::Acquire),
            1,
            "cancellation during backoff must stop before the next retry",
        );
    }

    #[rstest]
    #[case::rotated(AuthTokenRefreshOutcome::Rotated, Some(AUTH_TOKEN_REFRESH_INTERVAL))]
    #[case::cancelled(AuthTokenRefreshOutcome::Cancelled, None)]
    #[case::exhausted(
        AuthTokenRefreshOutcome::Exhausted,
        Some(AUTH_TOKEN_REFRESH_RETRY_MAX_DELAY)
    )]
    fn auth_token_refresh_next_delay_matches_outcome(
        #[case] outcome: AuthTokenRefreshOutcome,
        #[case] expected: Option<Duration>,
    ) {
        assert_eq!(auth_token_refresh_next_delay(outcome), expected);
    }

    #[rstest]
    fn auth_token_rotation_channels_match_private_account_streams() {
        assert_eq!(
            auth_token_rotation_channels(TEST_ACCOUNT_INDEX_I64),
            [
                LighterWsChannel::AccountAllOrders(TEST_ACCOUNT_INDEX_I64),
                LighterWsChannel::AccountAllTrades(TEST_ACCOUNT_INDEX_I64),
                LighterWsChannel::AccountAllPositions(TEST_ACCOUNT_INDEX_I64),
                LighterWsChannel::AccountAllAssets(TEST_ACCOUNT_INDEX_I64),
                LighterWsChannel::UserStats(TEST_ACCOUNT_INDEX_I64),
            ],
        );
    }

    #[rstest]
    #[case::below_max(
        Duration::from_millis(10),
        Duration::from_millis(100),
        Duration::from_millis(20)
    )]
    #[case::at_max(
        Duration::from_millis(100),
        Duration::from_millis(100),
        Duration::from_millis(100)
    )]
    #[case::overflow_clamps(Duration::MAX, Duration::from_secs(300), Duration::from_secs(300))]
    fn next_auth_token_refresh_retry_delay_doubles_and_caps(
        #[case] current: Duration,
        #[case] max: Duration,
        #[case] expected: Duration,
    ) {
        assert_eq!(next_auth_token_refresh_retry_delay(current, max), expected);
    }

    #[rstest]
    #[tokio::test]
    async fn auth_token_refresh_is_retained_until_session_shutdown() {
        let (mut client, _cache, _rx) = create_execution_client();

        client
            .spawn_auth_token_refresh(test_credential())
            .expect("spawn auth token refresh");
        client
            .nonce_recovery_inflight
            .store(true, Ordering::Release);

        assert!(
            client
                .auth_refresh_handle
                .as_ref()
                .is_some_and(|handle| !handle.is_finished()),
        );

        client.begin_session_shutdown();
        client
            .finish_session_shutdown()
            .await
            .expect("session shutdown");

        assert!(client.auth_refresh_handle.is_none());
        assert!(!client.nonce_recovery_inflight.load(Ordering::Acquire));
    }

    #[rstest]
    #[tokio::test]
    async fn session_shutdown_rejects_tasks_registered_during_abort() {
        struct SpawnOnDrop {
            pending_tasks: TaskSpawner,
            rejected: Arc<AtomicBool>,
            polled: Arc<AtomicBool>,
        }

        impl Drop for SpawnOnDrop {
            fn drop(&mut self) {
                let polled = Arc::clone(&self.polled);
                let result = self.pending_tasks.spawn(async move {
                    polled.store(true, Ordering::Release);
                });
                self.rejected.store(result.is_err(), Ordering::Release);
            }
        }

        let (mut client, _cache, _rx) = create_execution_client();
        let rejected = Arc::new(AtomicBool::new(false));
        let polled = Arc::new(AtomicBool::new(false));
        let pending_spawner = client.pending_tasks.spawner().expect("task spawner");
        let guard = SpawnOnDrop {
            pending_tasks: pending_spawner.clone(),
            rejected: Arc::clone(&rejected),
            polled: Arc::clone(&polled),
        };

        pending_spawner
            .spawn(async move {
                let _guard = guard;
                std::future::pending::<()>().await;
            })
            .expect("parent task spawn");

        client
            .finish_session_shutdown()
            .await
            .expect("session shutdown");

        assert!(client.pending_tasks.is_empty());
        assert!(rejected.load(Ordering::Acquire));
        assert!(!polled.load(Ordering::Acquire));
    }

    #[rstest]
    #[tokio::test]
    async fn session_shutdown_discards_pending_sendtx_before_epoch_reuse() {
        struct EnqueueOnDrop {
            dispatch: WsDispatchState,
            pending: Option<PendingSendTx>,
        }

        impl Drop for EnqueueOnDrop {
            fn drop(&mut self) {
                self.dispatch
                    .enqueue_pending_sendtx(self.pending.take().expect("pending sendTx"));
            }
        }

        let (mut client, _cache, _rx) = create_execution_client();
        let old_epoch = client.ws_client.connection_epoch();
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: old_epoch,
            kind: PendingSendTxKind::Other,
            submitted_at: UnixNanos::default(),
            nonce: TEST_NEXT_NONCE,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "shutdown-pending".to_string(),
        });
        let guard = EnqueueOnDrop {
            dispatch: client.dispatch.clone(),
            pending: Some(PendingSendTx {
                batch_id: None,
                connection_epoch: old_epoch,
                kind: PendingSendTxKind::Other,
                submitted_at: UnixNanos::default(),
                nonce: TEST_NEXT_NONCE + 1,
                api_key_index: TEST_API_KEY_INDEX,
                tx_hash: "shutdown-late".to_string(),
            }),
        };

        client
            .pending_tasks
            .spawn(async move {
                let _guard = guard;
                std::future::pending::<()>().await;
            })
            .expect("pending sendTx producer spawn");
        client
            .ws_stream_handle
            .insert(get_runtime().spawn(std::future::pending()));

        client.begin_session_shutdown();
        client
            .finish_session_shutdown()
            .await
            .expect("session shutdown");

        assert_eq!(client.ws_client.connection_epoch(), old_epoch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    fn replacing_ws_client_preserves_cached_instruments() {
        let (mut client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let instrument = cache
            .borrow()
            .instrument(&instrument_id)
            .expect("instrument")
            .clone();
        client
            .ws_client
            .cache_instrument(TEST_MARKET_INDEX, instrument.clone());

        let _old_ws_client = client.take_ws_client();

        let cached_instruments = client.ws_client.instruments_cache();
        assert_eq!(
            cached_instruments
                .get(&TEST_MARKET_INDEX)
                .expect("cached instrument")
                .value(),
            &instrument,
        );
    }

    #[rstest]
    fn tx_send_sequencer_allocates_under_registration_lock() {
        let sequencer = TxSendSequencer::new();

        let mut lower = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                assert!(
                    sequencer.state.try_lock().is_none(),
                    "allocation must be serialized with registration"
                );
                Ok(TEST_NEXT_NONCE)
            })
            .unwrap();

        let higher = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE + 1)
            })
            .unwrap();

        assert!(!sequencer.ready_to_send(higher.key, higher.nonce));
        lower.release();
        assert!(sequencer.ready_to_send(higher.key, higher.nonce));
    }

    #[rstest]
    fn tx_send_sequencer_retains_reused_nonce_reservation() {
        let (client, _cache, _rx) = create_execution_client();
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();
        let mut original = context.build_tx_context().unwrap();
        let nonce = original.context.nonce;
        rollback_tx_dispatch(
            &client.dispatch,
            client.credential.as_ref().unwrap(),
            None,
            nonce,
        );
        let mut replacement = context.build_tx_context().unwrap();
        let higher = context.build_tx_context().unwrap();
        original.send_reservation.release();
        assert_eq!(replacement.context.nonce, nonce);
        assert_eq!(higher.context.nonce, nonce + 1);
        assert!(
            !context
                .tx_send_sequencer
                .ready_to_send(higher.send_reservation.key, higher.context.nonce)
        );
        replacement.send_reservation.release();
        assert!(
            context
                .tx_send_sequencer
                .ready_to_send(higher.send_reservation.key, higher.context.nonce)
        );
    }

    #[tokio::test]
    async fn tx_send_sequencer_blocks_higher_nonce_until_lower_batch_releases() {
        let sequencer = TxSendSequencer::new();

        let mut lower_a = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE)
            })
            .unwrap();

        let mut lower_b = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE + 1)
            })
            .unwrap();

        let mut higher = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE + 2)
            })
            .unwrap();

        let (sent_tx, mut sent_rx) = tokio::sync::mpsc::unbounded_channel();

        let higher_task = tokio::spawn(async move {
            higher.wait_for_turn().await;
            sent_tx.send(higher.nonce).unwrap();
            higher.release();
        });

        assert!(
            tokio::time::timeout(Duration::from_millis(50), sent_rx.recv())
                .await
                .is_err(),
            "higher nonce must wait while the lower batch is pending",
        );

        {
            let lower_reservations = [&lower_a, &lower_b];
            tokio::time::timeout(
                Duration::from_millis(50),
                wait_for_tx_send_reservations(&lower_reservations),
            )
            .await
            .expect("lower batch must already have the send turn");
        }

        lower_a.release();
        lower_b.release();

        let sent = tokio::time::timeout(Duration::from_secs(2), sent_rx.recv())
            .await
            .expect("higher nonce must proceed after lower batch releases")
            .expect("send channel must stay open");
        higher_task.await.unwrap();

        assert_eq!(
            sent,
            TEST_NEXT_NONCE + 2,
            "higher nonce must send after the lower batch releases",
        );
    }

    #[tokio::test]
    async fn tx_send_reservation_drop_releases_lower_nonce() {
        let sequencer = TxSendSequencer::new();

        let lower = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE)
            })
            .unwrap();

        let mut higher = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE + 1)
            })
            .unwrap();

        let (sent_tx, mut sent_rx) = tokio::sync::mpsc::unbounded_channel();

        let higher_task = tokio::spawn(async move {
            higher.wait_for_turn().await;
            sent_tx.send(higher.nonce).unwrap();
            higher.release();
        });

        assert!(
            tokio::time::timeout(Duration::from_millis(50), sent_rx.recv())
                .await
                .is_err(),
            "higher nonce must wait while the lower reservation is pending",
        );

        drop(lower);

        let sent = tokio::time::timeout(Duration::from_secs(2), sent_rx.recv())
            .await
            .expect("higher nonce must proceed after lower reservation drops")
            .expect("send channel must stay open");
        higher_task.await.unwrap();

        assert_eq!(
            sent,
            TEST_NEXT_NONCE + 1,
            "higher nonce must send after the lower reservation drops",
        );
    }

    #[tokio::test]
    async fn tx_send_sequencer_keeps_nonce_streams_independent() {
        let sequencer = TxSendSequencer::new();

        let _other_account = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64 + 1, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE)
            })
            .unwrap();

        let _other_api_key = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX + 1, || {
                Ok(TEST_NEXT_NONCE)
            })
            .unwrap();

        let mut current = sequencer
            .reserve(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, || {
                Ok(TEST_NEXT_NONCE + 10)
            })
            .unwrap();

        tokio::time::timeout(Duration::from_millis(50), current.wait_for_turn())
            .await
            .expect("lower nonces for other keys must not block this key");
        current.release();
    }

    #[rstest]
    fn tx_dispatch_guard_rolls_back_nonce_and_cloid_when_armed() {
        let dispatch = WsDispatchState::new();
        let credential = test_credential();
        dispatch
            .nonce_manager
            .refresh(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, TEST_NEXT_NONCE);

        let cloid = ClientOrderId::from("O-GUARD-ARMED");
        let client_order_index = dispatch.derive_client_order_index(&cloid);
        dispatch.register_cloid(client_order_index, cloid).unwrap();
        let nonce = dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        {
            let _guard = TxDispatchGuard::new(
                dispatch.clone(),
                &credential,
                Some(client_order_index),
                nonce,
            );
        }

        assert_nonce_reusable(&dispatch);
        assert!(dispatch.cloid_map.get(&client_order_index).is_none());
    }

    #[rstest]
    fn tx_dispatch_guard_rolls_back_nonce_without_cloid_when_armed() {
        let dispatch = WsDispatchState::new();
        let credential = test_credential();
        dispatch
            .nonce_manager
            .refresh(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, TEST_NEXT_NONCE);
        let nonce = dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        {
            let _guard = TxDispatchGuard::new(dispatch.clone(), &credential, None, nonce);
        }

        assert_nonce_reusable(&dispatch);
        assert!(dispatch.cloid_map.is_empty());
    }

    #[rstest]
    fn tx_dispatch_guard_preserves_nonce_and_cloid_when_disarmed() {
        let dispatch = WsDispatchState::new();
        let credential = test_credential();
        dispatch
            .nonce_manager
            .refresh(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, TEST_NEXT_NONCE);

        let cloid = ClientOrderId::from("O-GUARD-DISARMED");
        let client_order_index = dispatch.derive_client_order_index(&cloid);
        dispatch.register_cloid(client_order_index, cloid).unwrap();
        let nonce = dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        {
            let mut guard = TxDispatchGuard::new(
                dispatch.clone(),
                &credential,
                Some(client_order_index),
                nonce,
            );
            guard.disarm();
        }

        assert_eq!(
            dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );
        assert_eq!(
            dispatch
                .cloid_map
                .get(&client_order_index)
                .map(|entry| *entry.value()),
            Some(cloid),
        );
    }

    #[tokio::test]
    async fn submit_order_send_failure_emits_submitted_then_rejected_and_rolls_back() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-SUBMIT-FAIL");
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let submitted = recv_order_event(&mut rx).await;
        let rejected = recv_order_event(&mut rx).await;

        match submitted {
            OrderEventAny::Submitted(event) => {
                assert_eq!(event.client_order_id, order.client_order_id());
                assert_eq!(event.instrument_id, instrument_id);
            }
            event => panic!("expected submitted event, was {event:?}"),
        }

        match rejected {
            OrderEventAny::Rejected(event) => {
                assert_eq!(event.client_order_id, order.client_order_id());
                assert_eq!(event.instrument_id, instrument_id);
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
                assert!(event.reason.contains("handler unavailable"));
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
        assert_nonce_reusable(&client.dispatch);
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            0,
            "local-send-failure must remove the pending entry by nonce",
        );
    }

    #[tokio::test]
    async fn submit_order_unknown_send_outcome_retains_pending_state() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-SUBMIT-UNKNOWN");
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());
        client.ws_client.drop_next_send_tx_result_for_test().await;

        client
            .submit_order(SubmitOrder::from_order(
                &order,
                trader_id(),
                Some(client_id()),
                None,
                UUID4::new(),
                UnixNanos::default(),
            ))
            .unwrap();

        assert!(matches!(
            recv_order_event(&mut rx).await,
            OrderEventAny::Submitted(_)
        ));
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "unknown outcome must not emit OrderRejected",
        );
        assert!(client.dispatch.cloid_map.contains_key(&client_order_index));
        assert_eq!(client.dispatch.pending_sendtx_len(), 1);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );

        let stale = client.dispatch.drain_pending_sendtx(0);
        assert_eq!(stale.len(), 1);
        assert!(matches!(stale[0].kind, PendingSendTxKind::Create { .. }));
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(client.dispatch.cloid_map.contains_key(&client_order_index));
        assert!(
            client
                .dispatch
                .order_identity(&order.client_order_id())
                .is_some(),
            "reconnect draining must retain identity for reconciliation",
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );
    }

    #[tokio::test]
    async fn submit_order_cloid_probe_exhaustion_denies_without_overwrite() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-PROBE-EXHAUSTED");
        let cloid = order.client_order_id();
        let mut index = client.dispatch.derive_client_order_index(&cloid);
        let mut existing = Vec::new();

        for attempt in 0..=crate::websocket::dispatch::CLOID_INDEX_PROBE_LIMIT {
            let existing_cloid = ClientOrderId::from(format!("EXISTING-{attempt}"));
            client.dispatch.cloid_map.insert(index, existing_cloid);
            existing.push((index, existing_cloid));
            index = if index == i64::from(i32::MAX) {
                0
            } else {
                index + 1
            };
        }

        cache_order(&cache, order.clone());

        client
            .submit_order(SubmitOrder::from_order(
                &order,
                trader_id(),
                Some(client_id()),
                None,
                UUID4::new(),
                UnixNanos::default(),
            ))
            .unwrap();

        let event = recv_order_event(&mut rx).await;
        assert!(matches!(event, OrderEventAny::Denied(_)));
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(client.dispatch.order_identity(&cloid).is_none());

        for (existing_index, existing_cloid) in existing {
            assert_eq!(
                client
                    .dispatch
                    .cloid_map
                    .get(&existing_index)
                    .map(|entry| *entry.value()),
                Some(existing_cloid),
            );
        }
    }

    #[tokio::test]
    async fn submit_sell_order_send_failure_dispatches_and_rolls_back() {
        // Mirror of the buy-side test for OrderSide::Sell; covers the
        // `is_ask=true` branch of the CreateOrderTxInfo payload.
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SUBMIT-FAIL-SELL",
            OrderSide::Sell,
            TimeInForce::Gtc,
            None,
            false,
        );
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let _submitted = recv_order_event(&mut rx).await;
        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::Rejected(event) => {
                assert_eq!(event.client_order_id, order.client_order_id());
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_gtd_order_with_explicit_expiry_dispatches_and_rolls_back() {
        // Covers the GTD branch in `order_expiry_for`: an explicit
        // expire_time must propagate as venue millis through the dispatch
        // path. Asserts the order reaches the dispatch step (rejected here
        // by handler unavailability, not by the adapter validating GTD).
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let expiry = client.clock.get_time_ns() + DurationNanos::from_mins(10);
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SUBMIT-FAIL-GTD",
            OrderSide::Buy,
            TimeInForce::Gtd,
            Some(expiry),
            false,
        );
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let _submitted = recv_order_event(&mut rx).await;
        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::Rejected(event) => {
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_gtd_order_with_short_expiry_is_denied_before_nonce_allocation() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let expiry = UnixNanos::from(
            client
                .clock
                .get_time_ns()
                .as_u64()
                .saturating_add(60 * 1_000_000_000),
        );
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SHORT-GTD",
            OrderSide::Buy,
            TimeInForce::Gtd,
            Some(expiry),
            false,
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let denied = recv_order_event(&mut rx).await;
        match denied {
            OrderEventAny::Denied(event) => {
                assert!(event.reason.contains("at least 5 minutes"));
            }
            event => panic!("expected denied event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_gtd_order_with_short_expiry_dispatches_when_use_gtd_false() {
        // With use_gtd=false the short strategy expire_time must not hit the venue
        // lifetime check: the order reaches the dispatch step rather than being
        // denied. It is rejected here by handler unavailability, which proves the
        // adapter accepted the short expiry and moved on to signing/dispatch.
        let (client, cache, mut rx) =
            create_execution_client_with_config(test_config_with_use_gtd(false));
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let expiry = UnixNanos::from(
            client
                .clock
                .get_time_ns()
                .as_u64()
                .saturating_add(60 * 1_000_000_000),
        );
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SHORT-GTD-MANAGED",
            OrderSide::Buy,
            TimeInForce::Gtd,
            Some(expiry),
            false,
        );
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let _submitted = recv_order_event(&mut rx).await;
        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::Rejected(event) => {
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    fn prepare_managed_gtd_plan_uses_safe_venue_expiry() {
        let (client, cache, _rx) =
            create_execution_client_with_config(test_config_with_use_gtd(false));
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let expiry = UnixNanos::from(
            client
                .clock
                .get_time_ns()
                .as_u64()
                .saturating_add(60 * 1_000_000_000),
        );
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SHORT-GTD-PLAN",
            OrderSide::Buy,
            TimeInForce::Gtd,
            Some(expiry),
            false,
        );

        let before_ms = (client.clock.get_time_ns().as_u64() / 1_000_000) as i64;
        let plan = client
            .prepare_create_order_plan(&order, 0, None)
            .expect("managed GTD plan must validate");
        let after_ms = (client.clock.get_time_ns().as_u64() / 1_000_000) as i64;

        assert!(
            (before_ms + crate::websocket::dispatch::ORDER_EXPIRY_DEFAULT_GTC_MS
                ..=after_ms + crate::websocket::dispatch::ORDER_EXPIRY_DEFAULT_GTC_MS)
                .contains(&plan.order_expiry)
        );
        assert_eq!(
            plan.time_in_force,
            crate::common::enums::LighterTimeInForce::GoodTillTime as u8,
        );
    }

    #[tokio::test]
    async fn submit_reduce_only_order_dispatches_and_rolls_back() {
        // Reduce-only is a venue constraint; this pins the adapter pass-through
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order_with(
            &mut factory,
            instrument_id,
            "O-SUBMIT-FAIL-REDUCE",
            OrderSide::Sell,
            TimeInForce::Gtc,
            None,
            true,
        );
        assert!(order.is_reduce_only());
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        client.submit_order(command).unwrap();

        let _submitted = recv_order_event(&mut rx).await;
        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::Rejected(event) => {
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case::nonce_refresh(false)]
    #[case::submission_gate(true)]
    #[tokio::test]
    async fn batch_signing_retries_after_nonce_readiness_recovers(#[case] lock_submission: bool) {
        let (client, _cache, _rx) = create_execution_client();
        let credential = test_credential();
        let context = client.fanout_dispatch_context(&credential).unwrap();
        let connection_epoch = context.ws_client.connection_epoch();
        let guard = if lock_submission {
            Some(context.nonce_submission_gate.write().await)
        } else {
            context
                .nonce_ready_connection_epoch
                .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);
            None
        };

        let error = context.build_tx_context().unwrap_err();
        drop(guard);
        context
            .nonce_ready_connection_epoch
            .store(connection_epoch, Ordering::Release);
        let reserved = context.build_tx_context().unwrap();

        assert_eq!(reserved.context.nonce, TEST_NEXT_NONCE);
        assert!(should_retry_batch_signing(&error));
        assert_eq!(
            error.to_string(),
            if lock_submission {
                "Lighter nonce refresh is in progress".to_string()
            } else {
                format!("Lighter nonce refresh is pending for connection epoch {connection_epoch}")
            }
        );
    }

    #[rstest]
    #[case::state_changed(TxPreparationError::StateChanged.into(), true)]
    #[case::skip_window(NonceError::SkipWindowExhausted {
        account_index: TEST_ACCOUNT_INDEX_I64,
        api_key_index: TEST_API_KEY_INDEX,
        outstanding: 17,
        skip_window: 16,
    }.into(), true)]
    #[case::uninitialized(NonceError::NotInitialized {
        account_index: TEST_ACCOUNT_INDEX_I64,
        api_key_index: TEST_API_KEY_INDEX,
    }.into(), false)]
    #[case::signing(anyhow::anyhow!("invalid signing key"), false)]
    fn batch_signing_retry_classifies_preparation_errors(
        #[case] error: anyhow::Error,
        #[case] expected: bool,
    ) {
        assert_eq!(should_retry_batch_signing(&error), expected);
    }

    #[rstest]
    #[case::submit(false)]
    #[case::modify(true)]
    #[tokio::test]
    async fn batch_orders_wait_for_nonce_readiness(#[case] modify: bool) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let orders: Vec<_> = ["O-READY-A", "O-READY-B"]
            .into_iter()
            .map(|id| test_limit_order(&mut factory, instrument_id, id))
            .collect();

        for order in &orders {
            cache_order(&cache, order.clone());
        }

        client.ws_client.drop_next_send_tx_result_for_test().await;
        client
            .nonce_ready_connection_epoch
            .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);

        if modify {
            let modifies = orders
                .iter()
                .enumerate()
                .map(|(i, order)| {
                    ModifyOrder::new(
                        trader_id(),
                        Some(client_id()),
                        strategy_id(),
                        instrument_id,
                        order.client_order_id(),
                        Some(VenueOrderId::from(format!("{}", 123 + i))),
                        Some(Quantity::from("0.2000")),
                        Some(Price::from("2362.00")),
                        None,
                        UUID4::new(),
                        UnixNanos::default(),
                        None,
                        None,
                    )
                })
                .collect();

            client
                .batch_modify_orders(BatchModifyOrders::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument_id,
                    modifies,
                    UUID4::new(),
                    UnixNanos::default(),
                    None,
                    None,
                ))
                .unwrap();
        } else {
            client
                .submit_order_list(submit_order_list_command(&orders, "OL-READY"))
                .unwrap();
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(100), rx.recv())
                .await
                .is_err()
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE - 1)
        );
        client
            .nonce_ready_connection_epoch
            .store(0, Ordering::Release);
        wait_until_async(
            || async { client.dispatch.pending_sendtx_len() == 2 },
            Duration::from_secs(2),
        )
        .await;

        let pending = client.dispatch.pending_sendtx.lock().clone();
        assert_eq!(pending.len(), 2);
        assert_eq!(pending[0].batch_id, pending[1].batch_id);
        assert!(
            pending[0]
                .batch_id
                .as_ref()
                .unwrap()
                .starts_with(TX_BATCH_ID_PREFIX)
        );

        for (i, (pending, order)) in pending.iter().zip(&orders).enumerate() {
            assert_eq!(pending.nonce, TEST_NEXT_NONCE + i as i64);
            assert_eq!(pending.api_key_index, TEST_API_KEY_INDEX);
            assert_eq!(pending.connection_epoch, 0);

            if modify {
                assert!(
                    matches!(&pending.kind, PendingSendTxKind::Modify { client_order_id, .. } if *client_order_id == order.client_order_id())
                );
                assert_eq!(
                    client
                        .dispatch
                        .pending_order_action(&order.client_order_id()),
                    Some(PendingOrderAction::Modify)
                );
            } else {
                assert!(
                    matches!(&pending.kind, PendingSendTxKind::Create { order: pending_order, .. } if pending_order.client_order_id() == order.client_order_id())
                );
                let event = recv_order_event(&mut rx).await;

                let OrderEventAny::Submitted(event) = event else {
                    panic!("expected Submitted after nonce readiness")
                };

                assert_eq!(event.client_order_id, order.client_order_id());
            }
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err()
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE + 1)
        );
    }

    #[tokio::test]
    async fn submit_order_list_send_failure_emits_submitted_then_rejected_and_rolls_back() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order_a = test_limit_order(&mut factory, instrument_id, "O-LIST-FAIL-A");
        let order_b = test_limit_order(&mut factory, instrument_id, "O-LIST-FAIL-B");
        let index_a = client
            .dispatch
            .derive_client_order_index(&order_a.client_order_id());
        let index_b = client
            .dispatch
            .derive_client_order_index(&order_b.client_order_id());
        cache_order(&cache, order_a.clone());
        cache_order(&cache, order_b.clone());

        let command = submit_order_list_command(&[order_a.clone(), order_b.clone()], "OL-FAIL");
        client.submit_order_list(command).unwrap();

        for expected in [order_a.client_order_id(), order_b.client_order_id()] {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Submitted(e) => assert_eq!(e.client_order_id, expected),
                other => panic!("expected Submitted, was {other:?}"),
            }
        }

        for expected in [order_b.client_order_id(), order_a.client_order_id()] {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Rejected(e) => {
                    assert_eq!(e.client_order_id, expected);
                    assert!(e.reason.contains("Lighter submit_order dispatch failed"));
                }
                other => panic!("expected Rejected, was {other:?}"),
            }
        }

        assert!(client.dispatch.cloid_map.get(&index_a).is_none());
        assert!(client.dispatch.cloid_map.get(&index_b).is_none());
        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    #[case::spill(16)]
    #[case::three(31)]
    #[tokio::test]
    async fn submit_order_list_chunks_large_lists_on_send_failure(#[case] count: usize) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let mut orders = Vec::new();

        for i in 0..count {
            let order = test_limit_order(&mut factory, instrument_id, &format!("O-LIST-MAX-{i}"));
            cache_order(&cache, order.clone());
            orders.push(order);
        }

        let command = submit_order_list_command(&orders, "OL-MAX");
        client.submit_order_list(command).unwrap();

        for chunk in orders.chunks(LIGHTER_MAX_BATCH_TX) {
            for order in chunk {
                match recv_order_event(&mut rx).await {
                    OrderEventAny::Submitted(e) => {
                        assert_eq!(e.client_order_id, order.client_order_id());
                    }
                    other => panic!("expected Submitted, was {other:?}"),
                }
            }

            for order in chunk.iter().rev() {
                match recv_order_event(&mut rx).await {
                    OrderEventAny::Rejected(e) => {
                        assert_eq!(e.client_order_id, order.client_order_id());
                        assert!(e.reason.contains("Lighter submit_order dispatch failed"));
                    }
                    other => panic!("expected Rejected, was {other:?}"),
                }
            }
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "chunked send failure must not emit extra events",
        );

        for order in &orders {
            let index = client
                .dispatch
                .derive_client_order_index(&order.client_order_id());
            assert!(client.dispatch.cloid_map.get(&index).is_none());
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[tokio::test]
    async fn submit_order_list_denies_unsupported_order_and_dispatches_supported() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let valid = test_limit_order(&mut factory, instrument_id, "O-LIST-VALID");
        let unsupported = factory.limit(
            instrument_id,
            OrderSide::Buy,
            Quantity::from("0.1000"),
            Price::from("2361.31"),
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            Some(Quantity::from("0.0500")),
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-LIST-ICEBERG")),
        );
        let unsupported_index = client
            .dispatch
            .derive_client_order_index(&unsupported.client_order_id());
        cache_order(&cache, valid.clone());
        cache_order(&cache, unsupported.clone());

        let command =
            submit_order_list_command(&[unsupported.clone(), valid.clone()], "OL-PARTIAL");
        client.submit_order_list(command).unwrap();

        match recv_order_event(&mut rx).await {
            OrderEventAny::Denied(e) => {
                assert_eq!(e.client_order_id, unsupported.client_order_id());
                assert!(e.reason.contains("display_qty"));
            }
            other => panic!("expected Denied, was {other:?}"),
        }

        match recv_order_event(&mut rx).await {
            OrderEventAny::Submitted(e) => assert_eq!(e.client_order_id, valid.client_order_id()),
            other => panic!("expected Submitted, was {other:?}"),
        }

        match recv_order_event(&mut rx).await {
            OrderEventAny::Rejected(e) => {
                assert_eq!(e.client_order_id, valid.client_order_id());
                assert!(e.reason.contains("Lighter submit_order dispatch failed"),);
            }
            other => panic!("expected Rejected, was {other:?}"),
        }

        assert!(client.dispatch.cloid_map.get(&unsupported_index).is_none());
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case(LighterGroupingType::OneTriggersTheOther)]
    #[case(LighterGroupingType::OneCancelsTheOther)]
    #[case(LighterGroupingType::OneTriggersOneCancelsTheOther)]
    fn prepare_native_group_preserves_relationships_and_sizes_children(
        #[case] grouping: LighterGroupingType,
    ) {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut orders = test_native_group(instrument, grouping);
        orders.reverse();
        let plan = client.prepare_create_group_plan(&orders, 50, None).unwrap();
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();
        let signed = context.sign_create_group(&plan).unwrap();
        let json: serde_json::Value = serde_json::from_str(signed.tx_info.get()).unwrap();
        let bodies = json["Orders"].as_array().unwrap();
        let has_parent = grouping != LighterGroupingType::OneCancelsTheOther;
        assert_eq!(plan.grouping_type, grouping);
        assert_eq!(signed.tx_type, LighterTxType::CreateGroupedOrders as u8);
        assert_eq!(bodies.len(), orders.len());
        assert_eq!(bodies[0]["BaseAmount"], 1_000);

        for (index, (body, leg)) in bodies.iter().zip(&plan.orders).enumerate() {
            assert_eq!(body["MarketIndex"], TEST_MARKET_INDEX);
            assert_eq!(
                body["ClientOrderIndex"],
                client
                    .dispatch
                    .client_order_index(&leg.order.client_order_id())
                    .unwrap()
            );
            assert_eq!(body["Price"], leg.price);
            assert_eq!(body["Type"], leg.order_type);
            assert_eq!(body["IsAsk"], u8::from(index > 0 || !has_parent));
            assert_eq!(body["ReduceOnly"], u8::from(index > 0 || !has_parent));
            assert_eq!(body["TimeInForce"], leg.time_in_force);
            assert_eq!(body["TriggerPrice"], leg.trigger_price);
            assert_eq!(body["OrderExpiry"], leg.order_expiry);
            assert_eq!(
                body["BaseAmount"],
                if has_parent && index > 0 { 0 } else { 1_000 }
            );
            assert_eq!(leg.order.quantity(), Quantity::from("0.1000"));
        }

        assert_eq!(signed.pending.kind.creates().count(), orders.len());
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE)
        );
    }

    #[tokio::test]
    async fn submit_native_group_send_failure_rejects_every_leg_and_releases_one_nonce() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );

        for order in &orders {
            cache_order(&cache, order.clone());
        }

        client
            .submit_order_list(submit_order_list_command(&orders, "OL-GROUP"))
            .unwrap();

        for order in &orders {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Submitted(event) => {
                    assert_eq!(event.client_order_id, order.client_order_id());
                }
                event => panic!("expected submitted event, was {event:?}"),
            }
        }

        for order in &orders {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Rejected(event) => {
                    assert_eq!(event.client_order_id, order.client_order_id());
                    assert!(
                        event
                            .reason
                            .contains("Lighter submit_order dispatch failed")
                    );
                }
                event => panic!("expected rejected event, was {event:?}"),
            }

            assert!(
                client
                    .dispatch
                    .order_identity(&order.client_order_id())
                    .is_none()
            );
        }

        assert_eq!(client.dispatch.cloid_map.len(), 0);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn native_group_denies_default_bracket_without_dispatch() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_order_factory()
            .bracket()
            .instrument_id(instrument)
            .order_side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .entry_order_type(OrderType::Limit)
            .entry_price(Price::from("2300.00"))
            .tp_price(Price::from("2400.00"))
            .sl_trigger_price(Price::from("2200.00"))
            .call();

        for order in &orders {
            cache_order(&cache, order.clone());
        }

        client
            .submit_order_list(submit_order_list_command(
                &orders,
                orders[0].order_list_id().unwrap().as_str(),
            ))
            .unwrap();

        for order in &orders {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Denied(event) => {
                    assert_eq!(event.client_order_id, order.client_order_id());
                    assert_eq!(
                        event.reason.as_str(),
                        "UNSUPPORTED_ORDER_LIST: Lighter grouped submit failed: Lighter native groups do not support Nautilus OUO quantity updates"
                    );
                }
                event => panic!("expected denied event, was {event:?}"),
            }
        }

        assert_eq!(client.dispatch.cloid_map.len(), 0);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case(LighterGroupingType::OneTriggersTheOther)]
    #[case(LighterGroupingType::OneCancelsTheOther)]
    #[case(LighterGroupingType::OneTriggersOneCancelsTheOther)]
    #[tokio::test]
    async fn native_group_denies_quote_quantity_without_dispatch(
        #[case] grouping: LighterGroupingType,
        #[values(false, true)] first_leg: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut orders = test_native_group(instrument, grouping);

        let index = if first_leg { 0 } else { orders.len() - 1 };
        let order = &orders[index];
        let mut builder = OrderTestBuilder::new(order.order_type());
        builder
            .trader_id(order.trader_id())
            .strategy_id(order.strategy_id())
            .instrument_id(instrument)
            .client_order_id(order.client_order_id())
            .side(order.order_side())
            .quantity(order.quantity())
            .price(order.price().unwrap())
            .reduce_only(order.is_reduce_only())
            .quote_quantity(true)
            .order_list_id(order.order_list_id().unwrap());

        if let Some(price) = order.trigger_price() {
            builder.trigger_price(price);
        }

        if let Some(parent) = order.parent_order_id() {
            builder.parent_order_id(parent);
        }

        if let Some(contingency) = order.contingency_type() {
            builder.contingency_type(contingency);
        }

        if let Some(linked) = order.linked_order_ids() {
            builder.linked_order_ids(linked.to_vec());
        }

        orders[index] = builder.build();

        for order in &orders {
            cache_order(&cache, order.clone());
        }

        client
            .submit_order_list(submit_order_list_command(&orders, "OL-GROUP"))
            .unwrap();

        for order in &orders {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Denied(event) => {
                    assert_eq!(event.client_order_id, order.client_order_id());
                    assert_eq!(event.reason.as_str(), "UNSUPPORTED_QUOTE_QUANTITY");
                }
                event => panic!("expected denied event, was {event:?}"),
            }
        }

        assert!(matches!(
            rx.try_recv(),
            Err(tokio::sync::mpsc::error::TryRecvError::Empty)
        ));
        assert_eq!(client.dispatch.cloid_map.len(), 0);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case(true)]
    #[case(false)]
    fn native_group_preserves_explicit_gtd_expiries(#[case] matching: bool) {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut orders = test_native_group(instrument, LighterGroupingType::OneCancelsTheOther);
        let expiry = client.clock.get_time_ns() + DurationNanos::from_mins(10);

        for (index, order) in orders.iter_mut().enumerate() {
            *order = OrderTestBuilder::new(order.order_type())
                .trader_id(order.trader_id())
                .strategy_id(order.strategy_id())
                .instrument_id(instrument)
                .client_order_id(order.client_order_id())
                .side(order.order_side())
                .quantity(order.quantity())
                .price(order.price().unwrap())
                .trigger_price(order.trigger_price().unwrap())
                .reduce_only(true)
                .order_list_id(order.order_list_id().unwrap())
                .contingency_type(ContingencyType::Oco)
                .linked_order_ids(order.linked_order_ids().unwrap().to_vec())
                .time_in_force(TimeInForce::Gtd)
                .expire_time(UnixNanos::from(
                    expiry.as_u64() + u64::from(!matching) * index as u64 * 1_000_000_000,
                ))
                .build();
        }

        let result = client.prepare_create_group_plan(&orders, 50, None);
        if matching {
            let plan = result.unwrap();
            assert_eq!(
                plan.orders
                    .iter()
                    .map(|leg| leg.order_expiry)
                    .collect::<Vec<_>>(),
                vec![expiry.as_u64() as i64 / 1_000_000; 2]
            );
        } else {
            assert_eq!(
                result.err().unwrap().to_string(),
                "Lighter group children require matching nonzero expiries"
            );
        }

        assert_eq!(client.dispatch.cloid_map.len(), 0);
    }

    #[rstest]
    fn native_group_denies_quantity_mismatch_without_registering_orders() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        orders[1].set_quantity(Quantity::from("0.2000"));
        let error = client
            .prepare_create_group_plan(&orders, 50, None)
            .err()
            .unwrap();
        assert_eq!(
            error.to_string(),
            "Lighter group quantities must match before parent-fill sizing"
        );
        assert_eq!(client.dispatch.cloid_map.len(), 0);
    }

    #[rstest]
    fn native_group_denies_duplicate_client_ids_without_registering_orders() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        orders[1] = orders[2].clone();
        let error = client
            .prepare_create_group_plan(&orders, 50, None)
            .err()
            .unwrap();
        assert_eq!(
            error.to_string(),
            "Lighter groups require unique client order IDs"
        );
        assert_eq!(client.dispatch.cloid_map.len(), 0);
    }

    #[rstest]
    fn native_group_reports_keep_client_links_and_held_quantities() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        let plan = client.prepare_create_group_plan(&orders, 50, None).unwrap();
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();
        let signed = context.sign_create_group(&plan).unwrap();
        context.enqueue_batch_tx(&signed);
        let venues = [
            VenueOrderId::from("281477001"),
            VenueOrderId::from("281477002"),
            VenueOrderId::from("281477003"),
        ];
        let indices: Vec<_> = signed
            .pending
            .kind
            .creates()
            .map(|(_, index)| index)
            .collect();

        for (index, order) in orders.iter().enumerate() {
            assert!(client.dispatch.observe_create_submission(
                &order.client_order_id(),
                indices[index],
                signed.pending.nonce,
                venues[index]
            ));
        }

        let mut parent = reconciliation_raw_order(indices[0], venues[0], LighterOrderStatus::Open);
        parent.to_trigger_order_id_0 = venues[1].to_string();
        parent.to_trigger_order_id_1 = venues[2].to_string();
        let parent_report = parse_http_order_to_report(
            &parent,
            &client.registry,
            account_id(),
            UnixNanos::from(7),
            &client.dispatch,
        )
        .unwrap();
        let parent_report = client.dispatch.translate_order_cloid(parent_report);
        let mut child =
            reconciliation_raw_order(indices[1], venues[1], LighterOrderStatus::Pending);
        child.order_type = LighterOrderKind::StopLossLimit;
        child.parent_order_id = venues[0].to_string();
        child.to_cancel_order_id_0 = venues[2].to_string();
        child.initial_base_amount = Decimal::ZERO;
        child.filled_base_amount = Decimal::ZERO;
        child.trigger_price = Decimal::from(2200);
        let child_report = parse_http_order_to_report(
            &child,
            &client.registry,
            account_id(),
            UnixNanos::from(8),
            &client.dispatch,
        )
        .unwrap();
        let child_report = client.dispatch.translate_order_cloid(child_report);
        client
            .dispatch
            .retire_order_identity(&orders[0].client_order_id());
        child.parent_order_id = "0".to_string();
        child.to_cancel_order_id_0 = "0".to_string();
        child.status = LighterOrderStatus::Open;
        child.trigger_status = LighterTriggerStatus::Na;
        child.trigger_price = Decimal::ZERO;
        child.initial_base_amount = Decimal::from_str("0.0400").unwrap();
        child.remaining_base_amount = child.initial_base_amount;
        let activated = parse_http_order_to_report(
            &child,
            &client.registry,
            account_id(),
            UnixNanos::from(9),
            &client.dispatch,
        )
        .unwrap();
        let activated = client.dispatch.translate_order_cloid(activated);
        assert_eq!(
            parent_report.client_order_id,
            Some(orders[0].client_order_id())
        );
        assert_eq!(parent_report.contingency_type, Some(ContingencyType::Oto));
        assert_eq!(
            parent_report.linked_order_ids,
            Some(vec![
                orders[1].client_order_id(),
                orders[2].client_order_id()
            ])
        );
        assert_eq!(parent_report.parent_order_id, None);
        assert_eq!(
            child_report.client_order_id,
            Some(orders[1].client_order_id())
        );
        assert_eq!(child_report.contingency_type, Some(ContingencyType::Oco));
        assert_eq!(
            child_report.linked_order_ids,
            Some(vec![orders[2].client_order_id()])
        );
        assert_eq!(
            child_report.parent_order_id,
            Some(orders[0].client_order_id())
        );
        assert_eq!(child_report.quantity, Quantity::from("0.1000"));
        assert_eq!(activated.order_type, OrderType::StopLimit);
        assert_eq!(activated.order_status, OrderStatus::Triggered);
        assert_eq!(activated.trigger_price, Some(Price::from("2200.00")));
        assert_eq!(activated.quantity, Quantity::from("0.0400"));
        assert_eq!(activated.parent_order_id, Some(orders[0].client_order_id()));
        assert_eq!(
            activated.linked_order_ids,
            Some(vec![orders[2].client_order_id()])
        );
    }

    #[rstest]
    fn native_group_restores_held_child_before_first_stream_frame() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        let child = orders[1].clone();
        let venue = VenueOrderId::from("281477004");
        cache_accepted_order(&cache, child.clone(), venue, Some(client_id()));
        let cached = cache
            .borrow()
            .order_owned(&child.client_order_id())
            .unwrap();
        client.dispatch.seed_order_restorations(vec![cached]);
        let (_, index) = forced_probed_index(child.client_order_id());
        let mut raw = reconciliation_raw_order(index, venue, LighterOrderStatus::Pending);
        raw.order_type = LighterOrderKind::StopLossLimit;
        raw.initial_base_amount = Decimal::ZERO;
        raw.filled_base_amount = Decimal::ZERO;
        raw.is_ask = true;
        raw.side = Some(LighterOrderSide::Sell);
        raw.reduce_only = true;
        raw.price = Decimal::from(2190);
        raw.trigger_price = Decimal::from(2200);
        dispatch_lighter_order(
            &raw,
            &client.dispatch,
            &client.emitter,
            &client.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let events = drain_events(&mut rx);
        let report = parse_http_order_to_report(
            &raw,
            &client.registry,
            account_id(),
            UnixNanos::from(2),
            &client.dispatch,
        )
        .unwrap();
        let report = client.dispatch.translate_order_cloid(report);
        assert!(
            events.is_empty(),
            "restored pending frame must be a tracked replay: {events:?}"
        );
        assert_eq!(
            cache
                .borrow()
                .order(&child.client_order_id())
                .unwrap()
                .quantity(),
            Quantity::from("0.1000")
        );
        assert_eq!(
            client.dispatch.client_order_index(&child.client_order_id()),
            Some(index)
        );
        assert_eq!(report.client_order_id, Some(child.client_order_id()));
        assert_eq!(report.quantity, Quantity::from("0.1000"));
        assert_eq!(report.parent_order_id, Some(orders[0].client_order_id()));
        assert_eq!(
            report.linked_order_ids,
            Some(vec![orders[2].client_order_id()])
        );
        assert_eq!(report.contingency_type, Some(ContingencyType::Oco));
        assert_eq!(report.order_type, OrderType::StopLimit);
        assert_eq!(report.trigger_price, Some(Price::from("2200.00")));
        assert_eq!(report.price, Some(Price::from("2190.00")));
        assert_eq!(report.order_side, Some(OrderSide::Sell));
        assert_eq!(report.order_status, OrderStatus::Accepted);
        assert!(report.reduce_only);
    }

    #[rstest]
    #[case(true)]
    #[case(false)]
    fn native_oco_cancel_targets_peer_with_venue_or_shared_submission_index(
        #[case] acknowledged: bool,
    ) {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        let group = client.prepare_create_group_plan(&orders, 50, None).unwrap();
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();
        let signed = context.sign_create_group(&group).unwrap();
        client
            .dispatch
            .enqueue_pending_sendtx(signed.pending.clone());
        let first = VenueOrderId::from("281477101");
        let second = VenueOrderId::from("281477102");
        cache_accepted_order(&cache, orders[1].clone(), first, Some(client_id()));
        let first_index = client
            .dispatch
            .client_order_index(&orders[1].client_order_id())
            .unwrap();
        let second_index = client
            .dispatch
            .client_order_index(&orders[2].client_order_id())
            .unwrap();
        assert!(client.dispatch.observe_create_submission(
            &orders[1].client_order_id(),
            first_index,
            signed.pending.nonce,
            first
        ));

        if acknowledged {
            cache_accepted_order(&cache, orders[2].clone(), second, Some(client_id()));
            assert!(client.dispatch.observe_create_submission(
                &orders[2].client_order_id(),
                second_index,
                signed.pending.nonce,
                second
            ));
        } else {
            cache_order(&cache, orders[2].clone());
            cache
                .borrow_mut()
                .update_order(&TestOrderEventStubs::submitted(&orders[2], account_id()))
                .unwrap();
        }

        let command = CancelOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument,
            orders[1].client_order_id(),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        let plans = client.prepare_oco_cancel_plans(&command).unwrap();
        assert_eq!(plans.len(), 2);

        for (index, plan) in plans.iter().enumerate() {
            assert_eq!(plan.client_order_id, orders[index + 1].client_order_id());
            assert_eq!(plan.strategy_id, strategy_id());
            assert_eq!(plan.instrument_id, instrument);
            assert_eq!(plan.market_index, TEST_MARKET_INDEX);
        }

        assert_eq!(plans[0].venue_order_id, Some(first));
        assert_eq!(plans[0].venue_index, 281_477_101);
        assert_eq!(plans[1].venue_order_id, acknowledged.then_some(second));
        assert_eq!(
            plans[1].venue_index,
            if acknowledged {
                281_477_102
            } else {
                second_index
            }
        );
        let mut override_venue = command.clone();
        override_venue.venue_order_id = Some(VenueOrderId::from("281477103"));
        assert!(client.prepare_oco_cancel_plans(&override_venue).is_none());

        if !acknowledged {
            client
                .dispatch
                .mark_order_submission(&orders[2].client_order_id(), signed.pending.nonce + 1);
            assert!(client.prepare_oco_cancel_plans(&command).is_none());
        }
    }

    #[rstest]
    fn native_group_denies_held_child_modification() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(instrument, LighterGroupingType::OneTriggersTheOther);
        let child = orders[1].clone();
        let venue = VenueOrderId::from("281477004");
        cache_accepted_order(&cache, child.clone(), venue, Some(client_id()));
        client.dispatch.store_snapshot(
            child.client_order_id(),
            OrderShapeSnapshot {
                quantity: Quantity::from("0.0000"),
                price: child.price(),
                trigger_price: child.trigger_price(),
            },
        );

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument,
            child.client_order_id(),
            Some(venue),
            None,
            Some(Price::from("2180.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        let error = client.prepare_modify_order_plan(&command).err().unwrap();
        assert_eq!(
            error.to_string(),
            "Lighter cannot modify an OTO child while it waits for parent execution"
        );
    }

    #[rstest]
    fn native_group_modifies_triggered_child_without_rearming_trigger() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let orders = test_native_group(
            instrument,
            LighterGroupingType::OneTriggersOneCancelsTheOther,
        );
        let child = orders[2].clone();
        let venue = VenueOrderId::from("281477004");
        cache_accepted_order(&cache, child.clone(), venue, Some(client_id()));
        client
            .dispatch
            .mark_triggered_emitted(child.client_order_id());

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument,
            child.client_order_id(),
            Some(venue),
            None,
            Some(Price::from("2380.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        let plan = client.prepare_modify_order_plan(&command).unwrap();
        let mut rearm = command;
        rearm.trigger_price = Some(Price::from("2450.00"));
        let error = client.prepare_modify_order_plan(&rearm).err().unwrap();
        assert_eq!(plan.trigger_price, 0);
        assert_eq!(plan.price, 238_000);
        assert_eq!(plan.base_amount, 1_000);
        assert_eq!(
            error.to_string(),
            "Lighter cannot modify a trigger price after the order has triggered"
        );
    }

    fn test_native_group(
        instrument_id: InstrumentId,
        grouping: LighterGroupingType,
    ) -> Vec<OrderAny> {
        let has_parent = grouping != LighterGroupingType::OneCancelsTheOther;
        let ids = [
            ClientOrderId::from("O-GROUP-ENTRY"),
            ClientOrderId::from("O-GROUP-SL"),
            ClientOrderId::from("O-GROUP-TP"),
        ];
        let mut orders = Vec::new();
        if has_parent {
            orders.push(
                OrderTestBuilder::new(OrderType::Limit)
                    .trader_id(trader_id())
                    .strategy_id(strategy_id())
                    .instrument_id(instrument_id)
                    .client_order_id(ids[0])
                    .side(OrderSide::Buy)
                    .quantity(Quantity::from("0.1000"))
                    .price(Price::from("2300.00"))
                    .order_list_id(OrderListId::from("OL-GROUP"))
                    .contingency_type(ContingencyType::Oto)
                    .linked_order_ids(if grouping == LighterGroupingType::OneTriggersTheOther {
                        vec![ids[1]]
                    } else {
                        vec![ids[1], ids[2]]
                    })
                    .build(),
            );
        }

        let count = if grouping == LighterGroupingType::OneTriggersTheOther {
            1
        } else {
            2
        };

        let children = [
            (
                OrderType::StopLimit,
                Price::from("2190.00"),
                Price::from("2200.00"),
            ),
            (
                OrderType::LimitIfTouched,
                Price::from("2390.00"),
                Price::from("2400.00"),
            ),
        ];

        for (index, (kind, price, trigger)) in children.into_iter().take(count).enumerate() {
            let mut builder = OrderTestBuilder::new(kind);
            builder
                .trader_id(trader_id())
                .strategy_id(strategy_id())
                .instrument_id(instrument_id)
                .client_order_id(ids[index + 1])
                .side(OrderSide::Sell)
                .quantity(Quantity::from("0.1000"))
                .price(price)
                .trigger_price(trigger)
                .reduce_only(true)
                .order_list_id(OrderListId::from("OL-GROUP"));

            if has_parent {
                builder.parent_order_id(ids[0]);
            }

            if count == 2 {
                builder
                    .contingency_type(ContingencyType::Oco)
                    .linked_order_ids(vec![ids[2 - index]]);
            }

            orders.push(builder.build());
        }

        orders
    }

    #[tokio::test]
    async fn submit_order_list_plain_limit_oco_denies_all_without_dispatch() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let order_a_id = "O-LIST-OCO-A";
        let order_b_id = "O-LIST-OCO-B";
        let order_a = test_contingent_limit_order(instrument_id, order_a_id, "OL-OCO", order_b_id);
        let order_b = test_contingent_limit_order(instrument_id, order_b_id, "OL-OCO", order_a_id);
        cache_order(&cache, order_a.clone());
        cache_order(&cache, order_b.clone());

        let command = submit_order_list_command(&[order_a.clone(), order_b.clone()], "OL-OCO");
        client.submit_order_list(command).unwrap();

        for order in [&order_a, &order_b] {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Denied(e) => {
                    assert_eq!(e.client_order_id, order.client_order_id());
                    assert!(e.reason.contains("reduce-only SL/TP orders"));
                }
                other => panic!("expected Denied, was {other:?}"),
            }
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "grouped list denial must not emit extra events",
        );
        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[tokio::test]
    async fn cancel_order_send_failure_emits_cancel_rejected_and_rolls_back() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-CANCEL-FAIL");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_pending_cancel_order(&cache, order, venue_order_id);

        let command = CancelOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.cancel_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::CancelRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(
                    event
                        .reason
                        .contains("Lighter cancel_order dispatch failed"),
                );
                assert!(event.reason.contains("handler unavailable"));
            }
            event => panic!("expected cancel rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            0,
            "local-send-failure must remove the pending cancel entry",
        );
        assert_eq!(client.dispatch.pending_order_action(&client_order_id), None);
    }

    #[tokio::test]
    async fn cancel_order_unknown_send_outcome_retains_pending_state() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-CANCEL-UNKNOWN");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_pending_cancel_order(&cache, order, venue_order_id);
        client.ws_client.drop_next_send_tx_result_for_test().await;

        client
            .cancel_order(CancelOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(venue_order_id),
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "unknown outcome must not emit OrderCancelRejected",
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 1);
        assert_eq!(
            client.dispatch.pending_order_action(&client_order_id),
            Some(PendingOrderAction::Cancel),
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );
    }

    #[tokio::test]
    async fn cancel_order_prepare_failure_emits_cancel_rejected_without_dispatch() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-CANCEL-NO-VOI");
        let client_order_id = order.client_order_id();
        cache_pending_cancel_order(&cache, order, VenueOrderId::from("123"));

        let command = CancelOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.cancel_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::CancelRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, None);
                assert!(event.reason.contains("Lighter cancel_order failed"));
                assert!(event.reason.contains("venue order_id not yet known"));
            }
            event => panic!("expected cancel rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(client.dispatch.pending_order_action(&client_order_id), None);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "prepare failure must emit exactly one cancel rejection",
        );
    }

    #[tokio::test]
    async fn cancel_order_prepare_failure_emits_cancel_rejected_when_order_uncached() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("O-CANCEL-NO-CACHE");
        let venue_order_id = VenueOrderId::from("123");

        let command = CancelOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.cancel_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::CancelRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(event.reason.contains("Lighter cancel_order failed"));
                assert!(event.reason.contains("order not found in cache"));
            }
            event => panic!("expected cancel rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "prepare failure must emit exactly one cancel rejection",
        );
    }

    #[rstest]
    #[case::buy(Some(OrderSide::Buy), false, vec![0, 2])]
    #[case::sell(Some(OrderSide::Sell), false, vec![1, 3])]
    #[case::unsided(None, false, vec![0, 1, 2, 3])]
    #[case::empty_buy(Some(OrderSide::Buy), true, vec![])]
    #[case::empty_sell(Some(OrderSide::Sell), true, vec![])]
    #[case::empty_unsided(None, true, vec![])]
    #[tokio::test]
    async fn cancel_all_orders_filters_orders_and_preserves_owners(
        #[case] order_side: Option<OrderSide>,
        #[case] empty: bool,
        #[case] expected_indices: Vec<usize>,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let other_instrument_id = InstrumentId::from("BTC-PERP.LIGHTER");
        let selected_account = account_id();
        let other_account = AccountId::from("LIGHTER-002");
        let mut orders = Vec::new();

        for (index, (instrument, owner, side, open, account)) in [
            (
                instrument_id,
                "S-001",
                OrderSide::Buy,
                true,
                selected_account,
            ),
            (
                instrument_id,
                "S-001",
                OrderSide::Sell,
                true,
                selected_account,
            ),
            (
                instrument_id,
                "S-002",
                OrderSide::Buy,
                true,
                selected_account,
            ),
            (
                instrument_id,
                "S-002",
                OrderSide::Sell,
                true,
                selected_account,
            ),
            (
                other_instrument_id,
                "S-001",
                OrderSide::Buy,
                true,
                selected_account,
            ),
            (
                other_instrument_id,
                "S-002",
                OrderSide::Sell,
                true,
                selected_account,
            ),
            (
                instrument_id,
                "S-001",
                OrderSide::Buy,
                false,
                selected_account,
            ),
            (
                instrument_id,
                "S-002",
                OrderSide::Sell,
                false,
                selected_account,
            ),
            (instrument_id, "S-001", OrderSide::Buy, true, other_account),
            (instrument_id, "S-002", OrderSide::Sell, true, other_account),
        ]
        .into_iter()
        .enumerate()
        {
            if empty
                && account == selected_account
                && instrument == instrument_id
                && open
                && order_side.is_none_or(|filter| filter == side)
            {
                continue;
            }

            let order = OrderTestBuilder::new(OrderType::Limit)
                .trader_id(trader_id())
                .strategy_id(StrategyId::from(owner))
                .instrument_id(instrument)
                .client_order_id(ClientOrderId::from(format!("O-CANCEL-ALL-{index}")))
                .side(side)
                .quantity(Quantity::from("0.1000"))
                .price(Price::from("2361.31"))
                .build();
            let venue_order_id = VenueOrderId::from(format!("{}", 123 + index));
            let accepted = TestOrderEventStubs::accepted(&order, account, venue_order_id);
            cache_order(&cache, order.clone());
            cache.borrow_mut().update_order(&accepted).unwrap();
            client
                .dispatch
                .venue_id_map
                .insert(order.client_order_id(), venue_order_id);

            let event = if open {
                OrderEventAny::PendingCancel(OrderPendingCancel::new(
                    order.trader_id(),
                    order.strategy_id(),
                    instrument,
                    order.client_order_id(),
                    Some(account),
                    UUID4::new(),
                    UnixNanos::default(),
                    UnixNanos::default(),
                    false,
                    Some(venue_order_id),
                ))
            } else {
                TestOrderEventStubs::canceled(&order, account, Some(venue_order_id))
            };

            cache.borrow_mut().update_order(&event).unwrap();
            orders.push((order, venue_order_id));
        }

        client
            .cancel_all_orders(CancelAllOrders::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                order_side,
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        // The disconnected transport rejects signed cancels, exposing selection
        // and event ownership through the existing dispatch failure path.
        let mut actual = Vec::new();

        for _ in &expected_indices {
            match recv_order_event(&mut rx).await {
                OrderEventAny::CancelRejected(event) => {
                    assert!(
                        event
                            .reason
                            .contains("Lighter cancel_order dispatch failed")
                    );
                    assert!(event.reason.contains("handler unavailable"));
                    assert_eq!(event.trader_id, trader_id());
                    assert_eq!(event.account_id, Some(account_id()));
                    actual.push((
                        event.client_order_id,
                        event.strategy_id,
                        event.instrument_id,
                        event.venue_order_id,
                    ));
                }
                event => panic!("expected cancel rejected event, was {event:?}"),
            }
        }

        let mut expected: Vec<_> = expected_indices
            .iter()
            .map(|&index| {
                let (order, venue_order_id) = &orders[index];
                (
                    order.client_order_id(),
                    order.strategy_id(),
                    order.instrument_id(),
                    Some(*venue_order_id),
                )
            })
            .collect();

        actual.sort();
        expected.sort();

        assert_eq!(actual, expected);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err()
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);

        for (order, _) in orders {
            assert_eq!(
                client
                    .dispatch
                    .pending_order_action(&order.client_order_id()),
                None
            );
        }

        if empty {
            assert_nonce_reusable(&client.dispatch);
        }
    }

    #[tokio::test]
    async fn cancel_all_orders_prepare_failure_suppresses_cancel_rejected_for_open_order() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-CANCEL-ALL-NO-VOI");
        cache_accepted_order(&cache, order, VenueOrderId::from("123"), Some(client_id()));

        let command = CancelAllOrders::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            Some(OrderSide::Buy),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.cancel_all_orders(command).unwrap();

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "cancel-all prepare failure must not emit an invalid cancel rejection",
        );
    }

    #[tokio::test]
    async fn cancel_order_nonce_prepare_failure_emits_cancel_rejected() {
        let mut config = test_config();
        config.base_url_http = Some(spawn_next_nonce_server(100).await);
        let (client, cache, mut rx) = create_execution_client_with_config(config);
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-CANCEL-NONCE-FAIL");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_pending_cancel_order(&cache, order, venue_order_id);

        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
        }

        let command = CancelOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.cancel_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::CancelRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(event.reason.contains("failed to allocate Lighter nonce"),);
                assert!(event.reason.contains("skip-window exhausted"));
            }
            event => panic!("expected cancel rejected event, was {event:?}"),
        }

        wait_for_spawned_tasks(&client).await;
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            100,
        );
    }

    #[tokio::test]
    async fn batch_cancel_releases_split_reservations_before_waiting_for_ack() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        client.ws_client.drop_next_send_tx_result_for_test().await;
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();

        let plan = CancelOrderPlan {
            client_order_id: ClientOrderId::from("O-SPLIT-CANCEL"),
            strategy_id: strategy_id(),
            instrument_id,
            venue_order_id: Some(VenueOrderId::from("123")),
            market_index: TEST_MARKET_INDEX,
            venue_index: 123,
        };

        let first = context.sign_cancel_order(&plan).unwrap();
        let interleaved = context.build_tx_context().unwrap();
        let second = context.sign_cancel_order(&plan).unwrap();
        let first_nonce = first.nonce;
        let second_nonce = second.nonce;
        drop(interleaved);

        let task = tokio::spawn(async move {
            context
                .send_batch(vec![
                    PreparedBatchTx::from((first, false)),
                    PreparedBatchTx::from((second, false)),
                ])
                .await;
        });

        wait_until_async(
            || async { client.dispatch.pending_sendtx_len() != 0 },
            Duration::from_secs(2),
        )
        .await;

        let released = tokio::time::timeout(
            Duration::from_millis(250),
            client.nonce_submission_gate.write(),
        )
        .await
        .is_ok();
        let pending = client.dispatch.pending_sendtx.lock().clone();
        task.abort();
        let _ = task.await;

        assert!(
            released,
            "unacknowledged group must not hold later nonce reservations"
        );
        assert_eq!(second_nonce, first_nonce + 2);
        assert_eq!(pending.len(), 1);
        assert_eq!(pending[0].nonce, first_nonce);
    }

    #[rstest]
    #[case::not_sent(false)]
    #[case::ambiguous(true)]
    #[tokio::test]
    async fn batch_cancel_orders_send_failure_preserves_delivery_semantics(
        #[case] ambiguous: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let cancels = ["O-BATCH-CANCEL-A", "O-BATCH-CANCEL-B"]
            .iter()
            .enumerate()
            .map(|(i, id)| {
                let order = test_limit_order(&mut factory, instrument_id, id);
                let client_order_id = order.client_order_id();
                let venue_order_id = VenueOrderId::from(format!("{}", 123 + i).as_str());
                cache_pending_cancel_order(&cache, order, venue_order_id);

                CancelOrder::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument_id,
                    client_order_id,
                    Some(venue_order_id),
                    UUID4::new(),
                    UnixNanos::default(),
                    None,
                    None,
                )
            })
            .collect::<Vec<_>>();

        let command = BatchCancelOrders::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            cancels.clone(),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );

        if ambiguous {
            client.ws_client.drop_next_send_tx_result_for_test().await;
        }

        client.batch_cancel_orders(command).unwrap();

        if ambiguous {
            assert!(
                tokio::time::timeout(Duration::from_millis(100), rx.recv())
                    .await
                    .is_err()
            );
            let pending = client.dispatch.pending_sendtx.lock().clone();
            assert_eq!(pending.len(), 2);
            assert_eq!(pending[0].batch_id, pending[1].batch_id);
            assert!(
                pending[0]
                    .batch_id
                    .as_ref()
                    .unwrap()
                    .starts_with("tx-batch:")
            );
            assert_eq!(pending[0].nonce, TEST_NEXT_NONCE);
            assert_eq!(pending[1].nonce, TEST_NEXT_NONCE + 1);

            for cancel in cancels {
                assert_eq!(
                    client
                        .dispatch
                        .pending_order_action(&cancel.client_order_id),
                    Some(PendingOrderAction::Cancel)
                );
            }

            assert_eq!(
                client
                    .dispatch
                    .nonce_manager
                    .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
                Some(TEST_NEXT_NONCE + 1)
            );
            return;
        }

        let first = recv_order_event(&mut rx).await;
        let second = recv_order_event(&mut rx).await;
        let rejected_ids = [first, second].map(|event| match event {
            OrderEventAny::CancelRejected(e) => {
                assert!(e.reason.contains("Lighter cancel_order dispatch failed"),);
                e.client_order_id
            }
            other => panic!("expected CancelRejected, was {other:?}"),
        });

        for cancel in cancels {
            assert!(rejected_ids.contains(&cancel.client_order_id));
            assert_eq!(
                client
                    .dispatch
                    .pending_order_action(&cancel.client_order_id),
                None,
            );
        }
        assert_nonce_reusable(&client.dispatch);
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            0,
            "local-send-failure must remove batch cancel pending entries",
        );
    }

    #[rstest]
    #[case::spill(16)]
    #[case::three(31)]
    #[tokio::test]
    async fn batch_cancel_orders_chunks_large_commands_on_send_failure(#[case] count: usize) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();

        let cancels = (0..count)
            .map(|i| {
                let order = test_limit_order(
                    &mut factory,
                    instrument_id,
                    &format!("O-BATCH-CANCEL-MAX-{i}"),
                );
                let id = order.client_order_id();
                let venue = VenueOrderId::from(format!("{}", 1_000 + i));
                cache_pending_cancel_order(&cache, order, venue);

                CancelOrder::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument_id,
                    id,
                    Some(venue),
                    UUID4::new(),
                    UnixNanos::default(),
                    None,
                    None,
                )
            })
            .collect::<Vec<_>>();

        let command = BatchCancelOrders::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            cancels.clone(),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.batch_cancel_orders(command).unwrap();

        let mut rejected = Vec::new();

        for _ in &cancels {
            match recv_order_event(&mut rx).await {
                OrderEventAny::CancelRejected(e) => {
                    assert!(e.reason.contains("Lighter cancel_order dispatch failed"));
                    rejected.push((e.client_order_id, e.venue_order_id));
                }
                other => panic!("expected CancelRejected, was {other:?}"),
            }
        }

        let mut expected: Vec<_> = cancels
            .iter()
            .map(|cancel| (cancel.client_order_id, cancel.venue_order_id))
            .collect();
        expected.sort();
        rejected.sort();
        assert_eq!(rejected, expected);

        for cancel in &cancels {
            assert_eq!(
                client
                    .dispatch
                    .pending_order_action(&cancel.client_order_id),
                None
            );
            assert_eq!(
                client
                    .dispatch
                    .pending_cancel_nonce(&cancel.client_order_id),
                None
            );
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
        );
        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    #[case::success(200, "batch-a", 0, vec!["hash-1", "hash-2"], 2, false)]
    #[case::partial_ack(200, "batch-a", 0, vec!["hash-2"], 1, false)]
    #[case::missing_hashes(200, "batch-a", 0, vec![], 0, false)]
    #[case::wrong_hashes(200, "batch-a", 0, vec!["unknown"], 0, false)]
    #[case::wrong_id(200, "unknown", 0, vec!["hash-1", "hash-2"], 0, false)]
    #[case::stale(200, "batch-a", 1, vec!["hash-1", "hash-2"], 0, false)]
    #[case::invalid_nonce(21104, "batch-a", 0, vec![], 0, true)]
    #[case::rejected(21727, "batch-a", 0, vec![], 0, false)]
    #[tokio::test]
    async fn batch_cancel_response_correlates_members_and_preserves_nonces(
        #[case] code: i64,
        #[case] id: &str,
        #[case] epoch: u64,
        #[case] hashes: Vec<&str>,
        #[case] acked_count: usize,
        #[case] resync_expected: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        for i in 0..3 {
            let nonce = client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
            let client_order_id = ClientOrderId::from(format!("O-BATCH-{i}"));
            client
                .dispatch
                .set_pending_order_action(client_order_id, PendingOrderAction::Cancel);
            client
                .dispatch
                .set_pending_cancel_nonce(&client_order_id, 0, nonce, true);
            client.dispatch.enqueue_pending_sendtx(PendingSendTx {
                batch_id: Some(if i == 0 { "batch-b" } else { "batch-a" }.to_string()),
                connection_epoch: 0,
                kind: PendingSendTxKind::Cancel {
                    emit_cancel_rejected: true,
                    strategy_id: strategy_id(),
                    instrument_id,
                    client_order_id,
                    venue_order_id: Some(VenueOrderId::from(format!("{}", 100 + i))),
                },
                submitted_at: UnixNanos::default(),
                nonce,
                api_key_index: TEST_API_KEY_INDEX,
                tx_hash: format!("hash-{i}"),
            });
        }

        assert!(client.dispatch.pop_pending_sendtx_if_only(0).is_none());
        let hashes: Vec<_> = hashes.into_iter().map(str::to_string).collect();
        let (acked, resync) = handle_send_tx_batch_result(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            epoch,
            UnixNanos::default(),
            id,
            code,
            "batch failure",
            &hashes,
        );
        assert_eq!(resync, resync_expected);
        assert_eq!(acked.len(), acked_count);
        let rejected = code != 200;
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            if rejected { 1 } else { 3 - acked_count }
        );

        if rejected {
            for i in [2, 1] {
                match recv_order_event(&mut rx).await {
                    OrderEventAny::CancelRejected(event) => {
                        assert_eq!(
                            event.client_order_id,
                            ClientOrderId::from(format!("O-BATCH-{i}"))
                        );
                        assert_eq!(event.strategy_id, strategy_id());
                        assert_eq!(event.instrument_id, instrument_id);
                        assert_eq!(
                            event.venue_order_id,
                            Some(VenueOrderId::from(format!("{}", 100 + i)))
                        );
                    }
                    event => panic!("expected rejection, was {event:?}"),
                }

                assert_eq!(
                    client
                        .dispatch
                        .pending_order_action(&ClientOrderId::from(format!("O-BATCH-{i}"))),
                    None
                );
            }

            assert_eq!(
                client
                    .dispatch
                    .nonce_manager
                    .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
                Some(TEST_NEXT_NONCE)
            );
        } else {
            for pending in &acked {
                assert!(hashes.contains(&pending.tx_hash));
            }

            assert_eq!(
                client
                    .dispatch
                    .nonce_manager
                    .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
                Some(TEST_NEXT_NONCE + 2)
            );
        }

        assert_eq!(
            client
                .dispatch
                .pending_order_action(&ClientOrderId::from("O-BATCH-0")),
            Some(PendingOrderAction::Cancel)
        );
        assert!(
            tokio::time::timeout(Duration::from_millis(20), rx.recv())
                .await
                .is_err()
        );
        let remaining = client.dispatch.drain_pending_sendtx(0);
        assert_eq!(remaining.len(), if rejected { 1 } else { 3 - acked_count });
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    fn cancel_order_from_cancel_all_preserves_tracing_ids() {
        let instrument_id = InstrumentId::from("ETH-PERP.LIGHTER");
        let client_order_id = ClientOrderId::from("O-CANCEL-ALL-CHILD");
        let command_id = UUID4::new();
        let correlation_id = UUID4::new();
        let causation_id = UUID4::new();
        let ts_init = UnixNanos::default();
        let mut cmd = CancelAllOrders::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            Some(OrderSide::Buy),
            command_id,
            ts_init,
            None,
            Some(correlation_id),
        );
        cmd.causation_id = Some(causation_id);

        let owner = StrategyId::from("S-002");
        let order_cmd = cancel_order_from_cancel_all(&cmd, client_order_id, owner);

        assert_eq!(order_cmd.trader_id, trader_id());
        assert_eq!(order_cmd.client_id, Some(client_id()));
        assert_eq!(order_cmd.strategy_id, owner);
        assert_eq!(order_cmd.instrument_id, instrument_id);
        assert_eq!(order_cmd.client_order_id, client_order_id);
        assert_eq!(order_cmd.venue_order_id, None);
        assert_eq!(order_cmd.command_id, command_id);
        assert_eq!(order_cmd.ts_init, ts_init);
        assert_eq!(order_cmd.params, None);
        assert_eq!(order_cmd.correlation_id, Some(correlation_id));
        assert_eq!(order_cmd.causation_id, Some(causation_id));
    }

    #[rstest]
    #[case::not_sent(false)]
    #[case::ambiguous(true)]
    #[tokio::test]
    async fn batch_modify_orders_send_failure_preserves_delivery_semantics(
        #[case] ambiguous: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();

        let modifies: Vec<_> = (0..2)
            .map(|i| {
                let order =
                    test_limit_order(&mut factory, instrument_id, &format!("O-BATCH-MODIFY-{i}"));
                let id = order.client_order_id();
                cache_order(&cache, order);

                ModifyOrder::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument_id,
                    id,
                    Some(VenueOrderId::from(format!("{}", 123 + i))),
                    Some(Quantity::from("0.2000")),
                    Some(Price::from("2362.00")),
                    None,
                    UUID4::new(),
                    UnixNanos::default(),
                    None,
                    None,
                )
            })
            .collect();

        if ambiguous {
            client.ws_client.drop_next_send_tx_result_for_test().await;
        }

        client
            .batch_modify_orders(BatchModifyOrders::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                modifies.clone(),
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        if ambiguous {
            wait_until_async(
                || async { client.dispatch.pending_sendtx_len() == 2 },
                Duration::from_secs(2),
            )
            .await;
            assert!(
                tokio::time::timeout(Duration::from_millis(100), rx.recv())
                    .await
                    .is_err()
            );
            let pending = client.dispatch.pending_sendtx.lock().clone();
            assert_eq!(pending.len(), 2);
            assert_eq!(pending[0].batch_id, pending[1].batch_id);
            assert!(
                pending[0]
                    .batch_id
                    .as_ref()
                    .unwrap()
                    .starts_with(TX_BATCH_ID_PREFIX)
            );
            assert_eq!(pending[0].nonce, TEST_NEXT_NONCE);
            assert_eq!(pending[1].nonce, TEST_NEXT_NONCE + 1);

            for modify in &modifies {
                assert_eq!(
                    client
                        .dispatch
                        .pending_order_action(&modify.client_order_id),
                    Some(PendingOrderAction::Modify)
                );
            }
        } else {
            let mut ids = Vec::new();

            for _ in 0..2 {
                match recv_order_event(&mut rx).await {
                    OrderEventAny::ModifyRejected(e) => {
                        assert!(e.reason.contains("Lighter modify_order dispatch failed"));
                        assert_eq!(e.instrument_id, instrument_id);
                        assert_eq!(e.strategy_id, strategy_id());
                        ids.push((e.client_order_id, e.venue_order_id));
                    }
                    other => panic!("expected ModifyRejected, was {other:?}"),
                }
            }

            ids.sort();
            let mut expected: Vec<_> = modifies
                .iter()
                .map(|modify| (modify.client_order_id, modify.venue_order_id))
                .collect();
            expected.sort();
            assert_eq!(ids, expected);
            assert_eq!(client.dispatch.pending_sendtx_len(), 0);

            for modify in &modifies {
                assert_eq!(
                    client
                        .dispatch
                        .pending_order_action(&modify.client_order_id),
                    None
                );
            }

            assert_nonce_reusable(&client.dispatch);
        }
    }

    #[tokio::test]
    async fn batch_modify_orders_rejects_invalid_child_and_dispatches_supported() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let mut modifies = Vec::new();

        for (id, venue_id) in [("O-MODIFY-INVALID", "invalid"), ("O-MODIFY-VALID", "456")] {
            let order = test_limit_order(&mut factory, instrument_id, id);
            let client_order_id = order.client_order_id();
            cache_order(&cache, order);
            modifies.push(ModifyOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(VenueOrderId::from(venue_id)),
                Some(Quantity::from("0.2000")),
                Some(Price::from("2362.00")),
                None,
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ));
        }

        client.ws_client.drop_next_send_tx_result_for_test().await;
        client
            .batch_modify_orders(BatchModifyOrders::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                modifies.clone(),
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();
        let event = recv_order_event(&mut rx).await;

        let OrderEventAny::ModifyRejected(event) = event else {
            panic!("expected invalid-child rejection")
        };

        assert_eq!(event.client_order_id, modifies[0].client_order_id);
        assert_eq!(event.venue_order_id, modifies[0].venue_order_id);
        assert!(event.reason.contains("invalid"));
        wait_until_async(
            || async { client.dispatch.pending_sendtx_len() == 1 },
            Duration::from_secs(2),
        )
        .await;
        let pending = client.dispatch.pending_sendtx.lock().clone();
        assert_eq!(pending.len(), 1);
        assert_eq!(pending[0].nonce, TEST_NEXT_NONCE);
        assert!(
            matches!(&pending[0].kind, PendingSendTxKind::Modify { client_order_id, .. } if *client_order_id == modifies[1].client_order_id)
        );
        assert_eq!(
            client
                .dispatch
                .pending_order_action(&modifies[0].client_order_id),
            None
        );
        assert_eq!(
            client
                .dispatch
                .pending_order_action(&modifies[1].client_order_id),
            Some(PendingOrderAction::Modify)
        );
        assert!(rx.try_recv().is_err());
    }

    #[rstest]
    #[case::empty(0)]
    #[case::full(15)]
    #[case::spill(16)]
    #[case::three(31)]
    #[tokio::test]
    async fn batch_modify_orders_chunks_large_commands_on_send_failure(#[case] count: usize) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();

        let modifies: Vec<_> = (0..count)
            .map(|i| {
                let order =
                    test_limit_order(&mut factory, instrument_id, &format!("O-BATCH-SIZE-{i}"));
                let id = order.client_order_id();
                cache_order(&cache, order);

                ModifyOrder::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument_id,
                    id,
                    Some(VenueOrderId::from(format!("{}", 123 + i))),
                    Some(Quantity::from("0.2000")),
                    Some(Price::from("2362.00")),
                    None,
                    UUID4::new(),
                    UnixNanos::default(),
                    None,
                    None,
                )
            })
            .collect();

        client
            .batch_modify_orders(BatchModifyOrders::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                modifies.clone(),
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        let mut rejected = Vec::new();

        for _ in &modifies {
            match recv_order_event(&mut rx).await {
                OrderEventAny::ModifyRejected(e) => {
                    assert!(e.reason.contains("Lighter modify_order dispatch failed"));
                    rejected.push((e.client_order_id, e.venue_order_id));
                }
                other => panic!("expected ModifyRejected, was {other:?}"),
            }
        }

        let mut expected: Vec<_> = modifies
            .iter()
            .map(|modify| (modify.client_order_id, modify.venue_order_id))
            .collect();
        expected.sort();
        rejected.sort();
        assert_eq!(rejected, expected);

        for modify in &modifies {
            assert_eq!(
                client
                    .dispatch
                    .pending_order_action(&modify.client_order_id),
                None
            );
            assert_eq!(
                client
                    .dispatch
                    .pending_cancel_nonce(&modify.client_order_id),
                None
            );
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn modify_order_send_failure_emits_modify_rejected_and_rolls_back() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-FAIL");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_order(&cache, order);

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.modify_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;

        match rejected {
            OrderEventAny::ModifyRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(
                    event
                        .reason
                        .contains("Lighter modify_order dispatch failed"),
                );
                assert!(event.reason.contains("handler unavailable"));
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            0,
            "local-send-failure must remove the pending modify entry",
        );
        assert_eq!(client.dispatch.pending_order_action(&client_order_id), None);
    }

    #[tokio::test]
    async fn modify_order_unknown_send_outcome_retains_pending_state() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-UNKNOWN");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_order(&cache, order);
        client.ws_client.drop_next_send_tx_result_for_test().await;

        client
            .modify_order(ModifyOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(venue_order_id),
                Some(Quantity::from("0.2000")),
                Some(Price::from("2362.00")),
                None,
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "unknown outcome must not emit OrderModifyRejected",
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 1);
        assert_eq!(
            client.dispatch.pending_order_action(&client_order_id),
            Some(PendingOrderAction::Modify),
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );
    }

    #[tokio::test]
    async fn modify_order_prepare_failure_emits_modify_rejected_without_dispatch() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("O-MODIFY-NO-CACHE");
        let venue_order_id = VenueOrderId::from("123");

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.modify_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::ModifyRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(event.reason.contains("Lighter modify_order failed"));
                assert!(event.reason.contains("order not found in cache"));
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(client.dispatch.pending_order_action(&client_order_id), None);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "prepare failure must emit exactly one modify rejection",
        );
    }

    #[tokio::test]
    async fn modify_order_prepare_failure_emits_modify_rejected_when_instrument_uncached() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id =
            client
                .registry
                .insert(TEST_MARKET_INDEX, "ETH", LighterProductType::Perp);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-NO-INSTRUMENT");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_order(&cache, order);

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.modify_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::ModifyRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(event.reason.contains("Lighter modify_order failed"));
                assert!(event.reason.contains("instrument not found in cache"));
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "prepare failure must emit exactly one modify rejection",
        );
    }

    #[tokio::test]
    async fn modify_stop_market_derives_price_from_trigger_without_explicit_price() {
        // A trigger-only STOP_MARKET carries no limit price; modifying its trigger
        // must derive the wire cap from the trigger rather than trip the price
        // guard. Prepare succeeds, so the only failure here is the test harness's
        // missing WS send handler.
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = factory.stop_market(
            instrument_id,
            OrderSide::Sell,
            Quantity::from("0.1000"),
            Price::from("2300.00"), // trigger
            None,
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-MODIFY-STOP-MARKET")),
        );
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_order(&cache, order);

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            None,
            None,
            Some(Price::from("2310.00")),
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.modify_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::ModifyRejected(event) => {
                assert!(
                    !event.reason.contains("requires a price"),
                    "trigger-only stop modify must not trip the price guard, was: {}",
                    event.reason,
                );
                assert!(
                    event.reason.contains("dispatch failed"),
                    "expected send-stage failure after a successful prepare, was: {}",
                    event.reason,
                );
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn modify_order_rejects_sub_tick_quantity_before_nonce_allocation() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-SUB-TICK");
        let client_order_id = order.client_order_id();
        cache_order(&cache, order);

        client
            .modify_order(ModifyOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(VenueOrderId::from("123")),
                Some(Quantity::from("0.00001")),
                Some(Price::from("2362.00")),
                None,
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        assert_modify_rejected_reason(&mut rx, "rounds to 0 ticks").await;
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn modify_order_rejects_below_min_notional_before_nonce_allocation() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-MIN-NOTIONAL");
        let client_order_id = order.client_order_id();
        cache_order(&cache, order);

        client
            .modify_order(ModifyOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(VenueOrderId::from("123")),
                Some(Quantity::from("0.0001")),
                Some(Price::from("2362.00")),
                None,
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        assert_modify_rejected_reason(&mut rx, "below Lighter min_quote_amount").await;
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn modify_conditional_order_rejects_sub_tick_trigger_before_nonce_allocation() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = factory.stop_market(
            instrument_id,
            OrderSide::Sell,
            Quantity::from("0.1000"),
            Price::from("2300.00"),
            None,
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-MODIFY-SUB-TICK-TRIGGER")),
        );
        let client_order_id = order.client_order_id();
        cache_order(&cache, order);

        client
            .modify_order(ModifyOrder::new(
                trader_id(),
                Some(client_id()),
                strategy_id(),
                instrument_id,
                client_order_id,
                Some(VenueOrderId::from("123")),
                None,
                None,
                Some(Price::from("0.001")),
                UUID4::new(),
                UnixNanos::default(),
                None,
                None,
            ))
            .unwrap();

        assert_modify_rejected_reason(&mut rx, "rounds to 0 ticks").await;
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn modify_order_nonce_prepare_failure_emits_modify_rejected() {
        let mut config = test_config();
        config.base_url_http = Some(spawn_next_nonce_server(101).await);
        let (client, cache, mut rx) = create_execution_client_with_config(config);
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-MODIFY-NONCE-FAIL");
        let client_order_id = order.client_order_id();
        let venue_order_id = VenueOrderId::from("123");
        cache_order(&cache, order);

        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
        }

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.modify_order(command).unwrap();

        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::ModifyRejected(event) => {
                assert_eq!(event.client_order_id, client_order_id);
                assert_eq!(event.venue_order_id, Some(venue_order_id));
                assert!(event.reason.contains("failed to allocate Lighter nonce"),);
                assert!(event.reason.contains("skip-window exhausted"));
            }
            event => panic!("expected modify rejected event, was {event:?}"),
        }

        wait_for_spawned_tasks(&client).await;
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            101,
        );
    }

    #[tokio::test]
    async fn update_leverage_requires_credentials() {
        let (mut client, _cache, _rx) = create_execution_client();
        client.credential = None;
        let instrument_id = InstrumentId::from("ETH-PERP.LIGHTER");

        let err = client
            .update_leverage(instrument_id, 500, LighterPositionMarginMode::Isolated)
            .unwrap_err();

        assert!(
            err.to_string()
                .contains("cannot update leverage without credentials"),
        );
    }

    #[tokio::test]
    async fn update_leverage_requires_registered_instrument() {
        let (client, _cache, _rx) = create_execution_client();
        let unknown = InstrumentId::from("DOGE-PERP.LIGHTER");

        let err = client
            .update_leverage(unknown, 500, LighterPositionMarginMode::Isolated)
            .unwrap_err();

        assert!(
            err.to_string()
                .contains("no Lighter market_index registered")
        );
        // Pin that nonce was not burned on the rejected path: instrument
        // lookup must happen before `build_tx_context` allocates a nonce.
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn update_leverage_dispatches_and_rolls_back_on_send_failure() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);

        client
            .update_leverage(instrument_id, 500, LighterPositionMarginMode::Isolated)
            .unwrap();

        wait_for_spawned_tasks(&client).await;
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn update_leverage_unknown_send_outcome_retains_pending_nonce() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        client.ws_client.drop_next_send_tx_result_for_test().await;

        client
            .update_leverage(instrument_id, 500, LighterPositionMarginMode::Isolated)
            .unwrap();

        wait_for_spawned_tasks(&client).await;
        assert_eq!(client.dispatch.pending_sendtx_len(), 1);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE),
        );
    }

    #[tokio::test]
    async fn update_leverage_rejects_zero_margin_fraction() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);

        let err = client
            .update_leverage(instrument_id, 0, LighterPositionMarginMode::Cross)
            .unwrap_err();
        assert!(err.to_string().contains("must be in 1..=10_000"));
    }

    #[tokio::test]
    async fn update_leverage_rejects_above_margin_fraction_tick() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);

        let err = client
            .update_leverage(instrument_id, 10_001, LighterPositionMarginMode::Cross)
            .unwrap_err();
        assert!(err.to_string().contains("must be in 1..=10_000"));
    }

    #[tokio::test]
    async fn update_leverage_accepts_minimum_margin_fraction() {
        // Pin the inclusive lower bound of the venue's `MarginFractionTick`
        // range. An exclusive `(1.., ...)` range check would fail this case.
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);

        client
            .update_leverage(instrument_id, 1, LighterPositionMarginMode::Cross)
            .unwrap();

        wait_for_spawned_tasks(&client).await;
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn update_leverage_accepts_maximum_margin_fraction() {
        // Pin the inclusive upper bound of the venue's `MarginFractionTick`
        // range. An exclusive `(..10_000)` range check would fail this case.
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);

        client
            .update_leverage(instrument_id, 10_000, LighterPositionMarginMode::Isolated)
            .unwrap();

        wait_for_spawned_tasks(&client).await;
        assert_nonce_reusable(&client.dispatch);
    }

    async fn wait_for_spawned_tasks(client: &LighterExecutionClient) {
        wait_until_async(
            || async { client.pending_tasks_all_finished() },
            Duration::from_secs(2),
        )
        .await;
    }

    fn mark_all_streams_ready(client: &LighterExecutionClient) {
        let ready = &client.dispatch.account_streams_ready;
        ready.mark_orders();
        ready.mark_trades();
        ready.mark_positions();
        ready.mark_assets();
        ready.mark_user_stats();
    }

    #[tokio::test]
    async fn await_account_streams_ready_times_out_when_no_frame_arrives() {
        // Drives the timeout branch `connect()` uses to tear the WS down
        // when at least one account stream has not delivered a first frame.
        let (client, _cache, _rx) = create_execution_client();

        let err = client.await_account_streams_ready(0.05).await.unwrap_err();

        assert!(
            err.to_string().contains("Timeout")
                && err.to_string().contains("Lighter account streams"),
            "unexpected error message, was {err}",
        );
    }

    #[tokio::test]
    async fn await_account_streams_ready_returns_when_all_streams_marked() {
        let (client, _cache, _rx) = create_execution_client();
        mark_all_streams_ready(&client);

        client.await_account_streams_ready(0.05).await.unwrap();
    }

    #[tokio::test]
    async fn await_account_streams_ready_returns_when_streams_arrive_mid_wait() {
        let (client, _cache, _rx) = create_execution_client();
        let ready = Arc::clone(&client.dispatch.account_streams_ready);
        let (pending_tx, pending_rx) = tokio::sync::oneshot::channel();
        let mut pending_tx = Some(pending_tx);
        let wait = client.await_account_streams_ready(30.0);
        tokio::pin!(wait);

        let producer = tokio::spawn(async move {
            pending_rx.await.expect("readiness waiter parked");
            ready.mark_orders();
            ready.mark_trades();
            ready.mark_positions();
            ready.mark_assets();
            ready.mark_user_stats();
        });

        // Await the waiter before the producer so its completion cannot supply the wakeup
        tokio::time::timeout(
            Duration::from_secs(2),
            std::future::poll_fn(|cx| {
                let result = wait.as_mut().poll(cx);
                if result.is_pending()
                    && let Some(tx) = pending_tx.take()
                {
                    tx.send(()).expect("readiness producer alive");
                }

                result
            }),
        )
        .await
        .expect("marks must wake the waiter before its deadline")
        .unwrap();

        assert!(pending_tx.is_none(), "waiter must initially be pending");
        producer.await.unwrap();
    }

    #[tokio::test]
    async fn await_account_streams_ready_times_out_with_partial_marks() {
        // Three out of four streams marked must still time out: strict
        // await means every account stream has to deliver before connect
        // unblocks.
        let (client, _cache, _rx) = create_execution_client();
        let ready = &client.dispatch.account_streams_ready;
        ready.mark_orders();
        ready.mark_trades();
        ready.mark_positions();

        let err = client.await_account_streams_ready(0.05).await.unwrap_err();
        assert!(
            err.to_string().contains("assets"),
            "pending list should call out the missing stream, was {err}",
        );
    }

    #[tokio::test]
    async fn await_account_streams_ready_after_reset_requires_new_marks() {
        // Pins the connect-retry contract: marks from a prior session
        // must not satisfy a fresh await once `reset()` has cleared the
        // gate. A regression that drops the reset() call from connect()
        // would let a retried session return immediately with stale flags.
        let (client, _cache, _rx) = create_execution_client();
        mark_all_streams_ready(&client);
        client.await_account_streams_ready(0.05).await.unwrap();

        client.dispatch.account_streams_ready.reset();

        let err = client.await_account_streams_ready(0.05).await.unwrap_err();
        let msg = err.to_string();
        assert!(msg.contains("orders"), "pending list missing orders: {msg}");
        assert!(msg.contains("trades"), "pending list missing trades: {msg}");
        assert!(
            msg.contains("positions"),
            "pending list missing positions: {msg}",
        );
        assert!(msg.contains("assets"), "pending list missing assets: {msg}");
        assert!(
            msg.contains("user_stats"),
            "pending list missing user_stats: {msg}",
        );
    }

    fn test_market_order(
        factory: &mut OrderFactory,
        instrument_id: InstrumentId,
        client_order_id: &str,
        side: OrderSide,
    ) -> OrderAny {
        factory.market(
            instrument_id,
            side,
            Quantity::from("0.1000"),
            Some(TimeInForce::Ioc),
            Some(false),
            Some(false),
            None,
            None,
            None,
            Some(ClientOrderId::from(client_order_id)),
        )
    }

    fn add_test_quote(
        cache: &Rc<RefCell<Cache>>,
        instrument_id: InstrumentId,
        bid: &str,
        ask: &str,
    ) {
        let quote = QuoteTick::new(
            instrument_id,
            Price::from(bid),
            Price::from(ask),
            Quantity::from("1.0000"),
            Quantity::from("1.0000"),
            UnixNanos::default(),
            UnixNanos::default(),
        );
        cache.borrow_mut().add_quote(quote).unwrap();
    }

    #[tokio::test]
    async fn submit_market_order_without_cached_quote_emits_denied() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_market_order(
            &mut factory,
            instrument_id,
            "O-MARKET-NO-QUOTE",
            OrderSide::Buy,
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        // submit_order returns Err but also emits OrderDenied; consume both.
        let _ = client.submit_order(command);

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Denied(event) => {
                assert!(
                    event.reason.contains("no cached quote"),
                    "expected no-cached-quote in reason, was {:?}",
                    event.reason,
                );
            }
            event => panic!("expected denied event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_market_buy_with_quote_uses_ask_widened_by_slippage() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        add_test_quote(&cache, instrument_id, "2360.00", "2361.00");

        let mut factory = test_order_factory();
        let order = test_market_order(
            &mut factory,
            instrument_id,
            "O-MARKET-QUOTED-BUY",
            OrderSide::Buy,
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let submitted = recv_order_event(&mut rx).await;
        assert!(
            matches!(submitted, OrderEventAny::Submitted(_)),
            "expected submitted, was {submitted:?}",
        );
        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::Rejected(event) => {
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_order_with_sub_tick_quantity_emits_denied() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        // ETH-PERP size_precision=4; quantity 0.00001 truncates to 0 ticks.
        let order = factory.limit(
            instrument_id,
            OrderSide::Buy,
            Quantity::from("0.00001"),
            Price::from("2361.31"),
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-SUB-TICK-QTY")),
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Denied(event) => {
                assert!(
                    event.reason.contains("rounds to 0 ticks"),
                    "expected rounds-to-0 in reason, was {:?}",
                    event.reason,
                );
            }
            event => panic!("expected denied event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_order_below_min_notional_emits_denied() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = factory.limit(
            instrument_id,
            OrderSide::Buy,
            Quantity::from("0.0010"),
            Price::from("2361.31"),
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-BELOW-MIN-NOTIONAL")),
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Denied(event) => {
                assert!(
                    event.reason.contains("min_quote_amount"),
                    "expected min_quote_amount in reason, was {:?}",
                    event.reason,
                );
            }
            event => panic!("expected denied event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_stop_market_with_sub_tick_trigger_emits_denied() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        // ETH-PERP price_precision=2; trigger 0.001 truncates to 0 ticks.
        let order = factory.stop_market(
            instrument_id,
            OrderSide::Buy,
            Quantity::from("0.1000"),
            Price::from("0.001"),
            None,
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-STOP-SUB-TICK")),
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Denied(event) => {
                assert!(
                    event.reason.contains("rounds to 0 ticks"),
                    "expected rounds-to-0 in reason, was {:?}",
                    event.reason,
                );
            }
            event => panic!("expected denied event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_stop_market_dispatches_using_trigger_widened_by_slippage() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = factory.stop_market(
            instrument_id,
            OrderSide::Sell,
            Quantity::from("0.1000"),
            Price::from("2300.00"), // trigger
            None,
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-STOP-MARKET")),
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let submitted = recv_order_event(&mut rx).await;
        assert!(matches!(submitted, OrderEventAny::Submitted(_)));
        let rejected = recv_order_event(&mut rx).await;
        assert!(matches!(rejected, OrderEventAny::Rejected(_)));
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn submit_market_order_respects_per_order_slippage_override() {
        // 0-bps override on a valid ask exercises the params path without
        // adding any widening.
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        add_test_quote(&cache, instrument_id, "2360.00", "2361.00");

        let mut factory = test_order_factory();
        let order = test_market_order(
            &mut factory,
            instrument_id,
            "O-MARKET-ZERO-SLIP",
            OrderSide::Buy,
        );
        cache_order(&cache, order.clone());

        let params: Params =
            serde_json::from_value(serde_json::json!({"market_order_slippage_bps": 0})).unwrap();
        let mut command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        command.params = Some(params);
        let _ = client.submit_order(command);

        let submitted = recv_order_event(&mut rx).await;
        assert!(matches!(submitted, OrderEventAny::Submitted(_)));
        let rejected = recv_order_event(&mut rx).await;
        assert!(matches!(rejected, OrderEventAny::Rejected(_)));
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn resolve_slippage_bps_prefers_params_over_config_default() {
        let (client, _cache, _rx) = create_execution_client();
        assert_eq!(client.resolve_slippage_bps(None), 50);

        let override_params: Params =
            serde_json::from_value(serde_json::json!({"market_order_slippage_bps": 100})).unwrap();
        assert_eq!(client.resolve_slippage_bps(Some(&override_params)), 100);

        let unrelated_params: Params =
            serde_json::from_value(serde_json::json!({"other_key": 999})).unwrap();
        assert_eq!(client.resolve_slippage_bps(Some(&unrelated_params)), 50);
    }

    #[tokio::test]
    async fn submit_market_sell_with_quote_uses_bid_widened_by_slippage() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        add_test_quote(&cache, instrument_id, "2360.00", "2361.00");

        let mut factory = test_order_factory();
        let order = test_market_order(
            &mut factory,
            instrument_id,
            "O-MARKET-QUOTED-SELL",
            OrderSide::Sell,
        );
        cache_order(&cache, order.clone());

        let command = SubmitOrder::from_order(
            &order,
            trader_id(),
            Some(client_id()),
            None,
            UUID4::new(),
            UnixNanos::default(),
        );
        let _ = client.submit_order(command);

        let submitted = recv_order_event(&mut rx).await;
        assert!(
            matches!(submitted, OrderEventAny::Submitted(_)),
            "expected submitted, was {submitted:?}",
        );
        let rejected = recv_order_event(&mut rx).await;
        match rejected {
            OrderEventAny::Rejected(event) => {
                assert!(
                    event
                        .reason
                        .contains("Lighter submit_order dispatch failed"),
                );
            }
            event => panic!("expected rejected event, was {event:?}"),
        }

        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    fn integrator_attributes_tag_mainnet_orders() {
        assert_eq!(
            integrator_attributes(Some(LIGHTER_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX)),
            L2TxAttributes {
                integrator_account_index: LIGHTER_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX,
                ..Default::default()
            },
        );
    }

    #[rstest]
    #[case("expire_maker", "account_index", 0, 0)]
    #[case("expire_maker", "master_account_index", 0, 1)]
    #[case("expire_taker", "account_index", 1, 0)]
    #[case("EXPIRE_TAKER", "MASTER_ACCOUNT_INDEX", 1, 1)]
    #[case("cancel_both", "account_index", 2, 0)]
    #[case("cancel_both", "master_account_index", 2, 1)]
    #[case("reduce", "account_index", 3, 0)]
    fn resolve_self_trade_params(
        #[case] behavior: &str,
        #[case] equality: &str,
        #[case] expected_behavior: u8,
        #[case] expected_equality: u8,
    ) {
        let (client, _cache, _rx) = create_execution_client();
        let params: Params = serde_json::from_value(serde_json::json!({
            "self_trade_behavior_mode": behavior,
            "self_trade_equality_mode": equality,
        }))
        .unwrap();

        let attrs = client.resolve_create_attributes(Some(&params)).unwrap();

        assert_eq!(
            attrs,
            L2TxAttributes {
                self_trade_behavior_mode: Some(
                    serde_json::from_value(serde_json::json!(expected_behavior)).unwrap()
                ),
                self_trade_equality_mode: Some(
                    serde_json::from_value(serde_json::json!(expected_equality)).unwrap()
                ),
                ..Default::default()
            }
        );
    }

    #[rstest]
    fn resolve_self_trade_defaults_are_explicit() {
        let (client, _cache, _rx) = create_execution_client();
        let attrs = client.resolve_create_attributes(None).unwrap();

        assert_eq!(
            attrs,
            L2TxAttributes {
                self_trade_behavior_mode: Some(LighterSelfTradeBehaviorMode::ExpireMaker),
                self_trade_equality_mode: Some(LighterSelfTradeEqualityMode::AccountIndex),
                ..Default::default()
            }
        );
    }

    #[rstest]
    #[case(serde_json::json!({"self_trade_behavior_mode": "unknown"}), "invalid Lighter self_trade_behavior_mode")]
    #[case(serde_json::json!({"self_trade_equality_mode": "unknown"}), "invalid Lighter self_trade_equality_mode")]
    #[case(serde_json::json!({"self_trade_behavior_mode": 1}), "Lighter self_trade_behavior_mode must be a string")]
    #[case(serde_json::json!({"self_trade_equality_mode": null}), "Lighter self_trade_equality_mode must be a string")]
    #[case(serde_json::json!({"self_trade_behavior_mode": "reduce", "self_trade_equality_mode": "master_account_index"}), "Lighter reduce self-trade behavior cannot combine with master-account equality")]
    fn resolve_self_trade_rejects_invalid_params(
        #[case] value: serde_json::Value,
        #[case] expected: &str,
    ) {
        let (client, _cache, _rx) = create_execution_client();
        let params: Params = serde_json::from_value(value).unwrap();

        let error = client.resolve_create_attributes(Some(&params)).unwrap_err();

        assert_eq!(error.to_string(), expected);
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case::single(false, false)]
    #[case::list(true, false)]
    #[case::group(true, true)]
    #[tokio::test]
    async fn submit_self_trade_invalid_combination_denies_before_dispatch(
        #[case] list: bool,
        #[case] grouped: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();

        let orders = if grouped {
            test_native_group(
                instrument,
                LighterGroupingType::OneTriggersOneCancelsTheOther,
            )
        } else {
            vec![test_limit_order(
                &mut factory,
                instrument,
                "O-SELF-TRADE-INVALID",
            )]
        };

        for order in &orders {
            cache_order(&cache, order.clone());
        }

        let params: Params = serde_json::from_value(serde_json::json!({
            "self_trade_behavior_mode": "reduce",
            "self_trade_equality_mode": "master_account_index",
        }))
        .unwrap();

        if list {
            let mut command = submit_order_list_command(&orders, "OL-SELF-TRADE-INVALID");
            command.params = Some(params);
            client.submit_order_list(command).unwrap();
        } else {
            let mut command = SubmitOrder::from_order(
                &orders[0],
                trader_id(),
                Some(client_id()),
                None,
                UUID4::new(),
                UnixNanos::default(),
            );
            command.params = Some(params);
            client.submit_order(command).unwrap();
        }

        for order in &orders {
            match recv_order_event(&mut rx).await {
                OrderEventAny::Denied(event) => {
                    assert_eq!(event.client_order_id, order.client_order_id());
                    assert!(event.reason.contains("Lighter reduce self-trade behavior cannot combine with master-account equality"));
                }
                event => panic!("expected OrderDenied, was {event:?}"),
            }
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    fn integrator_attributes_leave_testnet_orders_unattributed() {
        assert_eq!(integrator_attributes(None), L2TxAttributes::default());
    }

    #[rstest]
    #[case::lighter_mainnet(
        LighterDeployment::Lighter,
        LighterEnvironment::Mainnet,
        Some(LIGHTER_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX)
    )]
    #[case::lighter_testnet(LighterDeployment::Lighter, LighterEnvironment::Testnet, None)]
    #[case::robinhood_mainnet(
        LighterDeployment::Robinhood,
        LighterEnvironment::Mainnet,
        Some(LIGHTER_ROBINHOOD_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX)
    )]
    #[case::robinhood_testnet(LighterDeployment::Robinhood, LighterEnvironment::Testnet, None)]
    fn integrator_account_index_follows_deployment(
        #[case] deployment: LighterDeployment,
        #[case] environment: LighterEnvironment,
        #[case] expected: Option<u64>,
    ) {
        let mut config = test_config();
        config.deployment = deployment;
        config.environment = environment;
        config.venue = Some(*LIGHTER_VENUE);
        let (client, _cache, _rx) = create_execution_client_with_config(config);

        assert_eq!(client.integrator_account_index(), expected);
    }

    #[rstest]
    fn robinhood_orders_carry_integrator_attributes() {
        let mut config = test_config();
        config.deployment = LighterDeployment::Robinhood;
        config.environment = LighterEnvironment::Mainnet;

        assert_eq!(
            integrator_attributes(deployment::integrator_account_index(
                config.deployment,
                config.environment,
            )),
            L2TxAttributes {
                integrator_account_index: LIGHTER_ROBINHOOD_NAUTILUS_INTEGRATOR_ACCOUNT_INDEX,
                ..Default::default()
            },
        );
    }

    use std::str::FromStr;

    use nautilus_live::ExecutionEventEmitter;
    use rust_decimal::Decimal;

    use crate::{
        common::enums::{
            LighterOrderKind, LighterOrderSide, LighterOrderStatus, LighterOrderTimeInForce,
            LighterTradeType, LighterTriggerStatus,
        },
        http::models::{LighterOrder, LighterTrade},
    };

    fn dispatcher_emitter() -> (
        ExecutionEventEmitter,
        tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
    ) {
        let mut emitter = ExecutionEventEmitter::new(
            get_atomic_clock_realtime(),
            trader_id(),
            account_id(),
            AccountType::Margin,
            None,
        );
        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel::<ExecutionEvent>();
        emitter.set_sender(sender);
        (emitter, receiver)
    }

    /// Test rig that owns a `WsDispatchState`, a process-global instrument
    /// cache entry, a `MarketRegistry`, and an emitter wired to a receiver.
    /// Used by every dispatcher test to keep the call-site short.
    struct DispatcherRig {
        dispatch: WsDispatchState,
        registry: Arc<MarketRegistry>,
        emitter: ExecutionEventEmitter,
        rx: tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
        instrument_id: InstrumentId,
        cloid: ClientOrderId,
    }

    fn dispatcher_rig(cloid_suffix: &str) -> DispatcherRig {
        let registry = Arc::new(MarketRegistry::new());
        // All dispatcher tests share the same instrument (ETH-PERP) so
        // `LIGHTER_INSTRUMENT_CACHE` only ever holds one entry; per-test
        // isolation comes from the per-rig `WsDispatchState` and the
        // unique cloid built from `cloid_suffix`.
        let instrument_id = registry.insert(TEST_MARKET_INDEX, "ETH", LighterProductType::Perp);
        let instrument = InstrumentAny::CryptoPerpetual(
            CryptoPerpetual::builder()
                .instrument_id(instrument_id)
                .raw_symbol(Symbol::new("ETH-PERP"))
                .base_currency(Currency::from("ETH"))
                .quote_currency(Currency::from("USDC"))
                .settlement_currency(Currency::from("USDC"))
                .is_inverse(false)
                .price_precision(2)
                .size_precision(4)
                .price_increment(Price::from("0.01"))
                .size_increment(Quantity::from("0.0001"))
                .min_notional(Money::from("10.000000 USDC"))
                .ts_event(UnixNanos::default())
                .ts_init(UnixNanos::default())
                .build()
                .unwrap(),
        );
        LIGHTER_INSTRUMENT_CACHE.insert(instrument_id, instrument);
        let (emitter, rx) = dispatcher_emitter();

        DispatcherRig {
            dispatch: WsDispatchState::new(),
            registry,
            emitter,
            rx,
            instrument_id,
            cloid: ClientOrderId::new(format!("CLOID-{cloid_suffix}")),
        }
    }

    fn register_identity(rig: &DispatcherRig) {
        register_identity_for(rig, OrderType::Limit);
    }

    fn register_identity_for(rig: &DispatcherRig, order_type: OrderType) {
        let derived = rig.dispatch.derive_client_order_index(&rig.cloid);
        let client_order_index = rig.dispatch.register_cloid(derived, rig.cloid).unwrap();
        rig.dispatch.register_order_identity(
            rig.cloid,
            OrderIdentity::new(
                rig.instrument_id,
                strategy_id(),
                OrderSide::Buy,
                order_type,
                client_order_index,
            ),
        );
        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
    }

    fn register_unowned_identity(rig: &DispatcherRig) {
        let derived = rig.dispatch.derive_client_order_index(&rig.cloid);
        let client_order_index = rig.dispatch.register_cloid(derived, rig.cloid).unwrap();
        rig.dispatch.register_order_identity(
            rig.cloid,
            OrderIdentity::new(
                rig.instrument_id,
                strategy_id(),
                OrderSide::Buy,
                OrderType::Limit,
                client_order_index,
            ),
        );
    }

    fn dispatcher_test_order(rig: &DispatcherRig, status: LighterOrderStatus) -> LighterOrder {
        let derived = rig.dispatch.derive_client_order_index(&rig.cloid);
        rig.dispatch.register_cloid(derived, rig.cloid).unwrap();

        LighterOrder {
            order_index: 281_476_929_510_110,
            client_order_index: derived,
            order_id: "281476929510110".to_string(),
            client_order_id: derived.to_string(),
            market_index: TEST_MARKET_INDEX,
            owner_account_index: TEST_ACCOUNT_INDEX_I64,
            initial_base_amount: Decimal::from_str("0.0050").unwrap(),
            price: Decimal::from_str("2352.74").unwrap(),
            nonce: TEST_ORDER_NONCE,
            remaining_base_amount: Decimal::from_str("0.0050").unwrap(),
            is_ask: false,
            base_size: 50,
            base_price: 235_274,
            filled_base_amount: Decimal::ZERO,
            filled_quote_amount: Decimal::ZERO,
            side: Some(LighterOrderSide::Buy),
            order_type: LighterOrderKind::Limit,
            time_in_force: LighterOrderTimeInForce::GoodTillTime,
            reduce_only: false,
            trigger_price: Decimal::ZERO,
            order_expiry: 1_780_360_584_479,
            status,
            trigger_status: LighterTriggerStatus::Na,
            trigger_time: 0,
            parent_order_index: 0,
            parent_order_id: "0".to_string(),
            to_trigger_order_id_0: "0".to_string(),
            to_trigger_order_id_1: "0".to_string(),
            to_cancel_order_id_0: "0".to_string(),
            integrator_fee_collector_index: "0".to_string(),
            integrator_taker_fee: Decimal::ZERO,
            integrator_maker_fee: Decimal::ZERO,
            block_height: 227_535_532,
            timestamp: 1_777_941_383_576,
            created_at: 1_777_941_383_576,
            updated_at: 1_777_941_383_900,
            transaction_time: 1_777_941_383_576_735,
        }
    }

    fn dispatcher_test_trade(rig: &DispatcherRig, user_is_bidder: bool) -> LighterTrade {
        let derived = rig.dispatch.derive_client_order_index(&rig.cloid);
        rig.dispatch.register_cloid(derived, rig.cloid).unwrap();

        LighterTrade {
            trade_id: 19_209_006_902,
            trade_id_str: Some("19209006902".to_string()),
            tx_hash: "000000128b1ee814".to_string(),
            trade_type: LighterTradeType::Trade,
            market_id: TEST_MARKET_INDEX,
            size: Decimal::from_str("0.1336").unwrap(),
            price: Decimal::from_str("2352.73").unwrap(),
            usd_amount: Decimal::from_str("314.324728").unwrap(),
            ask_id: 281_476_929_510_102,
            ask_id_str: Some("281476929510102".to_string()),
            bid_id: 562_947_905_631_053,
            bid_id_str: Some("562947905631053".to_string()),
            ask_client_id: if user_is_bidder { 0 } else { derived },
            ask_client_id_str: Some(if user_is_bidder {
                "0".to_string()
            } else {
                derived.to_string()
            }),
            bid_client_id: if user_is_bidder { derived } else { 0 },
            bid_client_id_str: Some(if user_is_bidder {
                derived.to_string()
            } else {
                "0".to_string()
            }),
            ask_account_id: if user_is_bidder {
                91_249
            } else {
                TEST_ACCOUNT_INDEX_I64
            },
            bid_account_id: if user_is_bidder {
                TEST_ACCOUNT_INDEX_I64
            } else {
                91_249
            },
            is_maker_ask: false,
            block_height: 227_535_535,
            timestamp: 1_777_941_384_181,
            taker_fee: Some(196),
            taker_position_size_before: None,
            taker_entry_quote_before: None,
            taker_initial_margin_fraction_before: None,
            taker_position_sign_changed: None,
            maker_fee: Some(28),
            maker_position_size_before: None,
            maker_entry_quote_before: None,
            maker_initial_margin_fraction_before: None,
            maker_position_sign_changed: None,
            transaction_time: 1_777_941_384_181_586,
            ask_account_pnl: None,
            bid_account_pnl: None,
        }
    }

    /// Drain all pending events from the rig's receiver. Useful when a
    /// test wants to assert what landed without timing-sensitive
    /// `recv_order_event` waits.
    fn drain_events(
        rx: &mut tokio::sync::mpsc::UnboundedReceiver<ExecutionEvent>,
    ) -> Vec<ExecutionEvent> {
        let mut events = Vec::new();
        while let Ok(event) = rx.try_recv() {
            events.push(event);
        }

        events
    }

    #[rstest]
    fn dispatch_lighter_order_tracked_emits_accepted_then_silent_repeat() {
        let mut rig = dispatcher_rig("1");
        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            1,
            "exactly one event expected, was {events:?}",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Accepted(e)) => {
                assert_eq!(e.client_order_id, rig.cloid);
                assert_eq!(e.venue_order_id.to_string(), "281476929510110");
            }
            other => panic!("expected Accepted, was {other:?}"),
        }

        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(rig.dispatch.snapshot_for(&rig.cloid).is_some());
    }

    #[rstest]
    fn dispatch_lighter_order_tracked_emits_updated_on_shape_change() {
        let mut rig = dispatcher_rig("2");
        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        assert_eq!(drain_events(&mut rig.rx).len(), 1);

        let mut modified = order;
        modified.price = Decimal::from_str("2400.00").unwrap();

        dispatch_lighter_order(
            &modified,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            1,
            "expected one Updated event, was {events:?}",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Updated(e)) => {
                assert_eq!(e.client_order_id, rig.cloid);
                assert_eq!(e.price, Some(Price::from("2400.00")));
            }
            other => panic!("expected Updated, was {other:?}"),
        }

        let snapshot = rig.dispatch.snapshot_for(&rig.cloid).expect("snapshot");
        assert_eq!(snapshot.price, Some(Price::from("2400.00")));
    }

    #[rstest]
    #[case(LighterOrderStatus::Pending)]
    #[case(LighterOrderStatus::Open)]
    fn dispatch_lighter_order_defers_live_frame_while_cancel_pending(
        #[case] status: LighterOrderStatus,
    ) {
        let mut rig = dispatcher_rig(match status {
            LighterOrderStatus::Pending => "24-PENDING",
            LighterOrderStatus::Open => "24-OPEN",
            other => panic!("unexpected case {other:?}"),
        });

        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        assert_eq!(drain_events(&mut rig.rx).len(), 1);

        rig.dispatch
            .set_pending_order_action(rig.cloid, PendingOrderAction::Cancel);
        let mut late = order;
        late.status = status;
        late.initial_base_amount = Decimal::from_str("0.0075").unwrap();
        late.price = Decimal::from_str("2400.00").unwrap();

        dispatch_lighter_order(
            &late,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 0, "late frame must be silent: {events:?}");
        assert_eq!(
            rig.dispatch.pending_order_action(&rig.cloid),
            Some(PendingOrderAction::Cancel),
        );
        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(!rig.dispatch.triggered_was_emitted(&rig.cloid));
        assert_eq!(
            rig.dispatch.lookup_venue_order_id(&rig.cloid),
            Some(VenueOrderId::new("281476929510110")),
        );
        assert!(rig.dispatch.order_identities.contains_key(&rig.cloid));
        assert_eq!(
            rig.dispatch.snapshot_for(&rig.cloid),
            Some(crate::websocket::dispatch::OrderShapeSnapshot {
                quantity: Quantity::from("0.0050"),
                price: Some(Price::from("2352.74")),
                trigger_price: None,
            }),
        );
    }

    #[rstest]
    #[case::standalone(false)]
    #[case::native_child(true)]
    fn dispatch_lighter_order_emits_updated_then_triggered_for_one_frame(
        #[case] native_child: bool,
    ) {
        let mut rig = dispatcher_rig("25");

        if native_child {
            let child = OrderTestBuilder::new(OrderType::StopLimit)
                .trader_id(trader_id())
                .strategy_id(strategy_id())
                .instrument_id(rig.instrument_id)
                .client_order_id(rig.cloid)
                .side(OrderSide::Buy)
                .quantity(Quantity::from("0.0050"))
                .price(Price::from("2352.74"))
                .trigger_price(Price::from("2300.00"))
                .parent_order_id(ClientOrderId::new("TRIGGER-PARENT"))
                .build();
            rig.dispatch.register_create_identity(&child).unwrap();
            rig.dispatch
                .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        } else {
            register_identity_for(&rig, OrderType::StopLimit);
        }

        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Pending);
        order.order_type = LighterOrderKind::StopLossLimit;
        order.trigger_price = Decimal::from_str("2300.00").unwrap();

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let accepted = drain_events(&mut rig.rx);
        assert_eq!(accepted.len(), 1, "expected one acceptance: {accepted:?}");
        assert!(matches!(
            accepted[0],
            ExecutionEvent::Order(OrderEventAny::Accepted(_)),
        ));

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            Some(VenueOrderId::new("281476929510110")),
            Some(Quantity::from("0.0075")),
            Some(Price::from("2400.00")),
            Some(Price::from("2390.00")),
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        rig.dispatch.set_pending_modify_action(&command);
        rig.dispatch.set_pending_modify_shape(
            &command,
            OrderShapeSnapshot {
                quantity: command.quantity.unwrap(),
                price: command.price,
                trigger_price: command.trigger_price,
            },
        );

        rig.dispatch
            .set_pending_modify_nonce(&rig.cloid, command.command_id, 0, 29);
        let mut triggered = order;
        triggered.status = LighterOrderStatus::Open;
        triggered.trigger_status = LighterTriggerStatus::Ready;
        triggered.initial_base_amount = Decimal::from_str("0.0075").unwrap();
        triggered.remaining_base_amount = triggered.initial_base_amount;
        triggered.price = Decimal::from_str("2400.00").unwrap();
        triggered.trigger_price = Decimal::from_str("2390.00").unwrap();

        dispatch_lighter_order(
            &triggered,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        assert!(drain_events(&mut rig.rx).is_empty());
        let (client, _, _) = create_execution_client();
        let mut context = acked_probe_context(&client);
        context.dispatch = rig.dispatch.clone();
        context.registry = rig.registry.clone();
        context.emitter = rig.emitter.clone();

        let pending = PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Modify {
                strategy_id: strategy_id(),
                instrument_id: rig.instrument_id,
                client_order_id: rig.cloid,
                venue_order_id: command.venue_order_id,
            },
            submitted_at: UnixNanos::from(2),
            nonce: 29,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "confirmed-trigger".to_string(),
        };

        confirm_modify_order(&pending, &context, &triggered).unwrap();
        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            2,
            "expected Updated then Triggered: {events:?}",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Updated(event)) => {
                assert_eq!(event.trader_id, trader_id());
                assert_eq!(event.strategy_id, strategy_id());
                assert_eq!(event.instrument_id, rig.instrument_id);
                assert_eq!(event.client_order_id, rig.cloid);
                assert_eq!(
                    event.venue_order_id,
                    Some(VenueOrderId::new("281476929510110")),
                );
                assert_eq!(event.account_id, Some(account_id()));
                assert_eq!(event.quantity, Quantity::from("0.0075"));
                assert_eq!(event.price, Some(Price::from("2400.00")));
                assert_eq!(event.trigger_price, Some(Price::from("2390.00")));
            }
            other => panic!("first event should be Updated, was {other:?}"),
        }

        match &events[1] {
            ExecutionEvent::Order(OrderEventAny::Triggered(event)) => {
                assert_eq!(event.trader_id, trader_id());
                assert_eq!(event.strategy_id, strategy_id());
                assert_eq!(event.instrument_id, rig.instrument_id);
                assert_eq!(event.client_order_id, rig.cloid);
                assert_eq!(
                    event.venue_order_id,
                    Some(VenueOrderId::new("281476929510110")),
                );
                assert_eq!(event.account_id, Some(account_id()));
            }
            other => panic!("second event should be Triggered, was {other:?}"),
        }

        assert_eq!(rig.dispatch.pending_order_action(&rig.cloid), None);
        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(rig.dispatch.triggered_was_emitted(&rig.cloid));
        assert_eq!(
            rig.dispatch.snapshot_for(&rig.cloid),
            Some(crate::websocket::dispatch::OrderShapeSnapshot {
                quantity: Quantity::from("0.0075"),
                price: Some(Price::from("2400.00")),
                trigger_price: Some(Price::from("2390.00")),
            }),
        );

        dispatch_lighter_order(
            &triggered,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        assert!(
            drain_events(&mut rig.rx).is_empty(),
            "replayed frame must be silent",
        );
    }

    #[rstest]
    #[case(LighterTriggerStatus::Ready)]
    #[case(LighterTriggerStatus::Na)]
    fn dispatch_lighter_order_defers_trigger_until_modify_resolves(
        #[case] trigger_status: LighterTriggerStatus,
    ) {
        let mut rig = dispatcher_rig("26");
        register_identity_for(&rig, OrderType::StopLimit);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Pending);
        order.order_type = LighterOrderKind::StopLossLimit;
        order.trigger_price = Decimal::from_str("2300.00").unwrap();

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        assert_eq!(drain_events(&mut rig.rx).len(), 1);

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            Some(VenueOrderId::new("281476929510110")),
            Some(Quantity::from("0.0075")),
            Some(Price::from("2400.00")),
            Some(Price::from("2390.00")),
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        rig.dispatch.set_pending_modify_action(&command);
        rig.dispatch.set_pending_modify_shape(
            &command,
            OrderShapeSnapshot {
                quantity: command.quantity.unwrap(),
                price: command.price,
                trigger_price: command.trigger_price,
            },
        );

        order.status = LighterOrderStatus::Open;
        order.trigger_status = trigger_status;
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        assert!(drain_events(&mut rig.rx).is_empty());
        assert_eq!(
            rig.dispatch.pending_order_action(&rig.cloid),
            Some(PendingOrderAction::Modify),
        );
        assert!(!rig.dispatch.triggered_was_emitted(&rig.cloid));

        assert!(
            rig.dispatch
                .clear_pending_modify_if_command(&rig.cloid, command.command_id)
        );
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 1, "expected deferred trigger: {events:?}");

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Triggered(event)) => {
                assert_eq!(event.client_order_id, rig.cloid);
                assert_eq!(
                    event.venue_order_id,
                    Some(VenueOrderId::new("281476929510110")),
                );
                assert_eq!(event.account_id, Some(account_id()));
            }
            other => panic!("expected Triggered, was {other:?}"),
        }

        assert!(rig.dispatch.triggered_was_emitted(&rig.cloid));
    }

    #[rstest]
    fn dispatch_lighter_order_pending_emits_accepted_then_updated() {
        let mut rig = dispatcher_rig("23");
        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Pending);

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let accepted = drain_events(&mut rig.rx);

        let mut modified = order;
        modified.price = Decimal::from_str("2400.00").unwrap();
        dispatch_lighter_order(
            &modified,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );
        let updated = drain_events(&mut rig.rx);

        assert_eq!(
            accepted.len(),
            1,
            "expected one Accepted event: {accepted:?}"
        );
        assert!(matches!(
            accepted[0],
            ExecutionEvent::Order(OrderEventAny::Accepted(_))
        ));
        assert_eq!(updated.len(), 1, "expected one Updated event: {updated:?}");
        assert!(matches!(
            updated[0],
            ExecutionEvent::Order(OrderEventAny::Updated(_))
        ));
        assert_eq!(
            rig.dispatch
                .snapshot_for(&rig.cloid)
                .expect("snapshot")
                .price,
            Some(Price::from("2400.00")),
        );
    }

    #[rstest]
    fn dispatch_lighter_order_untracked_emits_report() {
        let mut rig = dispatcher_rig("3");
        // No identity registered: this is an external order.
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        order.client_order_id = "external-1".to_string();
        order.client_order_index = 0;

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 1);

        match &events[0] {
            ExecutionEvent::Report(report) => match report {
                EngineExecutionReport::Order(r) => {
                    assert_eq!(r.venue_order_id.to_string(), "281476929510110");
                }
                other => panic!("expected order report, was {other:?}"),
            },
            other => panic!("expected report, was {other:?}"),
        }

        assert!(
            !rig.dispatch
                .accepted_was_emitted(&ClientOrderId::new("external-1"))
        );
    }

    #[rstest]
    fn same_index_external_order_waits_for_create_submission_ownership() {
        let mut rig = dispatcher_rig("EPOCH-ORDER");
        register_unowned_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let venue_order_id = VenueOrderId::new(order.order_id.as_str());

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let external = drain_events(&mut rig.rx);
        assert_eq!(external.len(), 1);

        match &external[0] {
            ExecutionEvent::Report(EngineExecutionReport::Order(report)) => {
                assert_eq!(report.venue_order_id, venue_order_id);
                assert_eq!(
                    report.client_order_id,
                    Some(ClientOrderId::new(venue_order_id.as_str())),
                );
            }
            other => panic!("expected one external order report, was {other:?}"),
        }

        assert!(!rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(!rig.dispatch.venue_id_map.contains_key(&rig.cloid));

        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let replayed_external = drain_events(&mut rig.rx);
        assert_eq!(replayed_external.len(), 1);

        match &replayed_external[0] {
            ExecutionEvent::Report(EngineExecutionReport::Order(report)) => {
                assert_eq!(report.venue_order_id, venue_order_id);
                assert_eq!(
                    report.client_order_id,
                    Some(ClientOrderId::new(venue_order_id.as_str())),
                );
            }
            other => panic!("expected replayed external order report, was {other:?}"),
        }

        assert!(!rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(!rig.dispatch.venue_id_map.contains_key(&rig.cloid));

        let mut local_order = order.clone();
        local_order.order_id = "281476929510111".to_string();
        let local_venue_order_id = VenueOrderId::new(local_order.order_id.as_str());
        dispatch_lighter_order(
            &local_order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );

        let local = drain_events(&mut rig.rx);
        assert_eq!(local.len(), 1);

        match &local[0] {
            ExecutionEvent::Order(OrderEventAny::Accepted(event)) => {
                assert_eq!(event.client_order_id, rig.cloid);
                assert_eq!(event.venue_order_id, local_venue_order_id);
                assert_eq!(event.account_id, account_id());
            }
            other => panic!("expected one local OrderAccepted, was {other:?}"),
        }

        assert_eq!(
            rig.dispatch
                .venue_id_map
                .get(&rig.cloid)
                .map(|entry| *entry),
            Some(local_venue_order_id),
        );
        assert_eq!(
            rig.dispatch
                .resolve_live_order_cloid(order.client_order_id.as_str(), local_venue_order_id,),
            Some(rig.cloid),
            "a bound identity remains stable across replay epochs",
        );
    }

    #[rstest]
    #[case::order_first(false)]
    #[case::trade_first(true)]
    fn quantity_amend_immediate_fill_orders_update_before_fill(
        #[case] trade_first: bool,
        #[values(false, true)] reduced: bool,
    ) {
        let mut rig = dispatcher_rig("AMEND-FILL");
        let mut cached = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.0050"))
            .price(Price::from("2352.74"))
            .build();
        rig.dispatch.register_create_identity(&cached).unwrap();
        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        for event in drain_events(&mut rig.rx) {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            cached.apply(event).unwrap();
        }

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            cached.venue_order_id(),
            Some(Quantity::from("0.0100")),
            Some(Price::from("2400.00")),
            None,
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        rig.dispatch.set_pending_modify_action(&command);
        rig.dispatch.set_pending_modify_shape(
            &command,
            OrderShapeSnapshot {
                quantity: Quantity::from("0.0100"),
                price: Some(Price::from("2400.00")),
                trigger_price: None,
            },
        );

        rig.dispatch
            .set_pending_modify_nonce(&rig.cloid, command.command_id, 0, 19);

        let pending = PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Modify {
                strategy_id: strategy_id(),
                instrument_id: rig.instrument_id,
                client_order_id: rig.cloid,
                venue_order_id: cached.venue_order_id(),
            },
            submitted_at: UnixNanos::from(2),
            nonce: 19,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "confirmed-amend".to_string(),
        };

        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        let expected_qty = Quantity::from(if reduced { "0.0040" } else { "0.0100" });
        trade.size = expected_qty.as_decimal();
        trade.usd_amount = trade.size * trade.price;

        if trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(3),
            );
            assert!(
                drain_events(&mut rig.rx).is_empty(),
                "unconfirmed amend fill must wait"
            );
            assert!(
                !rig.dispatch
                    .seen_trade_ids
                    .contains(&parse_lighter_trade_id(&trade).unwrap())
            );
        }

        frame.status = LighterOrderStatus::Filled;
        frame.initial_base_amount = Decimal::from_str("0.0100").unwrap();
        frame.remaining_base_amount = Decimal::ZERO;
        frame.filled_base_amount = trade.size;
        frame.price = Decimal::from_str("2400.00").unwrap();
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(4),
        );

        if !trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(5),
            );
        }

        assert!(
            drain_events(&mut rig.rx).is_empty(),
            "order echo must wait for transaction confirmation"
        );
        let (client, _, _) = create_execution_client();
        let mut context = acked_probe_context(&client);
        context.dispatch = rig.dispatch.clone();
        context.registry = rig.registry.clone();
        context.emitter = rig.emitter.clone();
        confirm_modify_order(&pending, &context, &frame).unwrap();
        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 2, "expected update then fill, was {events:?}");

        let ExecutionEvent::Order(OrderEventAny::Updated(update)) = &events[0] else {
            panic!("expected update before fill, was {:?}", events[0]);
        };

        assert_eq!(update.client_order_id, rig.cloid);
        assert_eq!(update.quantity, expected_qty);
        assert_eq!(update.price, Some(Price::from("2400.00")));
        assert_eq!(update.trigger_price, None);

        let ExecutionEvent::Order(OrderEventAny::Filled(fill)) = &events[1] else {
            panic!("expected real fill, was {:?}", events[1]);
        };

        assert_eq!(fill.trade_id, parse_lighter_trade_id(&trade).unwrap());
        assert_eq!(fill.last_qty, expected_qty);
        assert_eq!(fill.last_px, Price::from("2352.73"));

        for event in events {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            cached.apply(event).unwrap();
        }

        assert_eq!(cached.quantity(), expected_qty);
        assert_eq!(cached.filled_qty(), expected_qty);
        assert_eq!(cached.price(), Some(Price::from("2400.00")));
        assert_eq!(cached.status(), OrderStatus::Filled);
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(6),
        );
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(7),
        );
        assert!(
            drain_events(&mut rig.rx)
                .iter()
                .all(|event| matches!(event, ExecutionEvent::Report(_))),
            "terminal replay must not emit duplicate order events"
        );
    }

    #[rstest]
    #[case(OrderType::StopMarket)]
    #[case(OrderType::StopLimit)]
    #[case(OrderType::MarketIfTouched)]
    #[case(OrderType::LimitIfTouched)]
    fn conditional_fill_synthesizes_trigger_once_across_retirement(#[case] kind: OrderType) {
        let mut rig = dispatcher_rig("CONDITIONAL-FILL");
        register_identity_for(&rig, kind);
        let trade = dispatcher_test_trade(&rig, true);
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );
        let first = drain_events(&mut rig.rx);
        let triggerable = TRIGGERABLE_ORDER_TYPES.contains(&kind);
        let mut builder = OrderTestBuilder::new(kind);
        builder
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.2672"))
            .trigger_price(Price::from("2300.00"));

        if LIMIT_ORDER_TYPES.contains(&kind) {
            builder.price(Price::from("2352.74"));
        }

        let mut order = builder.build();

        for event in &first {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            order.apply(event.clone()).unwrap();
        }

        rig.dispatch.retire_order_identity(&rig.cloid);
        let mut subsequent = trade;
        subsequent.trade_id += 1;
        subsequent.trade_id_str = Some(subsequent.trade_id.to_string());
        dispatch_lighter_trade(
            &subsequent,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );
        let next = drain_events(&mut rig.rx);
        assert_eq!(first.len(), 2 + usize::from(triggerable));
        assert!(
            matches!(&first[0], ExecutionEvent::Order(OrderEventAny::Accepted(event)) if event.client_order_id == rig.cloid)
        );

        if triggerable {
            assert!(
                matches!(&first[1], ExecutionEvent::Order(OrderEventAny::Triggered(event)) if event.client_order_id == rig.cloid)
            );
        }

        assert!(
            matches!(first.last().unwrap(), ExecutionEvent::Order(OrderEventAny::Filled(event)) if event.client_order_id == rig.cloid && event.order_type == kind && event.last_qty == Quantity::from("0.1336"))
        );
        assert_eq!(next.len(), 1);
        assert!(
            matches!(&next[0], ExecutionEvent::Order(OrderEventAny::Filled(event)) if event.client_order_id == rig.cloid && event.trade_id.as_str() == subsequent.trade_id.to_string())
        );

        let ExecutionEvent::Order(event) = &next[0] else {
            panic!("expected trailing fill");
        };

        order.apply(event.clone()).unwrap();
        assert_eq!(order.status(), OrderStatus::Filled);
        assert_eq!(order.filled_qty(), Quantity::from("0.2672"));
        assert_eq!(order.is_triggered(), Some(triggerable));
        assert_eq!(rig.dispatch.triggered_was_emitted(&rig.cloid), triggerable);
    }

    #[rstest]
    #[case(OrderType::Limit)]
    #[case(OrderType::StopLimit)]
    #[case(OrderType::StopMarket)]
    fn cached_order_restores_before_first_fill(
        #[case] kind: OrderType,
        #[values(false, true)] retired: bool,
    ) {
        let mut rig = dispatcher_rig("CACHED-FIRST-FILL");
        let trade = dispatcher_test_trade(&rig, true);
        rig.dispatch.forget_cloid(trade.bid_client_id);
        let venue = VenueOrderId::new(trade.bid_id_str.as_deref().unwrap());
        let mut builder = OrderTestBuilder::new(kind);
        builder
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1336"));

        if LIMIT_ORDER_TYPES.contains(&kind) {
            builder.price(Price::from("2352.74"));
        }

        if STOP_ORDER_TYPES.contains(&kind) {
            builder.trigger_price(Price::from("2300.00"));
        }

        let mut order = builder.build();
        order
            .apply(OrderEventAny::Accepted(OrderAccepted::new(
                trader_id(),
                strategy_id(),
                rig.instrument_id,
                rig.cloid,
                venue,
                account_id(),
                UUID4::new(),
                UnixNanos::from(1),
                UnixNanos::from(1),
                false,
            )))
            .unwrap();
        rig.dispatch.seed_order_restorations(vec![order.clone()]);
        if retired {
            rig.dispatch
                .restore_reconciled_order(&order, trade.bid_client_id, venue, true)
                .unwrap();
        }

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );
        let events = drain_events(&mut rig.rx);
        let triggerable = TRIGGERABLE_ORDER_TYPES.contains(&kind);
        assert_eq!(events.len(), 1 + usize::from(triggerable));

        for event in events {
            let ExecutionEvent::Order(event) = event else {
                panic!("cached fill must remain tracked");
            };

            assert_eq!(event.client_order_id(), rig.cloid);
            order.apply(event).unwrap();
        }

        assert_eq!(order.status(), OrderStatus::Filled);
        assert_eq!(order.filled_qty(), Quantity::from("0.1336"));
        assert_eq!(order.venue_order_id(), Some(venue));
        assert_eq!(
            rig.dispatch.client_order_index(&rig.cloid),
            Some(trade.bid_client_id)
        );
    }

    #[rstest]
    fn dispatch_lighter_trade_tracked_synthesizes_accepted_before_filled() {
        // Fill-before-open: the trade arrives before the matching Open
        // frame. The dispatcher must synthesize `OrderAccepted` first so
        // the engine sees the lifecycle in order.
        let mut rig = dispatcher_rig("4");
        register_identity(&rig);

        let trade = dispatcher_test_trade(&rig, true);

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            2,
            "expected Accepted then Filled, was {events:?}",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Accepted(_)) => {}
            other => panic!("first event should be Accepted, was {other:?}"),
        }

        match &events[1] {
            ExecutionEvent::Order(OrderEventAny::Filled(e)) => {
                assert_eq!(e.client_order_id, rig.cloid);
                assert_eq!(e.last_qty, Quantity::from("0.1336"));
                assert_eq!(e.last_px, Price::from("2352.73"));
            }
            other => panic!("second event should be Filled, was {other:?}"),
        }

        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));
    }

    #[rstest]
    fn dispatch_lighter_trade_dedupes_repeated_trade_ids() {
        let mut rig = dispatcher_rig("5");
        register_identity(&rig);
        let trade = dispatcher_test_trade(&rig, true);

        for _ in 0..3 {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(1),
            );
        }

        let events = drain_events(&mut rig.rx);
        // First call: Accepted + Filled. Subsequent calls deduped by trade_id.
        assert_eq!(
            events.len(),
            2,
            "expected dedup after first dispatch, was {events:?}"
        );
    }

    #[rstest]
    #[case::commission_overflow(true)]
    #[case::invalid_timestamp(false)]
    fn invalid_tracked_fill_preserves_unaccepted_order_for_replay(#[case] overflow: bool) {
        let mut rig = dispatcher_rig("INVALID-FILL-REPLAY");
        register_identity(&rig);
        let trade = dispatcher_test_trade(&rig, true);
        let mut invalid = trade.clone();
        if overflow {
            invalid.price = Decimal::from(1_000_000_000);
            invalid.size = Decimal::from(1_000_000_000);
        } else {
            invalid.timestamp = -1;
        }

        let trade_id = parse_lighter_trade_id(&trade).unwrap();

        if overflow {
            let error = parse_lighter_order_filled(
                &invalid,
                &LIGHTER_INSTRUMENT_CACHE.get(&rig.instrument_id).unwrap(),
                &rig.dispatch.order_identity(&rig.cloid).unwrap(),
                rig.cloid,
                account_id(),
                trader_id(),
                TEST_ACCOUNT_INDEX_I64,
                UnixNanos::from(1),
            )
            .unwrap_err();
            assert!(is_commission_error(&error));
        }

        dispatch_lighter_trade(
            &invalid,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );

        assert!(drain_events(&mut rig.rx).is_empty());
        assert!(!rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(!rig.dispatch.seen_trade_ids.contains(&trade_id));
        assert!(
            !rig.dispatch
                .order_identity(&rig.cloid)
                .unwrap()
                .has_publication()
        );
        assert!(rig.dispatch.order_identities.contains_key(&rig.cloid));

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 2);
        assert!(
            matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Accepted(event)) if event.client_order_id == rig.cloid)
        );

        let ExecutionEvent::Order(OrderEventAny::Filled(actual)) = &events[1] else {
            panic!("expected typed fill");
        };

        assert_eq!(actual.trade_id, trade_id);
        assert_eq!(actual.trader_id, trader_id());
        assert_eq!(actual.strategy_id, strategy_id());
        assert_eq!(actual.instrument_id, rig.instrument_id);
        assert_eq!(actual.client_order_id, rig.cloid);
        assert_eq!(actual.venue_order_id, VenueOrderId::from("562947905631053"));
        assert_eq!(actual.account_id, account_id());
        assert_eq!(actual.order_side, OrderSide::Buy);
        assert_eq!(actual.order_type, OrderType::Limit);
        assert_eq!(actual.last_qty, Quantity::from("0.1336"));
        assert_eq!(actual.last_px, Price::from("2352.73"));
        assert_eq!(actual.currency, Currency::USDC());
        assert_eq!(actual.liquidity_side, LiquiditySide::Maker);
        assert_eq!(actual.ts_event, UnixNanos::from(1_777_941_384_181_000_000));
        assert_eq!(actual.ts_init, UnixNanos::from(2));
        assert!(!actual.reconciliation);
        assert_eq!(actual.position_id, None);
        assert_eq!(actual.commission, Some(Money::from("0.00880109 USDC")));
        assert_eq!(actual.info, None);
        assert_eq!(actual.causation_id, None);
        assert!(rig.dispatch.seen_trade_ids.contains(&trade_id));
    }

    #[rstest]
    #[case::tracked(true)]
    #[case::external(false)]
    fn malformed_duplicate_preserves_delivered_fill(#[case] tracked: bool) {
        let mut rig = dispatcher_rig("DUPLICATE-MALFORMED");
        if tracked {
            register_identity(&rig);
        }

        let original = dispatcher_test_trade(&rig, true);
        let mut malformed = original.clone();
        malformed.timestamp = -1;
        for trade in [&original, &malformed, &original] {
            dispatch_lighter_trade(
                trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(1),
            );
        }

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), if tracked { 2 } else { 1 });

        let fills = events
            .iter()
            .filter(|event| {
                matches!(
                    event,
                    ExecutionEvent::Order(OrderEventAny::Filled(_)) | ExecutionEvent::Report(_)
                )
            })
            .count();

        assert_eq!(fills, 1);
        assert!(
            rig.dispatch
                .seen_trade_ids
                .contains(&parse_lighter_trade_id(&original).unwrap())
        );
    }

    #[rstest]
    #[case::confirmed(true, false)]
    #[case::confirmed_stale_http(true, true)]
    #[case::rejected(false, false)]
    fn cancel_overlap_preserves_amendment_and_real_fill(
        #[case] confirmed: bool,
        #[case] stale_http: bool,
    ) {
        let mut rig = dispatcher_rig("AMEND-CANCEL-FILL");
        let mut cached = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.0050"))
            .price(Price::from("2352.74"))
            .build();
        rig.dispatch.register_create_identity(&cached).unwrap();
        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        let mut raw = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        dispatch_lighter_order(
            &raw,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        for event in drain_events(&mut rig.rx) {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected acceptance");
            };

            cached.apply(event).unwrap();
        }

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            cached.venue_order_id(),
            Some(Quantity::from("0.0100")),
            Some(Price::from("2400.00")),
            None,
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        assert!(rig.dispatch.set_pending_modify_action(&command));
        rig.dispatch.set_pending_modify_shape(
            &command,
            OrderShapeSnapshot {
                quantity: command.quantity.unwrap(),
                price: command.price,
                trigger_price: None,
            },
        );

        rig.dispatch
            .set_pending_modify_nonce(&rig.cloid, command.command_id, 0, 19);
        rig.dispatch
            .set_pending_order_action(rig.cloid, PendingOrderAction::Cancel);
        rig.dispatch
            .set_pending_cancel_nonce(&rig.cloid, 0, 20, true);
        assert_eq!(rig.dispatch.pending_modify_nonce(&rig.cloid), Some((0, 19)));
        assert_eq!(rig.dispatch.pending_cancel_nonce(&rig.cloid), Some((0, 20)));
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = raw.order_index;
        trade.bid_id_str = Some(raw.order_id.clone());
        trade.size = Decimal::from_str("0.0030").unwrap();
        trade.usd_amount = trade.size * trade.price;
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(3),
        );
        raw.status = LighterOrderStatus::Canceled;
        raw.filled_base_amount = trade.size;
        if confirmed {
            raw.initial_base_amount = Decimal::from_str("0.0100").unwrap();
            raw.price = Decimal::from_str("2400.00").unwrap();
        }

        raw.remaining_base_amount = raw.initial_base_amount - trade.size;
        dispatch_lighter_order(
            &raw,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(4),
        );
        assert!(drain_events(&mut rig.rx).is_empty());
        assert!(
            !rig.dispatch
                .seen_trade_ids
                .contains(&parse_lighter_trade_id(&trade).unwrap())
        );

        let pending = PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Modify {
                strategy_id: strategy_id(),
                instrument_id: rig.instrument_id,
                client_order_id: rig.cloid,
                venue_order_id: cached.venue_order_id(),
            },
            submitted_at: UnixNanos::from(2),
            nonce: 19,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "amend-cancel".to_string(),
        };

        if confirmed {
            let (client, _, _) = create_execution_client();
            let mut context = acked_probe_context(&client);
            context.dispatch = rig.dispatch.clone();
            context.registry = rig.registry.clone();
            context.emitter = rig.emitter.clone();
            let mut http = raw;
            if stale_http {
                http.status = LighterOrderStatus::Open;
            }

            confirm_modify_order(&pending, &context, &http).unwrap();
        } else {
            reject_modify_order(
                &rig.dispatch,
                &rig.emitter,
                &pending,
                "amendment failed",
                UnixNanos::from(5),
            );
        }

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 3);

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Updated(update)) if confirmed => {
                assert_eq!(update.client_order_id, rig.cloid);
                assert_eq!(update.quantity, Quantity::from("0.0100"));
                assert_eq!(update.price, Some(Price::from("2400.00")));
            }
            ExecutionEvent::Order(OrderEventAny::ModifyRejected(rejected)) if !confirmed => {
                assert_eq!(rejected.client_order_id, rig.cloid);
                assert_eq!(rejected.reason.as_str(), "amendment failed");
            }
            other => panic!("expected amendment resolution before fill, was {other:?}"),
        }

        let ExecutionEvent::Order(OrderEventAny::Filled(fill)) = &events[1] else {
            panic!("expected held real fill");
        };

        assert_eq!(fill.client_order_id, rig.cloid);
        assert_eq!(fill.trade_id, parse_lighter_trade_id(&trade).unwrap());
        assert_eq!(fill.last_qty, Quantity::from("0.0030"));
        assert_eq!(fill.last_px, Price::from("2352.73"));

        let ExecutionEvent::Order(OrderEventAny::Canceled(cancel)) = &events[2] else {
            panic!("expected cancellation after fill");
        };

        assert_eq!(cancel.client_order_id, rig.cloid);
        assert_eq!(cancel.venue_order_id, cached.venue_order_id());

        for event in events {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            cached.apply(event).unwrap();
        }

        assert_eq!(cached.status(), OrderStatus::Canceled);
        assert_eq!(
            cached.quantity(),
            Quantity::from(if confirmed { "0.0100" } else { "0.0050" })
        );
        assert_eq!(cached.filled_qty(), Quantity::from("0.0030"));
        assert_eq!(
            cached.leaves_qty(),
            Quantity::from(if confirmed { "0.0070" } else { "0.0020" })
        );
        assert_eq!(rig.dispatch.pending_modify_nonce(&rig.cloid), None);
        assert_eq!(rig.dispatch.pending_cancel_nonce(&rig.cloid), None);
        assert!(
            rig.dispatch
                .seen_trade_ids
                .contains(&parse_lighter_trade_id(&trade).unwrap())
        );
    }

    #[rstest]
    fn overlapping_modify_rejection_preserves_first_submission() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let cloid = ClientOrderId::from("OVERLAPPING-MODIFY");
        let venue = VenueOrderId::from("789");
        enqueue_modify(&client, instrument_id, cloid, venue, 23);

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            cloid,
            Some(venue),
            Some(Quantity::from("0.3000")),
            Some(Price::from("2363.00")),
            None,
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        assert!(!client.admit_modify_order(&command));
        let events = drain_events(&mut rx);
        assert_eq!(events.len(), 1);

        let ExecutionEvent::Order(OrderEventAny::ModifyRejected(event)) = &events[0] else {
            panic!("expected overlap rejection");
        };

        assert_eq!(event.trader_id, trader_id());
        assert_eq!(event.strategy_id, strategy_id());
        assert_eq!(event.instrument_id, instrument_id);
        assert_eq!(event.client_order_id, cloid);
        assert_eq!(event.venue_order_id, Some(venue));
        assert_eq!(event.account_id, Some(account_id()));
        assert_eq!(
            event.reason.as_str(),
            "Lighter permits one unresolved modification per order; wait for its update or rejection"
        );
        assert!(!event.reconciliation);
        assert_eq!(client.dispatch.pending_modify_nonce(&cloid), Some((0, 23)));
        assert_eq!(
            client.dispatch.pending_modify_shape(&cloid),
            Some(OrderShapeSnapshot {
                quantity: Quantity::from("0.2000"),
                price: Some(Price::from("2362.00")),
                trigger_price: None
            })
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 1);
    }

    #[rstest]
    fn recovery_waits_for_confirmed_update_in_cache() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let rig = dispatcher_rig("HTTP-AMEND");
        let cloid = rig.cloid;
        let mut raw = dispatcher_test_order(&rig, LighterOrderStatus::Filled);
        let venue = VenueOrderId::new(&raw.order_id);
        let order = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.0050"))
            .price(Price::from("2352.74"))
            .build();
        cache_accepted_order(&cache, order, venue, Some(client_id()));
        let cached = cache.borrow().order_owned(&cloid).unwrap();
        client
            .dispatch
            .restore_reconciled_order(&cached, raw.client_order_index, venue, false)
            .unwrap();
        enqueue_modify(&client, instrument_id, cloid, venue, 23);
        let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
        raw.initial_base_amount = Decimal::from_str("0.2000").unwrap();
        raw.filled_base_amount = raw.initial_base_amount;
        raw.remaining_base_amount = Decimal::ZERO;
        raw.price = Decimal::from_str("2362.00").unwrap();
        let instrument = LIGHTER_INSTRUMENT_CACHE.get(&instrument_id).unwrap();
        let report =
            parse_ws_order_status_report(&raw, &instrument, account_id(), UnixNanos::from(3))
                .unwrap()
                .with_client_order_id(cloid);
        drop(instrument);

        let command = GenerateOrderStatusReports::new(
            UUID4::new(),
            UnixNanos::default(),
            false,
            Some(instrument_id),
            None,
            None,
            None,
            None,
        );

        let result = finish_order_reports(
            &client.core,
            &client.dispatch,
            OrderReportSweep {
                orders: vec![(raw.client_order_index, report)],
                ..Default::default()
            },
            &command,
            None,
        );

        assert_eq!(
            result.unwrap_err().to_string(),
            "incomplete Lighter order reports: Lighter execution confirmation is pending"
        );
        assert_eq!(client.dispatch.pending_modify_nonce(&cloid), Some((0, 23)));
        assert!(client.dispatch.order_identities.contains_key(&cloid));
        let fill = reconciliation_fill_report(
            instrument_id,
            raw.client_order_index,
            venue,
            "HTTP-AMEND-TRADE",
        );

        let withheld = finish_fill_reports(
            &client.core,
            &client.dispatch,
            BTreeSet::new(),
            Ok(FillSweep {
                reports: vec![fill.clone()],
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            }),
        )
        .unwrap();

        assert!(withheld.reports.is_empty());
        assert!(!withheld.covers_window);
        assert!(!client.dispatch.seen_trade_ids.contains(&fill.trade_id));
        confirm_modify_order(&pending, &acked_probe_context(&client), &raw).unwrap();
        let events = drain_events(&mut rx);
        assert_eq!(events.len(), 2);
        let mut events = events.into_iter();

        let ExecutionEvent::Order(update @ OrderEventAny::Updated(_)) = events.next().unwrap()
        else {
            panic!("expected confirmed update before real fill");
        };

        let ExecutionEvent::Order(delivered_fill @ OrderEventAny::Filled(_)) =
            events.next().unwrap()
        else {
            panic!("expected buffered real fill");
        };

        let OrderEventAny::Filled(actual) = &delivered_fill else {
            unreachable!()
        };

        assert_eq!(actual.trade_id, fill.trade_id);
        assert_eq!(actual.client_order_id, cloid);
        assert_eq!(actual.venue_order_id, fill.venue_order_id);
        assert_eq!(actual.last_qty, fill.last_qty);
        assert_eq!(actual.last_px, fill.last_px);
        assert_eq!(actual.commission, Some(fill.commission));
        assert_eq!(actual.liquidity_side, fill.liquidity_side);
        assert_eq!(actual.ts_event, fill.ts_event);
        assert!(!actual.reconciliation);

        let still_withheld = finish_fill_reports(
            &client.core,
            &client.dispatch,
            BTreeSet::new(),
            Ok(FillSweep {
                reports: vec![fill.clone()],
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            }),
        )
        .unwrap();

        assert!(still_withheld.reports.is_empty());
        assert!(!still_withheld.covers_window);
        assert!(client.dispatch.seen_trade_ids.contains(&fill.trade_id));
        cache.borrow_mut().update_order(&update).unwrap();
        assert!(order_shape_pending(&client.core, &client.dispatch, &cloid));
        cache.borrow_mut().update_order(&delivered_fill).unwrap();

        let delivered = finish_fill_reports(
            &client.core,
            &client.dispatch,
            BTreeSet::new(),
            Ok(FillSweep {
                reports: vec![fill.clone()],
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            }),
        )
        .unwrap();

        assert!(delivered.reports.is_empty());
        assert!(delivered.covers_window);
        assert_eq!(
            client.dispatch.mark_trade_reconciled(fill.trade_id),
            Some(TradeDedupSource::Live)
        );
    }

    #[rstest]
    fn dispatch_lighter_trade_parse_failure_rolls_back_dedup() {
        // A parse failure must not consume the dedup slot, else the fill is lost on replay
        let mut rig = dispatcher_rig("21");
        register_identity(&rig);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.timestamp = -1;
        let trade_id = parse_lighter_trade_id(&trade).expect("trade id parses");

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        assert!(
            !events
                .iter()
                .any(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Filled(_)))),
            "malformed trade must not emit a fill, was {events:?}",
        );
        assert!(
            rig.dispatch.mark_trade_seen(trade_id),
            "parse-failed trade must be re-markable (dedup rolled back)",
        );
    }

    #[rstest]
    fn dispatch_lighter_trade_untracked_parse_failure_rolls_back_dedup() {
        // Untracked path (no registered identity -> FillReport): dedup rollback must still hold
        let mut rig = dispatcher_rig("22");
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.timestamp = -1;
        let trade_id = parse_lighter_trade_id(&trade).expect("trade id parses");

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        assert!(
            events.is_empty(),
            "untracked malformed trade must emit nothing, was {events:?}",
        );
        assert!(
            rig.dispatch.mark_trade_seen(trade_id),
            "untracked parse-failed trade must be re-markable (dedup rolled back)",
        );
    }

    #[rstest]
    fn dispatch_tracked_order_event_terminal_cancel_retires_identity_and_removes_snapshot() {
        let mut rig = dispatcher_rig("6");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        rig.dispatch.store_snapshot(
            rig.cloid,
            crate::websocket::dispatch::OrderShapeSnapshot {
                quantity: Quantity::from("0.0050"),
                price: Some(Price::from("2352.74")),
                trigger_price: None,
            },
        );
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        order.filled_base_amount = Decimal::ZERO;
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        let canceled = events
            .iter()
            .find(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Canceled(_))))
            .expect("expected a Canceled event");
        if let ExecutionEvent::Order(OrderEventAny::Canceled(e)) = canceled {
            assert_eq!(e.client_order_id, rig.cloid);
        }
        assert!(!rig.dispatch.order_identities.contains_key(&rig.cloid));
        assert!(rig.dispatch.order_identity(&rig.cloid).is_some());
        assert!(rig.dispatch.snapshot_for(&rig.cloid).is_none());
        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );
        let trailing = drain_events(&mut rig.rx);
        assert_eq!(
            trailing.len(),
            1,
            "expected one trailing fill: {trailing:?}"
        );

        match &trailing[0] {
            ExecutionEvent::Order(OrderEventAny::Filled(event)) => {
                assert_eq!(event.client_order_id, rig.cloid);
            }
            other => panic!("expected typed trailing OrderFilled, was {other:?}"),
        }
    }

    #[rstest]
    fn dispatch_tracked_cancel_after_report_seed_skips_synthesized_accept() {
        let mut rig = dispatcher_rig("10");
        register_identity(&rig);

        let report_order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .expect("instrument cached");
        let report = parse_ws_order_status_report(
            &report_order,
            instrument.value(),
            account_id(),
            UnixNanos::from(1),
        )
        .map(|report| report.with_client_order_id(rig.cloid))
        .expect("report parses");

        assert_eq!(report.order_status, OrderStatus::Accepted);
        rig.dispatch.seed_accepted_from_report(&report);

        let mut cancel_order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        cancel_order.filled_base_amount = Decimal::ZERO;
        dispatch_lighter_order(
            &cancel_order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            1,
            "report-seeded cancel should emit only Canceled, was {events:?}",
        );
        assert!(
            !events
                .iter()
                .any(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Accepted(_)))),
            "typed cancel must not synthesize a second Accepted",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Canceled(e)) => {
                assert_eq!(e.client_order_id, rig.cloid);
                assert_eq!(e.venue_order_id, Some(VenueOrderId::new("281476929510110")));
            }
            other => panic!("expected Canceled, was {other:?}"),
        }
    }

    #[rstest]
    fn dispatch_tracked_cancel_after_submitted_report_seed_skips_synthesized_accept() {
        let mut rig = dispatcher_rig("11");
        register_identity(&rig);

        let report_order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .expect("instrument cached");
        let mut report = parse_ws_order_status_report(
            &report_order,
            instrument.value(),
            account_id(),
            UnixNanos::from(1),
        )
        .map(|report| report.with_client_order_id(rig.cloid))
        .expect("report parses");
        report.order_status = OrderStatus::Submitted;

        rig.dispatch.seed_accepted_from_report(&report);
        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));

        let mut cancel_order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        cancel_order.filled_base_amount = Decimal::ZERO;

        dispatch_lighter_order(
            &cancel_order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        assert_eq!(
            events.len(),
            1,
            "Cancel after Submitted report should emit only Canceled, was {events:?}",
        );

        match &events[0] {
            ExecutionEvent::Order(OrderEventAny::Canceled(e)) => {
                assert_eq!(e.client_order_id, rig.cloid);
                assert_eq!(e.venue_order_id, Some(VenueOrderId::new("281476929510110")));
            }
            other => panic!("expected Canceled, was {other:?}"),
        }
    }

    #[rstest]
    fn dispatch_tracked_order_event_accept_dedup_is_idempotent() {
        let mut rig = dispatcher_rig("7");
        register_identity(&rig);
        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);

        // First dispatch emits Accepted. Second dispatch must be silent
        // (no shape change) and not re-emit Accepted.
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        let events = drain_events(&mut rig.rx);
        let accepted_count = events
            .iter()
            .filter(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Accepted(_))))
            .count();
        assert_eq!(accepted_count, 1, "Accepted must be emitted exactly once");
    }

    #[rstest]
    fn dispatch_lighter_order_drops_when_instrument_uncached() {
        // Construct a rig but use a market_index the registry does not know.
        let registry = Arc::new(MarketRegistry::new());
        let (emitter, mut rx) = dispatcher_emitter();
        let dispatch = WsDispatchState::new();
        let cloid = ClientOrderId::new("CLOID-MISSING");
        dispatch.register_order_identity(
            cloid,
            OrderIdentity::new(
                InstrumentId::from("MISSING-PERP.LIGHTER"),
                strategy_id(),
                OrderSide::Buy,
                OrderType::Limit,
                1,
            ),
        );
        let mut order = LighterOrder {
            order_index: 1,
            client_order_index: 1,
            order_id: "1".to_string(),
            client_order_id: "1".to_string(),
            market_index: 999, // not in registry
            owner_account_index: TEST_ACCOUNT_INDEX_I64,
            initial_base_amount: Decimal::ZERO,
            price: Decimal::ZERO,
            nonce: 0,
            remaining_base_amount: Decimal::ZERO,
            is_ask: false,
            base_size: 0,
            base_price: 0,
            filled_base_amount: Decimal::ZERO,
            filled_quote_amount: Decimal::ZERO,
            side: Some(LighterOrderSide::Buy),
            order_type: LighterOrderKind::Limit,
            time_in_force: LighterOrderTimeInForce::GoodTillTime,
            reduce_only: false,
            trigger_price: Decimal::ZERO,
            order_expiry: 0,
            status: LighterOrderStatus::Open,
            trigger_status: LighterTriggerStatus::Na,
            trigger_time: 0,
            parent_order_index: 0,
            parent_order_id: "0".to_string(),
            to_trigger_order_id_0: "0".to_string(),
            to_trigger_order_id_1: "0".to_string(),
            to_cancel_order_id_0: "0".to_string(),
            integrator_fee_collector_index: "0".to_string(),
            integrator_taker_fee: Decimal::ZERO,
            integrator_maker_fee: Decimal::ZERO,
            block_height: 0,
            timestamp: 0,
            created_at: 0,
            updated_at: 0,
            transaction_time: 0,
        };
        order.client_order_id = "1".to_string();

        dispatch_lighter_order(
            &order,
            &dispatch,
            &emitter,
            &registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rx);
        assert!(
            events.is_empty(),
            "no event for uncached instrument, was {events:?}"
        );
        assert!(dispatch.order_identities.contains_key(&cloid));
    }

    #[rstest]
    fn dispatch_lighter_trade_filters_non_account_trades_defensively() {
        let mut rig = dispatcher_rig("8");
        // Trade involves accounts 91249 and 91250, but the supplied
        // account_index is TEST_ACCOUNT_INDEX_I64 (12345). The handler is
        // the first defensive filter; this verifies the dispatcher path
        // also drops foreign trades cleanly.
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_account_id = 91_249;
        trade.ask_account_id = 91_250;

        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );

        let events = drain_events(&mut rig.rx);
        assert!(
            events.is_empty(),
            "foreign trade must produce no event, was {events:?}"
        );
        assert!(
            !rig.dispatch
                .seen_trade_ids
                .contains(&TradeId::new("19209006902"),)
        );
    }

    #[rstest]
    fn register_cloid_in_submit_path_uses_probed_index_on_collision() {
        // Forcing a collision at the derived index for a fresh cloid must
        // result in `register_cloid` returning a different (probed) index;
        // the submit path uses this returned value as the venue-side
        // client_order_index, so it must be the probed one.
        let dispatch = WsDispatchState::new();
        let cloid = ClientOrderId::new("PROBE-CLOID");
        let derived = dispatch.derive_client_order_index(&cloid);

        let intruder = ClientOrderId::new("INTRUDER");
        dispatch.cloid_map.insert(derived, intruder);

        let chosen = dispatch.register_cloid(derived, cloid).unwrap();

        assert_ne!(chosen, derived);
        assert_eq!(
            dispatch.cloid_map.get(&derived).map(|e| *e.value()),
            Some(intruder),
        );
        assert_eq!(
            dispatch.cloid_map.get(&chosen).map(|e| *e.value()),
            Some(cloid),
        );
    }

    #[rstest]
    fn reconciliation_restores_active_collision_probed_identity() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-RECON-ACTIVE");
        let cloid = order.client_order_id();
        let venue_order_id = VenueOrderId::from("281476929510110");
        cache_accepted_order(&cache, order, venue_order_id, None);
        let (base_index, client_order_index) = forced_probed_index(cloid);
        let raw =
            reconciliation_raw_order(client_order_index, venue_order_id, LighterOrderStatus::Open);

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(raw.order_id.as_str()),
            raw.client_order_index,
            false,
        );
        let report = parse_http_order_to_report(
            &raw,
            &client.registry,
            account_id(),
            UnixNanos::from(1),
            &client.dispatch,
        )
        .unwrap();
        let translated = client.dispatch.translate_order_cloid(report);
        let replacement = ClientOrderId::from("O-RECON-ACTIVE-REPLACEMENT");
        let replacement_index = client
            .dispatch
            .register_cloid(client_order_index, replacement)
            .unwrap();
        let wrong_venue_order_id = VenueOrderId::from("281476929510111");
        let wrong_raw = reconciliation_raw_order(
            client_order_index,
            wrong_venue_order_id,
            LighterOrderStatus::Open,
        );
        let wrong_report = parse_http_order_to_report(
            &wrong_raw,
            &client.registry,
            account_id(),
            UnixNanos::from(2),
            &client.dispatch,
        )
        .unwrap();
        let wrong_translated = client.dispatch.translate_order_cloid(wrong_report);

        assert_ne!(client_order_index, base_index);
        assert_eq!(
            client.dispatch.client_order_index(&cloid),
            Some(client_order_index),
        );
        assert_eq!(
            client
                .dispatch
                .resolve_client_order_index(client_order_index),
            Some(cloid),
        );
        assert_eq!(
            client.dispatch.lookup_venue_order_id(&cloid),
            Some(venue_order_id),
        );
        assert!(client.dispatch.order_identities.contains_key(&cloid));
        assert!(client.dispatch.accepted_was_emitted(&cloid));
        assert_eq!(translated.client_order_id, Some(cloid));
        assert_eq!(translated.venue_order_id, venue_order_id);
        assert_ne!(replacement_index, client_order_index);
        assert_eq!(
            client
                .dispatch
                .resolve_client_order_index(replacement_index),
            Some(replacement),
        );
        assert_eq!(
            wrong_translated.client_order_id,
            Some(ClientOrderId::new(wrong_venue_order_id.as_str())),
        );
        assert_eq!(wrong_translated.venue_order_id, wrong_venue_order_id);
    }

    #[rstest]
    fn reconciliation_retires_stale_active_cache_from_terminal_report() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-RECON-FILLED");
        let cloid = order.client_order_id();
        let venue_order_id = VenueOrderId::from("281476929510119");
        cache_accepted_order(&cache, order, venue_order_id, None);
        let (_, client_order_index) = forced_probed_index(cloid);
        let raw = reconciliation_raw_order(
            client_order_index,
            venue_order_id,
            LighterOrderStatus::Filled,
        );

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(raw.order_id.as_str()),
            raw.client_order_index,
            true,
        );
        let fill = client
            .dispatch
            .translate_fill_cloid(reconciliation_fill_report(
                instrument_id,
                client_order_index,
                venue_order_id,
                "19209006919",
            ));

        assert!(!client.dispatch.cloid_map.contains_key(&client_order_index));
        assert!(!client.dispatch.order_identities.contains_key(&cloid));
        assert_eq!(
            client.dispatch.client_order_index(&cloid),
            Some(client_order_index),
        );
        assert_eq!(fill.client_order_id, Some(cloid));
        assert_eq!(fill.venue_order_id, venue_order_id);
    }

    #[rstest]
    fn reconciliation_restores_reused_retired_index_for_fill_translation() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let first_order = test_limit_order(&mut factory, instrument_id, "O-RECON-RETIRED-A");
        let second_order = test_limit_order(&mut factory, instrument_id, "O-RECON-RETIRED-B");
        let first_cloid = first_order.client_order_id();
        let second_cloid = second_order.client_order_id();
        let first_venue_order_id = VenueOrderId::from("281476929510120");
        let second_venue_order_id = VenueOrderId::from("281476929510121");
        cache_canceled_order(&cache, first_order, first_venue_order_id);
        cache_canceled_order(&cache, second_order, second_venue_order_id);
        let (_, client_order_index) = forced_probed_index(first_cloid);
        let first_raw = reconciliation_raw_order(
            client_order_index,
            first_venue_order_id,
            LighterOrderStatus::Canceled,
        );
        let second_raw = reconciliation_raw_order(
            client_order_index,
            second_venue_order_id,
            LighterOrderStatus::Canceled,
        );

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(first_raw.order_id.as_str()),
            first_raw.client_order_index,
            true,
        );
        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(second_raw.order_id.as_str()),
            second_raw.client_order_index,
            true,
        );
        let first_fill = client
            .dispatch
            .translate_fill_cloid(reconciliation_fill_report(
                instrument_id,
                client_order_index,
                first_venue_order_id,
                "19209006920",
            ));
        let second_fill = client
            .dispatch
            .translate_fill_cloid(reconciliation_fill_report(
                instrument_id,
                client_order_index,
                second_venue_order_id,
                "19209006921",
            ));
        let replacement = ClientOrderId::from("O-RECON-RETIRED-REPLACEMENT");
        let replacement_index = client
            .dispatch
            .register_cloid(client_order_index, replacement)
            .unwrap();

        assert!(!client.dispatch.cloid_map.contains_key(&client_order_index));
        assert!(!client.dispatch.order_identities.contains_key(&first_cloid));
        assert!(!client.dispatch.order_identities.contains_key(&second_cloid));
        assert_eq!(
            client.dispatch.client_order_index(&first_cloid),
            Some(client_order_index),
        );
        assert_eq!(
            client.dispatch.client_order_index(&second_cloid),
            Some(client_order_index),
        );
        assert_eq!(
            client
                .dispatch
                .resolve_client_order_index(client_order_index),
            None,
        );
        assert_eq!(first_fill.client_order_id, Some(first_cloid));
        assert_eq!(first_fill.venue_order_id, first_venue_order_id);
        assert_eq!(second_fill.client_order_id, Some(second_cloid));
        assert_eq!(second_fill.venue_order_id, second_venue_order_id);
        assert_ne!(replacement_index, client_order_index);
        assert_eq!(
            client
                .dispatch
                .resolve_client_order_index(replacement_index),
            Some(replacement),
        );
    }

    #[rstest]
    fn reconciliation_restores_triggered_marker() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = factory.stop_limit(
            instrument_id,
            OrderSide::Sell,
            Quantity::from("0.1000"),
            Price::from("2290.00"),
            Price::from("2300.00"),
            None,
            Some(TimeInForce::Gtc),
            None,
            Some(false),
            Some(false),
            Some(false),
            None,
            None,
            None,
            None,
            None,
            None,
            Some(ClientOrderId::from("O-RECON-TRIGGERED")),
        );
        let cloid = order.client_order_id();
        let venue_order_id = VenueOrderId::from("281476929510124");
        cache_accepted_order(&cache, order, venue_order_id, None);
        let triggered = OrderEventAny::Triggered(OrderTriggered::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            cloid,
            UUID4::new(),
            UnixNanos::from(1),
            UnixNanos::from(2),
            false,
            Some(venue_order_id),
            Some(account_id()),
        ));
        cache.borrow_mut().update_order(&triggered).unwrap();
        let (_, client_order_index) = forced_probed_index(cloid);
        let raw =
            reconciliation_raw_order(client_order_index, venue_order_id, LighterOrderStatus::Open);

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(raw.order_id.as_str()),
            raw.client_order_index,
            false,
        );

        assert!(client.dispatch.order_identities.contains_key(&cloid));
        assert!(client.dispatch.accepted_was_emitted(&cloid));
        assert!(client.dispatch.triggered_was_emitted(&cloid));
    }

    #[rstest]
    fn reconciliation_routes_reused_index_by_exact_venue_order_id() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let active_order = test_limit_order(&mut factory, instrument_id, "O-RECON-LIVE-ACTIVE");
        let retired_order = test_limit_order(&mut factory, instrument_id, "O-RECON-LIVE-RETIRED");
        let active_cloid = active_order.client_order_id();
        let retired_cloid = retired_order.client_order_id();
        let active_venue_order_id = VenueOrderId::from("281476929510125");
        let retired_venue_order_id = VenueOrderId::from("281476929510126");
        cache_accepted_order(
            &cache,
            active_order,
            active_venue_order_id,
            Some(client_id()),
        );
        cache_canceled_order(&cache, retired_order, retired_venue_order_id);
        let (_, client_order_index) = forced_probed_index(active_cloid);
        let active_raw = reconciliation_raw_order(
            client_order_index,
            active_venue_order_id,
            LighterOrderStatus::Open,
        );
        let retired_raw = reconciliation_raw_order(
            client_order_index,
            retired_venue_order_id,
            LighterOrderStatus::Canceled,
        );
        let raw_client_id = client_order_index.to_string();

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(active_raw.order_id.as_str()),
            active_raw.client_order_index,
            false,
        );
        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(retired_raw.order_id.as_str()),
            retired_raw.client_order_index,
            true,
        );

        assert_eq!(
            client
                .dispatch
                .resolve_live_order_cloid(&raw_client_id, active_venue_order_id,),
            Some(active_cloid),
        );
        assert_eq!(
            client
                .dispatch
                .resolve_live_order_cloid(&raw_client_id, retired_venue_order_id,),
            Some(retired_cloid),
        );
        assert_eq!(
            client
                .dispatch
                .resolve_live_trade_cloid(&raw_client_id, active_venue_order_id),
            Some(active_cloid),
        );
        assert_eq!(
            client
                .dispatch
                .resolve_live_trade_cloid(&raw_client_id, retired_venue_order_id),
            Some(retired_cloid),
        );
    }

    #[rstest]
    fn reconciliation_does_not_restore_from_numeric_client_index_alone() {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-RECON-NUMERIC-ONLY");
        let cloid = order.client_order_id();
        let client_order_index = client.dispatch.derive_client_order_index(&cloid);
        let venue_order_id = VenueOrderId::from("281476929510130");
        cache_order(&cache, order);
        let raw =
            reconciliation_raw_order(client_order_index, venue_order_id, LighterOrderStatus::Open);

        restore_reconciled_order(
            &client.core,
            &client.dispatch,
            VenueOrderId::new(raw.order_id.as_str()),
            raw.client_order_index,
            false,
        );
        let report = parse_http_order_to_report(
            &raw,
            &client.registry,
            account_id(),
            UnixNanos::from(1),
            &client.dispatch,
        )
        .unwrap();
        let translated = client.dispatch.translate_order_cloid(report);

        assert_eq!(client.dispatch.client_order_index(&cloid), None);
        assert_eq!(
            client
                .dispatch
                .resolve_client_order_index(client_order_index),
            None,
        );
        assert!(!client.dispatch.order_identities.contains_key(&cloid));
        assert_eq!(
            translated.client_order_id,
            Some(ClientOrderId::new(venue_order_id.as_str())),
        );
        assert_eq!(translated.venue_order_id, venue_order_id);
    }

    #[rstest]
    #[case::known_partner(true)]
    #[case::external_partner(false)]
    fn lookup_after_restart_preserves_collision_partner(#[case] partner_cached: bool) {
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "O-UNACKNOWLEDGED-PROBED");
        let cloid = order.client_order_id();
        let partner = test_limit_order(&mut factory, instrument_id, "O-COLLISION-PARTNER");
        let partner_cloid = partner.client_order_id();
        let venue_order_id = VenueOrderId::from("281476929510140");
        let source = WsDispatchState::new();
        let base_index = source.derive_client_order_index(&cloid);
        source.register_cloid(base_index, partner_cloid).unwrap();
        let selected_index = source.register_cloid(base_index, cloid).unwrap();
        cache_order(&cache, order);

        let submitted = OrderSubmitted::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            cloid,
            account_id(),
            UUID4::new(),
            UnixNanos::from(1),
            UnixNanos::from(2),
        );
        cache
            .borrow_mut()
            .update_order(&OrderEventAny::Submitted(submitted))
            .unwrap();

        if partner_cached {
            cache_accepted_order(&cache, partner, venue_order_id, Some(client_id()));
            restore_reconciled_order(
                &client.core,
                &client.dispatch,
                venue_order_id,
                base_index,
                false,
            );
        }

        let raw = reconciliation_raw_order(base_index, venue_order_id, LighterOrderStatus::Open);
        let lookup = OrderReportLookup::new(
            &client.registry,
            &client.dispatch,
            Some(instrument_id),
            Some(&cloid),
            None,
        )
        .unwrap();
        let parsed = lookup
            .parse(
                &raw,
                &client.registry,
                account_id(),
                UnixNanos::from(3),
                &client.dispatch,
            )
            .unwrap();

        let expected_cloid = if partner_cached {
            partner_cloid
        } else {
            ClientOrderId::new(venue_order_id.as_str())
        };

        let expected = parsed.0.clone().with_client_order_id(expected_cloid);
        let report = lookup.finish(&client.dispatch, parsed);
        let cached = cache.borrow().order_owned(&cloid).unwrap();

        assert_eq!(selected_index, base_index + 1);
        assert_eq!(
            serde_json::to_value(&report).unwrap(),
            serde_json::to_value(&expected).unwrap()
        );
        assert_eq!(cached.status(), OrderStatus::Submitted);
        assert_eq!(cached.venue_order_id(), None);
        assert_eq!(client.dispatch.client_order_index(&cloid), None);
    }

    fn forced_probed_index(cloid: ClientOrderId) -> (i64, i64) {
        let source = WsDispatchState::new();
        let base_index = source.derive_client_order_index(&cloid);
        source
            .cloid_map
            .insert(base_index, ClientOrderId::from("O-FORCED-COLLISION"));
        let client_order_index = source.register_cloid(base_index, cloid).unwrap();
        (base_index, client_order_index)
    }

    fn reconciliation_raw_order(
        client_order_index: i64,
        venue_order_id: VenueOrderId,
        status: LighterOrderStatus,
    ) -> LighterOrder {
        let rig = dispatcher_rig("RECONCILIATION-RAW");
        let mut raw = dispatcher_test_order(&rig, status);
        raw.order_index = venue_order_id.as_str().parse().unwrap();
        raw.order_id = venue_order_id.to_string();
        raw.client_order_index = client_order_index;
        raw.client_order_id = client_order_index.to_string();
        raw
    }

    fn cache_canceled_order(
        cache: &Rc<RefCell<Cache>>,
        order: OrderAny,
        venue_order_id: VenueOrderId,
    ) {
        let (instrument_id, client_order_id) =
            cache_accepted_order(cache, order, venue_order_id, Some(client_id()));
        let canceled = OrderEventAny::Canceled(OrderCanceled::new(
            trader_id(),
            strategy_id(),
            instrument_id,
            client_order_id,
            UUID4::new(),
            UnixNanos::from(1),
            UnixNanos::from(2),
            false,
            Some(venue_order_id),
            Some(account_id()),
            None,
        ));
        cache.borrow_mut().update_order(&canceled).unwrap();
    }

    fn reconciliation_fill_report(
        instrument_id: InstrumentId,
        client_order_index: i64,
        venue_order_id: VenueOrderId,
        trade_id: &str,
    ) -> FillReport {
        FillReport::new(
            account_id(),
            instrument_id,
            venue_order_id,
            TradeId::new(trade_id),
            OrderSide::Buy,
            Quantity::from("0.1336"),
            Price::from("2352.73"),
            Money::from("0.000196 USDC"),
            LiquiditySide::Taker,
            Some(ClientOrderId::new(client_order_index.to_string())),
            None,
            UnixNanos::from(1),
            UnixNanos::from(2),
            Some(UUID4::new()),
        )
    }

    #[rstest]
    fn dispatch_lighter_order_seeds_snapshot_after_synthesized_accept() {
        // After a synthesized `OrderAccepted` (fill-before-open), the
        // next `Open` frame must seed the shape snapshot even when the
        // parser returns None. Without the seed, shape_changed stays
        // permanently false and a later modify is lost.
        let mut rig = dispatcher_rig("9");
        register_identity(&rig);

        let order = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );
        assert_eq!(drain_events(&mut rig.rx).len(), 2);
        assert!(rig.dispatch.accepted_was_emitted(&rig.cloid));
        assert!(
            rig.dispatch.snapshot_for(&rig.cloid).is_none(),
            "synthesized Accept has no snapshot until the Open frame seeds one",
        );

        // Open frame lands later (matches venue ordering). Parser
        // returns None (already accepted, shape unchanged) but the
        // dispatcher must still seed the snapshot baseline.
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );
        assert!(
            rig.dispatch.snapshot_for(&rig.cloid).is_some(),
            "Open frame after synthesized accept must seed the snapshot",
        );

        // A real modify must now fire Updated.
        let mut modified = order;
        modified.price = Decimal::from_str("2400.00").unwrap();
        dispatch_lighter_order(
            &modified,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        let events = drain_events(&mut rig.rx);
        let updated = events
            .iter()
            .find(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Updated(_))));
        assert!(
            updated.is_some(),
            "real modify must produce Updated, events={events:?}"
        );
    }

    fn enqueue_create(client: &LighterExecutionClient, order: &OrderAny, nonce: i64) -> i64 {
        let client_order_index = client
            .dispatch
            .derive_client_order_index(&order.client_order_id());
        client
            .dispatch
            .register_cloid(client_order_index, order.client_order_id())
            .unwrap();
        client.dispatch.register_order_identity(
            order.client_order_id(),
            OrderIdentity::new(
                order.instrument_id(),
                order.strategy_id(),
                order.order_side(),
                order.order_type(),
                client_order_index,
            ),
        );
        let now = UnixNanos::from(1_000_000_000);
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Create {
                order: Box::new(order.clone()),
                client_order_index,
            },
            submitted_at: now,
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });
        client.dispatch.nonce_manager.refresh(
            TEST_ACCOUNT_INDEX_I64,
            TEST_API_KEY_INDEX,
            nonce + 1,
        );
        let _ = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX);
        client_order_index
    }

    fn enqueue_other(client: &LighterExecutionClient, nonce: i64) {
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Other,
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });
    }

    #[rstest]
    #[case(serde_json::json!({"self_trade_behavior_mode": "reduce"}), LighterSelfTradeBehaviorMode::Reduce, LighterSelfTradeEqualityMode::AccountIndex)]
    #[case(serde_json::json!({"self_trade_equality_mode": "master_account_index"}), LighterSelfTradeBehaviorMode::ExpireMaker, LighterSelfTradeEqualityMode::MasterAccountIndex)]
    #[case(serde_json::json!({"market_order_slippage_bps": 37}), LighterSelfTradeBehaviorMode::ExpireMaker, LighterSelfTradeEqualityMode::AccountIndex)]
    fn resolve_self_trade_partial_params(
        #[case] value: serde_json::Value,
        #[case] behavior: LighterSelfTradeBehaviorMode,
        #[case] equality: LighterSelfTradeEqualityMode,
    ) {
        let (client, _cache, _rx) = create_execution_client();
        let params: Params = serde_json::from_value(value).unwrap();

        let attrs = client.resolve_create_attributes(Some(&params)).unwrap();

        assert_eq!(
            attrs,
            L2TxAttributes {
                self_trade_behavior_mode: Some(behavior),
                self_trade_equality_mode: Some(equality),
                ..Default::default()
            }
        );
    }

    fn enqueue_cancel(
        client: &LighterExecutionClient,
        instrument_id: InstrumentId,
        client_order_id: ClientOrderId,
        venue_order_id: VenueOrderId,
        nonce: i64,
    ) {
        client
            .dispatch
            .set_pending_order_action(client_order_id, PendingOrderAction::Cancel);
        client
            .dispatch
            .set_pending_cancel_nonce(&client_order_id, 0, nonce, true);
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Cancel {
                emit_cancel_rejected: true,
                strategy_id: strategy_id(),
                instrument_id,
                client_order_id,
                venue_order_id: Some(venue_order_id),
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });
    }

    fn enqueue_modify(
        client: &LighterExecutionClient,
        instrument_id: InstrumentId,
        client_order_id: ClientOrderId,
        venue_order_id: VenueOrderId,
        nonce: i64,
    ) {
        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument_id,
            client_order_id,
            Some(venue_order_id),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        client.dispatch.set_pending_modify_action(&command);
        client.dispatch.set_pending_modify_shape(
            &command,
            OrderShapeSnapshot {
                quantity: command.quantity.unwrap(),
                price: command.price,
                trigger_price: command.trigger_price,
            },
        );

        client
            .dispatch
            .set_pending_modify_nonce(&client_order_id, command.command_id, 0, nonce);
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Modify {
                strategy_id: strategy_id(),
                instrument_id,
                client_order_id,
                venue_order_id: Some(venue_order_id),
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });
    }

    fn acked_probe_context(client: &LighterExecutionClient) -> AckedOrderProbeContext {
        AckedOrderProbeContext {
            http_client: client.http_client.clone(),
            registry: Arc::clone(&client.registry),
            credential: test_credential(),
            dispatch: client.dispatch.clone(),
            account_id: client.core.account_id,
            clock: client.clock,
            emitter: client.emitter.clone(),
            connection_epoch: client.ws_client.connection_epoch_atomic(),
            cancellation_token: client.cancellation_token.clone(),
            pending_tasks: client.pending_tasks.spawner().unwrap(),
        }
    }

    fn failed_modify_tx(pending: &PendingSendTx) -> LighterTx {
        LighterTx {
            code: 200,
            message: None,
            hash: pending.tx_hash.clone(),
            tx_type: LighterTxType::ModifyOrder as u8,
            info: String::new(),
            event_info: serde_json::json!({"ae":"invalid order price"}).to_string(),
            status: LighterTxStatus::Failed,
            account_index: TEST_ACCOUNT_INDEX_I64,
            nonce: pending.nonce,
            api_key_index: pending.api_key_index,
        }
    }

    #[rstest]
    #[case::hash("hash")]
    #[case::type_mismatch("type")]
    #[case::account("account")]
    #[case::key("key")]
    #[case::nonce("nonce")]
    #[tokio::test]
    async fn acknowledged_modify_requires_exact_transaction_identity(#[case] mismatch: &str) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("MODIFY-IDENTITY");
        enqueue_modify(&client, instrument, id, VenueOrderId::from("789"), 23);
        let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
        let mut tx = failed_modify_tx(&pending);
        match mismatch {
            "hash" => tx.hash = "different".to_string(),
            "type" => tx.tx_type = LighterTxType::CancelOrder as u8,
            "account" => tx.account_index += 1,
            "key" => tx.api_key_index += 1,
            "nonce" => tx.nonce += 1,
            _ => unreachable!(),
        }

        let result = resolve_acked_action(&pending, &acked_probe_context(&client), tx).await;
        assert_eq!(
            result.unwrap_err().to_string(),
            "Lighter transaction lookup did not match acknowledged action identity"
        );
        assert_eq!(client.dispatch.pending_modify_nonce(&id), Some((0, 23)));
        assert_eq!(
            client.dispatch.pending_order_action(&id),
            Some(PendingOrderAction::Modify)
        );
        assert!(rx.try_recv().is_err());
    }

    #[rstest]
    #[case::failed_status(LighterTxStatus::Failed, "", true)]
    #[case::malformed_failed_status(LighterTxStatus::Failed, "invalid json", true)]
    #[case::application_error(LighterTxStatus::Executed, "application", true)]
    #[case::pending(LighterTxStatus::Pending, "", false)]
    #[case::pending_final(LighterTxStatus::PendingFinal, "", false)]
    #[tokio::test]
    async fn acknowledged_modify_outcomes_consume_only_matching_action(
        #[case] status: LighterTxStatus,
        #[case] event_info: &str,
        #[case] failed: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("MODIFY-OUTCOME");
        let venue = VenueOrderId::from("789");
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        enqueue_modify(&client, instrument, id, venue, nonce);
        let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
        let context = acked_probe_context(&client);
        let mut tx = failed_modify_tx(&pending);
        tx.status = status;

        tx.event_info = if event_info == "application" {
            serde_json::json!({"ae":"invalid order price"}).to_string()
        } else {
            event_info.to_string()
        };

        let resolved = resolve_acked_action(&pending, &context, tx.clone())
            .await
            .unwrap();
        assert_eq!(resolved, failed);

        if failed {
            let OrderEventAny::ModifyRejected(event) = recv_order_event(&mut rx).await else {
                panic!("expected ModifyRejected")
            };

            assert_eq!(event.client_order_id, id);
            assert_eq!(event.venue_order_id, Some(venue));
            assert_eq!(event.instrument_id, instrument);
            assert_eq!(event.strategy_id, strategy_id());
            assert_eq!(
                event.reason.as_str(),
                if event_info == "application" {
                    "Lighter modify transaction failed: invalid order price"
                } else {
                    "Lighter modify transaction failed: transaction failed without an application error"
                }
            );
            assert_eq!(client.dispatch.pending_modify_nonce(&id), None);
            assert_eq!(client.dispatch.pending_order_action(&id), None);
            assert!(resolve_acked_action(&pending, &context, tx).await.unwrap());
        } else {
            assert_eq!(client.dispatch.pending_modify_nonce(&id), Some((0, nonce)));
        }

        assert!(rx.try_recv().is_err());
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            nonce + 1
        );
    }

    #[rstest]
    #[case::empty_error("")]
    #[case::malformed_error("invalid json")]
    #[tokio::test]
    async fn acknowledged_cancel_failure_consumes_action_once(
        #[case] event_info: &str,
        #[values(false, true)] emit_rejected: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("CANCEL-FAILED");
        let venue = VenueOrderId::from("789");
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        enqueue_cancel(&client, instrument, id, venue, nonce);
        let mut pending = client.dispatch.pop_pending_sendtx_head().unwrap();

        if let PendingSendTxKind::Cancel {
            emit_cancel_rejected,
            ..
        } = &mut pending.kind
        {
            *emit_cancel_rejected = emit_rejected;
        }

        client
            .dispatch
            .set_pending_order_action(id, PendingOrderAction::cancel(emit_rejected));
        client
            .dispatch
            .set_pending_cancel_nonce(&id, 0, nonce, emit_rejected);
        let mut tx = failed_modify_tx(&pending);
        tx.tx_type = LighterTxType::CancelOrder as u8;
        tx.event_info = event_info.to_string();
        let context = acked_probe_context(&client);
        let resolved = resolve_acked_action(&pending, &context, tx.clone())
            .await
            .unwrap();

        if emit_rejected {
            let OrderEventAny::CancelRejected(event) = recv_order_event(&mut rx).await else {
                panic!("expected CancelRejected")
            };

            assert_eq!(event.client_order_id, id);
            assert_eq!(event.venue_order_id, Some(venue));
            assert_eq!(event.instrument_id, instrument);
            assert_eq!(event.strategy_id, strategy_id());
            assert_eq!(
                event.reason.as_str(),
                "Lighter cancel transaction failed: transaction failed without an application error"
            );
        }

        let duplicate_resolved = resolve_acked_action(&pending, &context, tx).await.unwrap();
        assert!(resolved);
        assert!(duplicate_resolved);
        assert_eq!(client.dispatch.pending_cancel_nonce(&id), None);
        assert_eq!(client.dispatch.pending_order_action(&id), None);
        assert!(rx.try_recv().is_err());
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX,)
                .unwrap(),
            nonce + 1
        );
    }

    #[rstest]
    #[case::newer_nonce(false)]
    #[case::reconnected(true)]
    #[tokio::test]
    async fn acknowledged_modify_does_not_consume_newer_submission(#[case] reconnected: bool) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("MODIFY-NEWER");
        let venue = VenueOrderId::from("789");
        enqueue_modify(&client, instrument, id, venue, 23);
        let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
        let context = acked_probe_context(&client);
        client.dispatch.clear_pending_modify_if_nonce(&id, 0, 23);

        if reconnected {
            context.connection_epoch.store(1, Ordering::Release);
            enqueue_modify(&client, instrument, id, venue, 24);
        } else {
            enqueue_modify(&client, instrument, id, venue, 24);
        }

        assert!(
            resolve_acked_action(&pending, &context, failed_modify_tx(&pending))
                .await
                .unwrap()
        );
        assert_eq!(client.dispatch.pending_modify_nonce(&id), Some((0, 24)));
        assert!(rx.try_recv().is_err());
    }

    #[rstest]
    fn queued_modify_cannot_bind_a_newer_command() {
        let (client, cache, _rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("MODIFY-QUEUED");

        let mut cmd = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            instrument,
            id,
            Some(VenueOrderId::from("789")),
            Some(Quantity::from("0.2000")),
            Some(Price::from("2362.00")),
            None,
            UUID4::new(),
            UnixNanos::default(),
            None,
            None,
        );
        let old_command = cmd.command_id;
        let old_cmd = cmd.clone();
        client.dispatch.set_pending_modify_action(&cmd);
        assert!(
            client
                .dispatch
                .clear_pending_modify_if_command(&id, old_command)
        );
        cmd.command_id = UUID4::new();
        cmd.price = Some(Price::from("2363.00"));
        client.dispatch.set_pending_modify_action(&cmd);
        client.dispatch.set_pending_modify_shape(
            &cmd,
            OrderShapeSnapshot {
                quantity: cmd.quantity.unwrap(),
                price: cmd.price,
                trigger_price: cmd.trigger_price,
            },
        );

        client.dispatch.set_pending_modify_shape(
            &old_cmd,
            OrderShapeSnapshot {
                quantity: old_cmd.quantity.unwrap(),
                price: old_cmd.price,
                trigger_price: old_cmd.trigger_price,
            },
        );

        client
            .dispatch
            .set_pending_modify_nonce(&id, old_command, 0, 23);
        assert_eq!(client.dispatch.pending_modify_nonce(&id), None);
        assert!(
            !client
                .dispatch
                .clear_pending_modify_if_command(&id, old_command)
        );
        assert_eq!(
            client.dispatch.pending_order_action(&id),
            Some(PendingOrderAction::Modify)
        );
        client
            .dispatch
            .set_pending_modify_nonce(&id, cmd.command_id, 0, 24);
        client.dispatch.clear_pending_modify_if_update(
            &id,
            Quantity::from("0.2000"),
            Some(Price::from("2362.00")),
            None,
        );
        assert_eq!(client.dispatch.pending_modify_nonce(&id), Some((0, 24)));
        client.dispatch.clear_pending_modify_if_update(
            &id,
            Quantity::from("0.2000"),
            Some(Price::from("2363.00")),
            None,
        );
        assert_eq!(client.dispatch.pending_order_action(&id), None);
    }

    #[tokio::test]
    async fn handle_send_tx_ack_removes_hash_matched_entry() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order_a = test_limit_order(&mut factory, instrument_id, "ACK-A");
        let order_b = test_limit_order(&mut factory, instrument_id, "ACK-B");
        enqueue_create(&client, &order_a, 10);
        enqueue_create(&client, &order_b, 11);

        // Out-of-order ack: B's hash must remove B even though A is at head.
        let acked = handle_send_tx_ack(
            &client.dispatch,
            Some(TEST_ACCOUNT_INDEX_I64),
            200,
            Some("hash0b"),
        );

        let acked = acked.expect("create ack");
        assert!(matches!(acked.kind, PendingSendTxKind::Create { .. }));
        assert!(matches!(
            AckedOrderProbe::from_pending(&acked),
            Some(AckedOrderProbe {
                nonce: 11,
                connection_epoch: 0,
                ..
            }),
        ));
        assert_eq!(client.dispatch.pending_sendtx_len(), 1, "only B pops");
        let head = client.dispatch.pop_pending_sendtx_head().unwrap();
        match head.kind {
            PendingSendTxKind::Create { order, .. } => {
                assert_eq!(order.client_order_id(), order_a.client_order_id());
            }
            _ => panic!("expected Create kind"),
        }

        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "ack must not emit an event",
        );
    }

    #[rstest]
    #[case::executed(LighterTxStatus::Executed, false)]
    #[case::pending_final(LighterTxStatus::PendingFinal, true)]
    #[tokio::test]
    async fn acknowledged_create_probe_retains_unqueryable_order(
        #[case] status: LighterTxStatus,
        #[case] pending: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "PROBE-UNQUERYABLE");
        let index = enqueue_create(&client, &order, TEST_SUBMISSION_NONCE);
        let submission = client.dispatch.pop_pending_sendtx_head().unwrap();

        let tx = LighterTx {
            code: 200,
            message: None,
            hash: submission.tx_hash.clone(),
            tx_type: LighterTxType::CreateOrder as u8,
            info: serde_json::json!({"ClientOrderIndex": index}).to_string(),
            event_info: serde_json::json!({"ae": ""}).to_string(),
            status,
            account_index: TEST_ACCOUNT_INDEX_I64,
            nonce: TEST_SUBMISSION_NONCE,
            api_key_index: TEST_API_KEY_INDEX,
        };

        let (http_client, server) = spawn_create_probe_server(&tx).await;
        let mut context = acked_probe_context(&client);
        context.http_client = http_client;
        let cloid = order.client_order_id();
        assert!(
            client
                .dispatch
                .create_submission_is_pending(&cloid, index, TEST_SUBMISSION_NONCE)
        );

        probe_acked_create(
            &AckedOrderProbe::from_pending(&submission).unwrap(),
            &context,
        )
        .await
        .unwrap();
        server.abort();
        let _ = server.await;

        let identity = client.dispatch.order_identity(&cloid).unwrap();
        assert_eq!(
            client
                .dispatch
                .create_submission_is_pending(&cloid, index, TEST_SUBMISSION_NONCE),
            pending
        );
        assert_eq!(identity.instrument_id, instrument_id);
        assert_eq!(identity.strategy_id, strategy_id());
        assert_eq!(identity.order_side, order.order_side());
        assert_eq!(identity.order_type, order.order_type());
        assert_eq!(identity.client_order_index, index);
        assert_eq!(identity.venue_order_id(), None);
        assert!(!client.dispatch.accepted_was_emitted(&cloid));
        assert!(!client.dispatch.venue_id_map.contains_key(&cloid));
        assert_eq!(
            client.dispatch.cloid_map.get(&index).map(|id| *id),
            Some(cloid)
        );
        assert!(drain_events(&mut rx).is_empty());
    }

    #[rstest]
    #[case::hash("hash")]
    #[case::type_mismatch("type")]
    #[case::account("account")]
    #[case::key("key")]
    #[case::nonce("nonce")]
    #[case::index("index")]
    #[tokio::test]
    async fn acknowledged_create_probe_requires_exact_http_transaction_identity(
        #[case] mismatch: &str,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "PROBE-IDENTITY");
        let index = enqueue_create(&client, &order, TEST_SUBMISSION_NONCE);
        let submission = client.dispatch.pop_pending_sendtx_head().unwrap();

        let mut tx = LighterTx {
            code: 200,
            message: None,
            hash: submission.tx_hash.clone(),
            tx_type: LighterTxType::CreateOrder as u8,
            info: serde_json::json!({"ClientOrderIndex": index}).to_string(),
            event_info: serde_json::json!({"ae": "foreign transaction failed"}).to_string(),
            status: LighterTxStatus::Failed,
            account_index: TEST_ACCOUNT_INDEX_I64,
            nonce: TEST_SUBMISSION_NONCE,
            api_key_index: TEST_API_KEY_INDEX,
        };

        match mismatch {
            "hash" => tx.hash = "foreign".to_string(),
            "type" => tx.tx_type = LighterTxType::CancelOrder as u8,
            "account" => tx.account_index += 1,
            "key" => tx.api_key_index += 1,
            "nonce" => tx.nonce += 1,
            "index" => tx.info = serde_json::json!({"ClientOrderIndex": index + 1}).to_string(),
            _ => unreachable!(),
        }

        let (http_client, server) = spawn_create_probe_server(&tx).await;
        let mut context = acked_probe_context(&client);
        context.http_client = http_client;
        let error = probe_acked_create(
            &AckedOrderProbe::from_pending(&submission).unwrap(),
            &context,
        )
        .await
        .unwrap_err();
        server.abort();
        let _ = server.await;

        let expected = if mismatch == "index" {
            format!(
                "Lighter transaction lookup returned client_order_index {} for acknowledged create {index}",
                index + 1
            )
        } else {
            "Lighter transaction lookup did not match acknowledged create identity".to_string()
        };

        let cloid = order.client_order_id();
        assert_eq!(error.to_string(), expected);
        assert!(
            client
                .dispatch
                .create_submission_is_pending(&cloid, index, TEST_SUBMISSION_NONCE)
        );
        assert_eq!(
            client
                .dispatch
                .order_identity(&cloid)
                .unwrap()
                .client_order_index,
            index
        );
        assert_eq!(
            client.dispatch.cloid_map.get(&index).map(|id| *id),
            Some(cloid)
        );
        assert!(!client.dispatch.accepted_was_emitted(&cloid));
        assert!(!client.dispatch.venue_id_map.contains_key(&cloid));
        assert!(drain_events(&mut rx).is_empty());
    }

    async fn spawn_create_probe_server(
        tx: &LighterTx,
    ) -> (LighterHttpClient, tokio::task::JoinHandle<()>) {
        let body = serde_json::to_string(tx).unwrap();

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { r#"{"code":200,"orders":[]}"# }),
            )
            .route(
                "/api/v1/tx",
                get(move || {
                    let body = body.clone();
                    async move { body }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        (client, server)
    }

    #[rstest]
    fn acknowledged_create_tx_validation_requires_exact_identity() {
        let tx = LighterTx {
            code: 200,
            message: None,
            hash: "ABCDEF".to_string(),
            tx_type: LighterTxType::CreateOrder as u8,
            info: serde_json::json!({"ClientOrderIndex": 42}).to_string(),
            event_info: serde_json::json!({"ae": ""}).to_string(),
            status: LighterTxStatus::Failed,
            account_index: TEST_ACCOUNT_INDEX_I64,
            nonce: 10,
            api_key_index: TEST_API_KEY_INDEX,
        };
        assert!(
            validate_acked_create_tx(
                &tx,
                TEST_ACCOUNT_INDEX_I64,
                TEST_API_KEY_INDEX,
                42,
                10,
                "0xabcdef",
            )
            .is_ok(),
        );

        let mismatches = [
            LighterTx {
                hash: "different".to_string(),
                ..tx.clone()
            },
            LighterTx {
                tx_type: LighterTxType::CancelOrder as u8,
                ..tx.clone()
            },
            LighterTx {
                account_index: TEST_ACCOUNT_INDEX_I64 + 1,
                ..tx.clone()
            },
            LighterTx {
                nonce: 11,
                ..tx.clone()
            },
            LighterTx {
                api_key_index: TEST_API_KEY_INDEX + 1,
                ..tx.clone()
            },
        ];

        for mismatch in mismatches {
            let error = validate_acked_create_tx(
                &mismatch,
                TEST_ACCOUNT_INDEX_I64,
                TEST_API_KEY_INDEX,
                42,
                10,
                "abcdef",
            )
            .expect_err("mismatched transaction identity must fail");
            assert_eq!(
                error.to_string(),
                "Lighter transaction lookup did not match acknowledged create identity",
            );
        }

        let wrong_index = LighterTx {
            info: serde_json::json!({"ClientOrderIndex": 43}).to_string(),
            ..tx
        };

        let error = validate_acked_create_tx(
            &wrong_index,
            TEST_ACCOUNT_INDEX_I64,
            TEST_API_KEY_INDEX,
            42,
            10,
            "abcdef",
        )
        .expect_err("mismatched client order index must fail");
        assert_eq!(
            error.to_string(),
            "Lighter transaction lookup returned client_order_index 43 for acknowledged create 42",
        );
    }

    #[rstest]
    #[case(41, true)]
    #[case(42, true)]
    #[case(43, true)]
    #[case(44, false)]
    fn acknowledged_group_tx_validation_requires_membership(
        #[case] client_order_index: i64,
        #[case] expected: bool,
    ) {
        let tx = LighterTx {
            code: 200,
            message: None,
            hash: "ABCDEF".to_string(),
            tx_type: LighterTxType::CreateGroupedOrders as u8,
            info: serde_json::json!({"Orders": [
                {"ClientOrderIndex": 41}, {"ClientOrderIndex": 42}, {"ClientOrderIndex": 43}
            ]})
            .to_string(),
            event_info: serde_json::json!({"ae": ""}).to_string(),
            status: LighterTxStatus::Executed,
            account_index: TEST_ACCOUNT_INDEX_I64,
            nonce: 10,
            api_key_index: TEST_API_KEY_INDEX,
        };

        let result = validate_acked_create_tx(
            &tx,
            TEST_ACCOUNT_INDEX_I64,
            TEST_API_KEY_INDEX,
            client_order_index,
            10,
            "0xabcdef",
        );
        assert_eq!(result.is_ok(), expected);

        if !expected {
            assert_eq!(
                result.unwrap_err().to_string(),
                "Lighter transaction lookup did not include acknowledged client_order_index 44"
            );
        }
    }

    #[tokio::test]
    async fn send_tx_responses_only_attribute_within_their_connection_epoch() {
        let (client, _cache, mut rx) = create_execution_client();
        for (connection_epoch, nonce) in [(4, 20), (5, 21)] {
            client.dispatch.enqueue_pending_sendtx(PendingSendTx {
                batch_id: None,
                connection_epoch,
                kind: PendingSendTxKind::Other,
                submitted_at: UnixNanos::from(1_000_000_000 + nonce as u64),
                nonce,
                api_key_index: TEST_API_KEY_INDEX,
                tx_hash: "same-hash".to_string(),
            });
        }

        let acked =
            handle_send_tx_ack_for_connection(&client.dispatch, None, 5, 200, Some("same-hash"))
                .expect("replacement epoch response should match");
        assert_eq!(acked.connection_epoch, 5);
        assert_eq!(acked.nonce, 21);
        {
            let queue = client.dispatch.pending_sendtx.lock();
            assert_eq!(queue.len(), 1);
            assert_eq!(queue[0].connection_epoch, 4);
            assert_eq!(queue[0].nonce, 20);
        }

        assert!(!handle_send_tx_rejection_for_connection(
            &client.dispatch,
            &client.emitter,
            None,
            4,
            UnixNanos::from(1_000_000_100),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            Some("same-hash"),
        ));
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "non-order responses must not emit order events",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_ack_unmatched_hash_pops_nothing() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "ACK-UNMATCHED");
        enqueue_create(&client, &order, 10);

        let acked = handle_send_tx_ack(
            &client.dispatch,
            Some(TEST_ACCOUNT_INDEX_I64),
            200,
            Some("0xabc"),
        );

        assert!(acked.is_none());
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            1,
            "an echoed hash with no matching entry must not pop the head",
        );
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "unmatched ack must not emit an event",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_ack_hashless_with_multiple_pending_pops_nothing() {
        let (client, _cache, _rx) = create_execution_client();
        enqueue_other(&client, 10);
        enqueue_other(&client, 11);

        let acked = handle_send_tx_ack(&client.dispatch, Some(TEST_ACCOUNT_INDEX_I64), 200, None);

        assert!(acked.is_none());
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            2,
            "a hashless ack is ambiguous when multiple transactions are pending",
        );
    }

    #[tokio::test]
    async fn prepared_create_tx_hash_round_trips_through_ack() {
        // The hash prepare threads into the queue must be the lowercase hex
        // form a venue ack echoes, or every live ack goes unattributed.
        let (client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "ACK-REAL-HASH");

        let credential = test_credential();
        let plan = client
            .prepare_create_order_plan(&order, 0, None)
            .expect("prepare must validate");
        let prepared = client
            .fanout_dispatch_context(&credential)
            .expect("task admission")
            .sign_create_order(&plan)
            .expect("prepare must sign");

        assert_eq!(prepared.tx_hash.len(), TX_HASH_BYTES * 2);
        assert!(
            prepared
                .tx_hash
                .chars()
                .all(|c| matches!(c, '0'..='9' | 'a'..='f')),
            "tx_hash must be lowercase hex, was `{}`",
            prepared.tx_hash,
        );

        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Create {
                order: Box::new(order),
                client_order_index: prepared.client_order_index,
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce: prepared.nonce,
            api_key_index: prepared.api_key_index,
            tx_hash: prepared.tx_hash.clone(),
        });

        let acked = handle_send_tx_ack(
            &client.dispatch,
            Some(TEST_ACCOUNT_INDEX_I64),
            200,
            Some(&prepared.tx_hash),
        );

        assert!(acked.is_some());
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            0,
            "venue echo of the signed hash must match the enqueued entry",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_ack_retains_cancel_for_transaction_probe() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("ACK-CANCEL-TX");
        let venue_order_id = VenueOrderId::from("123");
        enqueue_cancel(&client, instrument_id, client_order_id, venue_order_id, 12);

        let acked = handle_send_tx_ack(
            &client.dispatch,
            Some(TEST_ACCOUNT_INDEX_I64),
            200,
            Some("hash0c"),
        )
        .expect("acked cancel pending entry");
        assert!(AckedOrderProbe::from_pending(&acked).is_none());

        let PendingSendTxKind::Cancel {
            instrument_id: actual_instrument_id,
            client_order_id: actual_client_order_id,
            venue_order_id: actual_venue_order_id,
            emit_cancel_rejected,
            strategy_id: actual_strategy_id,
        } = acked.kind
        else {
            panic!("expected acknowledged cancel")
        };

        assert_eq!(actual_instrument_id, instrument_id);
        assert_eq!(actual_client_order_id, client_order_id);
        assert_eq!(actual_venue_order_id, Some(venue_order_id));
        assert_eq!(actual_strategy_id, strategy_id());
        assert!(emit_cancel_rejected);
        assert_eq!(acked.connection_epoch, 0);
        assert_eq!(acked.nonce, 12);
        assert_eq!(acked.api_key_index, TEST_API_KEY_INDEX);
        assert_eq!(acked.tx_hash, "hash0c");
        assert_eq!(
            client.dispatch.pending_cancel_nonce(&client_order_id),
            Some((0, 12))
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "ack itself must not emit before the transaction probe runs",
        );
    }

    #[rstest]
    #[tokio::test]
    async fn acknowledged_order_probe_is_retained_until_session_shutdown() {
        let (mut client, cache, _rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let pending = PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Cancel {
                emit_cancel_rejected: true,
                strategy_id: strategy_id(),
                instrument_id,
                client_order_id: ClientOrderId::from("ACK-RETAINED"),
                venue_order_id: Some(VenueOrderId::from("123")),
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce: 12,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "hash0c".to_string(),
        };
        let context = AckedOrderProbeContext {
            http_client: client.http_client.clone(),
            registry: Arc::clone(&client.registry),
            credential: test_credential(),
            dispatch: client.dispatch.clone(),
            account_id: client.core.account_id,
            clock: client.clock,
            emitter: client.emitter.clone(),
            connection_epoch: client.ws_client.connection_epoch_atomic(),
            cancellation_token: client.cancellation_token.clone(),
            pending_tasks: client.pending_tasks.spawner().expect("task spawner"),
        };

        spawn_acked_order_probe(&pending, context);

        assert_eq!(client.pending_tasks.len(), 1);

        client.begin_session_shutdown();
        client
            .finish_session_shutdown()
            .await
            .expect("session shutdown");

        assert!(client.pending_tasks.is_empty());
    }

    #[tokio::test]
    async fn handle_send_tx_ack_retains_modify_for_transaction_probe() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("ACK-MODIFY-TX");
        let venue_order_id = VenueOrderId::from("456");
        enqueue_modify(&client, instrument_id, client_order_id, venue_order_id, 13);

        let acked = handle_send_tx_ack(
            &client.dispatch,
            Some(TEST_ACCOUNT_INDEX_I64),
            200,
            Some("hash0d"),
        )
        .expect("acked modify pending entry");
        assert!(AckedOrderProbe::from_pending(&acked).is_none());

        match acked.kind {
            PendingSendTxKind::Modify {
                instrument_id: actual_instrument_id,
                client_order_id: actual_client_order_id,
                venue_order_id: actual_venue_order_id,
                ..
            } => {
                assert_eq!(actual_instrument_id, instrument_id);
                assert_eq!(actual_client_order_id, client_order_id);
                assert_eq!(actual_venue_order_id, Some(venue_order_id));
            }
            other => panic!("expected acknowledged modify, was {other:?}"),
        }

        assert_eq!(acked.connection_epoch, 0);
        assert_eq!(acked.nonce, 13);
        assert_eq!(acked.api_key_index, TEST_API_KEY_INDEX);
        assert_eq!(acked.tx_hash, "hash0d");
        assert_eq!(
            client.dispatch.pending_modify_nonce(&client_order_id),
            Some((0, 13))
        );
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "ack itself must not emit before the transaction probe runs",
        );
    }

    #[rstest]
    #[case::missing(false)]
    #[case::working(true)]
    #[tokio::test]
    async fn acknowledged_cancel_unresolved_status_retains_pending(#[case] found: bool) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("ACK-CANCEL-UNRESOLVED");
        let venue = VenueOrderId::from("123");
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument, id.as_str());
        let index = client.dispatch.register_create_identity(&order).unwrap();
        enqueue_cancel(&client, instrument, id, venue, 12);
        let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
        let order = reconciliation_raw_order(index, venue, LighterOrderStatus::Open);

        let orders = if found { vec![order] } else { vec![] };
        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(move || {
                    let orders = orders.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":orders})) }
                }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
        let mut context = acked_probe_context(&client);
        context.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        let resolved = recover_acked_action_report(&pending, &context)
            .await
            .unwrap();
        server.abort();
        let _ = server.await;
        assert!(!resolved);
        assert_eq!(client.dispatch.pending_cancel_nonce(&id), Some((0, 12)));
        assert_eq!(
            client.dispatch.pending_order_action(&id),
            Some(PendingOrderAction::Cancel)
        );
        let events = drain_events(&mut rx);
        if found {
            let [ExecutionEvent::Report(ExecutionReport::Order(report))] = events.as_slice() else {
                panic!("expected pending cancellation report, was {events:?}")
            };

            assert_eq!(report.client_order_id, Some(id));
            assert_eq!(report.venue_order_id, venue);
            assert_eq!(report.order_status, OrderStatus::PendingCancel);
        } else {
            assert!(events.is_empty());
        }
    }

    #[tokio::test]
    async fn send_tx_acks_recover_skip_window_past_window_size() {
        let (client, _cache, _rx) = create_execution_client();
        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            let nonce = client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
            enqueue_other(&client, nonce);
        }

        assert!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .is_err(),
            "window must trip after {window} unacked txs",
        );

        // Each venue ack reopens one slot, carrying issuance past 2x the
        // window without a refresh.
        for i in 0..window {
            let acked = handle_send_tx_ack(
                &client.dispatch,
                Some(TEST_ACCOUNT_INDEX_I64),
                200,
                Some(&format!("hash{:02x}", TEST_NEXT_NONCE + i)),
            );
            assert!(matches!(
                acked.map(|pending| pending.kind),
                Some(PendingSendTxKind::Other),
            ));
            let nonce = client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
            assert_eq!(nonce, TEST_NEXT_NONCE + window + i);
            enqueue_other(&client, nonce);
        }
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_rolls_back_latest_nonce() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "REJECT-LATEST");

        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        let client_order_index = client.dispatch.register_create_identity(&order).unwrap();
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Create {
                order: Box::new(order.clone()),
                client_order_index,
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        assert!(matches!(event, OrderEventAny::Rejected(_)));
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_hashless_with_multiple_pending_is_unattributed() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order_a = test_limit_order(&mut factory, instrument_id, "REJECT-AMBIGUOUS-A");
        let order_b = test_limit_order(&mut factory, instrument_id, "REJECT-AMBIGUOUS-B");
        enqueue_create(&client, &order_a, 10);
        enqueue_create(&client, &order_b, 11);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            None,
        );

        assert_eq!(client.dispatch.pending_sendtx_len(), 2);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "an ambiguous hashless rejection must not reject either order",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_with_newer_issuance_skips_rollback() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "REJECT-STALE");

        let rejected_nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        let newer_nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        let client_order_index = client.dispatch.register_create_identity(&order).unwrap();
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Create {
                order: Box::new(order.clone()),
                client_order_index,
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce: rejected_nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{rejected_nonce:02x}"),
        });

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        assert!(matches!(event, OrderEventAny::Rejected(_)));
        // The newer nonce is signed into an in-flight tx: the failed nonce
        // must not be freed for reissue.
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(newer_nonce),
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            newer_nonce + 1,
        );
    }

    async fn spawn_next_nonce_server(nonce: i64) -> String {
        let body = serde_json::to_string(&LighterNextNonce {
            code: 200,
            message: None,
            nonce,
        })
        .unwrap();

        let app = Router::new().route(
            "/api/v1/nextNonce",
            get(move || {
                let body = body.clone();
                async move { body }
            }),
        );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        format!("http://{addr}")
    }

    async fn spawn_counting_next_nonce_server(nonce: i64) -> (String, Arc<AtomicUsize>) {
        let requests = Arc::new(AtomicUsize::new(0));
        let requests_for_route = Arc::clone(&requests);

        let body = serde_json::to_string(&LighterNextNonce {
            code: 200,
            message: None,
            nonce,
        })
        .unwrap();

        let app = Router::new().route(
            "/api/v1/nextNonce",
            get(move || {
                requests_for_route.fetch_add(1, Ordering::SeqCst);
                let body = body.clone();
                async move { body }
            }),
        );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        (format!("http://{addr}"), requests)
    }

    #[tokio::test]
    async fn hard_nonce_refresh_waits_for_submission_and_replaces_its_baseline() {
        let (base_url_http, requests) = spawn_counting_next_nonce_server(100).await;
        let mut config = test_config();
        config.base_url_http = Some(base_url_http);
        let (client, _cache, _rx) = create_execution_client_with_config(config);
        let credential = test_credential();
        client
            .dispatch
            .nonce_manager
            .refresh(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, 40);

        let reserved = client.build_tx_context(&credential).unwrap();
        assert_eq!(reserved.context.nonce, 40);
        let mut refresh = Box::pin(client.refresh_nonce());
        assert!(
            tokio::time::timeout(Duration::from_millis(50), refresh.as_mut())
                .await
                .is_err(),
            "hard refresh must wait while a submission retains its nonce",
        );
        assert_eq!(requests.load(Ordering::SeqCst), 0);
        assert_eq!(
            client.nonce_ready_connection_epoch.load(Ordering::Acquire),
            NONCE_CONNECTION_EPOCH_UNAVAILABLE,
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(40),
        );

        drop(reserved);
        refresh.await.unwrap();

        assert_eq!(requests.load(Ordering::SeqCst), 1);
        assert_eq!(
            client.nonce_ready_connection_epoch.load(Ordering::Acquire),
            NONCE_CONNECTION_EPOCH_UNAVAILABLE,
        );
        client
            .nonce_ready_connection_epoch
            .store(client.ws_client.connection_epoch(), Ordering::Release);
        let next = client.build_tx_context(&credential).unwrap();
        assert_eq!(next.context.nonce, 100);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(100),
        );
    }

    #[tokio::test]
    async fn nonce_refresh_retry_reopens_submission_with_replacement_baseline() {
        let (base_url_http, requests) = spawn_counting_next_nonce_server(100).await;
        let mut config = test_config();
        config.base_url_http = Some(base_url_http);
        let (client, _cache, _rx) = create_execution_client_with_config(config);
        let credential = test_credential();
        let connection_epoch = client.ws_client.connection_epoch();
        client
            .dispatch
            .nonce_manager
            .refresh(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX, 40);
        client
            .nonce_ready_connection_epoch
            .store(NONCE_CONNECTION_EPOCH_UNAVAILABLE, Ordering::Release);

        NonceRefreshRetry {
            http_client: client.http_client.clone(),
            dispatch: client.dispatch.clone(),
            credential: Some(credential.clone()),
            submission_gate: Arc::clone(&client.nonce_submission_gate),
            ready_connection_epoch: Arc::clone(&client.nonce_ready_connection_epoch),
            ws_client: client.ws_client.clone(),
            cancellation_token: client.cancellation_token.clone(),
            pending_tasks: client.pending_tasks.spawner().expect("task spawner"),
        }
        .spawn(connection_epoch);

        assert_eq!(client.pending_tasks.len(), 1);

        let err = client
            .build_tx_context(&credential)
            .expect_err("submission must stay closed until retry succeeds");
        assert_eq!(
            err.to_string(),
            format!("Lighter nonce refresh is pending for connection epoch {connection_epoch}"),
        );
        wait_until_async(
            || async {
                client.nonce_ready_connection_epoch.load(Ordering::Acquire) == connection_epoch
            },
            Duration::from_secs(3),
        )
        .await;

        let reserved = client.build_tx_context(&credential).unwrap();
        assert_eq!(requests.load(Ordering::SeqCst), 1);
        assert_eq!(reserved.context.nonce, 100);
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .baseline(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(99),
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(100),
        );
        assert!(client.pending_tasks.all_finished());
    }

    async fn spawn_integrator_approval_rejection_server() -> String {
        let app = Router::new()
            .route(
                "/api/v1/getMakerOnlyApiKeys",
                get(|| async { r#"{"code":200,"api_key_indexes":[]}"# }),
            )
            .route(
                "/api/v1/sendTx",
                post(|| async { r#"{"code":21702,"message":"invalid approval"}"# }),
            );
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        format!("http://{addr}")
    }

    #[tokio::test]
    async fn integrator_approval_api_rejection_releases_reservation_and_nonce() {
        let mut config = test_config();
        config.environment = LighterEnvironment::Mainnet;
        config.base_url_http = Some(spawn_integrator_approval_rejection_server().await);
        let (client, _cache, _rx) = create_execution_client_with_config(config);

        let err = client.submit_integrator_auto_approval().await.unwrap_err();

        assert!(format!("{err:#}").contains("invalid approval"));
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn skip_window_exhaustion_resyncs_baseline_from_venue() {
        let venue_next_nonce = 100;
        let mut config = test_config();
        config.base_url_http = Some(spawn_next_nonce_server(venue_next_nonce).await);
        let (client, _cache, _rx) = create_execution_client_with_config(config);
        let credential = test_credential();

        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
        }

        let err = client
            .build_tx_context(&credential)
            .expect_err("window must trip");
        assert!(
            err.to_string().contains("skip-window exhausted"),
            "unexpected error, was {err}",
        );

        wait_for_spawned_tasks(&client).await;

        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .baseline(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(venue_next_nonce - 1),
            "venue resync must advance the baseline",
        );
        assert!(
            !client.nonce_recovery_inflight.load(Ordering::Acquire),
            "recovery latch must release for the next exhaustion",
        );
        let context = client.build_tx_context(&credential).unwrap().context;
        assert_eq!(
            context.nonce, venue_next_nonce,
            "allocation must resume at the venue nonce",
        );
    }

    #[tokio::test]
    async fn skip_window_recovery_fetch_failure_releases_latch() {
        // 404 fails the fetch fast; unroutable addresses retry past the task wait
        let app = Router::new();
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let mut config = test_config();
        config.base_url_http = Some(format!("http://{addr}"));
        let (client, _cache, _rx) = create_execution_client_with_config(config);
        let credential = test_credential();

        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
        }

        client
            .build_tx_context(&credential)
            .expect_err("window must trip");

        wait_for_spawned_tasks(&client).await;

        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .baseline(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(TEST_NEXT_NONCE - 1),
            "failed venue fetch must leave the baseline unchanged",
        );
        assert!(
            !client.nonce_recovery_inflight.load(Ordering::Acquire),
            "failed venue fetch must release the recovery latch",
        );
    }

    #[tokio::test]
    async fn skip_window_recovery_dedupes_concurrent_fetches() {
        let hits = Arc::new(AtomicUsize::new(0));
        let server_hits = Arc::clone(&hits);

        let body = serde_json::to_string(&LighterNextNonce {
            code: 200,
            message: None,
            nonce: 100,
        })
        .unwrap();

        let app = Router::new().route(
            "/api/v1/nextNonce",
            get(move || {
                server_hits.fetch_add(1, Ordering::AcqRel);
                let body = body.clone();
                async move { body }
            }),
        );
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let mut config = test_config();
        config.base_url_http = Some(format!("http://{addr}"));
        let (client, _cache, _rx) = create_execution_client_with_config(config);
        let credential = test_credential();

        let window = i64::from(client.dispatch.nonce_manager.skip_window());
        for _ in 0..window {
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap();
        }

        // Back-to-back exhaustions land inside one HTTP round trip; the
        // latch must collapse them into a single fetch.
        client
            .build_tx_context(&credential)
            .expect_err("window must trip");
        client
            .build_tx_context(&credential)
            .expect_err("window must still be exhausted");

        wait_for_spawned_tasks(&client).await;

        assert_eq!(
            hits.load(Ordering::Acquire),
            1,
            "burst exhaustion must trigger a single venue fetch",
        );
        assert!(!client.nonce_recovery_inflight.load(Ordering::Acquire));
    }

    #[tokio::test]
    async fn refresh_nonce_releases_recovery_latch() {
        let venue_next_nonce = 77;
        let mut config = test_config();
        config.base_url_http = Some(spawn_next_nonce_server(venue_next_nonce).await);
        let (client, _cache, _rx) = create_execution_client_with_config(config);

        // Simulate a recovery task aborted between latch set and clear
        client
            .nonce_recovery_inflight
            .store(true, Ordering::Release);

        client.refresh_nonce().await.unwrap();

        assert!(
            !client.nonce_recovery_inflight.load(Ordering::Acquire),
            "connect-time refresh must release a stuck recovery latch",
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            venue_next_nonce,
            "refresh must hard-reset allocation to the venue nonce",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_ack_create_emits_order_rejected() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "REJECT-CREATE");
        let client_order_index = enqueue_create(&client, &order, 42);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Rejected(e) => {
                assert_eq!(e.client_order_id, order.client_order_id());
                assert_eq!(e.reason, "LIGHTER_21702: invalid price");
                assert!(!e.due_post_only);
            }
            other => panic!("expected Rejected, was {other:?}"),
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(client.dispatch.cloid_map.get(&client_order_index).is_none());
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_ack_create_sets_due_post_only() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "REJECT-POST-ONLY");
        enqueue_create(&client, &order, 43);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21700),
            "post-only order would execute",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Rejected(e) => {
                assert_eq!(e.client_order_id, order.client_order_id());
                assert!(e.due_post_only);
            }
            other => panic!("expected Rejected, was {other:?}"),
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    #[case::explicit_enqueued(true)]
    #[case::explicit_waiting(false)]
    #[tokio::test]
    async fn unmarked_cancel_enqueue_preserves_explicit_rejection(#[case] explicit_enqueued: bool) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "CANCEL-ELIGIBILITY");
        let id = order.client_order_id();
        let venue_id = VenueOrderId::from("123");
        cache_pending_cancel_order(&cache, order, venue_id);
        let context = client
            .fanout_dispatch_context(client.credential.as_ref().unwrap())
            .unwrap();

        let plan = CancelOrderPlan {
            client_order_id: id,
            strategy_id: strategy_id(),
            instrument_id,
            venue_order_id: Some(venue_id),
            market_index: TEST_MARKET_INDEX,
            venue_index: 123,
        };

        let first = context.sign_cancel_order(&plan).unwrap();
        let second = context.sign_cancel_order(&plan).unwrap();
        let (explicit, batch) = if explicit_enqueued {
            (first, second)
        } else {
            (second, first)
        };

        client
            .dispatch
            .set_pending_order_action(id, PendingOrderAction::Cancel);

        if explicit_enqueued {
            context.enqueue_cancel_order(&explicit, true);
        }

        let mut batch = PreparedBatchTx::from((batch, false));
        batch.pending.batch_id = Some("batch-unmarked".to_string());
        context.enqueue_batch_tx(&batch);
        assert_eq!(
            client.dispatch.pending_cancel_nonce(&id),
            explicit_enqueued.then_some((0, explicit.nonce))
        );

        if !explicit_enqueued {
            context.enqueue_cancel_order(&explicit, true);
        }

        handle_send_tx_rejection_for_connection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            0,
            UnixNanos::default(),
            SendTxRejectionSource::Ack,
            Some(21727),
            "unmarked batch failed",
            Some(&batch.pending.tx_hash),
        );
        assert_eq!(
            client.dispatch.pending_cancel_nonce(&id),
            Some((0, explicit.nonce))
        );
        assert!(rx.try_recv().is_err());
        handle_send_tx_rejection_for_connection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            0,
            UnixNanos::default(),
            SendTxRejectionSource::Ack,
            Some(21727),
            "explicit cancel failed",
            Some(&explicit.tx_hash),
        );
        let event = recv_order_event(&mut rx).await;
        cache.borrow_mut().update_order(&event).unwrap();
        match event {
            OrderEventAny::CancelRejected(event) => {
                assert_eq!(event.client_order_id, id);
                assert_eq!(event.venue_order_id, Some(venue_id));
                assert_eq!(event.instrument_id, instrument_id);
                assert_eq!(event.strategy_id, strategy_id());
                assert_eq!(event.reason, "LIGHTER_21727: explicit cancel failed");
            }
            other => panic!("expected explicit cancel rejection, was {other:?}"),
        }

        assert_eq!(
            cache.borrow().order(&id).unwrap().status(),
            OrderStatus::Accepted
        );
        assert_eq!(client.dispatch.pending_cancel_nonce(&id), None);
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[rstest]
    #[case::pending(PendingOrderAction::Cancel, true)]
    #[case::unmarked(PendingOrderAction::CancelUnmarked, false)]
    #[tokio::test]
    async fn cancel_rejection_preserves_newer_nonce(
        #[case] action: PendingOrderAction,
        #[case] emit_cancel_rejected: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("CANCEL-NEWER");

        let pending = PendingSendTx {
            batch_id: Some("batch-old".to_string()),
            connection_epoch: 3,
            kind: PendingSendTxKind::Cancel {
                emit_cancel_rejected,
                strategy_id: strategy_id(),
                instrument_id,
                client_order_id: id,
                venue_order_id: Some(VenueOrderId::from("123")),
            },
            submitted_at: UnixNanos::default(),
            nonce: 41,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: "old-hash".to_string(),
        };

        client.dispatch.set_pending_order_action(id, action);
        client
            .dispatch
            .set_pending_cancel_nonce(&id, 3, 42, emit_cancel_rejected);
        reject_cancel_order(
            &client.dispatch,
            &client.emitter,
            &pending,
            "old failure",
            UnixNanos::default(),
        );
        assert_eq!(client.dispatch.pending_cancel_nonce(&id), Some((3, 42)));
        assert_eq!(client.dispatch.pending_order_action(&id), Some(action));
        assert!(rx.try_recv().is_err());
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_cancel_emits_cancel_rejected() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("REJECT-CANCEL");
        let venue_order_id = VenueOrderId::from("123");
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        client
            .dispatch
            .set_pending_order_action(client_order_id, PendingOrderAction::Cancel);
        client
            .dispatch
            .set_pending_cancel_nonce(&client_order_id, 0, nonce, true);
        client.dispatch.enqueue_pending_sendtx(PendingSendTx {
            batch_id: None,
            connection_epoch: 0,
            kind: PendingSendTxKind::Cancel {
                emit_cancel_rejected: true,
                strategy_id: strategy_id(),
                instrument_id,
                client_order_id,
                venue_order_id: Some(venue_order_id),
            },
            submitted_at: UnixNanos::from(1_000_000_000),
            nonce,
            api_key_index: TEST_API_KEY_INDEX,
            tx_hash: format!("hash{nonce:02x}"),
        });

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21727),
            "order is not cancelable",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::CancelRejected(e) => {
                assert_eq!(e.client_order_id, client_order_id);
                assert_eq!(e.instrument_id, instrument_id);
                assert_eq!(e.venue_order_id, Some(venue_order_id));
                assert_eq!(e.reason, "LIGHTER_21727: order is not cancelable",);
            }
            other => panic!("expected CancelRejected, was {other:?}"),
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_modify_emits_modify_rejected() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let client_order_id = ClientOrderId::from("REJECT-MODIFY");
        let venue_order_id = VenueOrderId::from("456");
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        enqueue_modify(
            &client,
            instrument_id,
            client_order_id,
            venue_order_id,
            nonce,
        );

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "modify rejected by venue",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::ModifyRejected(e) => {
                assert_eq!(e.client_order_id, client_order_id);
                assert_eq!(e.instrument_id, instrument_id);
                assert_eq!(e.venue_order_id, Some(venue_order_id));
                assert_eq!(e.reason, "LIGHTER_21702: modify rejected by venue",);
            }
            other => panic!("expected ModifyRejected, was {other:?}"),
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert_nonce_reusable(&client.dispatch);
    }

    #[rstest]
    #[case::newer_modify(PendingOrderAction::Modify)]
    #[case::newer_cancel(PendingOrderAction::Cancel)]
    fn handle_send_tx_rejection_preserves_superseding_modify_action(
        #[case] action: PendingOrderAction,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("REJECT-MODIFY-SUPERSEDED");
        let venue = VenueOrderId::from("456");
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        enqueue_modify(&client, instrument, id, venue, nonce);
        let current_nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();

        assert!(client.dispatch.clear_pending_modify_if_nonce(&id, 0, nonce));

        if action == PendingOrderAction::Modify {
            enqueue_modify(&client, instrument, id, venue, current_nonce);
        } else {
            client.dispatch.set_pending_order_action(id, action);
            client
                .dispatch
                .set_pending_cancel_nonce(&id, 0, current_nonce, true);
        }

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "older modify rejected by venue",
            Some(&format!("hash{nonce:02x}")),
        );

        assert!(rx.try_recv().is_err());
        assert_eq!(client.dispatch.pending_order_action(&id), Some(action));
        assert_eq!(
            client.dispatch.pending_modify_nonce(&id),
            (action == PendingOrderAction::Modify).then_some((0, current_nonce))
        );
        assert_eq!(
            client.dispatch.pending_cancel_nonce(&id),
            (action == PendingOrderAction::Cancel).then_some((0, current_nonce))
        );
        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            usize::from(action == PendingOrderAction::Modify)
        );
        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
                .unwrap(),
            current_nonce + 1
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_hash_match_attributes_past_the_head() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order_a = test_limit_order(&mut factory, instrument_id, "REJECT-HASH-A");
        let order_b = test_limit_order(&mut factory, instrument_id, "REJECT-HASH-B");
        enqueue_create(&client, &order_a, 10);
        enqueue_create(&client, &order_b, 11);

        // A desynced or out-of-order rejection for B must not consume A.
        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            Some("hash0b"),
        );

        let event = recv_order_event(&mut rx).await;
        match event {
            OrderEventAny::Rejected(e) => {
                assert_eq!(e.client_order_id, order_b.client_order_id());
            }
            other => panic!("expected Rejected, was {other:?}"),
        }

        assert_eq!(client.dispatch.pending_sendtx_len(), 1, "A must survive");
        let head = client.dispatch.pop_pending_sendtx_head().unwrap();
        match head.kind {
            PendingSendTxKind::Create { order, .. } => {
                assert_eq!(order.client_order_id(), order_a.client_order_id());
            }
            _ => panic!("expected Create kind"),
        }
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_unmatched_hash_pops_nothing() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "REJECT-UNMATCHED");
        enqueue_create(&client, &order, 10);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            Some("0xbeef"),
        );

        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            1,
            "an echoed hash with no matching entry must not pop the head",
        );
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "unmatched rejection must not emit an event",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_bare_error_within_window_attributes() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "BARE-IN");
        enqueue_create(&client, &order, 50);

        let within_window = UnixNanos::from(1_000_000_000 + 500 * 1_000_000);
        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            within_window,
            SendTxRejectionSource::BareError,
            Some(21149),
            "integrator is not approved",
            None,
        );

        let event = recv_order_event(&mut rx).await;
        assert!(matches!(event, OrderEventAny::Rejected(_)));
        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_bare_error_outside_window_skips() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "BARE-OUT");
        enqueue_create(&client, &order, 60);

        let outside_window = UnixNanos::from(1_000_000_000 + 2_000 * 1_000_000);
        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            outside_window,
            SendTxRejectionSource::BareError,
            Some(99),
            "late error",
            None,
        );

        assert_eq!(
            client.dispatch.pending_sendtx_len(),
            1,
            "head must remain queued past the 1s attribution window",
        );
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "no event must be emitted outside the window",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_bare_error_with_multiple_pending_skips() {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order_a = test_limit_order(&mut factory, instrument_id, "BARE-MULTI-A");
        let order_b = test_limit_order(&mut factory, instrument_id, "BARE-MULTI-B");
        enqueue_create(&client, &order_a, 70);
        enqueue_create(&client, &order_b, 71);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000 + 500 * 1_000_000),
            SendTxRejectionSource::BareError,
            Some(21149),
            "integrator is not approved",
            None,
        );

        assert_eq!(client.dispatch.pending_sendtx_len(), 2);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "a bare error cannot be attributed with multiple transactions pending",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_other_kind_rolls_back_latest_nonce() {
        let (client, _cache, _rx) = create_execution_client();
        let nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        enqueue_other(&client, nonce);

        let needs_resync = handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(23000),
            "Too Many Requests",
            None,
        );

        assert!(!needs_resync, "rate-limit rejection must not force resync");
        assert_nonce_reusable(&client.dispatch);
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_other_kind_skips_rollback_with_newer_issuance() {
        let (client, _cache, _rx) = create_execution_client();
        let rejected_nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        let newer_nonce = client
            .dispatch
            .nonce_manager
            .next_nonce(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX)
            .unwrap();
        enqueue_other(&client, rejected_nonce);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(23000),
            "Too Many Requests",
            None,
        );

        assert_eq!(
            client
                .dispatch
                .nonce_manager
                .last_issued(TEST_ACCOUNT_INDEX_I64, TEST_API_KEY_INDEX),
            Some(newer_nonce),
            "non-latest rejection must leave last_issued alone",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_invalid_nonce_signals_resync() {
        let (client, _cache, _rx) = create_execution_client();

        enqueue_other(&client, 70);
        let attributed = handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(LIGHTER_ERROR_CODE_INVALID_NONCE),
            "invalid nonce",
            None,
        );
        assert!(attributed, "attributed invalid nonce must signal resync");

        let unattributed = handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(LIGHTER_ERROR_CODE_INVALID_NONCE),
            "invalid nonce",
            None,
        );
        assert!(
            unattributed,
            "unattributed invalid nonce must still signal resync",
        );

        enqueue_other(&client, 71);
        let other_code = handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21702),
            "invalid price",
            None,
        );
        assert!(!other_code, "other rejection codes must not force resync");
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_other_kind_logs_and_skips_emit() {
        let (client, _cache, mut rx) = create_execution_client();
        enqueue_other(&client, 70);

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(21727),
            "invalid client order index",
            None,
        );

        assert_eq!(client.dispatch.pending_sendtx_len(), 0, "Other head pops");
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
            "Other-kind rejection must not emit OrderRejected",
        );
    }

    #[tokio::test]
    async fn handle_send_tx_rejection_empty_queue_logs_warn() {
        let (client, _cache, mut rx) = create_execution_client();

        handle_send_tx_rejection(
            &client.dispatch,
            &client.emitter,
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1_000_000_000),
            SendTxRejectionSource::Ack,
            Some(1),
            "no pending",
            None,
        );

        assert_eq!(client.dispatch.pending_sendtx_len(), 0);
        assert!(
            tokio::time::timeout(Duration::from_millis(50), rx.recv())
                .await
                .is_err(),
        );
    }

    #[rstest]
    #[case::standard_no_override(LighterAccountTier::Standard, None, 60, None)]
    #[case::standard_zero_is_default(LighterAccountTier::Standard, Some(0), 60, None)]
    #[case::standard_override_above_tier(
        LighterAccountTier::Standard,
        Some(24_000),
        24_000,
        Some(TierCrossCheck::AboveTier { documented: 60 })
    )]
    #[case::premium_raise_hint(
        LighterAccountTier::Premium,
        None,
        60,
        Some(TierCrossCheck::RaiseHint { documented: 24_000 })
    )]
    #[case::premium_configured_no_advisory(LighterAccountTier::Premium, Some(24_000), 24_000, None)]
    #[case::unknown_no_advisory(LighterAccountTier::Unknown(7), None, 60, None)]
    fn test_tier_quota_report(
        #[case] tier: LighterAccountTier,
        #[case] configured: Option<u32>,
        #[case] expected_active: u32,
        #[case] expected_cross_check: Option<TierCrossCheck>,
    ) {
        assert_eq!(
            tier_quota_report(tier, configured, 60),
            (expected_active, expected_cross_check),
        );
    }

    #[rstest]
    fn cold_first_frame_updates_cached_shape() {
        let mut rig = dispatcher_rig("COLD-SHAPE");
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        rig.dispatch.forget_cloid(frame.client_order_index);
        let order = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("2352.74"))
            .build();
        let accepted =
            TestOrderEventStubs::accepted(&order, account_id(), VenueOrderId::new(&frame.order_id));
        let mut order = order;
        order.apply(accepted).unwrap();
        rig.dispatch.seed_order_restorations(vec![order]);
        frame.initial_base_amount = Decimal::from_str("0.0400").unwrap();
        frame.remaining_base_amount = frame.initial_base_amount;
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );
        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 1);

        let ExecutionEvent::Order(OrderEventAny::Updated(update)) = &events[0] else {
            panic!("expected restored shape update");
        };

        assert_eq!(update.quantity, Quantity::from("0.0400"));
        assert_eq!(update.price, Some(Price::from("2352.74")));
        assert_eq!(update.client_order_id, rig.cloid);
        assert_eq!(
            update.venue_order_id,
            Some(VenueOrderId::new(&frame.order_id))
        );
    }

    #[rstest]
    #[case(false)]
    #[case(true)]
    fn native_group_child_sizing_preserves_real_fill(#[case] trade_first: bool) {
        let mut rig = dispatcher_rig("CHILD-SIZING");
        let order = OrderTestBuilder::new(OrderType::StopLimit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("2352.74"))
            .trigger_price(Price::from("2300.00"))
            .parent_order_id(ClientOrderId::new("PARENT-CHILD-SIZING"))
            .reduce_only(true)
            .build();
        rig.dispatch.register_create_identity(&order).unwrap();
        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Pending);
        frame.initial_base_amount = Decimal::ZERO;
        frame.remaining_base_amount = Decimal::ZERO;
        frame.order_type = LighterOrderKind::StopLossLimit;
        frame.trigger_price = Decimal::from_str("2300.00").unwrap();
        frame.reduce_only = true;
        let cache = Rc::new(RefCell::new(Cache::default()));
        cache
            .borrow_mut()
            .add_instrument(
                LIGHTER_INSTRUMENT_CACHE
                    .get(&rig.instrument_id)
                    .unwrap()
                    .value()
                    .clone(),
            )
            .unwrap();
        cache
            .borrow_mut()
            .add_order(order, None, Some(client_id()), false)
            .unwrap();
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));
        let mut engine = ExecutionEngine::new(clock, cache.clone(), None);
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        for event in drain_events(&mut rig.rx) {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected acceptance");
            };

            engine.process(&event);
        }

        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = Decimal::from_str("0.0400").unwrap();
        trade.usd_amount = trade.size * trade.price;
        frame.status = LighterOrderStatus::Filled;
        frame.initial_base_amount = trade.size;
        frame.filled_base_amount = trade.size;
        frame.filled_quote_amount = trade.usd_amount;
        frame.order_type = LighterOrderKind::Limit;
        frame.trigger_price = Decimal::ZERO;

        if trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(2),
            );
        }

        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );

        if !trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(4),
            );
        }

        let events = drain_events(&mut rig.rx);
        for event in events {
            match event {
                ExecutionEvent::Order(event) => engine.process(&event),
                ExecutionEvent::Report(report) => engine.reconcile_execution_report(&report),
                _ => panic!("unexpected child event"),
            }
        }

        let cache = cache.borrow();
        let order = cache.order(&rig.cloid).unwrap();

        let fills = order
            .events()
            .into_iter()
            .filter_map(|event| match event {
                OrderEventAny::Filled(fill) => Some(fill),
                _ => None,
            })
            .collect::<Vec<_>>();

        assert_eq!(order.status(), OrderStatus::Filled);
        assert_eq!(order.quantity(), Quantity::from("0.0400"));
        assert_eq!(order.filled_qty(), Quantity::from("0.0400"));
        assert_eq!(order.leaves_qty(), Quantity::from("0.0000"));
        assert_eq!(order.is_triggered(), Some(true));
        assert_eq!(fills.len(), 1);
        assert_eq!(fills[0].trade_id, parse_lighter_trade_id(&trade).unwrap());
        assert_eq!(fills[0].last_qty, Quantity::from("0.0400"));
        assert_eq!(fills[0].last_px, Price::from("2352.73"));
        assert_eq!(fills[0].commission, Some(Money::from("0.00263506 USDC")));
    }

    #[rstest]
    #[case::distinct_timestamps(false)]
    #[case::same_timestamp(true)]
    fn native_group_preserves_position_fill_order(#[case] same_timestamp: bool) {
        let mut rig = dispatcher_rig("POSITION-PARENT");
        let parent_id = rig.cloid;
        let child_id = ClientOrderId::new("POSITION-CHILD");
        let extra_id = ClientOrderId::new("POSITION-EXTRA");
        let parent = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(parent_id)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("100.00"))
            .build();
        rig.dispatch.register_create_identity(&parent).unwrap();
        rig.dispatch
            .mark_order_submission(&parent_id, TEST_SUBMISSION_NONCE);
        let mut parent_frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        parent_frame.order_index = 562_947_905_631_053;
        parent_frame.order_id = parent_frame.order_index.to_string();
        parent_frame.initial_base_amount = Decimal::from_str("0.1000").unwrap();
        parent_frame.remaining_base_amount = parent_frame.initial_base_amount;
        parent_frame.price = Decimal::from_str("100.00").unwrap();
        dispatch_lighter_order(
            &parent_frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let mut opening = dispatcher_test_trade(&rig, true);
        opening.bid_id = parent_frame.order_index;
        opening.bid_id_str = Some(parent_frame.order_id);
        opening.trade_id_str = Some("900001".to_string());
        opening.size = Decimal::from_str("0.1000").unwrap();
        opening.price = Decimal::from_str("100.00").unwrap();
        opening.usd_amount = opening.size * opening.price;
        opening.maker_fee = Some(0);
        opening.taker_fee = Some(0);
        dispatch_lighter_trade(
            &opening,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );
        rig.cloid = child_id;
        let child = OrderTestBuilder::new(OrderType::StopLimit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(child_id)
            .side(OrderSide::Sell)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("200.00"))
            .trigger_price(Price::from("150.00"))
            .parent_order_id(parent_id)
            .reduce_only(true)
            .build();
        rig.dispatch.register_create_identity(&child).unwrap();
        rig.dispatch
            .mark_order_submission(&child_id, TEST_SUBMISSION_NONCE);
        let mut child_frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        child_frame.initial_base_amount = Decimal::from_str("0.0400").unwrap();
        child_frame.remaining_base_amount = child_frame.initial_base_amount;
        child_frame.price = Decimal::from_str("200.00").unwrap();
        child_frame.side = Some(LighterOrderSide::Sell);
        child_frame.is_ask = true;
        child_frame.reduce_only = true;
        dispatch_lighter_order(
            &child_frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        let mut first = dispatcher_test_trade(&rig, false);
        first.ask_id = child_frame.order_index;
        first.ask_id_str = Some(child_frame.order_id.clone());
        first.trade_id_str = Some("900002".to_string());
        first.timestamp = opening.timestamp + i64::from(!same_timestamp);
        first.size = Decimal::from_str("0.0200").unwrap();
        first.price = Decimal::from_str("200.00").unwrap();
        first.usd_amount = first.size * first.price;
        first.maker_fee = Some(0);
        first.taker_fee = Some(0);
        dispatch_lighter_trade(
            &first,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(4),
        );
        rig.cloid = extra_id;
        let extra = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(extra_id)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("100.00"))
            .time_in_force(TimeInForce::Ioc)
            .build();
        rig.dispatch.register_create_identity(&extra).unwrap();
        rig.dispatch
            .mark_order_submission(&extra_id, TEST_SUBMISSION_NONCE + 1);
        let mut extra_frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        extra_frame.order_index += 5;
        extra_frame.order_id = extra_frame.order_index.to_string();
        extra_frame.initial_base_amount = Decimal::from_str("0.1000").unwrap();
        extra_frame.remaining_base_amount = extra_frame.initial_base_amount;
        extra_frame.price = Decimal::from_str("100.00").unwrap();
        dispatch_lighter_order(
            &extra_frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(5),
        );
        let mut addition = dispatcher_test_trade(&rig, true);
        addition.bid_id = extra_frame.order_index;
        addition.bid_id_str = Some(extra_frame.order_id);
        addition.trade_id_str = Some("900003".to_string());
        addition.timestamp = opening.timestamp + 2 * i64::from(!same_timestamp);
        addition.size = Decimal::from_str("0.0600").unwrap();
        addition.price = Decimal::from_str("50.00").unwrap();
        addition.usd_amount = addition.size * addition.price;
        addition.maker_fee = Some(0);
        addition.taker_fee = Some(0);
        dispatch_lighter_trade(
            &addition,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(6),
        );
        rig.cloid = child_id;
        let mut last = first;
        last.trade_id_str = Some("900004".to_string());
        last.timestamp = opening.timestamp + 3 * i64::from(!same_timestamp);
        child_frame.status = LighterOrderStatus::Filled;
        child_frame.remaining_base_amount = Decimal::ZERO;
        child_frame.filled_base_amount = Decimal::from_str("0.0400").unwrap();
        child_frame.filled_quote_amount = Decimal::from(8);
        dispatch_lighter_order(
            &child_frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(7),
        );
        dispatch_lighter_trade(
            &last,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(8),
        );
        let mut fills = Vec::new();

        for event in drain_events(&mut rig.rx) {
            match event {
                ExecutionEvent::Order(OrderEventAny::Filled(fill)) => fills.push(fill),
                ExecutionEvent::Report(EngineExecutionReport::OrderWithFills(_, reports)) => {
                    for report in reports {
                        fills.push(OrderFilled::new(
                            trader_id(),
                            strategy_id(),
                            rig.instrument_id,
                            report.client_order_id.unwrap(),
                            report.venue_order_id,
                            account_id(),
                            report.trade_id,
                            report.order_side,
                            OrderType::StopLimit,
                            report.last_qty,
                            report.last_px,
                            Currency::from("USDC"),
                            report.liquidity_side,
                            UUID4::new(),
                            report.ts_event,
                            report.ts_init,
                            true,
                            None,
                            Some(report.commission),
                            None,
                        ));
                    }
                }
                _ => {}
            }
        }

        let ids = fills.iter().map(|fill| fill.trade_id).collect::<Vec<_>>();
        let position_id = PositionId::new("POSITION-ORDER");
        for fill in &mut fills {
            fill.position_id = Some(position_id);
        }

        let instrument = LIGHTER_INSTRUMENT_CACHE.get(&rig.instrument_id).unwrap();
        let mut position = Position::new(&instrument, fills[0].clone());
        for fill in &fills[1..] {
            position.apply(fill);
        }

        // The two reductions realize 2 + 17/7 USDC
        let expected_pnl = Money::from_decimal_native(
            Decimal::from(31) / Decimal::from(7),
            Currency::from("USDC"),
        )
        .unwrap();

        assert_eq!(
            ids,
            ["900001", "900002", "900003", "900004"].map(TradeId::new)
        );
        assert_eq!(position.quantity, Quantity::from("0.1200"));
        assert_eq!(position.realized_pnl, Some(expected_pnl));
    }

    #[rstest]
    #[case::filled(LighterOrderStatus::Filled)]
    #[case::partial_then_canceled(LighterOrderStatus::Canceled)]
    fn terminal_after_fill_retires_identity_with_publication(#[case] status: LighterOrderStatus) {
        let mut rig = dispatcher_rig("TERMINAL-PUBLICATION");
        register_identity(&rig);
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = if status == LighterOrderStatus::Filled {
            frame.initial_base_amount
        } else {
            frame.initial_base_amount / Decimal::from(2)
        };

        trade.usd_amount = trade.size * trade.price;
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );
        frame.status = status;
        frame.filled_base_amount = trade.size;
        frame.remaining_base_amount = Decimal::ZERO;
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();
        let events = drain_events(&mut rig.rx);
        assert!(!rig.dispatch.order_identities.contains_key(&rig.cloid));
        assert!(!rig.dispatch.venue_id_map.contains_key(&rig.cloid));
        assert!(
            !rig.dispatch
                .cloid_map
                .contains_key(&frame.client_order_index)
        );
        assert!(!rig.dispatch.order_snapshots.contains_key(&rig.cloid));
        assert!(identity.has_publication());
        assert!(
            rig.dispatch
                .any_order_identity(|id, other, _| *id == rig.cloid && other.has_publication())
        );
        assert_eq!(
            events
                .iter()
                .filter(|e| matches!(e, ExecutionEvent::Order(OrderEventAny::Filled(_))))
                .count(),
            1
        );
    }

    #[rstest]
    #[case::modify("modify", false)]
    #[case::terminal("terminal", false)]
    #[case::fill("fill", false)]
    #[case::update("update", false)]
    #[case::retired_fill("fill", true)]
    #[case::retired_update("update", true)]
    fn position_reports_wait_for_execution(#[case] hold: &str, #[case] retired: bool) {
        let (client, cache, _) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut factory = test_order_factory();
        let order = test_limit_order(&mut factory, instrument_id, "POSITION-HOLD");
        let cloid = order.client_order_id();
        client.dispatch.register_create_identity(&order).unwrap();
        let identity = client.dispatch.order_identity(&cloid).unwrap();

        match hold {
            "modify" => {
                enqueue_modify(&client, instrument_id, cloid, VenueOrderId::new("700"), 23);
            }
            "terminal" => {
                let rig = dispatcher_rig("POSITION-TERMINAL");
                client
                    .dispatch
                    .order_events
                    .lock()
                    .entry(cloid)
                    .or_default()
                    .order = Some(dispatcher_test_order(&rig, LighterOrderStatus::Canceled));
            }
            "update" => identity.publish_update(UUID4::new()),
            "fill" => {
                let instrument = cache.borrow().instrument(&instrument_id).unwrap().clone();

                let OrderEventAny::Filled(fill) = TestOrderEventStubs::filled(
                    &order,
                    &instrument,
                    Some(TradeId::new("HELD-FILL")),
                    None,
                    Some(Price::from("2360.00")),
                    Some(Quantity::from("0.0050")),
                    None,
                    Some(Money::from("0.01000000 USDC")),
                    None,
                    Some(account_id()),
                ) else {
                    unreachable!()
                };

                identity.publish_fill(&fill);
            }
            _ => unreachable!(),
        }

        if retired {
            client.dispatch.retire_order_identity(&cloid);
        }

        let report = PositionStatusReport::new(
            account_id(),
            instrument_id,
            PositionSide::Long,
            Quantity::from("0.0050"),
            UnixNanos::from(4),
            UnixNanos::from(5),
            None,
            None,
            Some(Decimal::from_str("2360.00").unwrap()),
        );
        client
            .dispatch
            .replace_position_snapshot(std::slice::from_ref(&report), &[], &[]);

        let cmd = GeneratePositionStatusReports::new(
            UUID4::new(),
            UnixNanos::from(6),
            Some(instrument_id),
            None,
            None,
            None,
            None,
        );
        let (reports, complete, coverage) = client.cached_position_reports(&cmd).unwrap();
        assert!(reports.is_empty());
        assert!(!complete);
        assert_eq!(coverage, Some(AHashSet::from_iter([TEST_MARKET_INDEX])));
        let other_id = client.registry.insert(1, "BTC", LighterProductType::Perp);
        let mut other_cmd = cmd;
        other_cmd.instrument_id = Some(other_id);
        let (reports, complete, _) = client.cached_position_reports(&other_cmd).unwrap();
        assert!(reports.is_empty());
        assert!(complete);
    }

    #[rstest]
    #[case::explicit_flat(true)]
    #[case::empty_snapshot(false)]
    #[tokio::test]
    async fn restart_held_child_fill_does_not_synthesize_position(#[case] explicit_flat: bool) {
        let (mut client, cache, mut rx) = create_execution_client();
        let core = client.core.clone();
        let instrument_id = register_test_instrument(&client, &cache);
        let mut rig = dispatcher_rig("RESTART-CHILD");
        rig.dispatch = client.dispatch.clone();
        rig.registry = Arc::clone(&client.registry);

        let account = MarginAccount::new(
            AccountState::new(
                account_id(),
                AccountType::Margin,
                vec![AccountBalance::new(
                    Money::from("10000.00000000 USDC"),
                    Money::from("0.00000000 USDC"),
                    Money::from("10000.00000000 USDC"),
                )],
                Vec::new(),
                true,
                UUID4::new(),
                UnixNanos::from(1),
                UnixNanos::from(1),
                Some(Currency::from("USDC")),
            ),
            true,
        );
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(account))
            .unwrap();
        let parent_id = ClientOrderId::new("RESTART-PARENT");
        let position_id = PositionId::new("RESTART-POSITION");
        let parent = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(parent_id)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("2352.73"))
            .build();
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&instrument_id)
            .unwrap()
            .value()
            .clone();
        let opening = TestOrderEventStubs::filled(
            &parent,
            &instrument,
            Some(TradeId::new("RESTART-OPENING")),
            Some(position_id),
            Some(Price::from("2352.73")),
            Some(Quantity::from("0.1000")),
            Some(LiquiditySide::Taker),
            Some(Money::from("0.00000000 USDC")),
            Some(UnixNanos::from(1)),
            Some(account_id()),
        );
        let mut parent = parent;
        parent
            .apply(TestOrderEventStubs::accepted(
                &parent,
                account_id(),
                VenueOrderId::new("600"),
            ))
            .unwrap();
        parent.apply(opening.clone()).unwrap();
        cache
            .borrow_mut()
            .add_order(parent, Some(position_id), Some(client_id()), false)
            .unwrap();

        let OrderEventAny::Filled(opening) = opening else {
            unreachable!()
        };

        let position = Position::new(&instrument, opening);
        cache
            .borrow_mut()
            .add_position(&position, OmsType::Netting)
            .unwrap();
        let child = OrderTestBuilder::new(OrderType::StopLimit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Sell)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("2352.74"))
            .trigger_price(Price::from("2300.00"))
            .parent_order_id(parent_id)
            .reduce_only(true)
            .build();
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        frame.side = Some(LighterOrderSide::Sell);
        frame.is_ask = true;
        frame.order_type = LighterOrderKind::Limit;
        frame.reduce_only = true;
        let venue_id = VenueOrderId::new(&frame.order_id);
        cache_accepted_order(&cache, child, venue_id, Some(client_id()));
        cache
            .borrow_mut()
            .add_position_id(
                &position_id,
                &instrument_id.venue,
                &rig.cloid,
                &strategy_id(),
            )
            .unwrap();
        let child = cache.borrow().order_owned(&rig.cloid).unwrap();
        client
            .dispatch
            .restore_reconciled_order(&child, frame.client_order_index, venue_id, false)
            .unwrap();
        let mut trade = dispatcher_test_trade(&rig, false);
        trade.ask_id = frame.order_index;
        trade.ask_id_str = Some(frame.order_id.clone());
        trade.size = Decimal::from_str("0.1000").unwrap();
        trade.usd_amount = trade.size * trade.price;
        trade.maker_fee = Some(0);
        trade.taker_fee = Some(0);
        dispatch_lighter_trade(
            &trade,
            &client.dispatch,
            &client.emitter,
            &client.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(2),
        );

        let flat = PositionStatusReport::new(
            account_id(),
            instrument_id,
            PositionSide::Flat,
            Quantity::from("0.0000"),
            UnixNanos::from(3),
            UnixNanos::from(4),
            None,
            None,
            None,
        );

        let positions = if explicit_flat {
            vec![flat]
        } else {
            Vec::new()
        };

        client
            .dispatch
            .replace_position_snapshot(&positions, &[], &[]);
        let mut external = frame.clone();
        external.order_index += 1;
        external.order_id = external.order_index.to_string();
        external.client_order_index = 0;
        external.client_order_id = "0".to_string();
        external.reduce_only = false;
        let active = serde_json::json!({"code":200,"orders":[external]});
        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(move || {
                    let active = active.clone();
                    async move { axum::Json(active) }
                }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/trades",
                get(|| async { axum::Json(serde_json::json!({"code":200,"trades":[]})) }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        let mass = client
            .generate_mass_status(Some(60))
            .await
            .unwrap()
            .unwrap();
        server.abort();
        let _ = server.await;

        let command = GeneratePositionStatusReports::new(
            UUID4::new(),
            UnixNanos::from(5),
            None,
            None,
            None,
            None,
            None,
        );
        let direct = client.generate_position_status_reports(&command).await;
        let worker = client
            .generate_position_status_reports_task(&command)
            .unwrap();
        worker.collection.await;
        let worker = (worker.finish)();
        assert!(mass.position_reports().is_empty());
        assert!(!mass.reports_complete());
        assert!(direct.is_err());
        assert!(worker.is_err());
        assert!(drain_events(&mut rx).is_empty());
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));

        let engine = Rc::new(RefCell::new(ExecutionEngine::new(
            clock.clone(),
            cache.clone(),
            None,
        )));
        let mut manager =
            ExecutionManager::new(clock, cache.clone(), ExecutionManagerConfig::default()).unwrap();
        let result = manager.reconcile_execution_mass_status(&mass, &engine);
        assert!(
            result
                .events
                .iter()
                .all(|event| !matches!(event, OrderEventAny::Filled(_)))
        );
        assert_eq!(
            cache.borrow().position(&position_id).unwrap().quantity,
            Quantity::from("0.1000")
        );
        frame.status = LighterOrderStatus::Filled;
        frame.initial_base_amount = trade.size;
        frame.filled_base_amount = trade.size;
        frame.remaining_base_amount = Decimal::ZERO;
        frame.filled_quote_amount = trade.usd_amount;
        dispatch_lighter_order(
            &frame,
            &client.dispatch,
            &client.emitter,
            &client.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(6),
        );
        engine
            .borrow_mut()
            .register_client(Box::new(client))
            .unwrap();
        let released = drain_events(&mut rx);
        assert!(
            released
                .iter()
                .any(|event| matches!(event, ExecutionEvent::Order(OrderEventAny::Filled(_)))),
            "released child events: {released:?}"
        );

        for event in released {
            match event {
                ExecutionEvent::Order(event) => engine.borrow_mut().process(&event),
                ExecutionEvent::Report(report) => {
                    engine.borrow_mut().reconcile_execution_report(&report);
                }
                _ => panic!("unexpected restart event"),
            }
        }

        let cache_ref = cache.borrow();
        let position = cache_ref.position(&position_id).unwrap();
        let child = cache_ref.order(&rig.cloid).unwrap();
        assert_eq!(position.quantity, Quantity::from("0.0000"));
        assert_eq!(position.realized_pnl, Some(Money::from("0.00000000 USDC")));
        assert_eq!(
            child.trade_ids(),
            vec![&parse_lighter_trade_id(&trade).unwrap()]
        );
        assert_eq!(child.filled_qty(), Quantity::from("0.1000"));
        assert!(!rig.dispatch.order_identities.contains_key(&rig.cloid));
        assert!(!rig.dispatch.venue_id_map.contains_key(&rig.cloid));

        let command = GeneratePositionStatusReports::new(
            UUID4::new(),
            UnixNanos::from(7),
            None,
            None,
            None,
            None,
            None,
        );
        let (reports, complete, coverage) =
            cached_position_reports(&core, &rig.dispatch, &rig.registry, &command).unwrap();
        assert!(complete);
        assert_eq!(coverage, Some(AHashSet::new()));
        assert_eq!(reports.len(), usize::from(explicit_flat));
    }

    #[rstest]
    fn resting_child_does_not_withhold_position_reports() {
        let (client, cache, _) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let rig = dispatcher_rig("RESTING-POSITION");
        let order = OrderTestBuilder::new(OrderType::StopLimit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Sell)
            .quantity(Quantity::from("0.1000"))
            .price(Price::from("2300.00"))
            .trigger_price(Price::from("2301.00"))
            .parent_order_id(ClientOrderId::new("RESTING-PARENT"))
            .reduce_only(true)
            .build();
        client.dispatch.register_create_identity(&order).unwrap();
        client
            .dispatch
            .order_events
            .lock()
            .entry(rig.cloid)
            .or_default()
            .order = Some(dispatcher_test_order(&rig, LighterOrderStatus::Pending));

        let report = PositionStatusReport::new(
            account_id(),
            instrument_id,
            PositionSide::Long,
            Quantity::from("0.1000"),
            UnixNanos::from(4),
            UnixNanos::from(5),
            None,
            None,
            Some(Decimal::from_str("2360.00").unwrap()),
        );
        client
            .dispatch
            .replace_position_snapshot(std::slice::from_ref(&report), &[], &[]);

        let cmd = GeneratePositionStatusReports::new(
            UUID4::new(),
            UnixNanos::from(6),
            None,
            None,
            None,
            None,
            None,
        );
        let (reports, complete, coverage) = client.cached_position_reports(&cmd).unwrap();
        assert_eq!(reports, vec![report]);
        assert!(complete);
        assert_eq!(coverage, Some(AHashSet::new()));
    }

    #[rstest]
    #[case::cached_fill("2352.73", false)]
    #[case::price_restatement("2352.74", true)]
    fn cached_parent_fill_is_not_deferred_during_child_recovery(
        #[case] price: &str,
        #[case] deferred: bool,
    ) {
        let (client, cache, mut rx) = create_execution_client();
        let instrument_id = register_test_instrument(&client, &cache);
        let instrument = cache.borrow().instrument(&instrument_id).unwrap().clone();
        LIGHTER_INSTRUMENT_CACHE.insert(instrument_id, instrument.clone());
        let parent_id = ClientOrderId::new("HTTP-CACHED-PARENT");
        let parent_venue = VenueOrderId::new("710001");
        let child_id = ClientOrderId::new("HTTP-RECOVERING-CHILD");
        let child_venue = VenueOrderId::new("710002");
        let parent = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(parent_id)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.1336"))
            .price(Price::from("2352.73"))
            .build();
        cache_accepted_order(&cache, parent, parent_venue, Some(client_id()));
        let parent = cache.borrow().order_owned(&parent_id).unwrap();
        let mut report =
            reconciliation_fill_report(instrument_id, 101, parent_venue, "CACHED-PARENT-FILL");
        let opening = TestOrderEventStubs::filled(
            &parent,
            &instrument,
            Some(report.trade_id),
            None,
            Some(report.last_px),
            Some(report.last_qty),
            Some(report.liquidity_side),
            Some(report.commission),
            Some(report.ts_event),
            Some(account_id()),
        );
        cache.borrow_mut().update_order(&opening).unwrap();
        let child = OrderTestBuilder::new(OrderType::StopLimit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(instrument_id)
            .client_order_id(child_id)
            .side(OrderSide::Sell)
            .quantity(Quantity::from("0.1336"))
            .price(Price::from("2301.00"))
            .trigger_price(Price::from("2302.00"))
            .parent_order_id(parent_id)
            .reduce_only(true)
            .build();
        cache_accepted_order(&cache, child, child_venue, Some(client_id()));
        let child = cache.borrow().order_owned(&child_id).unwrap();
        client
            .dispatch
            .restore_reconciled_order(&child, 102, child_venue, false)
            .unwrap();
        let identity = client.dispatch.order_identity(&child_id).unwrap();
        let mut child_report =
            reconciliation_fill_report(instrument_id, 102, child_venue, "NEW-CHILD-FILL");
        child_report.order_side = OrderSide::Sell;
        child_report.last_qty = Quantity::from("0.0444");
        child_report.last_px = Price::from("2301.23");
        let child_fill = child_fill_from_report(&child_report, &identity, trader_id()).unwrap();
        client.dispatch.defer_fill(
            client
                .dispatch
                .order_events
                .lock()
                .entry(child_id)
                .or_default(),
            child_fill.clone(),
        );
        report.last_px = Price::from(price);

        let sweep = finish_fill_reports(
            &client.core,
            &client.dispatch,
            BTreeSet::new(),
            Ok(FillSweep {
                reports: vec![report.clone()],
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            }),
        )
        .unwrap();

        let events = client.dispatch.order_events.lock();
        assert!(sweep.reports.is_empty());
        assert!(!sweep.covers_window);
        assert_eq!(
            sweep.withheld_instruments,
            AHashSet::from_iter([instrument_id])
        );
        assert_eq!(events.get(&parent_id).is_some(), deferred);
        assert_eq!(events[&child_id].fills, vec![child_fill]);

        if deferred {
            let fills = &events[&parent_id].fills;
            assert_eq!(fills.len(), 1);
            assert_eq!(fills[0].trade_id, report.trade_id);
            assert_eq!(fills[0].client_order_id, parent_id);
            assert_eq!(fills[0].venue_order_id, parent_venue);
            assert_eq!(fills[0].last_qty, report.last_qty);
            assert_eq!(fills[0].last_px, report.last_px);
            assert_eq!(fills[0].commission, Some(report.commission));
        }

        assert_eq!(
            cache.borrow().order(&parent_id).unwrap().trade_ids(),
            vec![&report.trade_id]
        );
        assert!(drain_events(&mut rx).is_empty());
    }

    #[rstest]
    #[case::immediate(false, false, 1)]
    #[case::deferred(false, true, 1)]
    #[case::repeated(false, false, 16)]
    #[case::deferred_repeated(false, true, 16)]
    #[case::first_frame(true, false, 1)]
    fn self_trade_reduce_updates_cache_and_reports(
        #[case] first_frame: bool,
        #[case] deferred: bool,
        #[case] repeats: usize,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        let mut events = Vec::new();

        if !first_frame {
            dispatch_reduce_frame(&rig, &frame, false);
            if !deferred {
                events.extend(consume_reduce_events(&mut rig, &mut engine));
            }
        }

        frame.remaining_base_amount = Decimal::from_str("0.0001").unwrap();
        frame.updated_at += 1_000;
        for _ in 0..repeats {
            dispatch_reduce_frame(&rig, &frame, false);
            if !deferred {
                events.extend(consume_reduce_events(&mut rig, &mut engine));
            }
        }

        events.extend(consume_reduce_events(&mut rig, &mut engine));
        let order = cache.borrow().order(&rig.cloid).unwrap().clone();
        let report = rig.dispatch.translate_order_cloid(
            parse_http_order_to_report(
                &frame,
                &rig.registry,
                account_id(),
                UnixNanos::from(5),
                &rig.dispatch,
            )
            .unwrap(),
        );
        engine.reconcile_order_status_report(&report);
        engine.reconcile_order_status_report(&report);
        let reconciled = cache.borrow().order(&rig.cloid).unwrap().clone();
        rig.dispatch = WsDispatchState::new();
        rig.dispatch
            .seed_order_restorations(vec![reconciled.clone()]);
        dispatch_reduce_frame(&rig, &frame, false);
        let replayed = consume_reduce_events(&mut rig, &mut engine);

        assert_eq!(events.len(), 2);
        assert!(matches!(events[0], OrderEventAny::Accepted(_)));

        let OrderEventAny::Updated(update) = &events[1] else {
            panic!("expected quantity update");
        };

        assert_eq!(update.quantity, Quantity::from("0.0001"));
        assert!(update.reconciliation);
        assert_eq!(order.status(), OrderStatus::Accepted);
        assert_eq!(order.quantity(), Quantity::from("0.0001"));
        assert_eq!(order.leaves_qty(), Quantity::from("0.0001"));
        assert_eq!(order.filled_qty(), Quantity::from("0.0000"));
        assert_eq!(report.quantity, Quantity::from("0.0001"));
        assert_eq!(report.filled_qty, Quantity::from("0.0000"));
        assert_eq!(reconciled, order);
        assert!(replayed.is_empty());
    }

    #[rstest]
    #[case::frame_first(false, false, false)]
    #[case::trade_first(true, false, false)]
    #[case::reduced_then_frame(false, true, false)]
    #[case::reduced_then_trade(true, true, false)]
    #[case::deferred_frame(false, false, true)]
    #[case::deferred_trade(true, false, true)]
    fn self_trade_reduce_final_fill_ordering(
        #[case] trade_first: bool,
        #[case] reduced_open: bool,
        #[case] deferred: bool,
        #[values(false, true)] first_frame: bool,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        if !first_frame {
            dispatch_reduce_frame(&rig, &frame, false);
            consume_reduce_events(&mut rig, &mut engine);
        }

        frame.remaining_base_amount = Decimal::from_str("0.0001").unwrap();
        frame.updated_at += 1_000;
        if reduced_open {
            dispatch_reduce_frame(&rig, &frame, false);
            consume_reduce_events(&mut rig, &mut engine);
        }

        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = Decimal::from_str("0.0001").unwrap();
        trade.usd_amount = trade.size * trade.price;
        frame.status = LighterOrderStatus::Filled;
        frame.remaining_base_amount = Decimal::ZERO;
        frame.filled_base_amount = trade.size;
        frame.filled_quote_amount = trade.usd_amount;
        frame.updated_at += 1_000;

        if trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(3),
            );
            consume_reduce_events(&mut rig, &mut engine);
        }

        dispatch_reduce_frame(&rig, &frame, deferred);
        consume_reduce_events(&mut rig, &mut engine);

        if !trade_first {
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(4),
            );
            consume_reduce_events(&mut rig, &mut engine);
        }

        let order = cache.borrow().order(&rig.cloid).unwrap().clone();

        assert_eq!(order.quantity(), Quantity::from("0.0001"));
        assert_eq!(order.filled_qty(), Quantity::from("0.0001"));
        assert_eq!(order.leaves_qty(), Quantity::from("0.0000"));
        assert_eq!(order.status(), OrderStatus::Filled);
        assert_eq!(
            order.trade_ids(),
            vec![&parse_lighter_trade_id(&trade).unwrap()]
        );
    }

    #[rstest]
    #[case::stream(false)]
    #[case::report(true)]
    fn self_trade_reduce_cancellation_remains_canceled(#[case] report: bool) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        frame.remaining_base_amount = Decimal::from_str("0.0001").unwrap();
        frame.updated_at += 1_000;
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        frame.status = LighterOrderStatus::Canceled;
        frame.remaining_base_amount = Decimal::ZERO;
        frame.updated_at += 1_000;

        if report {
            let report = rig.dispatch.translate_order_cloid(
                parse_http_order_to_report(
                    &frame,
                    &rig.registry,
                    account_id(),
                    UnixNanos::from(5),
                    &rig.dispatch,
                )
                .unwrap(),
            );
            engine.reconcile_order_status_report(&report);
        } else {
            dispatch_reduce_frame(&rig, &frame, false);
            consume_reduce_events(&mut rig, &mut engine);
        }

        let order = cache.borrow().order(&rig.cloid).unwrap().clone();

        assert_eq!(order.status(), OrderStatus::Canceled);
        assert_eq!(order.filled_qty(), Quantity::from("0.0000"));
        assert!(order.trade_ids().is_empty());
        assert_eq!(
            order.quantity(),
            Quantity::from(if report { "0.0027" } else { "0.0001" })
        );
    }

    fn reduce_order_replay() -> (
        DispatcherRig,
        Rc<RefCell<Cache>>,
        ExecutionEngine,
        LighterOrder,
    ) {
        let rig = dispatcher_rig("REDUCE-REPLAY");
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        frame.initial_base_amount = Decimal::from_str("0.0027").unwrap();
        frame.remaining_base_amount = frame.initial_base_amount;
        let order = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.0027"))
            .price(Price::from("2352.74"))
            .build();
        rig.dispatch.register_create_identity(&order).unwrap();
        rig.dispatch
            .mark_order_submission(&rig.cloid, TEST_SUBMISSION_NONCE);
        let cache = Rc::new(RefCell::new(Cache::default()));
        cache
            .borrow_mut()
            .add_instrument(
                LIGHTER_INSTRUMENT_CACHE
                    .get(&rig.instrument_id)
                    .unwrap()
                    .value()
                    .clone(),
            )
            .unwrap();
        cache
            .borrow_mut()
            .add_order(order, None, Some(client_id()), false)
            .unwrap();
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));
        let mut engine = ExecutionEngine::new(clock, cache.clone(), None);
        engine.process(&OrderEventAny::Submitted(OrderSubmitted::new(
            trader_id(),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            account_id(),
            UUID4::new(),
            UnixNanos::from(1),
            UnixNanos::from(1),
        )));
        (rig, cache, engine, frame)
    }

    fn dispatch_reduce_frame(rig: &DispatcherRig, frame: &LighterOrder, deferred: bool) {
        if deferred {
            dispatch_deferred_order(rig.cloid, frame, &rig.dispatch, &rig.emitter);
        } else {
            dispatch_lighter_order(
                frame,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                UnixNanos::from(3),
            );
        }
    }

    fn consume_reduce_events(
        rig: &mut DispatcherRig,
        engine: &mut ExecutionEngine,
    ) -> Vec<OrderEventAny> {
        let mut orders = Vec::new();

        for event in drain_events(&mut rig.rx) {
            match event {
                ExecutionEvent::Order(event) => {
                    engine.process(&event);
                    orders.push(event);
                }
                ExecutionEvent::Report(report) => engine.reconcile_execution_report(&report),
                other => panic!("unexpected event: {other:?}"),
            }
        }

        orders
    }

    #[rstest]
    #[case::ioc(LighterOrderStatus::CanceledNotEnoughLiquidity, false)]
    #[case::expiry(LighterOrderStatus::CanceledExpired, false)]
    #[case::post_only(LighterOrderStatus::CanceledPostOnly, false)]
    #[case::resting(LighterOrderStatus::Canceled, true)]
    fn terminal_waits_for_all_distinct_fills(
        #[case] status: LighterOrderStatus,
        #[case] trade_first: bool,
    ) {
        let mut rig = dispatcher_rig("TERMINAL-FILLS");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();
        let mut order = dispatcher_test_order(&rig, status);
        order.filled_base_amount = Decimal::from_str("0.0030").unwrap();
        let mut first = dispatcher_test_trade(&rig, true);
        first.bid_id = order.order_index;
        first.bid_id_str = Some(order.order_id.clone());
        first.size = Decimal::from_str("0.0010").unwrap();
        let mut second = first.clone();
        second.trade_id += 1;
        second.trade_id_str = Some(second.trade_id.to_string());
        second.size = Decimal::from_str("0.0020").unwrap();

        let send_trade = |trade: &LighterTrade| {
            dispatch_lighter_trade(
                trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(2),
            );
        };

        if trade_first {
            send_trade(&first);
        }

        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let deadline = rig.dispatch.terminals_pending.lock()[&rig.cloid].retry_at;
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        assert_eq!(
            rig.dispatch.terminals_pending.lock()[&rig.cloid].retry_at,
            deadline
        );
        send_trade(&first);
        send_trade(&first);
        assert_eq!(identity.filled_qty(), Decimal::from_str("0.0010").unwrap());
        assert!(rig.dispatch.order_identities.contains_key(&rig.cloid));
        let mut events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 1);
        assert!(
            matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Filled(fill))
            if fill.trade_id.as_str() == first.trade_id_str.as_deref().unwrap()
                && fill.last_qty == Quantity::from("0.0010"))
        );
        dispatch_lighter_trade(
            &second,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(4),
        );
        events.extend(drain_events(&mut rig.rx));
        assert_eq!(events.len(), 3);
        assert!(
            matches!(&events[1], ExecutionEvent::Order(OrderEventAny::Filled(fill))
            if fill.last_qty == Quantity::from("0.0020"))
        );

        let terminal_ts = match &events[2] {
            ExecutionEvent::Order(OrderEventAny::Canceled(event)) => {
                assert_ne!(status, LighterOrderStatus::CanceledExpired);
                event.ts_event
            }
            ExecutionEvent::Order(OrderEventAny::Expired(event)) => {
                assert_eq!(status, LighterOrderStatus::CanceledExpired);
                event.ts_event
            }
            event => panic!("expected terminal after fills, was {event:?}"),
        };

        assert_eq!(terminal_ts, UnixNanos::from(1_777_941_383_900_000_000));
        assert_eq!(identity.filled_qty(), Decimal::from_str("0.0030").unwrap());
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        assert!(!rig.dispatch.order_identities.contains_key(&rig.cloid));
    }

    #[rstest]
    fn terminal_after_fills_has_no_delay() {
        let mut rig = dispatcher_rig("TERMINAL-COVERED");
        register_identity(&rig);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        order.filled_base_amount = trade.size;
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(1),
        );
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );
        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 3);
        assert!(matches!(
            &events[0],
            ExecutionEvent::Order(OrderEventAny::Accepted(_))
        ));
        assert!(matches!(
            &events[1],
            ExecutionEvent::Order(OrderEventAny::Filled(_))
        ));
        assert!(matches!(
            &events[2],
            ExecutionEvent::Order(OrderEventAny::Canceled(_))
        ));
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
    }

    #[rstest]
    #[case::modify_hold(true)]
    #[case::fill_hold(false)]
    #[tokio::test]
    async fn terminal_preserves_later_holds_and_emits_once(#[case] modify_pending: bool) {
        let mut rig = dispatcher_rig("TERMINAL-MODIFY");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        order.filled_base_amount = trade.size;
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let command = ModifyOrder::new(
            trader_id(),
            Some(client_id()),
            strategy_id(),
            rig.instrument_id,
            rig.cloid,
            Some(VenueOrderId::new(&order.order_id)),
            None,
            Some(Price::from("2350.00")),
            None,
            UUID4::new(),
            UnixNanos::from(2),
            None,
            None,
        );
        assert!(rig.dispatch.set_pending_modify_action(&command));
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(3),
        );
        dispatch_lighter_trade(
            &trade,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(4),
        );

        if !modify_pending {
            assert!(
                rig.dispatch
                    .clear_pending_modify_if_command(&rig.cloid, command.command_id)
            );
        }

        let (http_client, hits, server) = terminal_trades_server(&order, Vec::new()).await;
        let (client, _, _) = create_execution_client();
        let mut context = acked_probe_context(&client);
        context.http_client = http_client;
        context.dispatch = rig.dispatch.clone();
        context.registry = rig.registry.clone();
        context.emitter = rig.emitter.clone();
        for _ in 0..=ACKED_ORDER_PROBE_ATTEMPTS {
            recover_terminals(&context, true).await;
        }

        assert_eq!(hits.load(Ordering::Relaxed), ACKED_ORDER_PROBE_ATTEMPTS);
        {
            let mut events = rig.dispatch.order_events.lock();
            release_terminal(rig.cloid, true, &rig.dispatch, &rig.emitter, &events);
            assert!(drain_events(&mut rig.rx).is_empty());
            assert!(
                rig.dispatch
                    .terminals_pending
                    .lock()
                    .contains_key(&rig.cloid)
            );
            assert!(rig.dispatch.order_identities.contains_key(&rig.cloid));

            if modify_pending {
                assert!(
                    rig.dispatch
                        .clear_pending_modify_if_command(&rig.cloid, command.command_id)
                );
            }

            let deferred = events.remove(&rig.cloid).unwrap();
            flush_modify_events(
                rig.cloid,
                deferred,
                &rig.dispatch,
                &rig.emitter,
                &mut events,
            );
        }

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 2);
        assert!(
            matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Filled(fill)) if fill.trade_id == parse_lighter_trade_id(&trade).unwrap())
        );
        assert!(matches!(
            &events[1],
            ExecutionEvent::Order(OrderEventAny::Canceled(_))
        ));
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        assert!(rig.dispatch.order_events.lock().is_empty());
        assert!(!rig.dispatch.order_identities.contains_key(&rig.cloid));
        server.abort();
        let _ = server.await;
    }

    async fn terminal_trades_server(
        order: &LighterOrder,
        trades: Vec<LighterTrade>,
    ) -> (
        LighterHttpClient,
        Arc<AtomicUsize>,
        tokio::task::JoinHandle<()>,
    ) {
        let hits = Arc::new(AtomicUsize::new(0));
        let count = hits.clone();
        let order_index = order.order_index.to_string();
        let market_index = order.market_index.to_string();

        let raw = order.clone();

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let raw = raw.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[raw]})) }
                }),
            )
            .route(
                "/api/v1/trades",
                get(
                    move |axum::extract::Query(query): axum::extract::Query<
                        BTreeMap<String, String>,
                    >| {
                        let trades = trades.clone();
                        let count = count.clone();
                        let order_index = order_index.clone();
                        let market_index = market_index.clone();
                        async move {
                            count.fetch_add(1, Ordering::Relaxed);
                            assert_eq!(query.get("order_index"), Some(&order_index));
                            assert_eq!(query.get("market_id"), Some(&market_index));
                            assert_eq!(
                                query.get("account_index"),
                                Some(&TEST_ACCOUNT_INDEX_I64.to_string())
                            );
                            assert_eq!(query.get("sort_by").map(String::as_str), Some("timestamp"));
                            assert_eq!(query.get("sort_dir").map(String::as_str), Some("desc"));
                            assert_eq!(query.get("limit").map(String::as_str), Some("100"));
                            assert!(!query.contains_key("from"));
                            assert!(query.get("auth").is_some_and(|auth| !auth.is_empty()));
                            axum::Json(serde_json::json!({"code":200,"trades":trades}))
                        }
                    },
                ),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        (http_client, hits, server)
    }

    #[rstest]
    #[case::recovered(true, false)]
    #[case::exhausted(false, false)]
    #[case::foreign_order(false, true)]
    #[tokio::test]
    async fn terminal_recovery_is_order_scoped_and_bounded(
        #[case] recovered: bool,
        #[case] foreign_order: bool,
    ) {
        let mut rig = dispatcher_rig("TERMINAL-RECOVERY");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::CanceledNotEnoughLiquidity);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        trade.size = Decimal::from_str("0.0025").unwrap();
        order.filled_base_amount = trade.size;
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );

        let trades = if foreign_order {
            trade.bid_id += 1;
            trade.bid_id_str = Some(trade.bid_id.to_string());
            vec![trade]
        } else if recovered {
            vec![trade.clone(), trade]
        } else {
            Vec::new()
        };

        let (http_client, hits, server) = terminal_trades_server(&order, trades).await;
        let (client, _, _) = create_execution_client();
        let mut context = acked_probe_context(&client);
        context.http_client = http_client;
        context.dispatch = rig.dispatch.clone();
        context.registry = rig.registry.clone();
        context.emitter = rig.emitter.clone();
        recover_terminals(&context, false).await;
        assert_eq!(hits.load(Ordering::Relaxed), 0, "deadline must be honored");

        if foreign_order {
            let error = recover_terminal_trades(order.market_index, order.order_index, &context)
                .await
                .unwrap_err();
            assert_eq!(
                error.to_string(),
                "Lighter terminal recovery returned a trade outside the requested order"
            );
            hits.store(0, Ordering::Relaxed);
        }

        let attempts = if recovered {
            1
        } else {
            ACKED_ORDER_PROBE_ATTEMPTS
        };

        for attempt in 1..=attempts {
            recover_terminals(&context, true).await;
            assert_eq!(hits.load(Ordering::Relaxed), attempt);

            if attempt < attempts {
                assert!(drain_events(&mut rig.rx).is_empty());
                assert_eq!(
                    rig.dispatch.terminals_pending.lock()[&rig.cloid].attempts,
                    attempt
                );
            }
        }

        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), if recovered { 2 } else { 1 });

        if recovered {
            assert!(
                matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Filled(fill))
                if fill.last_qty == Quantity::from("0.0025"))
            );
        }

        assert!(matches!(
            events.last(),
            Some(ExecutionEvent::Order(OrderEventAny::Canceled(_)))
        ));
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        recover_terminals(&context, true).await;
        assert!(drain_events(&mut rig.rx).is_empty());
        assert_eq!(hits.load(Ordering::Relaxed), attempts);
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::reconnect(false)]
    #[case::stop(true)]
    #[tokio::test]
    async fn terminal_worker_recovers_immediately_on_lifecycle(#[case] stop: bool) {
        let mut rig = dispatcher_rig("TERMINAL-LIFECYCLE");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::CanceledExpired);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        trade.size = Decimal::from_str("0.0025").unwrap();
        order.filled_base_amount = trade.size;
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        rig.dispatch
            .terminals_pending
            .lock()
            .get_mut(&rig.cloid)
            .unwrap()
            .retry_at = tokio::time::Instant::now() + Duration::from_secs(3600);
        let (http_client, hits, server) = terminal_trades_server(&order, vec![trade]).await;
        let (mut client, _, _) = create_execution_client();
        client.http_client = http_client;
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        let context = acked_probe_context(&client);
        client
            .terminal_recovery_handle
            .spawn(run_terminal_recovery(
                context,
                client.terminal_producers_stopped.clone(),
            ))
            .unwrap();

        if stop {
            client.stop().unwrap();
        } else {
            client.dispatch.terminals_recover.notify_one();
        }

        if !stop {
            wait_until_async(
                || async { rig.dispatch.terminals_pending.lock().is_empty() },
                Duration::from_secs(2),
            )
            .await;
            client.stop().unwrap();
        }

        client.finish_session_shutdown().await.unwrap();
        let events = drain_events(&mut rig.rx);
        assert_eq!(hits.load(Ordering::Relaxed), 1);
        assert_eq!(events.len(), 2);
        assert!(
            matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Filled(fill))
            if fill.last_qty == Quantity::from("0.0025"))
        );
        assert!(
            matches!(&events[1], ExecutionEvent::Order(OrderEventAny::Expired(event))
            if event.ts_event == UnixNanos::from(1_777_941_383_900_000_000))
        );
        assert!(client.terminal_recovery_handle.is_none());
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::restored(true, false)]
    #[case::reconciled(false, false)]
    #[case::declined(false, true)]
    fn terminal_preserves_applied_fills_and_post_only_state(
        #[case] restored: bool,
        #[case] declined: bool,
    ) {
        let mut rig = dispatcher_rig("TERMINAL-BASELINE");
        register_identity(&rig);
        let mut frame = dispatcher_test_order(&rig, LighterOrderStatus::Open);
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .unwrap()
            .value()
            .clone();
        let mut order = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(rig.cloid)
            .side(OrderSide::Buy)
            .quantity(Quantity::from("0.0050"))
            .price(Price::from("2352.74"))
            .post_only(true)
            .build();
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        frame.price = Decimal::from_str("2353.00").unwrap();
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(2),
        );

        for event in drain_events(&mut rig.rx) {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            order.apply(event).unwrap();
        }

        let mut first = dispatcher_test_trade(&rig, true);
        first.bid_id = frame.order_index;
        first.bid_id_str = Some(frame.order_id.clone());
        first.size = Decimal::from_str("0.0010").unwrap();
        let fill = parse_lighter_order_filled(
            &first,
            &instrument,
            &rig.dispatch.order_identity(&rig.cloid).unwrap(),
            rig.cloid,
            account_id(),
            trader_id(),
            TEST_ACCOUNT_INDEX_I64,
            UnixNanos::from(3),
        )
        .unwrap()
        .unwrap();
        let (mut client, cache, _) = create_execution_client();
        client.dispatch = rig.dispatch.clone();
        client.emitter = rig.emitter.clone();
        client.subscribe_applied_fills();
        cache
            .borrow_mut()
            .add_order(order.clone(), None, Some(client_id()), false)
            .unwrap();

        if !restored {
            let mut report = parse_ws_fill_report(
                &first,
                TEST_ACCOUNT_INDEX_I64,
                &instrument,
                account_id(),
                UnixNanos::from(3),
            )
            .unwrap()
            .unwrap();
            report.client_order_id = Some(rig.cloid);

            let sweep = finish_fill_reports(
                &client.core,
                &rig.dispatch,
                BTreeSet::new(),
                Ok(FillSweep {
                    reports: vec![report.clone()],
                    covers_window: true,
                    withheld_instruments: AHashSet::new(),
                }),
            )
            .unwrap();

            assert_eq!(
                rig.dispatch
                    .order_identity(&rig.cloid)
                    .unwrap()
                    .filled_qty(),
                Decimal::ZERO
            );
            assert_eq!(sweep.reports, vec![report.clone()]);
            assert!(sweep.covers_window);
            assert!(sweep.withheld_instruments.is_empty());
            assert!(!order_shape_pending(
                &client.core,
                &rig.dispatch,
                &rig.cloid
            ));
            assert_eq!(rig.dispatch.trade_source(fill.trade_id), None);

            let repeated = finish_fill_reports(
                &client.core,
                &rig.dispatch,
                BTreeSet::new(),
                Ok(FillSweep {
                    reports: vec![report.clone()],
                    covers_window: true,
                    withheld_instruments: AHashSet::new(),
                }),
            )
            .unwrap();

            assert_eq!(repeated.reports, vec![report]);
        }

        msgbus::publish_order_event(
            "events.order.S-001".into(),
            &OrderEventAny::Filled(fill.clone()),
        );
        assert_eq!(
            rig.dispatch
                .order_identity(&rig.cloid)
                .unwrap()
                .filled_qty(),
            Decimal::ZERO
        );

        if !declined {
            cache
                .borrow_mut()
                .update_order(&OrderEventAny::Filled(fill.clone()))
                .unwrap();
            msgbus::publish_order_event(
                "events.order.S-001".into(),
                &OrderEventAny::Filled(fill.clone()),
            );
            order.apply(OrderEventAny::Filled(fill.clone())).unwrap();
        }

        if restored {
            rig.dispatch = WsDispatchState::new();
            rig.dispatch.seed_order_restorations(vec![order.clone()]);
        }

        if !restored {
            assert_eq!(
                rig.dispatch
                    .order_identity(&rig.cloid)
                    .unwrap()
                    .filled_qty(),
                if declined { Decimal::ZERO } else { first.size }
            );
        }

        frame.status = LighterOrderStatus::CanceledPostOnly;
        frame.filled_base_amount = Decimal::from_str("0.0030").unwrap();
        dispatch_lighter_order(
            &frame,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(4),
        );
        let report =
            parse_ws_order_status_report(&frame, &instrument, account_id(), UnixNanos::from(4))
                .unwrap()
                .with_client_order_id(rig.cloid);
        assert!(!order_report_ready(
            &client.core,
            &rig.dispatch,
            &report,
            &[]
        ));
        assert_eq!(
            execution_instruments_pending(&client.core, &rig.dispatch),
            AHashSet::from_iter([rig.instrument_id])
        );
        dispatch_lighter_trade(
            &first,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(5),
        );
        let recovered = drain_events(&mut rig.rx);

        if declined {
            assert_eq!(recovered.len(), 1);

            let ExecutionEvent::Order(OrderEventAny::Filled(recovered_fill)) = &recovered[0] else {
                panic!("discarded HTTP report must remain recoverable as a real fill");
            };

            assert_eq!(recovered_fill.trade_id, fill.trade_id);
            assert_eq!(recovered_fill.last_qty, fill.last_qty);
            cache
                .borrow_mut()
                .update_order(&OrderEventAny::Filled(recovered_fill.clone()))
                .unwrap();
            msgbus::publish_order_event(
                "events.order.S-001".into(),
                &OrderEventAny::Filled(recovered_fill.clone()),
            );
            order
                .apply(OrderEventAny::Filled(recovered_fill.clone()))
                .unwrap();
        } else {
            assert!(
                recovered.is_empty(),
                "historical fill must not repeat or release terminal"
            );
        }

        let mut second = first;
        second.trade_id += 1;
        second.trade_id_str = Some(second.trade_id.to_string());
        second.size = Decimal::from_str("0.0020").unwrap();
        dispatch_lighter_trade(
            &second,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(6),
        );
        let events = drain_events(&mut rig.rx);
        assert_eq!(events.len(), 2);
        assert!(matches!(
            &events[0],
            ExecutionEvent::Order(OrderEventAny::Filled(_))
        ));
        assert!(matches!(
            &events[1],
            ExecutionEvent::Order(OrderEventAny::Canceled(_))
        ));

        for event in events {
            let ExecutionEvent::Order(event) = event else {
                panic!("expected order event");
            };

            order.apply(event).unwrap();
        }

        assert_eq!(order.status(), OrderStatus::Canceled);
        assert_eq!(order.filled_qty(), Quantity::from("0.0030"));
        assert_eq!(order.price(), Some(Price::from("2353.00")));
        assert_eq!(order.trade_ids().len(), 2);
        assert_eq!(
            rig.dispatch
                .order_identity(&rig.cloid)
                .unwrap()
                .filled_qty(),
            Decimal::from_str("0.0030").unwrap()
        );
    }

    #[rstest]
    #[case::paged(false)]
    #[case::repeated_cursor(true)]
    #[tokio::test]
    async fn terminal_recovery_paginates_without_duplicate_fills(#[case] repeat_cursor: bool) {
        let mut rig = dispatcher_rig("TERMINAL-PAGES");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::Canceled);
        order.filled_base_amount = Decimal::from_str("0.0030").unwrap();
        let mut first = dispatcher_test_trade(&rig, true);
        first.bid_id = order.order_index;
        first.bid_id_str = Some(order.order_id.clone());
        first.size = Decimal::from_str("0.0010").unwrap();
        let mut second = first.clone();
        second.trade_id += 1;
        second.trade_id_str = Some(second.trade_id.to_string());
        second.size = Decimal::from_str("0.0020").unwrap();
        let hits = Arc::new(AtomicUsize::new(0));
        let count = hits.clone();

        let app = Router::new().route("/api/v1/trades", get(move |axum::extract::Query(query): axum::extract::Query<BTreeMap<String, String>>| {
            let first = first.clone();
            let second = second.clone();
            let count = count.clone();
            async move {
                count.fetch_add(1, Ordering::Relaxed);

                if let Some(cursor) = query.get("cursor") {
                    assert_eq!(cursor, "older");
                    axum::Json(serde_json::json!({"code":200,"trades":[first],"next_cursor":if repeat_cursor { Some("older") } else { None }}))
                } else {
                    axum::Json(serde_json::json!({"code":200,"trades":[second],"next_cursor":"older"}))
                }
            }
        }));

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let (client, _, _) = create_execution_client();
        let mut context = acked_probe_context(&client);
        context.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        context.dispatch = rig.dispatch.clone();
        context.registry = rig.registry.clone();
        context.emitter = rig.emitter.clone();
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let result = recover_terminal_trades(order.market_index, order.order_index, &context).await;
        assert_eq!(hits.load(Ordering::Relaxed), 2);

        if repeat_cursor {
            assert_eq!(
                result.unwrap_err().to_string(),
                "Lighter terminal recovery repeated cursor"
            );
            assert!(drain_events(&mut rig.rx).is_empty());
            assert!(
                rig.dispatch
                    .terminals_pending
                    .lock()
                    .contains_key(&rig.cloid)
            );
        } else {
            result.unwrap();
            let events = drain_events(&mut rig.rx);
            assert_eq!(events.len(), 3);
            assert!(
                matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Filled(fill)) if fill.last_qty == Quantity::from("0.0010"))
            );
            assert!(
                matches!(&events[1], ExecutionEvent::Order(OrderEventAny::Filled(fill)) if fill.last_qty == Quantity::from("0.0020"))
            );
            assert!(matches!(
                &events[2],
                ExecutionEvent::Order(OrderEventAny::Canceled(_))
            ));
            assert!(rig.dispatch.terminals_pending.lock().is_empty());
        }

        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::normal(false, 0)]
    #[case::interrupted_shutdown(true, 0)]
    #[case::interrupted_lookup(false, 1)]
    #[case::repeated_reconnect(false, ACKED_ORDER_PROBE_ATTEMPTS)]
    #[tokio::test]
    async fn terminal_shutdown_bounds_unresponsive_http(
        #[case] interrupted: bool,
        #[case] reconnects: usize,
    ) {
        let mut rig = dispatcher_rig("TERMINAL-TIMEOUT");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::CanceledExpired);
        order.filled_base_amount = Decimal::from_str("0.0025").unwrap();
        dispatch_lighter_order(
            &order,
            &rig.dispatch,
            &rig.emitter,
            &rig.registry,
            account_id(),
            trader_id(),
            UnixNanos::from(1),
        );
        let hits = Arc::new(AtomicUsize::new(0));
        let count = hits.clone();
        let app = Router::new().route(
            "/api/v1/trades",
            get(move || {
                count.fetch_add(1, Ordering::Relaxed);
                std::future::pending::<String>()
            }),
        );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let (mut client, _, _) = create_execution_client();
        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            60,
            None,
        )
        .unwrap();
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        let context = acked_probe_context(&client);
        client
            .terminal_recovery_handle
            .spawn(run_terminal_recovery(
                context,
                client.terminal_producers_stopped.clone(),
            ))
            .unwrap();

        for expected in 1..=reconnects {
            rig.dispatch.terminals_recover.notify_one();
            wait_until_async(
                || async { hits.load(Ordering::Relaxed) == expected },
                Duration::from_secs(2),
            )
            .await;
        }

        client.stop().unwrap();

        if interrupted {
            {
                let shutdown = client.finish_session_shutdown();
                tokio::pin!(shutdown);
                tokio::select! {
                    result = &mut shutdown => panic!("shutdown completed before blocked recovery: {result:?}"),
                    () = wait_until_async(|| async { hits.load(Ordering::Relaxed) == 1 }, Duration::from_secs(2)) => {},
                }
            }

            assert!(client.terminal_recovery_handle.is_some());
            assert!(client.terminal_producers_stopped.is_cancelled());
        }

        tokio::time::timeout(
            TERMINAL_SHUTDOWN_TIMEOUT + DISCONNECT_TIMEOUT,
            client.finish_session_shutdown(),
        )
        .await
        .unwrap()
        .unwrap();
        let events = drain_events(&mut rig.rx);
        assert_eq!(hits.load(Ordering::Relaxed), ACKED_ORDER_PROBE_ATTEMPTS);
        assert_eq!(events.len(), 1);
        assert!(
            matches!(&events[0], ExecutionEvent::Order(OrderEventAny::Expired(event))
            if event.client_order_id == rig.cloid)
        );
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        assert!(client.terminal_recovery_handle.is_none());
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::query_terminal(0, 0)]
    #[case::query_deferred(0, 1)]
    #[case::cancel_terminal(1, 0)]
    #[case::cancel_deferred(1, 1)]
    #[case::query_partial(0, 2)]
    #[case::cancel_partial(1, 2)]
    #[case::create_partial(2, 2)]
    #[case::query_queued_fill(0, 3)]
    #[case::cancel_queued_fill(1, 3)]
    #[case::create_queued_fill(2, 3)]
    #[tokio::test]
    async fn terminal_blocks_http_order_publication(#[case] route: u8, #[case] phase: u8) {
        let (mut client, cache, mut rx) = create_execution_client();
        let instrument = register_test_instrument(&client, &cache);
        let id = ClientOrderId::from("TERMINAL-HTTP-BARRIER");
        let venue = VenueOrderId::from("123");
        let mut factory = test_order_factory();
        let cached = test_limit_order(&mut factory, instrument, id.as_str());
        let index = client.dispatch.register_create_identity(&cached).unwrap();
        client
            .dispatch
            .mark_order_submission(&id, TEST_SUBMISSION_NONCE);
        cache_accepted_order(&cache, cached, venue, Some(client_id()));
        client.dispatch.mark_accepted_emitted(id);
        let mut order = reconciliation_raw_order(index, venue, LighterOrderStatus::Canceled);
        order.filled_base_amount = Decimal::from_str("0.0025").unwrap();
        if phase >= 2 {
            order.status = LighterOrderStatus::Open;
            order.remaining_base_amount = order.initial_base_amount - order.filled_base_amount;

            if phase == 3 {
                let mut report =
                    reconciliation_fill_report(instrument, index, venue, "QUEUED-REAL-FILL");
                report.client_order_id = Some(id);
                report.last_qty = Quantity::from("0.0025");
                let identity = client.dispatch.order_identity(&id).unwrap();
                let cached = cache.borrow().order(&id).unwrap().clone();
                let inst = cache.borrow().instrument(&instrument).unwrap().clone();

                let OrderEventAny::Filled(fill) = TestOrderEventStubs::filled(
                    &cached,
                    &inst,
                    Some(report.trade_id),
                    None,
                    Some(report.last_px),
                    Some(report.last_qty),
                    None,
                    Some(report.commission),
                    None,
                    Some(account_id()),
                ) else {
                    panic!("expected fill");
                };

                assert!(!identity.has_publication());
                dispatch_lighter_fill(
                    fill,
                    &client.emitter,
                    &client.dispatch,
                    &client.dispatch.order_events.lock(),
                );
            }
        } else {
            dispatch_lighter_order(
                &order,
                &client.dispatch,
                &client.emitter,
                &client.registry,
                account_id(),
                trader_id(),
                UnixNanos::from(1),
            );
            assert!(client.dispatch.terminals_pending.lock().contains_key(&id));

            if phase == 1 {
                client.dispatch.terminals_pending.lock().remove(&id);
                client
                    .dispatch
                    .order_events
                    .lock()
                    .entry(id)
                    .or_default()
                    .store_order(&order);
            }
        }

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let order = order.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[order]})) }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();

        if route == 1 {
            enqueue_cancel(&client, instrument, id, venue, 12);
            let pending = client.dispatch.pop_pending_sendtx_head().unwrap();
            assert!(
                !recover_acked_action_report(&pending, &acked_probe_context(&client))
                    .await
                    .unwrap()
            );
            assert_eq!(client.dispatch.pending_cancel_nonce(&id), Some((0, 12)));
        } else if route == 2 {
            let cached = cache.borrow().order(&id).unwrap().clone();

            let probe = AckedOrderProbe {
                order: Box::new(cached),
                client_order_index: index,
                connection_epoch: 0,
                nonce: TEST_SUBMISSION_NONCE,
                api_key_index: TEST_API_KEY_INDEX,
                tx_hash: "create-probe".to_string(),
            };

            assert!(!probe_acked_create_report(&probe, &acked_probe_context(&client), 1).await);
        } else {
            client
                .query_order(QueryOrder::new(
                    trader_id(),
                    Some(client_id()),
                    strategy_id(),
                    instrument,
                    id,
                    Some(venue),
                    UUID4::new(),
                    UnixNanos::from(2),
                    None,
                    None,
                ))
                .unwrap();
            client.pending_tasks.begin_shutdown();
            client
                .pending_tasks
                .finish_shutdown(Duration::from_secs(2), DISCONNECT_TIMEOUT)
                .await
                .unwrap();
        }

        let events = drain_events(&mut rx);
        assert_eq!(events.len(), usize::from(phase == 3));
        assert_eq!(
            cache.borrow().order(&id).unwrap().filled_qty(),
            Quantity::from("0.0000")
        );

        if phase == 3 {
            assert!(matches!(
                &events[0],
                ExecutionEvent::Order(OrderEventAny::Filled(_))
            ));
        }

        assert!(client.dispatch.order_identities.contains_key(&id));
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::normal(false, false)]
    #[case::interrupted(true, false)]
    #[case::incomplete(false, true)]
    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
    async fn terminal_shutdown_drains_after_producer_drop(
        #[case] interrupted: bool,
        #[case] incomplete: bool,
    ) {
        let mut rig = dispatcher_rig("TERMINAL-LATE-PRODUCER");
        register_identity(&rig);
        rig.dispatch.mark_accepted_emitted(rig.cloid);
        let mut order = dispatcher_test_order(&rig, LighterOrderStatus::CanceledExpired);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = order.order_index;
        trade.bid_id_str = Some(order.order_id.clone());
        order.filled_base_amount = trade.size;
        let (http_client, hits, server) = terminal_trades_server(&order, vec![trade]).await;
        let (mut client, _, _) = create_execution_client();
        client.http_client = http_client;
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client.subscribe_applied_fills();
        let context = acked_probe_context(&client);
        client
            .terminal_recovery_handle
            .spawn(run_terminal_recovery(
                context.clone(),
                client.terminal_producers_stopped.clone(),
            ))
            .unwrap();
        let (ready, started) = tokio::sync::oneshot::channel();
        let (release, released) = std::sync::mpsc::sync_channel::<()>(1);

        client
            .pending_tasks
            .spawn(async move {
                let _guard = TaskGroupGuard::new(&[], move || {
                    dispatch_lighter_order(
                        &order,
                        &context.dispatch,
                        &context.emitter,
                        &context.registry,
                        account_id(),
                        trader_id(),
                        UnixNanos::from(2),
                    );
                });

                ready.send(()).unwrap();

                if incomplete {
                    released.recv().unwrap();
                } else {
                    std::future::pending::<()>().await;
                }
            })
            .unwrap();

        started.await.unwrap();
        client.stop().unwrap();

        if interrupted {
            assert!(
                tokio::time::timeout(Duration::from_millis(20), client.finish_session_shutdown())
                    .await
                    .is_err()
            );
            assert!(!client.terminal_producers_stopped.is_cancelled());
            assert!(client.terminal_recovery_handle.is_some());
            assert!(!client.pending_tasks.is_empty());
        }

        if incomplete {
            assert!(client.finish_session_shutdown().await.is_err());
            assert!(!client.terminal_producers_stopped.is_cancelled());
            assert!(client.terminal_recovery_handle.is_some());
            assert!(!client.pending_tasks.is_empty());
            assert!(client.fills_applied.is_some());
            release.send(()).unwrap();
        }

        client.finish_session_shutdown().await.unwrap();
        let events = drain_events(&mut rig.rx);
        assert_eq!(hits.load(Ordering::Relaxed), 1);
        assert_eq!(events.len(), 2);
        assert!(matches!(
            &events[0],
            ExecutionEvent::Order(OrderEventAny::Filled(_))
        ));
        assert!(matches!(
            &events[1],
            ExecutionEvent::Order(OrderEventAny::Expired(_))
        ));
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        assert!(client.session_tasks_finished());
        assert!(client.fills_applied.is_none());
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::canceled(LighterOrderStatus::Canceled, true, false, false)]
    #[case::expired(LighterOrderStatus::CanceledExpired, true, false, false)]
    #[case::missing_trade(LighterOrderStatus::Canceled, false, false, false)]
    #[case::canceled_bundle_first(LighterOrderStatus::Canceled, true, true, true)]
    #[case::canceled_mass_first(LighterOrderStatus::Canceled, true, true, false)]
    #[case::expired_bundle_first(LighterOrderStatus::CanceledExpired, true, true, true)]
    #[case::expired_mass_first(LighterOrderStatus::CanceledExpired, true, true, false)]
    #[case::early_missing_trade(LighterOrderStatus::Canceled, false, true, false)]
    #[tokio::test]
    async fn terminal_mass_status_pairs_missing_fills(
        #[case] status: LighterOrderStatus,
        #[case] complete: bool,
        #[case] early_timestamp: bool,
        #[case] bundle_first: bool,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .unwrap()
            .value()
            .clone();
        let mut first = dispatcher_test_trade(&rig, true);
        first.bid_id = frame.order_index;
        first.bid_id_str = Some(frame.order_id.clone());
        first.size = Decimal::from_str("0.0005").unwrap();
        first.usd_amount = first.size * first.price;
        let mut initial_fill = parse_ws_fill_report(
            &first,
            TEST_ACCOUNT_INDEX_I64,
            &instrument,
            account_id(),
            UnixNanos::from(2),
        )
        .unwrap()
        .unwrap();
        initial_fill.client_order_id = Some(rig.cloid);
        engine.reconcile_fill_report(&initial_fill);
        let mut second = first.clone();
        second.trade_id += 1;
        second.trade_id_str = Some(second.trade_id.to_string());
        second.timestamp += 1;
        second.size = Decimal::from_str("0.0010").unwrap();
        second.usd_amount = second.size * second.price;
        let second_id = parse_lighter_trade_id(&second).unwrap();
        frame.updated_at = if early_timestamp {
            second.timestamp - 2
        } else {
            second.timestamp + 1
        };

        let terminal_timestamp = UnixNanos::from(frame.updated_at as u64 * 1_000_000);
        frame.status = status;
        frame.filled_base_amount =
            Decimal::from_str(if complete { "0.0015" } else { "0.0020" }).unwrap();
        frame.filled_quote_amount = frame.filled_base_amount * frame.price;
        frame.remaining_base_amount = Decimal::ZERO;

        let mut client = create_execution_client_with_cache(cache.clone());
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client
            .dispatch
            .seed_order_restorations(vec![cache.borrow().order(&rig.cloid).unwrap().clone()]);
        client.dispatch.note_active_market(frame.market_index);

        let position = PositionStatusReport::new(
            account_id(),
            rig.instrument_id,
            PositionSide::Long,
            Quantity::from("0.0015"),
            UnixNanos::from(3),
            UnixNanos::from(3),
            None,
            None,
            None,
        );
        client
            .dispatch
            .replace_position_snapshot(&[position], &[], &[]);
        let trades = vec![first, second.clone(), second];

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let frame = frame.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[frame]})) }
                }),
            )
            .route(
                "/api/v1/trades",
                get(move || {
                    let trades = trades.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"trades":trades})) }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        let mass = client.generate_mass_status(None).await.unwrap().unwrap();
        assert_eq!(
            mass.order_reports().len(),
            usize::from(complete && !early_timestamp)
        );
        let bundles = drain_events(&mut rig.rx);
        assert_eq!(bundles.len(), usize::from(complete && early_timestamp));
        assert_eq!(mass.fill_reports().values().map(Vec::len).sum::<usize>(), 2);
        assert_eq!(mass.position_reports().len(), usize::from(complete));
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));
        let engine = Rc::new(RefCell::new(engine));
        engine
            .borrow_mut()
            .register_client(Box::new(client))
            .unwrap();
        let mut manager =
            ExecutionManager::new(clock, cache.clone(), ExecutionManagerConfig::default()).unwrap();
        let applied = Rc::new(RefCell::new(Vec::new()));
        let captured = applied.clone();
        let handler = TypedHandler::from(move |event: &OrderEventAny| {
            captured.borrow_mut().push(event.clone());
        });

        msgbus::subscribe_order_events(ORDER_EVENTS_PATTERN.into(), handler.clone(), None);
        let subscription = AppliedFillSubscription(handler);

        if bundle_first {
            for event in &bundles {
                let ExecutionEvent::Report(report) = event else {
                    panic!("expected bundled report")
                };

                engine.borrow_mut().reconcile_execution_report(report);
            }
        }

        manager.reconcile_execution_mass_status(&mass, &engine);

        if !bundle_first {
            for event in &bundles {
                let ExecutionEvent::Report(report) = event else {
                    panic!("expected bundled report")
                };

                engine.borrow_mut().reconcile_execution_report(report);
            }
        }

        drop(subscription);
        let applied = applied.take();
        assert_eq!(applied.len(), if complete { 2 } else { 1 });

        let OrderEventAny::Filled(fill) = &applied[0] else {
            panic!("expected real fill first")
        };

        assert_eq!(fill.trade_id, second_id);
        assert_eq!(fill.last_qty, Quantity::from("0.0010"));

        if complete {
            assert!(matches!(
                applied.last(),
                Some(OrderEventAny::Canceled(_) | OrderEventAny::Expired(_))
            ));
            assert_eq!(applied.last().unwrap().ts_event(), terminal_timestamp);
        }

        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(cached.filled_qty(), Quantity::from("0.0015"));
        assert_eq!(cached.trade_ids(), vec![&initial_fill.trade_id, &second_id]);
        assert_eq!(
            cached.status(),
            if !complete {
                OrderStatus::PartiallyFilled
            } else if status == LighterOrderStatus::CanceledExpired {
                OrderStatus::Expired
            } else {
                OrderStatus::Canceled
            }
        );
        assert!(
            nautilus_execution::reconciliation::inferred_reconciliation_trade_ids(&cached)
                .unwrap()
                .is_empty()
        );
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::observed(0)]
    #[case::synced(1)]
    #[case::restored(2)]
    #[case::restored_child(3)]
    #[tokio::test]
    async fn terminal_inferred_fills_exhaust_without_replay(#[case] mode: u8) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();

        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.emitter = rig.emitter.clone();
        client.registry = rig.registry.clone();
        if mode == 0 {
            client.subscribe_applied_fills();
        }

        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        frame.filled_base_amount = Decimal::from_str("0.0010").unwrap();
        frame.remaining_base_amount -= frame.filled_base_amount;
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .unwrap()
            .value()
            .clone();
        let mut report =
            parse_ws_order_status_report(&frame, &instrument, account_id(), UnixNanos::from(2))
                .unwrap()
                .with_client_order_id(rig.cloid);
        report.order_status = OrderStatus::PartiallyFilled;
        engine.reconcile_order_status_report(&report);
        let mut cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        let inferred =
            nautilus_execution::reconciliation::inferred_reconciliation_trade_ids(&cached).unwrap();
        assert_eq!(inferred.len(), 1);
        assert_eq!(cached.filled_qty(), Quantity::from("0.0010"));

        if mode == 1 {
            assert!(order_shape_pending(&client.core, &rig.dispatch, &rig.cloid));
        } else if mode >= 2 {
            if mode == 3 {
                let mut history = cached.events().into_iter().cloned().collect::<Vec<_>>();

                let OrderEventAny::Initialized(init) = &mut history[0] else {
                    panic!("expected initialization");
                };

                init.parent_order_id = Some(ClientOrderId::new("INFERRED-PARENT"));
                cached = OrderAny::from_events(history).unwrap();
                cache
                    .borrow_mut()
                    .add_order(cached.clone(), None, Some(client_id()), true)
                    .unwrap();
            }

            rig.dispatch = WsDispatchState::new();
            rig.dispatch.seed_order_restorations(vec![cached]);
            client.dispatch = rig.dispatch.clone();
            dispatch_reduce_frame(&rig, &frame, false);
            assert!(drain_events(&mut rig.rx).is_empty());
        }

        let positions_before = cache
            .borrow()
            .positions_open(None, None, None, None, None)
            .iter()
            .map(|position| position.quantity)
            .collect::<Vec<_>>();
        assert_eq!(positions_before, vec![Quantity::from("0.0010")]);
        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();
        assert!(identity.has_inferred_fills());
        assert_eq!(identity.filled_qty(), Decimal::ZERO);
        assert_eq!(rig.dispatch.trade_source(inferred[0]), None);
        assert_eq!(
            execution_instruments_pending(&client.core, &client.dispatch),
            AHashSet::from_iter([rig.instrument_id])
        );
        assert!(!order_report_ready(
            &client.core,
            &rig.dispatch,
            &report,
            &[]
        ));
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = frame.filled_base_amount;
        let mut fill = parse_ws_fill_report(
            &trade,
            TEST_ACCOUNT_INDEX_I64,
            &instrument,
            account_id(),
            UnixNanos::from(3),
        )
        .unwrap()
        .unwrap();
        fill.client_order_id = Some(rig.cloid);
        frame.status = LighterOrderStatus::Canceled;
        frame.remaining_base_amount = Decimal::ZERO;
        dispatch_reduce_frame(&rig, &frame, false);
        assert!(drain_events(&mut rig.rx).is_empty());
        let (http, hits, server) = terminal_trades_server(&frame, vec![trade]).await;
        client.http_client = http;
        let context = acked_probe_context(&client);

        if mode == 3 {
            let command = GenerateOrderStatusReport::new(
                UUID4::new(),
                UnixNanos::from(4),
                Some(rig.instrument_id),
                Some(rig.cloid),
                Some(VenueOrderId::new(&frame.order_id)),
                None,
                None,
            );
            assert!(client.generate_order_status_report(&command).await.is_err());
            wait_until_async(
                || async {
                    client
                        .dispatch
                        .order_events
                        .lock()
                        .get(&rig.cloid)
                        .is_none_or(|entry| entry.recovery_epoch.is_none())
                },
                Duration::from_secs(6),
            )
            .await;
        }

        for attempt in 1..=ACKED_ORDER_PROBE_ATTEMPTS {
            recover_terminals(&context, true).await;
            let events = consume_reduce_events(&mut rig, &mut engine);

            if attempt < ACKED_ORDER_PROBE_ATTEMPTS {
                assert!(events.is_empty());
            } else {
                assert_eq!(events.len(), 1);
                assert!(
                    matches!(&events[0], OrderEventAny::Canceled(event) if event.ts_event == report.ts_last)
                );
            }
        }

        let sweep = finish_fill_reports(
            &client.core,
            &rig.dispatch,
            BTreeSet::new(),
            Ok(FillSweep {
                reports: vec![fill],
                covers_window: true,
                withheld_instruments: AHashSet::new(),
            }),
        )
        .unwrap();

        assert!(sweep.reports.is_empty());
        assert!(!sweep.covers_window);
        assert_eq!(
            sweep.withheld_instruments,
            AHashSet::from_iter([rig.instrument_id])
        );
        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(cached.filled_qty(), Quantity::from("0.0010"));
        assert_eq!(cached.trade_ids(), inferred.iter().collect::<Vec<_>>());
        assert_eq!(cached.status(), OrderStatus::Canceled);
        assert_eq!(
            cache
                .borrow()
                .positions_open(None, None, None, None, None)
                .iter()
                .map(|position| position.quantity)
                .collect::<Vec<_>>(),
            positions_before
        );
        assert_eq!(identity.filled_qty(), Decimal::ZERO);
        assert_eq!(hits.load(Ordering::Relaxed), ACKED_ORDER_PROBE_ATTEMPTS);
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        inferred_reconciliation_trade_ids(&cached).unwrap();
        assert_eq!(
            client
                .dispatch
                .order_events
                .lock()
                .get(&rig.cloid)
                .map_or(0, |entry| entry.fills.len()),
            0
        );
        client.dispatch.replace_position_snapshot(&[], &[], &[]);
        assert!(execution_instruments_pending(&client.core, &client.dispatch).is_empty());

        let command = GeneratePositionStatusReports::new(
            UUID4::new(),
            UnixNanos::from(5),
            Some(rig.instrument_id),
            None,
            None,
            None,
            None,
        );
        assert!(
            client
                .generate_position_status_reports(&command)
                .await
                .unwrap()
                .is_empty()
        );
        let task = client
            .generate_position_status_reports_task(&command)
            .unwrap();
        task.collection.await;
        assert!((task.finish)().unwrap().is_empty());
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));

        let config = ExecutionManagerConfig {
            position_check_threshold_ns: DurationNanos::from_secs(0),
            ..ExecutionManagerConfig::default()
        };

        let mut manager = ExecutionManager::new(clock, cache.clone(), config).unwrap();
        for event in manager.check_positions_consistency(&[&client]).await {
            engine.process(&event);
        }

        assert_eq!(
            cache
                .borrow()
                .positions_open(None, None, None, None, None)
                .iter()
                .map(|position| position.signed_decimal_qty())
                .sum::<Decimal>(),
            Decimal::ZERO
        );
        assert_eq!(
            cache.borrow().order(&rig.cloid).unwrap().trade_ids(),
            inferred.iter().collect::<Vec<_>>()
        );
        assert_eq!(identity.filled_qty(), Decimal::ZERO);
        cache
            .borrow_mut()
            .purge_closed_orders(UnixNanos::from(u64::MAX), 0);
        assert!(cache.borrow().order(&rig.cloid).is_none());
        assert!(execution_instruments_pending(&client.core, &client.dispatch).is_empty());
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::applied(true, false)]
    #[case::discarded(false, false)]
    #[case::venue_uuid(true, true)]
    fn terminal_tracks_engine_applied_reconciliation(
        #[case] applied: bool,
        #[case] venue_uuid: bool,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.emitter = rig.emitter.clone();
        client.subscribe_applied_fills();
        client.subscribe_applied_fills();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = Decimal::from_str("0.0010").unwrap();
        if venue_uuid {
            trade.trade_id_str = Some("4b1da1f0-0d43-5a14-99b0-7245e76569af".to_string());
        }

        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .unwrap()
            .value()
            .clone();
        let mut report = parse_ws_fill_report(
            &trade,
            TEST_ACCOUNT_INDEX_I64,
            &instrument,
            account_id(),
            UnixNanos::from(2),
        )
        .unwrap()
        .unwrap();
        report.client_order_id = Some(rig.cloid);

        for _ in 0..2 {
            let reports = finish_fill_reports(
                &client.core,
                &rig.dispatch,
                BTreeSet::new(),
                Ok(FillSweep {
                    reports: vec![report.clone()],
                    covers_window: true,
                    withheld_instruments: AHashSet::new(),
                }),
            )
            .unwrap();

            assert_eq!(reports.reports, vec![report.clone()]);
            assert!(!order_shape_pending(
                &client.core,
                &rig.dispatch,
                &rig.cloid
            ));
        }

        if applied {
            engine.reconcile_fill_report(&report);
        }

        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();
        assert_eq!(
            identity.filled_qty(),
            if applied { trade.size } else { Decimal::ZERO }
        );
        assert_eq!(
            rig.dispatch.trade_source(report.trade_id),
            if applied {
                Some(TradeDedupSource::Reconciliation)
            } else {
                None
            }
        );
        assert!(!identity.has_publication());
        frame.status = LighterOrderStatus::Canceled;
        frame.filled_base_amount = trade.size;
        frame.remaining_base_amount = Decimal::ZERO;
        dispatch_reduce_frame(&rig, &frame, false);

        if !applied {
            assert!(drain_events(&mut rig.rx).is_empty());
            dispatch_lighter_trade(
                &trade,
                &rig.dispatch,
                &rig.emitter,
                &rig.registry,
                account_id(),
                trader_id(),
                Some(TEST_ACCOUNT_INDEX_I64),
                UnixNanos::from(3),
            );
        }

        let events = consume_reduce_events(&mut rig, &mut engine);
        assert_eq!(events.len(), if applied { 1 } else { 2 });
        assert!(matches!(events.last(), Some(OrderEventAny::Canceled(_))));

        if !applied {
            assert!(
                matches!(&events[0], OrderEventAny::Filled(fill) if fill.trade_id == report.trade_id)
            );
        }

        let order = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(order.status(), OrderStatus::Canceled);
        assert_eq!(order.filled_qty(), Quantity::from("0.0010"));
        assert_eq!(order.trade_ids(), vec![&report.trade_id]);
        assert!(rig.dispatch.terminals_pending.lock().is_empty());
        frame.filled_base_amount += Decimal::from_str("0.0001").unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        assert!(drain_events(&mut rig.rx).is_empty());
    }

    #[rstest]
    #[case::drop(true)]
    #[case::shutdown(false)]
    #[tokio::test]
    async fn terminal_fill_subscription_detaches(#[case] drop_client: bool) {
        let (mut rig, cache, mut engine, frame) = reduce_order_replay();

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.subscribe_applied_fills();
        client.subscribe_applied_fills();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        let mut report = reconciliation_fill_report(
            rig.instrument_id,
            frame.client_order_index,
            VenueOrderId::new(&frame.order_id),
            "APPLIED-FIRST",
        );
        report.client_order_id = Some(rig.cloid);
        report.last_qty = Quantity::from("0.0010");
        engine.reconcile_fill_report(&report);
        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();
        assert_eq!(identity.filled_qty(), Decimal::from_str("0.0010").unwrap());

        if !drop_client {
            client.stop().unwrap();
            client.finish_session_shutdown().await.unwrap();
            assert!(client.fills_applied.is_none());
        }

        drop(client);
        report.trade_id = TradeId::new("APPLIED-SECOND");
        engine.reconcile_fill_report(&report);
        assert_eq!(
            cache.borrow().order(&rig.cloid).unwrap().filled_qty(),
            Quantity::from("0.0020")
        );
        assert_eq!(identity.filled_qty(), Decimal::from_str("0.0010").unwrap());
        assert_eq!(rig.dispatch.trade_source(report.trade_id), None);
    }

    fn test_margin_account() -> MarginAccount {
        MarginAccount::new(
            AccountState::new(
                account_id(),
                AccountType::Margin,
                vec![AccountBalance::new(
                    Money::from("10000.00000000 USDC"),
                    Money::from("0.00000000 USDC"),
                    Money::from("10000.00000000 USDC"),
                )],
                Vec::new(),
                true,
                UUID4::new(),
                UnixNanos::from(1),
                UnixNanos::from(1),
                Some(Currency::from("USDC")),
            ),
            true,
        )
    }

    #[rstest]
    #[case::inline_cancel(0, LighterOrderStatus::Canceled)]
    #[case::worker_cancel(1, LighterOrderStatus::Canceled)]
    #[case::query_cancel(2, LighterOrderStatus::Canceled)]
    #[case::inline_expire(0, LighterOrderStatus::CanceledExpired)]
    #[case::worker_expire(1, LighterOrderStatus::CanceledExpired)]
    #[case::query_expire(2, LighterOrderStatus::CanceledExpired)]
    #[case::query_filled(2, LighterOrderStatus::Filled)]
    #[tokio::test]
    async fn terminal_query_recovers_missed_frames(
        #[case] route: u8,
        #[case] status: LighterOrderStatus,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        frame.status = status;
        let filled = status == LighterOrderStatus::Filled;
        let qty = Quantity::from(if filled { "0.0027" } else { "0.0010" });
        frame.filled_base_amount = qty.as_decimal();
        frame.filled_quote_amount = frame.filled_base_amount * frame.price;
        frame.remaining_base_amount = Decimal::ZERO;
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = frame.filled_base_amount;
        trade.usd_amount = trade.size * trade.price;
        let trade_id = parse_lighter_trade_id(&trade).unwrap();
        let terminal_timestamp = UnixNanos::from(frame.updated_at as u64 * 1_000_000);
        let venue = VenueOrderId::from(frame.order_id.as_str());
        let raw = frame.clone();
        let hits = Arc::new(AtomicUsize::new(0));
        let counted = hits.clone();

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let raw = raw.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[raw]})) }
                }),
            )
            .route(
                "/api/v1/trades",
                get(move || {
                    let trade = trade.clone();
                    let counted = counted.clone();
                    async move {
                        counted.fetch_add(1, Ordering::Relaxed);
                        axum::Json(serde_json::json!({"code":200,"trades":[trade]}))
                    }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();

        let command = GenerateOrderStatusReport::new(
            UUID4::new(),
            UnixNanos::from(4),
            Some(rig.instrument_id),
            Some(rig.cloid),
            Some(venue),
            None,
            None,
        );

        if filled && route == 2 {
            dispatch_reduce_frame(&rig, &frame, false);
            assert!(!client.dispatch.order_identities.contains_key(&rig.cloid));
        }

        let context = acked_probe_context(&client);
        let report = match route {
            0 => client.generate_order_status_report(&command).await.unwrap(),
            1 => {
                let task = client.generate_order_status_report_task(&command).unwrap();
                task.collection.await;
                (task.finish)().unwrap()
            }
            _ => {
                client
                    .query_order(QueryOrder::new(
                        trader_id(),
                        Some(client_id()),
                        strategy_id(),
                        rig.instrument_id,
                        rig.cloid,
                        Some(venue),
                        UUID4::new(),
                        UnixNanos::from(4),
                        None,
                        None,
                    ))
                    .unwrap();
                client.pending_tasks.begin_shutdown();
                client
                    .pending_tasks
                    .finish_shutdown(Duration::from_secs(2), DISCONNECT_TIMEOUT)
                    .await
                    .unwrap();
                None
            }
        };

        if !filled || route != 2 {
            assert!(drain_events(&mut rig.rx).is_empty());
        }

        assert_eq!(
            client
                .dispatch
                .terminals_pending
                .lock()
                .contains_key(&rig.cloid),
            route == 2 && !filled
        );
        let applied = Rc::new(RefCell::new(Vec::new()));
        let captured = applied.clone();
        let handler = TypedHandler::from(move |event: &OrderEventAny| {
            captured.borrow_mut().push(event.clone());
        });

        msgbus::subscribe_order_events(ORDER_EVENTS_PATTERN.into(), handler.clone(), None);
        let subscription = AppliedFillSubscription(handler);

        if let Some(report) = report {
            assert_eq!(report.filled_qty, qty);

            let command = GenerateFillReports::new(
                UUID4::new(),
                UnixNanos::from(5),
                Some(rig.instrument_id),
                Some(venue),
                None,
                None,
                None,
                None,
            );
            let fills = client.generate_fill_reports(command).await.unwrap();
            let bundle = EngineExecutionReport::OrderWithFills(Box::new(report), fills);
            engine.reconcile_execution_report(&bundle);
        } else {
            if !filled {
                recover_terminals(&context, true).await;
            }

            consume_reduce_events(&mut rig, &mut engine);
        }

        drop(subscription);
        let events = applied.take();
        assert_eq!(events.len(), if filled { 1 } else { 2 });

        let OrderEventAny::Filled(fill) = &events[0] else {
            panic!("expected real fill first");
        };

        assert_eq!(fill.trade_id, trade_id);
        assert_eq!(fill.last_qty, qty);

        if !filled {
            assert!(matches!(
                events[1],
                OrderEventAny::Canceled(_) | OrderEventAny::Expired(_)
            ));
            assert_eq!(events[1].ts_event(), terminal_timestamp);
        }

        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(cached.trade_ids(), vec![&trade_id]);
        assert_eq!(cached.filled_qty(), qty);
        assert_eq!(hits.load(Ordering::Relaxed), 1);
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::bulk_complete(true, 2)]
    #[case::targeted_complete(false, 2)]
    #[case::bulk_partial(true, 1)]
    #[case::targeted_partial(false, 1)]
    #[case::bulk_empty(true, 0)]
    #[case::targeted_empty(false, 0)]
    #[tokio::test]
    async fn terminal_targeted_reconciliation_recovers_offsetting_fills(
        #[case] bulk_report: bool,
        #[case] coverage: u8,
    ) {
        let (mut rig, cache, mut engine, mut buy) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &buy, false);
        consume_reduce_events(&mut rig, &mut engine);
        let sell_id = ClientOrderId::from("MISSED-SELL");
        let sell_order = OrderTestBuilder::new(OrderType::Limit)
            .trader_id(trader_id())
            .strategy_id(strategy_id())
            .instrument_id(rig.instrument_id)
            .client_order_id(sell_id)
            .side(OrderSide::Sell)
            .quantity(Quantity::from("0.0027"))
            .price(Price::from("2352.74"))
            .build();
        let sell_index = rig.dispatch.register_create_identity(&sell_order).unwrap();
        rig.dispatch
            .mark_order_submission(&sell_id, TEST_SUBMISSION_NONCE + 1);
        cache
            .borrow_mut()
            .add_order(sell_order, None, Some(client_id()), false)
            .unwrap();
        engine.process(&OrderEventAny::Submitted(OrderSubmitted::new(
            trader_id(),
            strategy_id(),
            rig.instrument_id,
            sell_id,
            account_id(),
            UUID4::new(),
            UnixNanos::from(1),
            UnixNanos::from(1),
        )));
        let mut sell = buy.clone();
        sell.order_index += 1;
        sell.order_id = sell.order_index.to_string();
        sell.client_order_index = sell_index;
        sell.client_order_id = sell_index.to_string();
        sell.is_ask = true;
        sell.side = Some(LighterOrderSide::Sell);
        dispatch_reduce_frame(&rig, &sell, false);
        consume_reduce_events(&mut rig, &mut engine);
        buy.status = LighterOrderStatus::Canceled;
        sell.status = LighterOrderStatus::CanceledExpired;
        for frame in [&mut buy, &mut sell] {
            frame.filled_base_amount = Decimal::from_str("0.0010").unwrap();
            frame.filled_quote_amount = frame.filled_base_amount * frame.price;
            frame.remaining_base_amount = Decimal::ZERO;
        }

        let mut buy_trade = dispatcher_test_trade(&rig, true);
        buy_trade.bid_id = buy.order_index;
        buy_trade.bid_id_str = Some(buy.order_id.clone());

        let qty = Quantity::from(match coverage {
            0 => "0.0000",
            1 => "0.0005",
            _ => "0.0010",
        });

        buy_trade.size = qty.as_decimal();
        buy_trade.usd_amount = buy_trade.size * buy_trade.price;
        let mut sell_trade = dispatcher_test_trade(&rig, false);
        sell_trade.trade_id += 1;
        sell_trade.trade_id_str = Some(sell_trade.trade_id.to_string());
        sell_trade.ask_id = sell.order_index;
        sell_trade.ask_id_str = Some(sell.order_id.clone());
        sell_trade.ask_client_id = sell_index;
        sell_trade.ask_client_id_str = Some(sell_index.to_string());
        sell_trade.size = buy_trade.size;
        sell_trade.usd_amount = sell_trade.size * sell_trade.price;
        let expected = [
            (
                rig.cloid,
                parse_lighter_trade_id(&buy_trade).unwrap(),
                OrderStatus::Canceled,
            ),
            (
                sell_id,
                parse_lighter_trade_id(&sell_trade).unwrap(),
                OrderStatus::Expired,
            ),
        ];
        let orders = vec![buy, sell];

        let trades = if coverage == 0 {
            Vec::new()
        } else {
            vec![buy_trade, sell_trade]
        };

        let history_hits = Arc::new(AtomicUsize::new(0));
        let hits = Arc::new(AtomicUsize::new(0));
        let counted = hits.clone();

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let orders = orders.clone();
                    let history_hits = history_hits.clone();
                    async move {
                        let first = history_hits.fetch_add(1, Ordering::Relaxed) == 0;

                        let orders = if !bulk_report && first {
                            Vec::new()
                        } else {
                            orders
                        };

                        axum::Json(serde_json::json!({"code":200,"orders":orders}))
                    }
                }),
            )
            .route(
                "/api/v1/trades",
                get(move || {
                    let trades = trades.clone();
                    let counted = counted.clone();
                    async move {
                        counted.fetch_add(1, Ordering::Relaxed);
                        axum::Json(serde_json::json!({"code":200,"trades":trades}))
                    }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client.dispatch.note_active_market(TEST_MARKET_INDEX);
        client.dispatch.replace_position_snapshot(&[], &[], &[]);
        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));

        let config = ExecutionManagerConfig {
            open_check_lookback_mins: None,
            open_check_missing_retries: 0,
            open_check_open_only: false,
            open_check_threshold_ns: DurationNanos::from_secs(0),
            single_order_query_delay_ms: 0,
            ..ExecutionManagerConfig::default()
        };

        let mut manager = ExecutionManager::new(clock, cache.clone(), config).unwrap();
        assert!(
            cache
                .borrow()
                .positions_open(None, None, None, None, None)
                .is_empty()
        );
        let events = manager.check_open_orders(&[&client]).await;
        for event in &events {
            engine.process(event);
        }

        assert_eq!(hits.load(Ordering::Relaxed), 2);
        assert_eq!(events.len(), usize::from(coverage) * 2);

        for (id, trade_id, status) in expected {
            let order_events = events
                .iter()
                .filter(|event| event.client_order_id() == id)
                .collect::<Vec<_>>();

            if coverage > 0 {
                assert!(
                    matches!(order_events[0], OrderEventAny::Filled(fill) if fill.trade_id == trade_id && fill.last_qty == qty)
                );
            }

            if coverage == 2 {
                assert!(matches!(
                    order_events[1],
                    OrderEventAny::Canceled(_) | OrderEventAny::Expired(_)
                ));
            }

            let order = cache.borrow().order(&id).unwrap().clone();
            assert_eq!(
                order.status(),
                match coverage {
                    0 => OrderStatus::Accepted,
                    1 => OrderStatus::PartiallyFilled,
                    _ => status,
                }
            );
            assert_eq!(order.filled_qty(), qty);
            let trade_ids: Vec<_> = std::iter::once(&trade_id)
                .take(usize::from(coverage > 0))
                .collect();
            assert_eq!(order.trade_ids(), trade_ids);
            assert!(
                inferred_reconciliation_trade_ids(&order)
                    .unwrap()
                    .is_empty()
            );
        }

        assert_eq!(
            cache
                .borrow()
                .positions_open(None, None, None, None, None)
                .iter()
                .map(|position| position.signed_decimal_qty())
                .sum::<Decimal>(),
            Decimal::ZERO
        );
        assert!(drain_events(&mut rig.rx).is_empty());
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::bulk_partial(true, false)]
    #[case::targeted_partial(false, false)]
    #[case::bulk_filled(true, true)]
    #[case::targeted_filled(false, true)]
    #[tokio::test]
    async fn terminal_reconciliation_preserves_real_fill_gate(
        #[case] bulk: bool,
        #[case] filled: bool,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);

        frame.status = if filled {
            LighterOrderStatus::Filled
        } else {
            LighterOrderStatus::Open
        };

        let qty = Quantity::from(if filled { "0.0027" } else { "0.0010" });
        frame.filled_base_amount = qty.as_decimal();
        frame.filled_quote_amount = frame.filled_base_amount * frame.price;
        frame.remaining_base_amount = frame.initial_base_amount - frame.filled_base_amount;
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = frame.filled_base_amount;
        trade.usd_amount = trade.size * trade.price;
        let trade_id = parse_lighter_trade_id(&trade).unwrap();
        let response_trade = trade.clone();
        let trade_hits = Arc::new(AtomicUsize::new(0));
        let hits = trade_hits.clone();
        let active = frame.clone();
        let inactive = frame.clone();
        let history_hits = Arc::new(AtomicUsize::new(0));
        let active_hits = history_hits.clone();

        let app = Router::new()
            .route(
                "/api/v1/trades",
                get(move || {
                    let trade = response_trade.clone();
                    let hits = hits.clone();
                    async move {
                        hits.fetch_add(1, Ordering::Relaxed);
                        axum::Json(serde_json::json!({"code":200,"trades":[trade]}))
                    }
                }),
            )
            .route(
                "/api/v1/accountActiveOrders",
                get(move || {
                    let active = active.clone();
                    let hits = active_hits.clone();
                    async move {
                        let orders =
                            if !filled && (bulk || hits.fetch_add(1, Ordering::Relaxed) > 0) {
                                vec![active]
                            } else {
                                Vec::new()
                            };

                        axum::Json(serde_json::json!({"code":200,"orders":orders}))
                    }
                }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let inactive = inactive.clone();
                    let hits = history_hits.clone();
                    async move {
                        let orders = if filled && (bulk || hits.fetch_add(1, Ordering::Relaxed) > 0)
                        {
                            vec![inactive]
                        } else {
                            Vec::new()
                        };

                        axum::Json(serde_json::json!({"code":200,"orders":orders}))
                    }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client.dispatch.note_active_market(TEST_MARKET_INDEX);
        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        client.subscribe_applied_fills();
        let clock: Rc<RefCell<dyn Clock>> = Rc::new(RefCell::new(VirtualClock::default()));

        let config = ExecutionManagerConfig {
            open_check_lookback_mins: None,
            open_check_missing_retries: 0,
            open_check_open_only: false,
            open_check_threshold_ns: DurationNanos::from_secs(0),
            single_order_query_delay_ms: 0,
            ..ExecutionManagerConfig::default()
        };

        let mut manager = ExecutionManager::new(clock, cache.clone(), config).unwrap();
        let events = manager.check_open_orders(&[&client]).await;
        assert!(
            events.is_empty(),
            "uncovered reports must not create inferred fills"
        );

        let command = GenerateOrderStatusReport::new(
            UUID4::new(),
            UnixNanos::from(4),
            Some(rig.instrument_id),
            Some(rig.cloid),
            Some(VenueOrderId::new(&frame.order_id)),
            None,
            None,
        );
        assert!(client.generate_order_status_report(&command).await.is_err());
        let task = client.generate_order_status_report_task(&command).unwrap();
        task.collection.await;
        assert!((task.finish)().is_err());
        assert_eq!(rig.rx.len(), usize::from(filled));
        assert_eq!(trade_hits.load(Ordering::Relaxed), usize::from(filled));
        dispatch_lighter_trade(
            &trade,
            &client.dispatch,
            &client.emitter,
            &client.registry,
            account_id(),
            trader_id(),
            Some(TEST_ACCOUNT_INDEX_I64),
            UnixNanos::from(5),
        );
        consume_reduce_events(&mut rig, &mut engine);
        let report = client
            .generate_order_status_report(&command)
            .await
            .unwrap()
            .unwrap();
        assert_eq!(report.filled_qty, qty);
        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(cached.trade_ids(), vec![&trade_id]);
        assert_eq!(cached.filled_qty(), qty);
        assert_eq!(
            cached.status(),
            if filled {
                OrderStatus::Filled
            } else {
                OrderStatus::PartiallyFilled
            }
        );
        assert!(
            inferred_reconciliation_trade_ids(&cached)
                .unwrap()
                .is_empty()
        );
        server.abort();
        let _ = server.await;
    }

    #[rstest]
    #[case::canceled(LighterOrderStatus::Canceled)]
    #[case::filled(LighterOrderStatus::Filled)]
    #[tokio::test]
    async fn terminal_mass_status_recovers_child_without_sweep_fills(
        #[case] status: LighterOrderStatus,
    ) {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        let mut history = cache
            .borrow()
            .order(&rig.cloid)
            .unwrap()
            .events()
            .into_iter()
            .cloned()
            .collect::<Vec<_>>();

        let OrderEventAny::Initialized(init) = &mut history[0] else {
            panic!("expected initialization");
        };

        init.parent_order_id = Some(ClientOrderId::new("OFFLINE-PARENT"));
        let cached = OrderAny::from_events(history).unwrap();
        cache
            .borrow_mut()
            .add_order(cached.clone(), None, Some(client_id()), true)
            .unwrap();

        let mut client = create_execution_client_with_cache(cache.clone());
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client.dispatch.seed_order_restorations(vec![cached]);
        client.dispatch.note_active_market(TEST_MARKET_INDEX);
        client.dispatch.replace_position_snapshot(&[], &[], &[]);
        frame.status = status;

        let qty = Quantity::from(if status == LighterOrderStatus::Filled {
            "0.0027"
        } else {
            "0.0010"
        });

        frame.filled_base_amount = qty.as_decimal();
        frame.filled_quote_amount = frame.filled_base_amount * frame.price;
        frame.remaining_base_amount = Decimal::ZERO;
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = qty.as_decimal();
        trade.usd_amount = trade.size * trade.price;
        let trade_id = parse_lighter_trade_id(&trade).unwrap();
        let hits = Arc::new(AtomicUsize::new(0));
        let counted = hits.clone();

        let venue = VenueOrderId::new(&frame.order_id);

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let frame = frame.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[frame]})) }
                }),
            )
            .route(
                "/api/v1/trades",
                get(move |Query(query): Query<AHashMap<String, String>>| {
                    let trade = trade.clone();
                    let hits = counted.clone();
                    async move {
                        let trades = if query.contains_key("order_index") {
                            hits.fetch_add(1, Ordering::Relaxed);
                            vec![trade]
                        } else {
                            Vec::new()
                        };

                        axum::Json(serde_json::json!({"code":200,"trades":trades}))
                    }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        assert_eq!(
            cache.borrow().client_order_id(&venue).copied(),
            Some(rig.cloid)
        );
        let mass = client.generate_mass_status(None).await.unwrap().unwrap();
        assert!(
            client
                .dispatch
                .order_identity(&rig.cloid)
                .unwrap()
                .child_fill_baseline()
                .is_some()
        );
        wait_until_async(
            || async {
                client
                    .dispatch
                    .order_identity(&rig.cloid)
                    .is_some_and(|identity| identity.has_child_publication())
            },
            Duration::from_secs(3),
        )
        .await;

        assert!(mass.fill_reports().is_empty());
        client.pending_tasks.begin_shutdown();
        client
            .pending_tasks
            .finish_shutdown(Duration::from_secs(2), DISCONNECT_TIMEOUT)
            .await
            .unwrap();

        for event in drain_events(&mut rig.rx) {
            match event {
                ExecutionEvent::Order(event) => engine.process(&event),
                ExecutionEvent::Report(report) => {
                    engine.reconcile_execution_report(&report);
                }
                _ => panic!("unexpected child recovery event"),
            }
        }

        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        assert_eq!(hits.load(Ordering::Relaxed), 1);
        assert_eq!(
            cached.status(),
            if status == LighterOrderStatus::Filled {
                OrderStatus::Filled
            } else {
                OrderStatus::Canceled
            }
        );
        assert_eq!(cached.filled_qty(), qty);
        assert_eq!(cached.trade_ids(), vec![&trade_id]);
        assert!(
            inferred_reconciliation_trade_ids(&cached)
                .unwrap()
                .is_empty()
        );
        server.abort();
        let _ = server.await;
    }

    #[tokio::test]
    async fn terminal_child_recovery_rechecks_inferred_overlap_after_http() {
        let (mut rig, cache, mut engine, mut frame) = reduce_order_replay();
        cache
            .borrow_mut()
            .add_account(AccountAny::Margin(test_margin_account()))
            .unwrap();
        dispatch_reduce_frame(&rig, &frame, false);
        consume_reduce_events(&mut rig, &mut engine);
        let mut history = cache
            .borrow()
            .order(&rig.cloid)
            .unwrap()
            .events()
            .into_iter()
            .cloned()
            .collect::<Vec<_>>();

        let OrderEventAny::Initialized(init) = &mut history[0] else {
            panic!("expected initialization");
        };

        init.parent_order_id = Some(ClientOrderId::new("RACING-PARENT"));
        let cached = OrderAny::from_events(history).unwrap();
        cache
            .borrow_mut()
            .add_order(cached.clone(), None, Some(client_id()), true)
            .unwrap();
        rig.dispatch = WsDispatchState::new();
        rig.dispatch
            .restore_reconciled_order(
                &cached,
                frame.client_order_index,
                VenueOrderId::new(&frame.order_id),
                false,
            )
            .unwrap();
        let identity = rig.dispatch.order_identity(&rig.cloid).unwrap();

        let mut client = create_execution_client_with_cache(cache.clone());
        client.dispatch = rig.dispatch.clone();
        client.registry = rig.registry.clone();
        client.emitter = rig.emitter.clone();
        client.subscribe_applied_fills();
        frame.status = LighterOrderStatus::Canceled;
        frame.filled_base_amount = Decimal::from_str("0.0010").unwrap();
        frame.remaining_base_amount = Decimal::ZERO;
        frame.filled_quote_amount = frame.filled_base_amount * frame.price;
        let instrument = LIGHTER_INSTRUMENT_CACHE
            .get(&rig.instrument_id)
            .unwrap()
            .value()
            .clone();
        let mut partial =
            parse_ws_order_status_report(&frame, &instrument, account_id(), UnixNanos::from(3))
                .unwrap()
                .with_client_order_id(rig.cloid);
        partial.order_status = OrderStatus::PartiallyFilled;
        let mut trade = dispatcher_test_trade(&rig, true);
        trade.bid_id = frame.order_index;
        trade.bid_id_str = Some(frame.order_id.clone());
        trade.size = frame.filled_base_amount;
        trade.usd_amount = trade.size * trade.price;
        let requested = Arc::new(tokio::sync::Notify::new());
        let resume = Arc::new(tokio::sync::Notify::new());
        let signal = requested.clone();
        let gate = resume.clone();

        let app = Router::new()
            .route(
                "/api/v1/accountActiveOrders",
                get(|| async { axum::Json(serde_json::json!({"code":200,"orders":[]})) }),
            )
            .route(
                "/api/v1/accountInactiveOrders",
                get(move || {
                    let frame = frame.clone();
                    async move { axum::Json(serde_json::json!({"code":200,"orders":[frame]})) }
                }),
            )
            .route(
                "/api/v1/trades",
                get(move || {
                    let trade = trade.clone();
                    let signal = signal.clone();
                    let gate = gate.clone();
                    async move {
                        signal.notify_one();
                        gate.notified().await;
                        axum::Json(serde_json::json!({"code":200,"trades":[trade]}))
                    }
                }),
            );

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let server = tokio::spawn(async move {
            axum::serve(listener, app).await.unwrap();
        });

        client.http_client = LighterHttpClient::new(
            LighterEnvironment::Testnet,
            Some(format!("http://{addr}")),
            1,
            None,
        )
        .unwrap();
        let context = acked_probe_context(&client);
        let (result, ()) = tokio::join!(recover_child_order(rig.cloid, 0, &context), async {
            tokio::time::timeout(Duration::from_secs(2), requested.notified())
                .await
                .unwrap();
            engine.reconcile_order_status_report(&partial);
            assert!(identity.has_inferred_fills());
            resume.notify_one();
        });
        assert!(result.unwrap());
        assert_eq!(
            client
                .dispatch
                .order_events
                .lock()
                .get(&rig.cloid)
                .map_or(0, |entry| entry.fills.len()),
            0
        );
        assert!(drain_events(&mut rig.rx).is_empty());
        assert_eq!(identity.filled_qty(), Decimal::ZERO);
        let cached = cache.borrow().order(&rig.cloid).unwrap().clone();
        let inferred = inferred_reconciliation_trade_ids(&cached).unwrap();
        assert_eq!(inferred.len(), 1);
        assert_eq!(cached.trade_ids(), inferred.iter().collect::<Vec<_>>());
        assert_eq!(cached.filled_qty(), Quantity::from("0.0010"));
        server.abort();
        let _ = server.await;
    }

    fn create_execution_client_with_cache(cache: Rc<RefCell<Cache>>) -> LighterExecutionClient {
        let core = ExecutionClientCore::new(
            trader_id(),
            client_id(),
            test_config().resolved_venue(),
            OmsType::Netting,
            account_id(),
            AccountType::Margin,
            None,
            cache,
        );
        LighterExecutionClient::new(core, test_config()).unwrap()
    }
}