JavaScriptSolidServer
diff --git a/‎markets/README.md‎
Lines changed: 19 additions & 1 deletion b/‎markets/README.md‎
Lines changed: 19 additions & 1 deletion
diff --git a/‎markets/plugin.js‎
Lines changed: 59 additions & 14 deletions b/‎markets/plugin.js‎
Lines changed: 59 additions & 14 deletions
diff --git a/‎markets/store.js‎
Lines changed: 23 additions & 1 deletion b/‎markets/store.js‎
Lines changed: 23 additions & 1 deletion
diff --git a/‎markets/test.js‎
Lines changed: 56 additions & 1 deletion b/‎markets/test.js‎
Lines changed: 56 additions & 1 deletion
@@ -73,6 +73,13 @@ the oracle was wrong and we know the right answer), and **void**.
 Re-resolution matters because voiding an incorrect resolution refunds the
 loser and wipes out whoever actually backed the correct outcome.
 
+An **oracle-initiated void is only a proposal** and sits in the same
+dispute window a resolution does. A void pays `min(TWAP, cost basis)`, so
+it is a payoff traders can only lose on while the creator recovers their
+escrow — the oracle never has to steal the pool, only refuse to pay it.
+Operators, and the anyone-can-rescue backstop on an abandoned market,
+still settle immediately.
+
 **A deployment with no `admins` cannot adjudicate anything** — every
 dispute expires into the oracle's resolution — so the plugin says so
 loudly at boot rather than letting the advertised check be quietly
@@ -159,6 +166,17 @@ the walls point at.
   regression test for exactly this attack, and it caught a real bug: the
   price path was seeded with `m.history || [seed]`, and an empty array is
   truthy, so the TWAP degenerated to the post-pump spot price.
+- **A state change that skips the reducer is a lie the audit trail tells
+  later.** Adjudicating a wrong resolution assigned `m.resolvedOutcome`
+  directly in the route handler and then settled. Payouts were correct
+  and journalled; the OUTCOME was not — so replaying the journal (the
+  recovery the boot error itself recommends) restored the oracle's
+  original wrong answer while the credits sat with the corrected one, and
+  the settlement receipts recorded the stale value too. store.js already
+  said "every mutation happens HERE and nowhere else"; one assignment
+  outside it was enough. Event sourcing only holds if the invariant is
+  structural — which is the argument for extracting the lifecycle from
+  the route layer entirely.
 - **A self-verifying credential needs an epoch, and the type of what
   `verify()` returns is a money bug.** Widening the session verifier from
   "returns the agent id" to "returns the claims" without updating its two
@@ -191,7 +209,7 @@ the walls point at.
 
 ## Tests
 
-`node --test --test-concurrency=1 markets/test.js` — 64 tests: LMSR and
+`node --test --test-concurrency=1 markets/test.js` — 66 tests: LMSR and
 TWAP math, session/CSRF/rate-limit units, hardened headers, cookie
 scoping, prototype-key ids, grants, escrow, stake-first quotes,
 quote↔trade parity, slippage guards (including the NaN-fails-closed case),
 
@@ -62,7 +62,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { lmsrPrices, tradeCostRaw, sharesForBudget, twapPrices, uniformPrices } from './lmsr.js';
-import { createStore, dict } from './store.js';
+import { createStore, dict, TWAP_PROTECT_MS } from './store.js';
 import {
   createSessions, createRateLimiter, isSameOrigin, isAmbientCredential, UI_HEADERS, API_HEADERS,
 } from './guard.js';
@@ -171,6 +171,12 @@ export async function activate(api) {
       throw new Error(`markets: config.${name} must be a positive number of milliseconds (got ${v})`);
     }
   }
+  if (twapWindowMs > TWAP_PROTECT_MS) {
+    throw new Error(
+      `markets: config.twapWindowMs (${twapWindowMs}) must not exceed ${TWAP_PROTECT_MS}ms — beyond that, `
+      + 'price-history thinning reaches inside the redemption window and makes the void price steerable by trade timing',
+    );
+  }
   if (!Number.isFinite(disputeBondMicro) || disputeBondMicro < 0) {
     throw new Error('markets: config.disputeBondCredits must be a non-negative number');
   }
@@ -231,7 +237,7 @@ export async function activate(api) {
     const claims = sessions.verify(token);
     if (!claims) return null;
     const row = state.ledger[claims.agent];
-    if (row && (row.epoch || 0) !== claims.epoch) return null;
+    if ((row ? row.epoch || 0 : 0) !== claims.epoch) return null;
     return claims.agent;
   }
 
@@ -262,7 +268,12 @@ export async function activate(api) {
     const known = ownOrigin();
     if (known) return known;
     const host = request.headers.host;
-    return host ? `${request.protocol || 'http'}://${host}` : null;
+    if (!host) return null;
+    // Fastify reports the SOCKET's protocol unless trustProxy is on,
+    // which a plugin cannot set; behind nginx/Caddy that is 'http' while
+    // the browser's Origin says https, and every mutation would 403.
+    const proto = request.headers['x-forwarded-proto'] || request.protocol || 'https';
+    return `${String(proto).split(',')[0].trim()}://${host}`;
   }
 
   function csrfOk(request) {
@@ -492,7 +503,7 @@ export async function activate(api) {
    * in the event, and applied by the reducer — so replay never recomputes
    * float arithmetic.
    */
-  function settle(m, status, payoutMicroOf, prices, { adjudicatedBy = null, sustained = false } = {}) {
+  function settle(m, status, payoutMicroOf, prices, { adjudicatedBy = null, sustained = false, outcome = null } = {}) {
     const pool = m.subsidyMicro + m.collectedMicro;
     const raw = [];
     let sum = 0;
@@ -541,6 +552,10 @@ export async function activate(api) {
       type: 'market.settle',
       marketId: m.id,
       status,
+      // Journalled so replay reproduces the settled outcome. Assigning
+      // m.resolvedOutcome outside the reducer made the audit trail
+      // contradict the money after a restore.
+      outcome,
       payouts,
       bondRefunds,
       creatorMicro: creatorFromPool + creatorFee,
@@ -552,7 +567,12 @@ export async function activate(api) {
     broadcast('settle', m);
   }
 
-  const settleResolved = (m, opts) => settle(m, 'resolved', (pos) => pos.shares[m.resolvedOutcome], null, opts);
+  const settleResolved = (m, opts = {}) => {
+    // An adjudicator may settle at a DIFFERENT outcome than the oracle
+    // declared; that corrected outcome rides in the event.
+    const outcome = opts.outcome ?? m.resolvedOutcome;
+    settle(m, 'resolved', (pos) => pos.shares[outcome], null, { ...opts, outcome });
+  };
   // On a void you receive the LESSER of market value (at the TWAP) and
   // what you actually paid. The cap is what finally kills the void
   // arbitrage: the TWAP already defeats a last-second pump, but a
@@ -593,6 +613,7 @@ export async function activate(api) {
     for (const m of Object.values(state.markets)) {
       try {
         if (m.status === 'resolving' && now >= m.settleAt) settleResolved(m);
+        else if (m.status === 'voiding' && now >= m.settleAt) settleVoid(m);
         else if (m.status === 'open' && now >= m.closesAt + settlementWindowMs) {
           api.log.warn(`markets: ${m.id} auto-voiding — no resolution within the settlement window`);
           settleVoid(m);
@@ -656,6 +677,9 @@ export async function activate(api) {
   ticker.unref?.();
 
   function broadcast(type, m) {
+    // A withdrawn market must not push its title and description to
+    // every connected client when it settles.
+    if (m.hidden) return;
     const msg = JSON.stringify({ type, market: marketOut(m) });
     for (const s of sockets) {
       // Drop a client that isn't draining rather than buffering without
@@ -737,6 +761,7 @@ export async function activate(api) {
     for (const id of byAgent.get(agent) || []) {
       const m = state.markets[id];
       if (!m) continue;
+      if (m.status === 'resolved' || m.status === 'void') continue; // paid out; the receipt is the record
       const pos = m.positions[agent];
       if (!pos || pos.shares.every((s) => s === 0)) continue;
       positions.push({
@@ -919,6 +944,7 @@ export async function activate(api) {
   api.fastify.get(`${prefix}/api/markets/:id/quote`, async (request, reply) => {
     const m = state.markets[request.params.id];
     if (!m) return err(reply, 404, 'no such market');
+    if (m.hidden) return err(reply, 451, 'this market has been withdrawn by the operator');
     const q = request.query || {};
     const t = priceTrade(m, q.side, q.outcome, q.shares, q.spend);
     if (t.error) return err(reply, 400, t.error);
@@ -1014,6 +1040,7 @@ export async function activate(api) {
   api.fastify.get(`${prefix}/api/markets/:id/history`, async (request, reply) => {
     const m = state.markets[request.params.id];
     if (!m) return err(reply, 404, 'no such market');
+    if (m.hidden) return err(reply, 451, 'this market has been withdrawn by the operator');
     return reply.send({
       id: m.id,
       outcomes: m.outcomes,
@@ -1067,7 +1094,7 @@ export async function activate(api) {
     if (!m) return err(reply, 404, 'no such market');
     tick();
     if (m.status === 'resolved' || m.status === 'void') return reply.send(marketOut(m));
-    if (m.status === 'resolving') {
+    if (m.status === 'resolving' || m.status === 'voiding') {
       return err(reply, 409, `settles at ${new Date(m.settleAt).toISOString()} (dispute window open)`);
     }
     return err(reply, 409, `market is ${displayStatus(m)} — nothing to settle`);
@@ -1085,7 +1112,8 @@ export async function activate(api) {
     // 'disputed' is disputable too: latching on the FIRST disputer meant
     // one person paid the bond and every other loser free-rode on the
     // resulting void. Each disputer posts their own.
-    if (m.status !== 'resolving' && m.status !== 'disputed') {
+    tick(); // otherwise a market past settleAt is still 'resolving' here
+    if (m.status !== 'resolving' && m.status !== 'disputed' && m.status !== 'voiding') {
       return err(reply, 409, 'only a resolving market can be disputed');
     }
     const pos = m.positions[agent];
@@ -1096,6 +1124,11 @@ export async function activate(api) {
     const reason = typeof (request.body || {}).reason === 'string'
       ? request.body.reason.slice(0, 500) : '';
     if (!reason.trim()) return err(reply, 400, 'a reason is required to dispute');
+    // With no operator configured, `sustained` can never become true, so
+    // the bond is mathematically unrecoverable. Don't take it.
+    if (!admins.size) {
+      return err(reply, 409, 'this deployment has no operator to adjudicate disputes, so a dispute bond could never be returned');
+    }
     ensureAccount(agent);
     // Scale with what the dispute puts at risk. A flat bond against a
     // large position is trivially +EV to post: the disputer risks 25 to
@@ -1118,6 +1151,9 @@ export async function activate(api) {
     if (!m) return err(reply, 404, 'no such market');
     const stale = Date.now() >= m.closesAt + settlementWindowMs;
     if (m.status === 'resolved' || m.status === 'void') return err(reply, 409, `market is ${m.status}`);
+    if (m.status === 'voiding' && !admins.has(agent) && !stale) {
+      return err(reply, 409, `a void is already proposed; it settles at ${new Date(m.settleAt).toISOString()}`);
+    }
     // Once disputed, ONLY an admin may settle. Otherwise the oracle
     // answers a dispute against itself by voiding the market, and the
     // dispute is no check on the oracle at all.
@@ -1132,11 +1168,21 @@ export async function activate(api) {
         : 'only the oracle may void before the settlement window expires');
     }
     if (!m.closedAt) store.commit({ type: 'market.close', marketId: m.id });
-    // An operator voiding a DISPUTED market has sustained the dispute,
-    // whichever route they used to do it.
-    settleVoid(m, m.status === 'disputed' && admins.has(agent)
-      ? { adjudicatedBy: agent, sustained: true } : {});
-    api.log.info(`markets: ${m.id} voided (redeemed at TWAP)`);
+
+    // An operator, or the anyone-can-rescue backstop, settles now.
+    if (admins.has(agent) || stale) {
+      settleVoid(m, m.status === 'disputed' && admins.has(agent)
+        ? { adjudicatedBy: agent, sustained: true } : {});
+      api.log.info(`markets: ${m.id} voided (redeemed at TWAP)`);
+      return reply.send(marketOut(m));
+    }
+
+    // An ORACLE void is only a proposal: it goes through the same
+    // dispute window as a resolution, so holders can object before a
+    // cancellation they can only lose on becomes final.
+    store.commit({ type: 'market.propose-void', marketId: m.id, agent, settleAt: Date.now() + disputeWindowMs });
+    api.log.info(`markets: ${m.id} void proposed by the oracle — settles after the dispute window`);
+    broadcast('market', m);
     return reply.send(marketOut(m));
   });
 
@@ -1247,8 +1293,7 @@ export async function activate(api) {
       // Voiding would refund the loser and wipe out whoever was RIGHT, so
       // a correctable error needs its own verb.
       if (outcome < 0 || outcome >= m.outcomes.length) return err(reply, 400, 'outcome must be a valid outcome index');
-      m.resolvedOutcome = outcome;
-      settleResolved(m, { adjudicatedBy: by, sustained: true });
+      settleResolved(m, { adjudicatedBy: by, sustained: true, outcome });
     } else if (uphold === false) {
       settleVoid(m, { adjudicatedBy: by, sustained: true });
     } else {
 
@@ -99,6 +99,8 @@ function compactHistory(h, nowT) {
   return h;
 }
 
+export const TWAP_PROTECT_MS = PROTECT_MS;
+
 export function emptyState() {
   return { seq: 0, ledger: dict(), markets: dict(), settlements: dict() };
 }
@@ -190,6 +192,15 @@ export function applyEvent(state, ev, prices) {
       m.closedAt = m.closedAt || ev.t;
       break;
     }
+    case 'market.propose-void': {
+      const m = state.markets[ev.marketId];
+      m.status = 'voiding';
+      m.settleAt = ev.settleAt;
+      m.closesAt = Math.min(m.closesAt, ev.t);
+      m.closedAt = m.closedAt || ev.t;
+      m.resolvedBy = ev.agent;
+      break;
+    }
     case 'market.resolve': {
       const m = state.markets[ev.marketId];
       m.status = 'resolving';
@@ -215,6 +226,8 @@ export function applyEvent(state, ev, prices) {
     }
     case 'market.settle': {
       const m = state.markets[ev.marketId];
+      // Set BEFORE the receipts are written — they record it.
+      if (ev.outcome !== undefined && ev.outcome !== null) m.resolvedOutcome = ev.outcome;
       // Everyone who HELD is given a receipt, not only those who were
       // paid: "you lost 12.40 on this" is the settlement a bettor most
       // needs to see, and a payout-only list silently drops it.
@@ -460,7 +473,16 @@ export function createStore({ dir, log, prices }) {
         if (/^journal\.\d+\.jsonl$/.test(f)) current.add(path.join(dir, f));
       }
     } catch { /* directory vanished */ }
-    for (const file of [...current].sort()) {
+    // Numeric order: lexicographic puts journal.100 before journal.20,
+    // so a busy account's "most recent 500 events" were the wrong 500.
+    const ordered = [...current].sort((a, b) => {
+      const na = /journal\.(\d+)\.jsonl$/.exec(a);
+      const nb = /journal\.(\d+)\.jsonl$/.exec(b);
+      if (!na) return 1;   // the live journal sorts last
+      if (!nb) return -1;
+      return Number(na[1]) - Number(nb[1]);
+    });
+    for (const file of ordered) {
       try { all.push(...fs.readFileSync(file, 'utf8').split('\n')); } catch { /* rotated away */ }
     }
     for (const line of all) {
 
@@ -197,6 +197,7 @@ describe('markets plugin', () => {
           disputeWindowMs: 300,
           settlementWindowMs: 800,
           twapWindowMs: 30 * 60 * 1000,
+          admins: ['https://operator.example/profile/card#me'],
           rateCapacity: 1e9,
           rateRefillPerSec: 1e6,
         },
@@ -621,7 +622,10 @@ describe('markets plugin', () => {
     const live = await json(await call('alice', 'POST', `/markets/${m.id}/void`), 403);
     assert.match(live.error, /close the market before voiding/);
     await json(await call('alice', 'POST', `/markets/${m.id}/close`), 200);
-    await json(await call('alice', 'POST', `/markets/${m.id}/void`), 200);
+    const proposed = await json(await call('alice', 'POST', `/markets/${m.id}/void`), 200);
+    assert.strictEqual(proposed.status, 'voiding', 'an oracle void is a proposal, not a fait accompli');
+    await sleep(400);
+    await json(await call(null, 'POST', `/markets/${m.id}/settle`), 200);
     const after = await balance('bob');
     assert.ok(after < before,
       `pump-and-void must lose money (before ${before}, after ${after})`);
@@ -641,6 +645,8 @@ describe('markets plugin', () => {
     const before = await balance('carol');
     await json(await call('alice', 'POST', `/markets/${m.id}/close`), 200);
     await json(await call('alice', 'POST', `/markets/${m.id}/void`), 200);
+    await sleep(400); // the oracle's void sits in the dispute window
+    await json(await call(null, 'POST', `/markets/${m.id}/settle`), 200);
     const redeemed = await balance('carol') - before;
     assert.ok(redeemed > 8 && redeemed < 20, `redeemed ${redeemed} ≈ 20 shares near 50c`);
     await assertConserved('after a holder void');
@@ -971,6 +977,52 @@ describe('markets plugin', () => {
     await assertConserved('after a re-resolution');
   });
 
+  it('a re-resolved outcome survives a restart (it must be in the journal)', async () => {
+    const m = await json(await call('alice', 'POST', '/markets', {
+      title: 'Re-resolution must be journalled',
+      outcomes: ['Home', 'Away'],
+      closesAt: new Date(Date.now() + 3600e3).toISOString(),
+      b: 25,
+    }), 201);
+    await json(await call('bob', 'POST', `/markets/${m.id}/trade`,
+      { side: 'buy', outcome: 0, shares: 8 }), 200);
+    await json(await call('alice', 'POST', `/markets/${m.id}/resolve`, { outcome: 1 }), 200);
+    await json(await call('bob', 'POST', `/markets/${m.id}/dispute`, { reason: 'wrong' }), 200);
+    await json(await call('alice', 'POST', '/admin/adjudicate',
+      { market: m.id, uphold: false, outcome: 0 }), 200);
+
+    // Rebuild purely from the journal — the recovery the boot error
+    // itself recommends — and the corrected outcome must still be there.
+    const { root } = jss;
+    const port = await probePort();
+    await jss.close({ keepData: true });
+    fs.rmSync(path.join(root, '.plugins', 'markets', 'state.json'), { force: true });
+    base = `http://127.0.0.1:${port}`;
+    mk = `${base}/markets/api`;
+    jss = await startJss({
+      root, port, idp: true,
+      plugins: [{
+        module: module_,
+        prefix: '/markets',
+        config: {
+          grantCredits: GRANT, feeBps: 100, baseUrl: base,
+          disputeWindowMs: 300, settlementWindowMs: 800, disputeBondCredits: 25,
+          rateCapacity: 1e9, rateRefillPerSec: 1e6, admins: [aliceId],
+        },
+      }],
+    });
+    const after = await json(await call(null, 'GET', `/markets/${m.id}`), 200);
+    assert.strictEqual(after.resolvedOutcome, 0,
+      'replay must reproduce the ADJUDICATED outcome, not the oracle’s original');
+    await assertConserved('after replaying a re-resolution');
+  });
+
+  it('settled positions stop showing as live value', async () => {
+    const positions = (await me('bob')).positions;
+    assert.ok(positions.every((x) => x.status !== 'resolved' && x.status !== 'void'),
+      'a paid-out market must not also appear as an open position');
+  });
+
   it('a void never pays a holder more than they paid (kills the sustained pump)', async () => {
     const m = await json(await call('alice', 'POST', '/markets', {
       title: 'Sustained pump attempt',
@@ -984,7 +1036,10 @@ describe('markets plugin', () => {
     await json(await call('bob', 'POST', `/markets/${m.id}/trade`,
       { side: 'buy', outcome: 0, spend: 150 }), 200);
     await sleep(600);
+    await json(await call('alice', 'POST', `/markets/${m.id}/close`), 200);
     await json(await call('alice', 'POST', `/markets/${m.id}/void`), 200);
+    await sleep(400);
+    await json(await call(null, 'POST', `/markets/${m.id}/settle`), 200);
     const net = await balance('bob') - before;
     assert.ok(net <= 1e-6, `pump-and-hold-then-void must not profit (net ${net})`);
     await assertConserved('after a sustained-pump void');