a ju@sLdZddlZddlZddlZddlmZddlmZddl Z dZ dZ dZ dZd Zed Zd Zed Zgd ZdaiZiZdZd2ddZeedddZeddddZedddZd3ddZ ddZ!edd d!Z"e#dd"d#Z$eed$d%d&Z%de fee#e#eee#ed'd(d)Z&d*d+Z'd4eee#d,d-d.Z(d/d0Z)e*d1krHe)dS)5aMaker-side order client: RESTING SELL orders, with a dead-man's switch. SEPARATE FROM kalshi_trader.place_limit_order ON PURPOSE. That function buys YES, immediate-or-cancel, capped at $1, and its comment says why: "never leave a resting order sitting unmonitored" (project_no_subask_limits). xlow's auto-trade depends on those properties. Market making needs the opposite -- sell YES, rest in the queue between polls -- so it gets its own client rather than a flag that weakens the one already in production. THE RISK THIS IS BUILT AROUND. On 2026-08-10 this machine powered off and was not noticed for two and a half days. Resting orders would have filled and settled with no complete_book, no flatten_stalled, and nobody watching. Cancel on startup and cancel on shutdown do not help: a power cut runs neither. So every order carries `expiration_time`. If this process stops refreshing them, the EXCHANGE cancels them within MAKER_TTL_S. The quoter re-posts every poll, so the orders are continuously renewed while it is alive and evaporate when it is not. That is the only safety property here that survives the machine dying. FOUR MORE GUARDS, all enforced before any HTTP request: post_only -- the exchange REJECTS the order if it would cross, so a maker can never accidentally lift somebody's bid. cancel_on_pause -- exchange-side cancel if the market halts. hard caps -- contracts, price, and total resting collateral. LIVE off by default -- set_live(True) must be called explicitly; until then every call is logged and returns without touching the network. Usage is via the quoter; run this file directly for the guard self-test. N)Path)Optionali {Gz?cinf-z%E:\soccer\research\mm_live_orders.csv Ztsactiontickersidecount price_cents expires_atZliveorder_idstatusdetailFcs@p tfddtD}|D]}t|dq&t|S)zFDrop ids whose TTL has passed -- the exchange has already killed them.cs*g|]"\}}t|tr|dkr|qS)r isinstancetuple.0oidvnowkalshi_maker.py s z!_prune_placed..N)time_PLACEDitemspoplen)rZdeadrrrr _prune_placeds  r&)rreturncCspddl}d|}|jtj|td|dd}|jdvrRtd|jd |jtt |<|jrl| SiS) a3DELETE /portfolio/events/orders/{id} -- the V2 cancel. NOT kalshi_trader.cancel_order, which still calls V1 (/portfolio/orders/{id}) and has returned 410 deprecated_v1_order_endpoint since 2026-07-23. Placement was migrated to V2 then; cancellation was not, and nothing caught it because every order this project had ever sent was immediate-or-cancel and so never rested long enough to need cancelling. The first resting order ever placed (2026-08-15) could not be cancelled at all and was only cleaned up by its expiration_time. rNz/portfolio/events/orders/ZDELETE)ZheadersZtimeout)zKalshi DELETE v2 order -> : ) requestsdeletektZAPI_BASEZ _auth_headersZ status_code RuntimeErrortextr! _CANCELLEDjson)rr,pathrrrrcancel_order_v2s      r5)flagr'cCs t|adS)z@Arm or disarm real order placement. Off until explicitly called.N)bool_LIVE)r6rrrset_livesr9)r'cCstS)N)r8rrrris_livesr:c Cst } tjjdddtjddddx} ddl} | j| td} | rN| | t j t j j||||||tt|p|d|t|dd d Wdn1s0YdS) NT)parentsexist_okar;zutf-8)newlineencodingr)Z fieldnamesiXr ) ORDER_LOGexistsparentmkdiropencsvZ DictWriter LOG_FIELDSZ writeheaderZwriterowdtdatetimertimezoneutc isoformatintr8str) r r r rrrrrrnewZfhrFwrrr_logs rQcCs|rt|tstd|t|ttfr4t|trBtd|||krR|tkrftdtd||tkrtd|dtt|tstd|t|krt ksntd|d td t dS) Nz bad ticker: zcount must be a number, got zcount must be >= z, got zcount z exceeds MAX_CONTRACTS=zprice_cents must be int, got z price_cents z outside z..) rrN ValueErrorrMfloatr7 MIN_COUNT MAX_CONTRACTSMIN_PRICE_CENTSMAX_PRICE_CENTS)r rrrrr _validates   rXc Csztp idgpg}Wnty6tdYS0d}|D]}zXt|dpr|dpr|dpr|dprd}t|d pt|d pdd }WnttfyYq@Yn0||tdd |7}q@|S) zDollars locked by orders currently resting, from the EXCHANGE. Read from the exchange rather than from our own state: our state is what we believe, and the whole point of a cap is to catch the case where belief and reality have diverged. ordersrremaining_count_fpZremaining_countcount_fprrZyes_price_dollarsZ yes_priceY@?)r.get_open_ordersget ExceptionrS TypeErrorrRmax)rYtotalocprrrresting_collaterals.    rhcCs:zttpidgpgWSty4tYS0dS)NrY)r%r.r_r`raMAX_CONCURRENT_ORDERSrrrropen_order_count8s rj)r r'c Csztp idgpg}Wnty6tdYS0|D]X}|d|krt dd|||dddt| j t dWYd} ~ n d} ~ 00| | |tdkrt dd|||ddd|d| d|dt t d|d| d|dtd t|d|d} | tkr4t dd|||ddd| d t d| ddtdd|d|ddd |d!d!d"d# }|rf||d$<tst d%d|||dd&t| d!|d'Sztd(|}WnPty} z6t d)d|||dd)t| jd*|  WYd} ~ n d} ~ 00|pid+p id,p"|pid,}|r:|d-ft |<t!t d.d||||d&d/ |S)0zRest a SELL-YES order that expires on its own. Returns the API response, or {'dry_run': True} when not armed. Raises on any cap breach BEFORE touching the network. ZrejectaskNZcapz orders already restingz resting orders >= cap zpositions unreadablez)cannot read positions -- refusing to postcsg|]\}}|kr|qSrr)rkr)_cutrrr z#place_maker_ask..cs,g|]$}|dkr|dtvr|qS)r r)r`r1rre)r rrr srYcss*|]"}t|dp|dpdVqdS)r[r\rN)rSr`rwrrr s  z"place_maker_ask..zopen orders unreadable: z/cannot read open orders -- refusing to post on g& .>zshort z + resting z + z exceeds z plus z resting plus z would exceed MAX_CONTRACTS=z on r^r]z collateral $z.2fz exceeds cap $z.4fgood_till_canceledTZtaker_at_cross) r r rZprice time_in_forceexpiration_time post_onlyZcancel_order_on_pauseZself_trade_prevention_typerqdry_runok)r}bodyz/portfolio/events/orderserrorr+orderrZplacedr;)"rXrMr!rHrIZ fromtimestamprJrKrLrjrirQr/rp_CANCEL_MEMORY_Sr1r#r$r.r_r`sumratype__name__rUrhMAX_RESTING_COLLATERALr8r2dumpsZ_postr"r&)r rrrqrrZexpiresZexp_isoZn_openZheldZ_oidZmineZ resting_qtyeZcollrr4rr)rur rplace_maker_askYs   &        .rcCs@ztp idgpg}Wnty0YdS0dd|DS)a9Events where the maker's subaccount holds a SHORT -- a book with at least one leg already sold. None if the positions cannot be read. From the EXCHANGE, not our state, for the same reason resting_collateral() is: this decides what survives a restart, and belief must not override the ledger. rkNcSs>h|]6}t|dpddkrt|dddddqS)rmrg& .r r;-r)rSr`rNrsplit)rrgrrr szheld_events..)r.rnr`ra)Zpsrrr held_eventss  r)reason keep_heldr'c Cs|r tnt}|dur6tddddddddd t}tddtD}z@tpZidgpfgD]"}|d rh|d d||d <qhWnXt y}z@tddddddddd t |d t |j d | WYd}~n d}~00d}|D] \}}|rD|rDt |ddd|vrDtd|dddd|d|d qtsltd|dddd|d| |d7}qz8t|td|dddd|d| t|d|d7}Wqt y}z@t|dtd|dddd|dt |j d | WYd}~qd}~00q|S)a}Cancel everything we placed AND everything the exchange lists resting. The union matters. Listing alone misses orders the exchange has accepted but not yet published (see _PLACED); our own ids alone would miss anything left over from a previous process. Cancelling an already-dead order is harmless, so erring toward cancelling twice is the right direction. keep_held=True SPARES orders on any event we already hold a leg in -- the completing legs of a part-filled book (2026-09-29). Used on RESTART paths only, never on a stop. Those legs carry a long TTL precisely so they rest through an outage ("leaving it resting through an outage is the outcome we want", mm_maker_live's HELD_TTL note), but every restart cancelled them anyway: on 2026-09-28 the guard's restart at 00:06 pulled TURITA's TUR and TIE, the relaunch then failed on DNS, and the book sat one-legged for 8h. A completing leg is priced at the book's budget, so a fill completes it at a profit whoever wins -- keeping it is the safe side. If positions cannot be read, this FAILS CLOSED and cancels everything, as before. N cancel_allr;rz>keep_held requested but positions unreadable -- cancelling allcSs(i|] \}}|t|tr |dn|qS)rrrrrr szcancel_all..rYrr z listing failed, falling back to z known ids: r+rrrZkeptr~z: completing leg of a held bookZdry_run_cancelZ cancelledZ cancel_fail)rsetrQr&r"r#r.r_r`rar%rrrNrr8r5r$) rrZkeeptargetsrernrr rrrrsX  &   rcstdtdtdus Jddfdd}|dd d |d d d |d d d|dd d|dd d|dd d|dd d|dd d|dd dtdddtdd7td ddd!}|d"d#ksJ||d$d%usJ||d&d'ksJ||d(tks4J||d(ttd)ksVJ|td*td+d7td,d-d.S)/zDGuards only -- no network, no orders. Run before trusting this file.zLIVE = z (must be False here)Fzmodule must not start armedrc sjz |WnLttfyV}z0td|dt|jd7WYd}~dSd}~00t|ddS)Nz [pass] r+rz did NOT raise)rRr/printrrAssertionError)fnZlabelrr~rr expect_raises z_selftest..expect_raisecSs tdddS)NTrrrXrrrrrvz_selftest..zcount 0 rejectedcSstdtddS)NrrrrXrUrrrrr rvzcount above MAX_CONTRACTScSs tdddS)Nrrrrrrrrr!rvzprice 0 rejectedcSs tdddS)Nrrdrrrrrr"rvzprice 100 rejectedcSstdtddS)Nrrrrrrrrr&rvzfraction above cap rejectedcSs tdddS)NrrZrrrrrrr'rvzcount below MIN_COUNT rejectedcSs tdddS)NrTrrrrrrr(rvzbool count rejectedcSs tdddS)Nr1rrrrrrr)rvzstring count rejectedcSs tdddS)Nr;rrrrrrrr*rvzempty ticker rejectedrg?rz& [pass] fractional count 0.5 acceptedrzKXTEST-1rr rsr|Trzryr{z7 [pass] dry-run body is a post-only expiring ASK (ttl zs) z' guard checks passed; nothing was sent.N)rr8rXrr! MAKER_TTL_S)rrrrr _selftests6  " r__main__)N)r;)r;F)+__doc__rIrHr2r!pathlibrtypingrZ kalshi_traderr.rrUrTrWrVrSrrirArGr8r"r1rr&rNdictr5r7r9r:rQrXrhrMrjrprrrrrrrrrsP  '#     k;,